The Future of Hacking
|
|
|
- Russell Arnold
- 8 years ago
- Views:
Transcription
1 The Future of Hacking An Ethical Hacker s View Peter Wood Chief of Operations First Base Technologies
2 Who am I? Started in electronics in 1969 Worked in networked computers since 1976 Second microcomputer reseller in UK (1980) First local area networks in business (1985) Founded First Base Technologies in 1989 Conceived network security best practice (1991) Presented BS 7799 throughout UK for BSI (1997) First independent ethical hacking firm in UK Founded white-hats.co.uk in 2002 Times 1000 / FTSE 100 and CNI clients Slide 2 First Base Technologies 2008
3 What is a hacker? Someone who plays golf poorly A programmer who breaks into computer systems in order to steal or change or destroy information A programmer for whom computing is its own reward; may enjoy the challenge of breaking into other computers but does no harm One who works hard at boring tasks [WordWeb.info] Is that all? Slide 3 First Base Technologies 2008
4 What is hacking? Hacking is a way of thinking A hacker is someone who thinks outside the box. It's someone who discards conventional wisdom, and does something else instead. It's someone who looks at the edge and wonders what's beyond. It's someone who sees a set of rules and wonders what happens if you don't follow them. [Bruce Schneier] Hacking applies to all aspects of life and not just computers Increasingly, hacking is used to perpetrate crimes theft, blackmail, terrorism Slide 4 First Base Technologies 2008
5 Criminal hacking techniques Internet intrusion attacks (against web applications, remote access portals) Trojans, rootkits, keyloggers et al. (via phishing, cross-site scripting, web sites) Botnets and denial of service attacks (primarily for blackmail or political attacks) Social engineering & physical attacks (insider attacks, wireless, bluetooth, laptop theft) Slide 5 First Base Technologies 2008
6 Typical response: technology For web application attacks For remote access attacks This becomes an arms race - criminals will seek an easier route Slide 6 First Base Technologies 2008
7 The blended attack Social engineering plus technology + Currently: Phishing Trojans & rootkits Laptop theft In person intrusion Slide 7 First Base Technologies 2008
8 Why social engineering? Social engineering can be used to gain access to any system, irrespective of the platform. It s the hardest form of attack to defend against because hardware and software alone can t stop it. Slide 8 First Base Technologies 2008
9 Social engineering Any medium that provides one-to-one communications between people can be exploited, including face-to-face, telephone and electronic mail. All it takes is to be a good liar. - Dorothy E. Denning Information Warfare and Security Slide 9 First Base Technologies 2008
10 Remote worker hack 1. Buy a pay-as-you-go mobile phone 2. Call the target firm s switchboard and ask for IT staff names and phone numbers 3. Overcome their security question: Are you a recruiter? 4. Call each number until voic tells you they are out 5. Call the help desk claiming to be working from home 6. Say you have forgotten your password and need it reset now, as you are going to pick up your kids from school 7. Receive the username and password as a text to your mobile 8. Game over! Slide 10 First Base Technologies 2008
11 IT support hack 1. Get staff contact names and numbers from reception 2. Call a target user who is unlikely to be technical 3. Say you are from IT working on upgrading their servers over the weekend 4. Say you need their username and password to test their account so that all will work smoothly on Monday morning 5. Game over! Slide 11 First Base Technologies 2008
12 In Person Be an employee, visitor or maintenance staff Look for information lying on desks and overhear conversations Do some shoulder surfing Plug in a sniffer or keylogger Simply use a vacant desk & workstation Slide 12 First Base Technologies 2008
13 Would you let this man into your building? Slide 13 First Base Technologies 2008
14 Slide 14 First Base Technologies 2008
15 Key Logger Time to get admin password = 10 minutes Slide 15 First Base Technologies 2008
16 Keystroke capture Keystrokes recorded so far is 2706 out of <PWR><CAD>fsmith<tab><tab>arabella xxxxxxx <tab><tab> None<tab><tab> None<tab><tab> None<tab><tab> <CAD> arabella <CAD> <CAD> arabella <CAD> <CAD> arabella exit tracert telnet cisco Slide 16 First Base Technologies 2008
17 A typical response Slide 17 First Base Technologies 2008
18 Preventing blended attacks All the money spent on software patches, security hardware, and audits could be wasted without prevention of social engineering attacks That means investing in staff awareness backed up by policies Slide 18 First Base Technologies 2008
