• E4J University Module Series: Cybercrime

• Module 9: Cybersecurity and Cybercrime Prevention - Practical Applications and Measures

• Introduction and learning outcomes

• Key issues

  • Assets, vulnerabilities and threats
  • Risk
  • Vulnerability disclosure
  • Cybersecurity measures and usability
  • Situational crime prevention
  • Incident detection, response, recovery and preparedness
  • Conclusion
  • References

• Exercises

• Possible class structure

• Core reading

• Advanced reading

• Student assessment

• Additional teaching tools

•  

• First published in April 2019, updated in February 2020 
  

•  

 

  This module is a resource for lecturers  

 

Assets, vulnerabilities and threats

 

Cybersecurity measures are implemented to protect  assets, which are defined as "something of importance or value, and can include people, property, information, systems, and equipment" (Maras, 2014b, p. 21), such as employees in an organization, digital devices, computer software, and data (ITU, 2008). Assets are susceptible (i.e., vulnerable) to various forms of harm. Specifically, assets have internal (or intrinsic) and external (or extrinsic)  vulnerabilities. For example, with respect to information and communication technology (ICT), intrinsic vulnerabilities can be found within system design, security configurations, hardware, and software, among other areas (ENISA, 2017). A case in point is a software bug. In 2018, a software bug in Monero's cryptocurrency wallet was revealed, which enabled individuals to exploit this vulnerability to illegally double their cryptocurrency transfer amounts (Barth, 2018) (for more information about cryptocurrencies, see Cybercrime Module 2 on General Types of Cybercrime). By contrast, extrinsic vulnerabilities are not found within assets, such as ICT. A case in point is the user of ICT. The user can engage in actions that make the device susceptible to malware infection (e.g., opening attachments in emails from unknown senders). Intrinsic and extrinsic properties make assets vulnerable to  threats  (i.e., anything that could potentially cause an adverse effect). These threats can cause unintentional and intentional harm. For instance, hardware of a digital device can malfunction or it can be purposely damaged as a result of someone exploiting the vulnerabilities of its firmware (ENISA, 2017).

 

Next: Risk

Back to top