Information Security

Size: px

Start display at page:

Download "Information Security"

Stephanie Phyllis Hicks
8 years ago
Views:

1 Information Security Level II Office of the Vice President for Information Technology Mr. Corbett Consolvo, IT Security Analyst Ms. Lori McElroy, IT Security Officer Iffat Jabeen, IT Security GRA

2 Agenda University server management requirements Securing your OS how to avoid most attacks Sensitive information scanning File share and permissions management Google scanning Vulnerability scanning Wireless security best practices Risk assessment

scanning File share and permissions management Google

3 Introduction A word about this class This is NOT a hacking class, it s not even an ethical hacking class The goal for this class is to better prepare you to manage security on the systems you are responsible for Why do we care about information security?

class is to better prepare you to manage security on the

4 How to Avoid Most Attacks The Big 4 OS patches AV update Firewall Use multiple accounts User, Admin

5 Securing Your OS The Big 4 first Activity 1: Using Windows XP Professional Security Checklist (on your CD)

6 Windows Security Tools Activity 2: Scanning with Windows Defender Activity 3: Scanning with Microsoft Security Baseline Analyzer

7 Windows Permissions Activity 4: Share Permissions Check active permission on share Activity 5: Security Permissions Security permissions are more granular permissions on the folders and files inside the share Beware "Inherit Permissions"

Security permissions are more granular permissions on the

8 Web Site Scanning Open source tools for web site scanning OWASP project Activity 6: Google Scanning Google Reconnaissance Defenses

9 Wireless Security Change default Admin password and user name Change default SSID Turn on encryption: WPA, WPA2 Enable MAC Address Filteringin Disable SSID broadcast Do not auto-connect to open WiFi nets Position router and access point to prevent data leakage

Address Filteringin Disable SSID broadcast Do not auto-connect

10 Risk Assessment and Auditing Vulnerability Scanning and Log Review Activity 7: NMap for Windows Activity 8: Windows Event Viewer Activity 9: Identity Finder Scanning Optional: Systinternals Optional: Wireshark

8: Windows Event Viewer Activity 9: Identity Finder

11 Tools and References (some on CD) Windows Server Management Procedures security.vpit.txstate.edu/awareness/best_practices/server/stand ards_procedures.html SANS and other Operating System Hardening and Security Checklists Google Checklists and Cheat Sheets Web Applications list of open source scanning tools and checklists Oracle Hardening Checklist Microsoft Security Baseline Analyzer (MSBA) microsoft.com/technet/security/tools/mbsahome.mspx Nmap for Windows (nmap.org) Windows Defender Sysinternals Identity Finder

tools and checklists Oracle Hardening Checklist Microsoft Security Baseline Analyzer (MSBA) microsoft.com/technet/security/tools/mbsahome.

12 Contact and Resources Texas State Sites IT Security - Texas State Software Downloadswww.tr.txstate.edu/software/download.html Phishing - /awareness/phishing.html Report an Incident to IT Security or /tools/incident_report.html Contacts Information Technology Security HACK(4225), Information Technology Assistance Center (Help Desk) ITAC(4822) or HELP, itac@txstate.edu

html Phishing - /awareness/phishing.html Report an Incident to IT Security or /tools/incident_report.

13 Q & A

14 Q & A

2012 Risk Assessment Workshop

2012 Risk Assessment Workshop Agenda Risk Assessment Strategy for Texas State Device Registration Application Risk Assessment using ISAAC Review Server Management responsibilities 1 Risk Assessment Strategy