19 Countermeasures Physical aspect: - in the workplace - over the phone - dumpster diving - on-line Psychological aspect: - persuasion - impersonation - conformity - friendliness Combat strategies require action on both the physical and psychological levels Slide 19 First Base Technologies 2008
20 Staff Awareness Train all employees - everyone has a role in protecting the organisation and thereby their own jobs If someone tries to threaten them or confuse them, it should raise a red flag Train new employees as they start Give extra security training to security guards, help desk staff, receptionists, telephone operators Keep the training up to date and relevant Slide 20 First Base Technologies 2008
21 Workplace Security Policy Shred phone lists, lists and other important documents before throwing away Some documents will need to be locked away Basic best practice - clear desk policy Slide 21 First Base Technologies 2008
22 End Point Security Policy Use screen savers with password controls Encrypt information on desktops, laptops and PDAs Secure mobiles and PDAs (infrared, bluetooth) Secure wireless (strong encryption, short range) Physically destroy unused hard disks, CDs and other media Slide 22 First Base Technologies 2008
23 Help Desk Policy Password resets only with call-back and PIN authentication Incident reporting and response procedures Clear escalation procedures Help desk staff should be encouraged to withhold support when a call does not feel right. In other words just say no.. Slide 23 First Base Technologies 2008
24 Staff Guidance What can be discussed over the telephone What can be discussed outside the building What can be written in an Don t use notification or voic s when away from the office. It sets up the replacement as a target. How to report an incident and to whom Slide 24 First Base Technologies 2008
25 Compliance Have a security assessment test performed and heed the recommendations - Test the company's ability to protect its environment, its ability to detect the attack and its ability to react and repel the attack - Have the first test performed when the company is expecting it - Do a blind test the second time around Slide 25 First Base Technologies 2008
26 End of Part One Slide 26 First Base Technologies 2008
27 Need more information? Peter Wood Chief of Operations First Base Technologies Slide 27 First Base Technologies 2008
28 The Real Risks of Stolen Laptops An Ethical Hacker s View Peter Wood Chief of Operations First Base Technologies
29 Who am I? Started in electronics in 1969 Worked in networked computers since 1976 Second microcomputer reseller in UK (1980) First local area networks in business (1985) Founded First Base Technologies in 1989 Conceived network security best practice (1991) Presented BS 7799 throughout UK for BSI (1997) First independent ethical hacking firm in UK Founded white-hats.co.uk in 2002 Times 1000 / FTSE 100 and CNI clients Slide 29 First Base Technologies 2008
30 This Presentation All organisations now have laptop users Laptops are vulnerable to theft This info may help reduce your exposure! Slide 30 First Base Technologies 2008
31 The target - a corporate laptop What sensitive information can we steal? What credentials can we steal? Can we connect to the corporate network? Can we introduce a Trojan? Slide 31 First Base Technologies 2008
32 Some example objectives Company-confidential documents & spreadsheets User s logon The local admin logon User s personal data User s VPN logon The contents of the corporate network! Slide 32 First Base Technologies 2008
33 Stage 1 Own the laptop Slide 33 First Base Technologies 2008
34 If we can boot from CD Slide 34 First Base Technologies 2008
35 Boot Ophcrack Live Slide 35 First Base Technologies 2008
36 We have the passwords! Slide 36 First Base Technologies 2008
37 or just read the disk Slide 37 First Base Technologies 2008
38 Find the password hashes Slide 38 First Base Technologies 2008
39 Copy hashes to USB key Slide 39 First Base Technologies 2008
40 Copy hashes to your cracking PC and plug in the rainbow tables Slide 40 First Base Technologies 2008
41 a few minutes later Slide 41 First Base Technologies 2008
42 That was the shortest route Slide 42 First Base Technologies 2008
43 No CD boot possible, but we have access to CMOS Slide 43 First Base Technologies 2008
44 Only the hard disk is enabled Slide 44 First Base Technologies 2008
45 Config is password protected, but the hard disk is not Slide 45 First Base Technologies 2008
46 So let s take out the hard disk Slide 46 First Base Technologies 2008
47 .. And read it in our laptop! Slide 47 First Base Technologies 2008
48 That was the longer route! Slide 48 First Base Technologies 2008
