Glanz: aiMOOC über GPT aiMOOC Action erstellt

2026-09-01T05:07:57Z

aiMOOC über GPT aiMOOC Action erstellt

Neue Seite

{{T}}
[[Category:English]]
[[Category:Cybersecurity Fundamentals]]

{{BR}}
= Introduction =

'''Cybersecurity Fundamentals''' introduces the principles, technologies, human factors, and governance practices used to protect digital systems and information. The course is designed for university students in computing, business, engineering, social science, and other fields that depend on trustworthy digital services. You will learn to think about cybersecurity as a form of [[English:Risk management|risk management]] rather than as a collection of isolated technical tricks.

[[File:Cybersecurity.png|500px|frameless|center]]

Cybersecurity aims to reduce the likelihood and impact of unwanted events affecting information, systems, people, and organizations. Effective security combines technical controls with clear processes, usable policies, trained people, and responsible leadership. No single control can eliminate all risk, so mature programs use layered defenses, continuous monitoring, and preparation for recovery.

By the end of this aiMOOC, you should be able to explain core security concepts, recognize common attack patterns, select appropriate controls, reason about trade-offs, interpret a basic risk scenario, and connect technical decisions to governance, ethics, privacy, and organizational resilience.

{{BR}}
== Learning Goals ==

You should be able to:
# [[English:Information security|Information security]]: Explain confidentiality, integrity, and availability and apply them to realistic university and workplace systems.
# [[English:Threat modeling|Threat modeling]]: Distinguish assets, threats, vulnerabilities, controls, incidents, likelihood, and impact.
# [[English:Identity and access management|Identity and access management]]: Explain authentication, authorization, least privilege, multifactor authentication, and passkeys.
# [[English:Network security|Network security]]: Describe segmentation, firewalls, encrypted transport, secure configuration, and monitoring.
# [[English:Cryptography|Cryptography]]: Distinguish symmetric encryption, public-key cryptography, hashing, and digital signatures.
# [[English:Malware|Malware]]: Recognize major threat categories such as phishing, ransomware, credential attacks, and software supply-chain risk.
# [[English:Incident response|Incident response]]: Outline detection, triage, containment, eradication, recovery, and lessons learned.
# [[English:Cyber risk management|Cyber risk management]]: Relate technical safeguards to the NIST Cybersecurity Framework and broader organizational risk.

{{BR}}
= Core Security Principles =

{{BR}}
== The CIA Triad ==

A widely used foundation for information security is the '''CIA triad''': confidentiality, integrity, and availability.

[[File:CIAJMK1209-en.svg|500px|frameless|center]]

'''Confidentiality''' means preventing unauthorized disclosure of information. Access control, encryption, and data minimization can support confidentiality. '''Integrity''' means protecting information and systems against unauthorized or improper alteration. Hashes, digital signatures, access controls, validation, and change management can support integrity. '''Availability''' means ensuring that authorized users can access needed systems and data when required. Redundancy, resilient architecture, tested backups, capacity planning, and incident response can support availability.

These goals can conflict. For example, an extremely restrictive access policy may improve confidentiality while making a service harder to use. Cybersecurity decisions therefore require explicit trade-offs informed by mission needs and risk.

{{BR}}
== Assets, Threats, Vulnerabilities, Controls, and Risk ==

An '''asset''' is something of value, such as research data, a student information system, credentials, intellectual property, a laboratory device, or an organization's reputation. A '''threat''' is a circumstance or actor that could cause harm. A '''vulnerability''' is a weakness that can be exploited or triggered. A '''control''' or safeguard reduces likelihood, impact, or both. An '''incident''' is an event that actually or potentially jeopardizes confidentiality, integrity, availability, or policy objectives.

A simplified model treats risk as a combination of '''likelihood''' and '''impact'''. Real risk assessment is more nuanced: uncertainty, dependencies, adversary capability, exposure, legal obligations, safety consequences, and recovery capacity may all matter. The purpose of a risk model is not to predict the future perfectly; it is to support defensible priorities.

