Risk management and Cybersecurity

odohj83

T17-ComputerITSecurity.pdf

Home >Business & Finance homework help >Operations Management homework help >Risk management and Cybersecurity

Topic #17

IT Security

IT Security Incidents: A Worsening Problem Security of informa:on technology is cri:cal

§  protect confiden+al business data, including customer and employee data

§  protect against malicious acts of the5 or disrup6on Security concerns must be balanced against other business needs (ethical decision regarding IT security):

§  Pursue prosecu6on at all costs or maintain low profile : to avoid nega6ve publicity!!

§  how much effort and money should be devoted to security? §  if firm produces SW with security flaws, what ac6ons should it take?

§  what if security safeguards make life more difficult for customers and employees: will it result in lost sales and increased costs?

Number of IT Security Incidents Are Increasing

Computer Emergency Response Team Coordina6on Center (CERT/CC) §  Established in 1988 at the So5ware Engineering Ins6tute (SEI)

§  SEI: federally funded R&D center at CMU §  Charged with

§  coordina6ng communica6on among experts during computer security emergencies

§  helping to prevent future incidents §  study Internet security vulnerabili6es §  publish security alerts §  develop informa6on and training for organiza6ons

Increasing Complexity Increases Vulnerability

Compu6ng environment is enormously complex Con6nues to increase in complexity:

§  networks, computers, OSes §  apps, Web sites §  switches, routers, gateways §  all interconnected and driven by 100s of millions of LoC (Lines of Code).

Number of possible entry points to a network expands con6nuously as more devices added,

§  This increases possibility of security breaches

Increased Reliance on Commercial SoDware with Known Vulnerabili:es

Exploit: An a\ack on an informa6on system that takes advantage of a par6cular system vulnerability. Typically due to poor system design or implementa6on SW developers quickly create and issue patch:

§  a “fix” to eliminate the problem §  users are responsible for obtaining and installing patches

-which they can download from the Web §  delays in installing patches expose users to security breaches

Zero-day aIack: Takes place before a vulnerability is discovered or fixed U.S. companies rely on commercial so5ware with known vulnerabili6es. IT orgs con6nue to use installed So5ware “as is” (e.g. IE, RealPlayer, JRE)

§  Since security fixes could make SW harder to use or eliminate “nice to have features.”

Number of Vulnerabili:es Reported to CERT/CC

Rate of discovering So5ware vulnerabili6es Exceeds 10/day

AIack of the Giant Worm •  On November 2, 1988, a worm began to thread its way

through the Internet. Once installed, it mul6plied, clogging available space, un6l computers ground to a halt. The worm exploited UNIX holes in sendmail and fingerd. Around 2500 computers were infected. Within 12 hours, the Computer Systems Research Group at Berkeley developed a way of stopping the spread of this worm. Total Cost? Although no data were destroyed, the 6me involved in fixing and tes6ng was es6mated to be between $1,000,000 and $100,000,000.

The Culprit?

•  Robert J. Morris, a Cornell graduate student in computer science, was convicted on May 4, 1990 to 3- year proba6on and a $10,000 fine.

•  “I'm at the MIT Computer Science and Ar6ficial Intelligence Laboratory (CSAIL) in the PDOS group.

First Na6onal A\ack

•  For the first 6me, a na6onal a\ack on the Internet was exposed.

•  As a result, the Computer Emergency Response Team (CERT), at the So5ware Engineering Ins6tute of Carnegie Mellon University was developed.

Other Examples •  HBO: In April of 1986, an HBO channel was taken over by an

intruder known as Captain Midnight, who overpowered the HBO uplink transmi\er signal with a stronger signal, and sent out his own messages to eight million viewers.

•  Friday the 13th: A student at Hebrew University in Jerusalem discovered that thousands of university computers were infected with a virus. The virus slowed down processing on certain Fridays the 13th and was scheduled to erase the hard disks of many computers on May 13, 1988.

Computer Crime •  According to the FBI, computer crime is the most expensive

form of crime, at $450,000 per the5. The es6mated total volume of computer crime is $5,000,000,000 per year.

•  Some reports es6mate that 90% of computer crime goes unreported.

•  (See h9p://www.usdoj.gov/criminal/cybercrime/cccases.html, the Computer Crime & Intellectual Property SecEon of the US Department of JusEce, Computer Crime Cases.)