49 So what now? What sensitive information can we steal? What credentials can we steal? Can we connect to the corporate network? Can we introduce a Trojan? Slide 49 First Base Technologies 2008
50 What sensitive information can we steal? Almost anything on the hard disk! - MS Office passwords are no protection - Neither are zip files (usually) - Windows EFS may not protect you either But we cannot see data that has been encrypted using a proven algorithm (e.g. PGP volumes) Slide 50 First Base Technologies 2008
51 What credentials can we steal? Almost anything on the hard disk! - All local Windows password hashes - Cached Windows logons - Dial-up credentials - passwords - Cached web credentials - Etc. Slide 51 First Base Technologies 2008
52 Can we connect to the corporate network? Very probably! - We know the local Windows passwords - If you use two-factor authentication, where is your SecurID card and PIN kept? - Perhaps the help desk will be very helpful? - Perhaps we can use a Trojan to get access later Slide 52 First Base Technologies 2008
53 Can we introduce a Trojan? Since we are local Administrator, yes! - We can turn off anti-virus - We can turn off the personal firewall - We can hide the Trojan using a rootkit Game over! Slide 53 First Base Technologies 2008
54 However Slide 54 First Base Technologies 2008
55 If there s no access to CMOS Slide 55 First Base Technologies 2008
56 and a password-protected disk Slide 56 First Base Technologies 2008
57 ATA Password Reset Slide 57 First Base Technologies 2008
58 Or just whole disk encryption Slide 58 First Base Technologies 2008
59 That was the route to failure! Slide 59 First Base Technologies 2008
60 Need more information? Peter Wood Chief of Operations First Base Technologies Slide 60 First Base Technologies 2008
Desktop and Laptop Security Policy
Desktop and Laptop Security Policy Appendix A Examples of Desktop and Laptop standards and guidelines 1. Implement anti-virus software An anti-virus program is necessary to protect your computer from malicious
Section 12 MUST BE COMPLETED BY: 4/22
Test Out Online Lesson 12 Schedule Section 12 MUST BE COMPLETED BY: 4/22 Section 12.1: Best Practices This section discusses the following security best practices: Implement the Principle of Least Privilege
Ethical Hacking Course Layout
Ethical Hacking Course Layout Introduction to Ethical Hacking o What is Information Security? o Problems faced by the Corporate World o Why Corporate needs Information Security? Who is a Hacker? o Type
Detailed Description about course module wise:
Detailed Description about course module wise: Module 1: Basics of Networking and Major Protocols 1.1 Networks and its Types. 1.2 Network Topologies 1.3 Major Protocols and their Functions 1.4 OSI Reference
1. Any email requesting personal information, or asking you to verify an account, is usually a scam... even if it looks authentic.
Your identity is one of the most valuable things you own. It s important to keep your identity from being stolen by someone who can potentially harm your good name and financial well-being. Identity theft
When a student leaves this intensive 5 day class they will have hands on understanding and experience in Ethical Hacking.
Ethical Hacking and Countermeasures Course Description: This class will immerse the student into an interactive environment where they will be shown how to scan, test, hack and secure their own systems.
Boston University Security Awareness. What you need to know to keep information safe and secure
What you need to know to keep information safe and secure Introduction Welcome to Boston University s Security Awareness training. Depending on your reading speed, this presentation will take approximately
Know the Risks. Protect Yourself. Protect Your Business.
Protect while you connect. Know the Risks. Protect Yourself. Protect Your Business. GETCYBERSAFE TIPS FOR S MALL AND MEDIUM BUSINESSES If you re like most small or medium businesses in Canada, the Internet
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines
Secure and Safe Computing Primer Examples of Desktop and Laptop standards and guidelines 1. Implement anti-virus software An anti-virus program is necessary to protect your computer from malicious programs,
Certified Ethical Hacker Exam 312-50 Version Comparison. Version Comparison
CEHv8 vs CEHv7 CEHv7 CEHv8 19 Modules 20 Modules 90 Labs 110 Labs 1700 Slides 1770 Slides Updated information as per the latest developments with a proper flow Classroom friendly with diagrammatic representation
National Cyber Security Month 2015: Daily Security Awareness Tips
National Cyber Security Month 2015: Daily Security Awareness Tips October 1 New Threats Are Constantly Being Developed. Protect Your Home Computer and Personal Devices by Automatically Installing OS Updates.