{{BR}}
== Security Principles for Design ==

'''Least privilege''' gives users, applications, and services only the access they need. '''Separation of duties''' divides critical responsibilities so that one person or component cannot complete a sensitive process alone. '''Secure defaults''' start from the least permissive reasonable configuration. '''Defense in depth''' uses multiple independent or complementary safeguards so that one failure does not automatically become a catastrophic compromise.

[[File:Defense In Depth - Onion Model.svg|500px|frameless|center]]

'''Zero trust''' is an architectural approach that avoids treating network location alone as proof of trust. Access decisions should consider identity, device state, context, policy, and resource sensitivity, with continuous verification where appropriate.

{{#ev:youtube|https://www.youtube.com/watch?v=FMMWSLIcaME|500|center}}

{{BR}}
= Common Threats and Attack Patterns =

{{BR}}
== Social Engineering and Phishing ==

[[English:Phishing|Phishing]] uses deception to persuade people to reveal information, approve access, open malicious content, or visit fraudulent services. Social engineering can exploit urgency, authority, curiosity, fear, or familiarity. Technical defenses such as filtering and phishing-resistant authentication help, but secure processes are equally important. For high-value actions, independent verification through a trusted channel can reduce the risk of impersonation.

[[File:Example phishing email.svg|500px|frameless|center]]

When evaluating a suspicious message, examine the sender context, destination of links, unexpected attachments, unusual requests, urgency, and whether the request fits normal procedures. Do not test suspicious links or files on a production device. Use approved reporting channels.

{{BR}}
== Malware, Ransomware, and Credential Attacks ==

'''Malware''' is software intentionally designed to cause harm or perform unauthorized actions. Categories include ransomware, spyware, trojans, worms, and destructive malware. '''Ransomware''' commonly attempts to deny access to data or systems, often through encryption, while demanding payment. Modern incidents may also involve data theft or extortion.

{{#ev:youtube|https://www.youtube.com/watch?v=imNfrtvYYbw|500|center}}

Credential attacks target passwords, session tokens, API keys, or other authentication material. Defenses include unique credentials, secure storage, multifactor authentication, passkeys where supported, rate limiting, monitoring, and rapid revocation after suspected compromise.

{{BR}}
== Misconfiguration, Vulnerable Software, and Supply Chains ==

Many incidents begin with systems that are exposed unnecessarily, configured insecurely, or left unpatched. Vulnerability management therefore includes asset inventory, secure configuration, patching, prioritization, verification, and exception handling. Software dependencies and third-party services add '''supply-chain risk''': your security can depend on code, vendors, infrastructure, and identities outside your direct control.

Secure software development incorporates security throughout requirements, design, implementation, testing, deployment, and maintenance. Reviews should consider authentication, authorization, input handling, secret management, dependency risk, logging, error handling, and secure update mechanisms. Security testing must be authorized and scoped.

{{BR}}
= Identity and Access Management =

'''Authentication''' asks who or what is attempting access. '''Authorization''' determines what an authenticated identity may do. '''Accounting''' or audit logging records relevant activity so that actions can be reviewed.

Passwords remain common, but password reuse creates risk because one breached service can endanger another. A password manager can generate and store unique credentials. Multifactor authentication requires independent factors, such as something you know and something you possess. Some methods are more resistant to phishing than others; cryptographic passkeys and security keys can provide stronger protection than manually entered one-time codes in many contexts.

[[File:Multifactorauthentication.jpg|500px|frameless|center]]

Access control should follow least privilege and should be reviewed when roles change. Privileged accounts deserve additional protection, monitoring, and separation from routine work.

{{BR}}
= Network and Infrastructure Security =

Networks connect endpoints, servers, cloud services, applications, and users. Security architecture should reduce unnecessary exposure and limit how far an attacker can move after a compromise. '''Network segmentation''' separates systems by trust, function, or sensitivity. '''Firewalls''' enforce traffic rules at network or host boundaries. Secure remote access, hardened configurations, intrusion detection, endpoint protection, and centralized logging can add further layers.