Types of A9acks Most frequent aIack: on a networked computer from an outside source Types of aIacks are many: Virus: §  malicious piece of code; requires users to spread infected files §  Does not spread itself from computer to computer §  must be passed on to other users through infected e-mail document

a\achments, programs on diske\es or shared files Macro viruses: §  most common and easily created viruses §  created in an applica6on macro language (e.g. Visual Basic or VBScript) §  infect documents: insert unwanted words, numbers or phrases §  infect applica6on templates (embedding itself in all future docs)

Types of A9acks (Cont.) Worm: harmful programs that reside in ac6ve memory §  Duplicate themselves: can propagate without human interven6on §  Send Copies of themselves to other computers via:

§  Email (e.g. Zip file a\achment) §  Internet Relay Chat (IRC)

§  Nega6ve Impact of virus or worm a\ack §  Lost data and programs §  Lost produc6vity (workers a\emp6ng to recover data and programs)

§  Effort for IT workers (cleaning up mess) Trojan horse: a program a hacker secretly installs on a computer §  Used to steal passwords, SSNs or spy on users by recording keystrokes §  Users are tricked into installing (e.g. disguised as iTunes file or malicious

web site) 13

Types of A9acks (Cont.) Logic bomb – another type of Trojan Horse, executes under specific condi6ons, triggered e.g. by

§  change in a par6cular file §  typing a specific series of keystrokes §  specific date/6me

Denial of service: malicious hacker takes over computers on Internet and causes them to flood a target site with demands for data

§  the computers that are taken over are called zombies Does not involve a break-in at the target computer

§  target machine is busy responding to a stream of automated requests §  thus legi6mate users cannot get in

Spoofing generates false return address on packets §  therefore, sources of a\ack cannot be iden6fied and turned off

Denial-of-Service (DoS) A9acks Defense

Ingress filtering §  when Internet service providers (ISPs) prevent incoming packets with false IP addresses from being passed on

Egress filtering §  ensuring spoofed packets don’t leave a network

Overhead: §  may prevent legi6mate users from geung in §  companies need to deploy faster and more powerful routers and switches to check IP address on each packet

What is Computer (IT) Security? •  Computer security is designed to protect your computer and everything

associated with it --- the building, the worksta6ons and printers, cabling, and disks and other storage media. Most importantly, computer security protects the informa6on stored in your system.

•  Computer security is not only designed to protect against outside intruders who break into systems, but also dangers arising from sharing a password with a friend, failing to back up a disk, spilling a soda on a keyboard. There are three dis6nct aspects of security: secrecy, accuracy, and availability.

•  Having said this, we should emphasize that “Informa6on Security” or “Cybersecurity” is more up-to-date terminology, since rarely are we concerned with the protec6on of a single computer system.

•  A secure computer system must not allow informa6on to be disclosed to anyone who is not authorized to access it. In highly secure government systems, secrecy ensures that users access only informa6on they’re allowed to access.

•  In business environments, confiden6ality ensures the protec6on of private informa6on such as payroll data.

What is IT Security? Security is the protec6on of assets.

The three main aspects are: •  preven6on

•  detec6on

•  re-ac6on/response

Preven:on Implement a layered security soluEon §  Make computer break-ins harder: if hacker breaks through one

layer, there is another layer to overcome Firewall: any Internet traffic not explicitly permi\ed into intranet denied entry; can also block access to certain Web sites, IM, etc. An:virus SoDware:

§  scans for a specific sequence of bytes known as virus signature, may clean, delete or quaran6ne affected files

§  Con6nually update with the latest virus detec6on info called definiEons

§  Do not leave accounts ac:ve aDer employees leave company: promptly delete computer accounts, login IDs, and passwords

Preven:on (Cont.) §  Carefully define employee roles: e.g. do not allow a single

employee to ini6ate a PO and approve invoice for its payment §  Create roles and user accounts: so employees have authority to

perform their responsibili6es and no more §  Keep Track of Well-Known Vulnerabili6es and patch them:

§  SANS (System Administra6on, Networking and Security) Ins6tute

§  CERT/CC §  Backup cri6cal applica6ons and data regularly §  Perform a Security audit to ensure organiza6on has well-

considered security policy in place and that is being followed: §  e.g. users must change their password every 30 days

Detec:on Detec:on systems: §  catch intruders in the act but preven6ve measures are not fail-proof Intrusion detecEon system:

§  monitors system and network resources and ac6vi6es §  no6fies the proper authority when it iden6fies

-possible intrusions from outside the organiza6on -misuse from within the organiza6on

2 fundamental approaches: Knowledge-based and Behavior-based Knowledge-based approaches

§  U6lize informa6on about specific a:acks and system vulnerabili+es and watch for a\empts to exploit these

§  examples include repeated failed login a\empts, a\empts to download a program to a server, or other symptoms of possible mischief

Detec:on (Cont.) Behavior-based approaches:

§  model normal behavior of a system and its users from reference source §  compare current ac6vity to this model and generate alarm if devia6on §  examples include unusual traffic at odd hours or a user in HR department who

accesses accoun6ng program he never used before Intrusion PrevenEon Systems (IPSs):