Computer Security and Penetration Testing. Chapter 2 Reconnaissance
Computer Security and Penetration Testing Chapter 2 Reconnaissance Objectives Identify various techniques for performing reconnaissance Distinguish and discuss the methods used in social engineering Discuss
IT Security Risks & Trends
IT Security Risks & Trends Key Threats to All Businesses 1 1 What do the following have in common? Catholic church parish Hospice Collection agency Main Street newspaper stand Electrical contractor Health
SPICE EduGuide EG0015 Security of Administrative Accounts
This SPICE EduGuide applies to HSC information systems, specifically Administrative login accounts; (aka Admin accounts) and the faculty, staff and students who use them. Admin accounts are logon IDs and
Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits)
Page 1 of 6 Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits) TNCC Cybersecurity Program web page: http://tncc.edu/programs/cyber-security Course Description: Encompasses
31 Ways To Make Your Computer System More Secure
31 Ways To Make Your Computer System More Secure Copyright 2001 Denver Tax Software, Inc. 1. Move to more secure Microsoft Windows systems. Windows NT, 2000 and XP can be made more secure than Windows
Whitepaper on AuthShield Two Factor Authentication with ERP Applications
Whitepaper on AuthShield Two Factor Authentication with ERP Applications By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to account passwords... 4 2.1 Social Engineering or Password
Remote Access Securing Your Employees Out of the Office
Remote Access Securing Your Employees Out of the Office HSTE-NB0011-RV 1.0 Hypersecu Information Systems, Inc. #200-6191 Westminster Hwy Richmond BC V7C 4V4 Canada 1 (855) 497-3700 www.hypersecu.com Introduction
86-10-15 The Self-Hack Audit Stephen James Payoff
86-10-15 The Self-Hack Audit Stephen James Payoff As organizations continue to link their internal networks to the Internet, system managers and administrators are becoming increasingly aware of the need
The Key to Secure Online Financial Transactions
Transaction Security The Key to Secure Online Financial Transactions Transferring money, shopping, or paying debts online is no longer a novelty. These days, it s just one of many daily occurrences on
ENISA s ten security awareness good practices July 09
July 09 2 About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European
Loophole+ with Ethical Hacking and Penetration Testing
Loophole+ with Ethical Hacking and Penetration Testing Duration Lecture and Demonstration: 15 Hours Security Challenge: 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once said,
Whitepaper on AuthShield Two Factor Authentication and Access integration with Microsoft outlook using any Mail Exchange Servers
Whitepaper on AuthShield Two Factor Authentication and Access integration with Microsoft outlook using any Mail Exchange Servers By INNEFU Labs Pvt. Ltd Table of Contents 1. Overview... 3 2. Threats to
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things.
What s Wrong with Information Security Today? You are looking in the wrong places for the wrong things. AGENDA Current State of Information Security Data Breach Statics Data Breach Case Studies Why current
Thanks for showing interest in Vortex IIT Delhi & What After College (WAC) Ethical Hacking Workshop.
Thanks for showing interest in Vortex IIT Delhi & What After College (WAC) Ethical Hacking Workshop. Our aim is to address the students apprehensions and anxieties regarding their career prospects in Ethical
Pointsec Enterprise Encryption and Access Control for Laptops and Workstations
Pointsec Enterprise Encryption and Access Control for Laptops and Workstations Overview of PC Security Since computer security has become increasingly important, almost all of the focus has been on securing
FORBIDDEN - Ethical Hacking Workshop Duration
Workshop Course Module FORBIDDEN - Ethical Hacking Workshop Duration Lecture and Demonstration : 15 Hours Security Challenge : 01 Hours Introduction Security can't be guaranteed. As Clint Eastwood once
Guide to Preventing Social Engineering Fraud
Guide to Preventing Social Engineering Fraud GUIDE TO PREVENTING SOCIAL ENGINEERING FRAUD CONTENTS Social Engineering Fraud Fundamentals and Fraud Strategies... 4 The Psychology of Social Engineering (And
VPN Lesson 2: VPN Implementation. Summary
VPN Lesson 2: VPN Implementation Summary 1 Notations VPN client (ok) Firewall Router VPN firewall VPN router VPN server VPN concentrator 2 Basic Questions 1. VPN implementation options for remote users
Learn to protect yourself from Identity Theft. First National Bank can help.