[[File:Gateway firewall.svg|500px|frameless|center]]

Encrypted protocols such as TLS protect data in transit against passive observation and can authenticate communicating parties. DNS security, certificate validation, time synchronization, and secure management interfaces also matter because infrastructure services form part of the trust chain.

A firewall is not a complete security strategy. If stolen credentials allow a legitimate-looking session, or if a vulnerable application is exposed through an allowed port, other controls must detect or limit the problem.

{{BR}}
= Cryptography Basics =

Cryptography provides mathematical tools for confidentiality, integrity, authentication, and related security goals. '''Symmetric encryption''' uses a shared secret key and is efficient for protecting large amounts of data. '''Asymmetric cryptography''' uses related public and private keys and can support encryption, key establishment, and digital signatures. A '''cryptographic hash function''' maps data to a fixed-length digest and is designed so that meaningful changes to the input are detectable. A '''digital signature''' can provide evidence that data was signed by the holder of a private key and that the signed content has not been altered.

[[File:Public key encryption.svg|500px|frameless|center]]

{{#ev:youtube|https://www.youtube.com/watch?v=GSIDS_lvRv4|500|center}}

{{#ev:youtube|https://www.youtube.com/watch?v=ZghMPWGXexs|500|center}}

Cryptography is only as strong as its implementation and key management. Secure systems need appropriate algorithms, protected private keys, safe random-number generation, certificate validation, key rotation or replacement processes, and plans for key compromise. Avoid designing your own cryptographic algorithm for real security use.

{{BR}}
= Detection, Incident Response, and Recovery =

Security monitoring aims to identify suspicious behavior, policy violations, and system failures early enough to reduce harm. Useful evidence can include authentication events, endpoint telemetry, application logs, network events, cloud audit records, and alerts from security tools. Logging should be purposeful: collecting everything without retention rules, time synchronization, access controls, or analysis can create cost without improving security.

A practical incident-response lifecycle includes preparation, detection and analysis, containment, eradication, recovery, and post-incident learning. Teams should preserve evidence where appropriate, communicate through established channels, document decisions, and coordinate technical, legal, privacy, leadership, and communications responsibilities.

Backups support recovery only when they are protected from the same failure or attacker and when restoration is tested. Recovery plans should define priorities, dependencies, acceptable downtime, and how to verify that restored systems are trustworthy before normal operations resume.

{{BR}}
= Cybersecurity Governance and Risk Management =

Cybersecurity is an organizational responsibility. Leaders decide priorities, risk tolerances, resources, accountabilities, and how security integrates with business or academic missions. Policies translate these decisions into expectations, while standards and procedures make them actionable.

The NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes into six high-level Functions: '''Govern, Identify, Protect, Detect, Respond, and Recover'''. The Functions are intended to provide a common language for managing cybersecurity risk rather than a single mandatory implementation recipe.

[[File:NIST Version 2.0.png|500px|frameless|center]]

{{#ev:youtube|https://www.youtube.com/watch?v=pPPiaGU12Og|500|center}}

A university might use '''Govern''' to define responsibility and policy, '''Identify''' to understand critical systems and risks, '''Protect''' to implement safeguards, '''Detect''' to discover suspicious activity, '''Respond''' to manage an incident, and '''Recover''' to restore services and improve resilience.

{{BR}}
== Privacy, Ethics, Law, and Responsible Practice ==

Security and privacy overlap but are not identical. A system can be secure against unauthorized access while still collecting more personal data than necessary. Good design considers purpose limitation, data minimization, transparency, retention, access, and applicable legal or institutional requirements.

Cybersecurity work must be authorized. Do not scan, probe, exploit, intercept, or access systems, accounts, or data without explicit permission and an appropriate scope. In university laboratories, use instructor-provided environments, deliberately vulnerable training systems, or your own isolated test systems. Professional competence includes knowing the technical boundary, the legal boundary, and the ethical boundary.