Learn to protect yourself from Identity Theft. First National Bank can help. Your identity is one of the most valuable things you own. It s important to keep your identity from being stolen by someone
IIABSC 2015 - Spring Conference
IIABSC 2015 - Spring Conference Cyber Security With enough time, anyone can be hacked. There is no solution that will completely protect you from hackers. March 11, 2015 Chris Joye, Security + 1 2 Cyber
How To Protect Your Information From Being Hacked By A Hacker
DOL New Hire Training: Computer Security and Privacy Table of Contents Introduction Lesson One: Computer Security Basics Lesson Two: Protecting Personally Identifiable Information (PII) Lesson Three: Appropriate
General Security Best Practices
General Security Best Practices 1. One of the strongest physical security measures for a computer or server is a locked door. 2. Whenever you step away from your workstation, get into the habit of locking
CYBERTRON NETWORK SOLUTIONS
CYBERTRON NETWORK SOLUTIONS CybertTron Certified Ethical Hacker (CT-CEH) CT-CEH a Certification offered by CyberTron @Copyright 2015 CyberTron Network Solutions All Rights Reserved CyberTron Certified
RSA Solution Brief. RSA SecurID Authentication in Action: Securing Privileged User Access. RSA Solution Brief
RSA SecurID Authentication in Action: Securing Privileged User Access RSA SecurID solutions not only protect enterprises against access by outsiders, but also secure resources from internal threats The
A Decision Maker s Guide to Securing an IT Infrastructure
A Decision Maker s Guide to Securing an IT Infrastructure A Rackspace White Paper Spring 2010 Summary With so many malicious attacks taking place now, securing an IT infrastructure is vital. The purpose
MCTS Guide to Microsoft Windows 7. Chapter 7 Windows 7 Security Features
MCTS Guide to Microsoft Windows 7 Chapter 7 Windows 7 Security Features Objectives Describe Windows 7 Security Improvements Use the local security policy to secure Windows 7 Enable auditing to record security
SECURING YOUR SMALL BUSINESS. Principles of information security and risk management
SECURING YOUR SMALL BUSINESS Principles of information security and risk management The challenge Information is one of the most valuable assets of any organization public or private, large or small and
NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT
Appendix A to 11-02-P1-NJOIT NJ OFFICE OF INFORMATION TECHNOLOGY P.O. Box 212 www.nj.gov/it/ps/ 300 Riverview Plaza Trenton, NJ 08625-0212 NEW JERSEY STATE POLICE EXAMPLES OF CRIMINAL INTENT The Intent
Cyber Self Assessment
Cyber Self Assessment According to Protecting Personal Information A Guide for Business 1 a sound data security plan is built on five key principles: 1. Take stock. Know what personal information you have
Written Information Security Plan (WISP) for. HR Knowledge, Inc. This document has been approved for general distribution.
Written Information Security Plan (WISP) for HR Knowledge, Inc. This document has been approved for general distribution. Last modified January 01, 2014 Written Information Security Policy (WISP) for HR
HACKERS vs. THE I.T. TEAM
HACKERS vs. THE I.T. TEAM IT Staff Multifaceted role As custodians of the network your responsibilities include: supporting servers networking hardware Infrastructure disaster recovery workstations operating
McAfee Internet Security Suite Quick-Start Guide
Enjoy a Worry Free Online Experience McAfee Internet Security Suite protects your PC, identity and online experience. It also includes PC and network tools, plus McAfee SiteAdvisor for safe surfing. Internet
a) Encryption is enabled on the access point. b) The conference room network is on a separate virtual local area network (VLAN)
MIS5206 Week 12 Your Name Date 1. Which significant risk is introduced by running the file transfer protocol (FTP) service on a server in a demilitarized zone (DMZ)? a) User from within could send a file
Hacking Database for Owning your Data
Hacking Database for Owning your Data 1 Introduction By Abdulaziz Alrasheed & Xiuwei Yi Stealing data is becoming a major threat. In 2012 alone, 500 fortune companies were compromised causing lots of money
If you know the enemy and know yourself, you need not fear the result of a hundred battles.
Rui Pereira,B.Sc.(Hons),CIPS ISP/ITCP,CISSP,CISA,CWNA/CWSP,CPTE/CPTC Principal Consultant, WaveFront Consulting Group ruiper@wavefrontcg.com 1 (604) 961-0701 If you know the enemy and know yourself, you
Certified Ethical Hacker (CEH) Ethical Hacking & Counter Measures Course 9962; 5 Days, Instructor-Led
Certified Ethical Hacker (CEH) Ethical Hacking & Counter Measures Course 9962; 5 Days, Instructor-Led Course Description This class will immerse the student into an interactive environment where they will
Encyclopedia of Information Assurance Suggested Titles: March 25, 2013 The following titles have not been contracted.
Encyclopedia of Information Assurance Suggested Titles: March 25, 2013 The following titles have not been contracted. Administrative Awareness Case Study: Government Offices Certification and Accreditation:
Passing PCI Compliance How to Address the Application Security Mandates
Passing PCI Compliance How to Address the Application Security Mandates The Payment Card Industry Data Security Standards includes several requirements that mandate security at the application layer. These
Belmont Savings Bank. Are there Hackers at the gate? 2013 Wolf & Company, P.C.
Belmont Savings Bank Are there Hackers at the gate? 2013 Wolf & Company, P.C. MEMBER OF PKF NORTH AMERICA, AN ASSOCIATION OF LEGALLY INDEPENDENT FIRMS 2013 Wolf & Company, P.C. About Wolf & Company, P.C.
Network Security. 1 Pass the course => Pass Written exam week 11 Pass Labs
Network Security Ola Lundh ola.lundh@hh.se Schedule/ time-table: landris.hh.se/ (NetwoSec) Course home-page: hh.se/english/ide/education/student/coursewebp ages/networksecurity cisco.netacad.net Packet
Threat Events: Software Attacks (cont.)
ROOTKIT stealthy software with root/administrator privileges aims to modify the operation of the OS in order to facilitate a nonstandard or unauthorized functions unlike virus, rootkit s goal is not to
Policy for Protecting Customer Data
Policy for Protecting Customer Data Store Name Store Owner/Manager Protecting our customer and employee information is very important to our store image and on-going business. We believe all of our employees
RemotelyAnywhere. Security Considerations
RemotelyAnywhere Security Considerations Table of Contents Introduction... 3 Microsoft Windows... 3 Default Configuration... 3 Unused Services... 3 Incoming Connections... 4 Default Port Numbers... 4 IP
Security Awareness For Server Administrators. State of Illinois Central Management Services Security and Compliance Solutions
Security Awareness For Server Administrators State of Illinois Central Management Services Security and Compliance Solutions Purpose and Scope To present a best practice approach to securing your servers
Penetration Testing //Vulnerability Assessment //Remedy
A Division Penetration Testing //Vulnerability Assessment //Remedy In Penetration Testing, part of a security assessment practice attempts to simulate the techniques adopted by an attacker in compromising
Secure Web Access Solution
Secure Web Access Solution I. CONTENTS II. INTRODUCTION... 2 OVERVIEW... 2 COPYRIGHTS AND TRADEMARKS... 2 III. E-CODE SECURE WEB ACCESS SOLUTION... 3 OVERVIEW... 3 PKI SECURE WEB ACCESS... 4 Description...
Chapter 8: Security Measures Test your knowledge
Security Equipment Chapter 8: Security Measures Test your knowledge 1. How does biometric security differ from using password security? Biometric security is the use of human physical characteristics (such
CEH Version8 Course Outline
CEH Version8 Course Outline Module 01: Introduction to Ethical Hacking Information Security Overview Information Security Threats and Attack Vectors Hacking Concepts Hacking Phases Types of Attacks Information
Strong Authentication: Enabling Efficiency and Maximizing Security in Your Microsoft Environment
Strong Authentication: Enabling Efficiency and Maximizing Security in Your Microsoft Environment IIIIII Best Practices www.gemalto.com IIIIII Table of Contents Strong Authentication and Cybercrime... 1
Student Tech Security Training. ITS Security Office
Student Tech Security Training ITS Security Office ITS Security Office Total Security is an illusion security will always be slightly broken. Find strategies for living with it. Monitor our Network with
Promoting Network Security (A Service Provider Perspective)
Promoting Network Security (A Service Provider Perspective) Prevention is the Foundation H S Gupta DGM (Technical) Data Networks, BSNL hsgupta@bsnl.co.in DNW, BSNL 1 Agenda Importance of Network Security
Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation. By Marc Ostryniec, vice president, CSID
Proactive Credential Monitoring as a Method of Fraud Prevention and Risk Mitigation By Marc Ostryniec, vice president, CSID The increase in volume, severity, publicity and fallout of recent data breaches
UBC Incident Response Plan
UBC Incident Response Plan Contents 1. Rationale... 1 2. Objective... 1 3. Application... 1 4. Definitions... 1 4.1 Types of Incidents... 1 4.2 Incident Severity... 2 4.3 Information Security Unit... 2
Protecting Yourself from Identity Theft. Charlene L. Esaw Chief, Outreach and Student Programs Central Intelligence Agency (CIA) May 2009