{{BR}}
= Reliable Starting Points =

For authoritative and openly accessible guidance, consult:
# [https://www.nist.gov/cyberframework NIST Cybersecurity Framework]: Framework resources for understanding and managing cybersecurity risk.
# [https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20 NIST Cybersecurity Framework 2.0]: The official CSF 2.0 publication page.
# [https://pages.nist.gov/800-63-4/sp800-63b/authenticators/ NIST Digital Identity Guidelines]: Current guidance on authenticators, passwords, multifactor authentication, and phishing resistance.
# [https://www.cisa.gov/topics/cyber-threats-and-advisories CISA Cyber Threats and Advisories]: Defensive information about common cyber threats and protective actions.
# [https://owasp.org/www-project-top-ten/ OWASP Top 10]: A widely used awareness resource for major web application security risks.

{{BR}}
= Interactive Tasks =

{{BR}}
== Quiz: Test Your Knowledge ==

{{MC}}

'''Which CIA principle focuses on ensuring that authorized users can access systems and data when needed?'''
(Availability)
(!Confidentiality)
(!Anonymity)
(!Obfuscation)

{{E}}
<br>

{{MC}}

'''Which term describes a weakness that could be exploited or triggered?'''
(Vulnerability)
(!Asset)
(!Policy)
(!Recovery)

{{E}}
<br>

{{MC}}

'''Which principle gives users and services only the access needed for their tasks?'''
(Least privilege)
(!Open access)
(!Shared control)
(!Universal trust)

{{E}}
<br>

{{MC}}

'''What is a primary purpose of a firewall?'''
(Filter network traffic)
(!Encrypt every file)
(!Create user passwords)
(!Replace backups)

{{E}}
<br>

{{MC}}

'''Which cryptographic mechanism uses a private key to create verifiable evidence of origin and integrity?'''
(Digital signature)
(!Password manager)
(!Network segment)
(!Backup archive)

{{E}}
<br>

{{MC}}

'''What does multifactor authentication require?'''
(More than one independent factor)
(!One long username)
(!One shared password)
(!One network address)

{{E}}
<br>

{{MC}}

'''What best describes phishing?'''
(Deception used to trick users)
(!Routine software updating)
(!Network traffic filtering)
(!Data backup testing)

{{E}}
<br>

{{MC}}

'''Which practice most directly shows that backups can support recovery?'''
(Test restoration)
(!Hide filenames)
(!Reuse passwords)
(!Disable logging)

{{E}}
<br>

{{MC}}

'''Which Function is part of NIST Cybersecurity Framework 2.0 alongside Identify Protect Detect Respond and Recover?'''
(Govern)
(!Encrypt)
(!Purchase)
(!Delete)

{{E}}
<br>

{{MC}}

'''Which incident response activity focuses on limiting the spread or damage of an active incident?'''
(Containment)
(!Marketing)
(!Procurement)
(!Archiving)

{{E}}
<br>

{{BR}}
== Memory Game ==

<div class="memo-quiz">
{|
|-
| Asset || Something of value that needs protection
|-
| Threat || A circumstance or actor that could cause harm
|-
| Vulnerability || A weakness that can be exploited or triggered
|-
| Control || A safeguard that reduces cybersecurity risk
|-
| Risk || The possibility and consequence of harm under uncertainty
|-
| Incident || An event that jeopardizes security objectives or policy
|}
{{E}}
<br>

{{BR}}
== Drag and Drop ==

<div class="lueckentext-quiz">

{| class="wikitable"
! Match the correct terms.
! Cybersecurity concept
|-
| '''Password manager'''
| Generates and stores unique credentials
|-
| '''Multifactor authentication'''
| Requires independent types of proof
|-
| '''Network segmentation'''
| Separates systems to limit unwanted movement
|-
| '''Encryption'''
| Protects data using cryptographic transformation
|-
| '''Logging'''
| Records events for detection and investigation
|}
{{E}}