Protecting Yourself from Identity Theft Charlene L. Esaw Chief, Outreach and Student Programs Central Intelligence Agency (CIA) May 2009 How Many of You...? use an ATM machine use your credit card online
Retail/Consumer Client. Internet Banking Awareness and Education Program
Retail/Consumer Client Internet Banking Awareness and Education Program Table of Contents Securing Your Environment... 3 Unsolicited Client Contact... 3 Protecting Your Identity... 3 E-mail Risk... 3 Internet
2. From a control perspective, the PRIMARY objective of classifying information assets is to:
MIS5206 Week 13 Your Name Date 1. When conducting a penetration test of an organization's internal network, which of the following approaches would BEST enable the conductor of the test to remain undetected
Cyber Security Education & Awareness. Guide for User s
Cyber Security Education & Awareness Guide for User s Release Q1 2010 Version 1.1 CONTENTS 1. Introduction 2. Protection against Nasty Code 3. System Security Maintenance 4. Personal Firewalls 5. Wireless
Using Remote Desktop Clients
CYBER SECURITY OPERATIONS CENTRE December 2011 Using Remote Desktop Clients INTRODUCTION 1. Remote access solutions are increasingly being used to access sensitive or classified systems from homes and
Data Access Request Service
Data Access Request Service Guidance Notes on Security Version: 4.0 Date: 01/04/2015 1 Copyright 2014, Health and Social Care Information Centre. Introduction This security guidance is for organisations
Contact details For contacting ENISA or for general enquiries on information security awareness matters, please use the following details:
Malicious software About ENISA The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for
Certified Cyber Security Analyst VS-1160
VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The
Austin Peay State University
1 Austin Peay State University Identity Theft Operating Standards (APSUITOS) I. PROGRAM ADOPTION Austin Peay State University establishes Identity Theft Operating Standards pursuant to the Federal Trade
Windows Operating Systems. Basic Security
Windows Operating Systems Basic Security Objectives Explain Windows Operating System (OS) common configurations Recognize OS related threats Apply major steps in securing the OS Windows Operating System
INFORMATION SECURITY GUIDE. Employee Teleworking. Information Security Unit. Information Technology Services (ITS) July 2013
INFORMATION SECURITY GUIDE Employee Teleworking Information Security Unit Information Technology Services (ITS) July 2013 CONTENTS 1. Introduction... 2 2. Teleworking Risks... 3 3. Safeguards for College
10- Assume you open your credit card bill and see several large unauthorized charges unfortunately you may have been the victim of (identity theft)
1- A (firewall) is a computer program that permits a user on the internal network to access the internet but severely restricts transmissions from the outside 2- A (system failure) is the prolonged malfunction
Preventing identity theft
Preventing identity theft February 10 Train the trainer reference guide 2 Preventing identity theft: Train the trainer reference guide About ENISA The European Network and Information Security Agency (ENISA)
Chapter 11 Manage Computing Securely, Safely and Ethically. Discovering Computers 2012. Your Interactive Guide to the Digital World
Chapter 11 Manage Computing Securely, Safely and Ethically Discovering Computers 2012 Your Interactive Guide to the Digital World Objectives Overview Define the term, computer security risks, and briefly
Telework and Remote Access Security Standard
State of California California Information Security Office Telework and Remote Access Security Standard SIMM 5360-A (formerly SIMM 66A) September 2013 REVISION HISTORY REVISION DATE OF RELEASE OWNER SUMMARY
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE. A guideline to help your organization chose the Best Secure USB device
CHOOSING THE RIGHT PORTABLE SECURITY DEVICE A guideline to help your organization chose the Best Secure USB device Introduction USB devices are widely used and convenient because of their small size, huge
DATA SECURITY HACKS, HIPAA AND HUMAN RISKS
DATA SECURITY HACKS, HIPAA AND HUMAN RISKS MSCPA HEALTH CARE SERVICES SEMINAR Ken Miller, CPA, CIA, CRMA, CHC, CISA Senior Manager, Healthcare HORNE LLP September 25, 2015 AGENDA 2015 The Year of the Healthcare
Information Security Basic Concepts
Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,
Pass-the-Hash II: Admin s Revenge. Skip Duckwall & Chris Campbell
Pass-the-Hash II: Admin s Revenge Skip Duckwall & Chris Campbell Do you know who I am? Skip Co-presented PTH talk last year at BH, Derbycon http://passing-the-hash.blogspot.com @passingthehash on twitter
Information Security Services
Information Security Services Information Security In 2013, Symantec reported a 62% increase in data breaches over 2012. These data breaches had tremendous impacts on many companies, resulting in intellectual
Electronic Security is defined d as:
Earl C. Rich, CRM Electronic Security is defined d as: Protection resulting from all measures designed d to deny to unauthorized persons information of value. Precautions taken to guard against crime,
Information Technology Cyber Security Policy
Information Technology Cyber Security Policy (Insert Name of Organization) SAMPLE TEMPLATE Organizations are encouraged to develop their own policy and procedures from the information enclosed. Please
Common Cyber Threats. Common cyber threats include:
Common Cyber Threats: and Common Cyber Threats... 2 Phishing and Spear Phishing... 3... 3... 4 Malicious Code... 5... 5... 5 Weak and Default Passwords... 6... 6... 6 Unpatched or Outdated Software Vulnerabilities...
How users bypass your security!
How users bypass your security! IT Days Security issues 20 th November 2014 Tom Leclerc, Security Consultant SAGS - Security Audits and Governance Services, a Telindus Security department Classification:
Identity Theft Protection
Identity Theft Protection Email Home EDUCATION on DANGER ZONES Internet Payments Telephone ID theft occurs when someone uses your personal information with out your knowledge to commit fraud. Some terms
Cyber Security Awareness
Cyber Security Awareness User IDs and Passwords Home Computer Protection Protecting your Information Firewalls Malicious Code Protection Mobile Computing Security Wireless Security Patching Possible Symptoms
Protecting your business against External Fraud
Monthly ebrief August 2012 Protecting your business against External Fraud Welcome to another edition of our monthly ebriefs, brought to you by Aquila Advisory, the boutique forensic accounting company.
Hang Seng HSBCnet Security. May 2016
Hang Seng HSBCnet Security May 2016 1 Security The Bank aims to provide you with a robust, reliable and secure online environment in which to do business. We seek to achieve this through the adoption of
Working Practices for Protecting Electronic Information
Information Security Framework Working Practices for Protecting Electronic Information 1. Purpose The following pages provide more information about the minimum working practices which seek to ensure that
Network Security for End Users in Health Care
Network Security for End Users in Health Care Virginia Health Information Technology Regional Extension Center is funded by grant #90RC0022/01 from the Office of the National Coordinator for Health Information
Compliance. Review. Our Compliance Review is based on an in-depth analysis and evaluation of your organization's:
Security.01 Penetration Testing.02 Compliance Review.03 Application Security Audit.04 Social Engineering.05 Security Outsourcing.06 Security Consulting.07 Security Policy and Program.08 Training Services
Armstrong State University Fall Staff Assembly. Chief Wayne Willcox, MSCJ, CLEE
Armstrong State University Fall Staff Assembly Chief Wayne Willcox, MSCJ, CLEE Identity Theft: When someone uses your personal information without your permission to commit fraud or other crime Name Social
Certified Secure Computer User
Certified Secure Computer User Exam Info Exam Name CSCU (112-12) Exam Credit Towards Certification Certified Secure Computer User (CSCU). Students need to pass the online EC-Council exam to receive the
Malware & Botnets. Botnets
- 2 - Malware & Botnets The Internet is a powerful and useful tool, but in the same way that you shouldn t drive without buckling your seat belt or ride a bike without a helmet, you shouldn t venture online
Two-Factor Authentication and Swivel
Two-Factor Authentication and Swivel Abstract This document looks at why the username and password are no longer sufficient for authentication and how the Swivel Secure authentication platform can provide
A Guide to Information Technology Security in Trinity College Dublin
A Guide to Information Technology Security in Trinity College Dublin Produced by The IT Security Officer & Training and Publications 2003 Web Address: www.tcd.ie/itsecurity Email: ITSecurity@tcd.ie 1 2