<br>
<br />

{{BR}}
== Crossword Puzzle ==

<div class="kreuzwort-quiz">
{|
|-
| Firewall || What security control filters network traffic according to rules?
|-
| Phishing || What deception technique often uses fraudulent messages or websites?
|-
| Encryption || What process transforms readable data using a cryptographic key?
|-
| Ransomware || What malware category commonly denies access to data and demands payment?
|-
| Integrity || Which CIA principle concerns unauthorized or improper alteration?
|-
| Recovery || What process restores systems and operations after disruption?
|}
{{E}}
<br>

{{BR}}
== LearningApps ==

<iframe> https://learningapps.org/index.php?s=Cybersecurity+Fundamentals </iframe>

{{BR}}
== Cloze Text ==

<quiz display=simple>
{'''Complete the text.'''<br>
|type="{}"}
The CIA triad includes confidentiality, integrity, and { availability }. A weakness that can be exploited is called a { vulnerability }. Limiting access to what is necessary follows the principle of { least privilege }. Requiring independent forms of proof is known as { multifactor authentication }. A cryptographic digest is produced by a { hash }. Separating systems into security zones is called network { segmentation }. Limiting an active incident to reduce further harm is called { containment }. The NIST Cybersecurity Framework 2.0 includes the function { Govern }.
</quiz>

<br>

{{BR}}
= Open-Ended Tasks =

{{BR}}
=== Easy ===
# [[English:Security vocabulary map|Security vocabulary map]]: Create a one-page concept map that connects asset, threat, vulnerability, control, risk, and incident with your own university-related examples.
# [[English:Phishing analysis|Phishing analysis]]: Examine several instructor-provided mock messages, mark signs of possible phishing, and write a short explanation of how you would verify each request safely.
# [[English:Password hygiene|Password hygiene]]: Produce an illustrated guide for students that explains unique passwords, password managers, multifactor authentication, and passkeys without revealing any real credentials.
# [[English:Campus cybersecurity interview|Campus cybersecurity interview]]: Interview an authorized university IT or security staff member about common defensive challenges and summarize three lessons in a short article.

{{BR}}
=== Standard ===
# [[English:Network defense diagram|Network defense diagram]]: Design a labeled network diagram for a fictional university laboratory and explain where you would use segmentation, firewalls, encrypted connections, and logging.
# [[English:Backup recovery experiment|Backup recovery experiment]]: In an isolated test folder, create a small backup, simulate accidental file loss, restore the data, and document what made the recovery reliable or unreliable.
# [[English:Incident response tabletop|Incident response tabletop]]: Run a tabletop exercise for a fictional ransomware alert, assign team roles, record decisions, and create a timeline from detection through recovery.
# [[English:Cybersecurity explainer video|Cybersecurity explainer video]]: Produce a three-minute educational video that explains one security principle, includes a realistic example, and distinguishes prevention from detection and recovery.

{{BR}}
=== Advanced ===
# [[English:Risk register|Risk register]]: Build a risk register for a fictional university service, justify likelihood and impact ratings, propose controls, and explain the residual risk after treatment.
# [[English:Secure software review|Secure software review]]: Review instructor-provided or deliberately vulnerable sample code in an authorized lab, identify design or implementation weaknesses, and propose defensive fixes without targeting real systems.
# [[English:NIST CSF profile|NIST CSF profile]]: Create a current-state and target-state profile for a fictional department using the six NIST CSF 2.0 Functions and justify your highest priorities.
# [[English:Cybersecurity policy critique|Cybersecurity policy critique]]: Compare a public university or organizational security policy with recognized guidance, identify strengths and gaps, and present a reasoned revision proposal.

{{:Open Task - Create a MOOC}}

{{BR}}
= Learning Assessment =

# [[English:Threat-to-control reasoning|Threat-to-control reasoning]]: Given a case in which a research account is phished, identify assets, vulnerabilities, likely impacts, and at least four controls, then explain which controls reduce likelihood and which reduce impact.
# [[English:Architecture trade-off|Architecture trade-off]]: Compare two proposed network designs for a student laboratory and defend the one that better balances least privilege, usability, resilience, and monitoring.
# [[English:Cryptography selection|Cryptography selection]]: For data at rest, data in transit, password verification, and software authenticity, choose appropriate cryptographic mechanisms and justify why each fits the security goal.
# [[English:Incident response decision|Incident response decision]]: Analyze a scenario with suspicious logins and unavailable files, prioritize the first response actions, and explain what evidence should be preserved before major changes are made.
# [[English:Governance transfer|Governance transfer]]: Map a fictional campus service to the six NIST CSF 2.0 Functions and explain how technical actions connect to leadership, policy, and risk ownership.
# [[English:Ethical boundary analysis|Ethical boundary analysis]]: Evaluate a proposed security test and distinguish actions that are permitted in an authorized lab from actions that would require additional permission, legal review, or a narrower scope.

<br>
<br>

{{BR}}
= Evidence of Learning =

Important evidence of learning includes:
# '''Knowledge''': Accurate explanations of confidentiality, integrity, availability, threats, vulnerabilities, risk, identity, network security, cryptography, incident response, and governance.
# '''Reasoning''': The ability to connect a threat scenario to assets, weaknesses, controls, likely impact, and residual risk.
# '''Technical communication''': Clear diagrams, reports, risk registers, incident timelines, and explanations that can be understood by both technical and nontechnical audiences.
# '''Practical products''': A threat model, network defense design, tested recovery procedure, incident-response tabletop record, and NIST CSF profile created in safe or fictional environments.
# '''Professional judgment''': Evidence that you can balance security, usability, privacy, cost, resilience, and mission needs.
# '''Transfer''': The ability to apply the same principles to unfamiliar systems such as cloud services, research platforms, mobile devices, industrial systems, or AI-enabled applications.
# '''Ethical practice''': Consistent use of authorization, scope, data minimization, and responsible disclosure or reporting channels when working with security issues.

<br>
<br>

{{BR}}
= OERs on the Topic =

The English Wikipedia article on computer security provides a broad open reference that you can use to review terminology and follow links to related topics.

<iframe> https://en.m.wikipedia.org/wiki/Computer_security </iframe>

You can deepen your study with the open guidance in the [[English:NIST Cybersecurity Framework|NIST Cybersecurity Framework]], [[English:Computer security|Computer security]], [[English:Information security|Information security]], [[English:Network security|Network security]], [[English:Cryptography|Cryptography]], [[English:Identity management|Identity management]], [[English:Malware|Malware]], [[English:Phishing|Phishing]], and [[English:Incident management|Incident management]] learning areas.

<br>

{{BR}}
= Linked Learning Areas =

{| align=center
{{:D-Tab}}
'''[[English:Cybersecurity Fundamentals|Cybersecurity Fundamentals]]'''
# [[English:Information security|Information security]]
# [[English:Computer security|Computer security]]
# [[English:Network security|Network security]]
# [[English:Cryptography|Cryptography]]
# [[English:Identity and access management|Identity and access management]]
# [[English:Threat modeling|Threat modeling]]
# [[English:Cyber risk management|Cyber risk management]]
# [[English:Incident response|Incident response]]
# [[English:Secure software development|Secure software development]]
# [[English:Digital privacy|Digital privacy]]
|}

[[Category:English]]
[[Category:Higher Education]]
[[Category:Computer Science]]
[[Category:Cybersecurity]]
[[Category:Information Security]]
[[Category:Network Security]]
[[Category:Digital Literacy]]

{{BR}}
= aiMOOC Projects =
[[Category:AI_MOOC]] [[Category:GPT aiMOOC]]
{{MT}}

English:Cybersecurity Fundamentals - Versionsgeschichte

Glanz: aiMOOC über GPT aiMOOC Action erstellt