§  Prevent a\acks by blocking: viruses, malformed packets & other threats §  Sits directly behind the firewall and examines all traffic passed by it §  Firewall and network IPS are complementary:

§  firewall blocks everything except what you explicitly allow through; §  IPS lets everything through except what it is told to block

Honeypot: provides would-be hackers with fake informa+on about the network §  Decoy server: goal is to confuse hackers, trace/keep a record for prosecu6on §  keeps hackers well-isolated from the rest of the network §  can extensively log ac6vi6es of intruders §  honeypot can iden6fy a\acker reconnaissance probes

-used by a\ackers to obtain info about network resources he wants to a\ack

Response Response plan:

§  prepare for the worst §  develop well in advance of any incident §  should be approved by legal department and senior management

Primary goals: §  regain control: technical and emo6onal §  limit damage, restore data and informa6on systems to normal

Incident no6fica6on defines: §  who to no6fy: within company, customers, suppliers? §  who not to no6fy

Security experts recommend against releasing specific info about a security compromise in public forums (news reports, conferences, online groups)

Response (Cont.) Document all details of a security incident §  do for future prosecu6on and to help with incident eradica6on and

follow-up §  all system events §  specific ac6ons taken §  all external conversa6ons Act quickly to contain an a\ack: may need to shut down or disconnect cri6cal system from network EradicaEon effort

§  collect and log all possible criminal evidence from the system §  verify necessary backups are current and complete

-create disk image of all compromised systems for later study and evidence

§  create new backups, a5er virus has been eradicated 23

Response (Cont.) Follow-up (the ‘a5ermath’)

§  determine how security was compromised -prevent it from happening again -was a so5ware fix not installed?

Review §  determine exactly what happened §  evaluate how the organiza6on responded §  write formal incident report

Capture the perpetrator But consider the poten6al for nega6ve publicity

§  brokerage firm might lose customers who think their money or records not secure

Legal precedent §  hold organiza6ons accountable for their own IT security weaknesses

§  par6cularly true for ISPs 24

Fundamental Goals for Computer Security

•  Data Confiden6ality

•  Data Integrity

•  System Availability

•  Related issue – Privacy •  A legal and ethic ques6on •  Implemented by Confiden6ality goal

In Business Terms

Asset

Threat Cost

Risk

Some differences between tradi6onal security and informa6on security

•  Informa6on can be stolen - but you s6ll have it

•  Confiden6al informa6on may be copied and sold - but the the5 might not be detected

•  The criminals may be on the other side of the world

Confiden6ality

•  The preven6on of unauthorised disclosure of informa6on.

•  Confiden6ality is keeping informa6on secret or private.

•  Confiden6ality might be important for military, business or personal reasons.

Integrity

•  Integrity is the unauthorised wri6ng or modifica6on of informa6on.

•  Integrity means that there is an external consistency in the system - everything is as it is expected to be.

•  Data integrity means that the data stored on a computer is the same as the source documents.

Availability •  A secure computer system must keep informa6on available to its

users. Availability means that the computer system’s hardware and so5ware keeps working efficiently and that the system is able to recover quickly and completely if a disaster occurs.

•  Informa6on should be accessible and useable upon appropriate demand by an authorized user.

•  Availability is the preven6on of unauthorized withholding of informa6on.

•  The opposite of availability is denial of service. Denial of service

a\acks are a common form of a\ack. Denial of service can be every bit as disrup6ve as actual informa6on the5.

Non-repudia6on

•  Non-repudia6on is the preven6on of either the sender or the receiver denying a transmi\ed message.

•  A system must be able to prove that certain messages were sent and received.

•  Non-repudia6on is o5en implemented by using digital signatures.

Authen6ca6on

•  Proving that you are who you say you are, where you say you are, at the 6me you say it is.

•  Authen6ca6on may be obtained by the provision of a password or a scan of your re6na.

Access Controls

•  The limita6on and control of access through iden6fica6on and authen6ca6on.

•  A system needs to be able to inden6fy and authen6cate users for access to data, applica6ons and hardware.

•  In a large system there may be a complex structure determining which users and applica6ons have access to which objects.

Accountability

•  The system managers are accountable to scru6ny from outside.

•  Audit trails must be selec6vely kept and protected so that ac6ons affec6ng security can be traced back to the responsible party

Security systems

•  A security system is not just a computer package. It also requires security conscious personnel who respect the procedures and their role in the system.

•  Conversely, a good security system should not rely on personnel having security exper6se.

Risk Analysis

•  The disadvantages of a security system are that they are 6me-consuming, costly, o5en clumsy, and impede management and smooth running of the organisa6on.

•  Risk analysis is the study of the cost of a par6cular system against the benefits of the system.

Designing a Security System

There are a number of design considera6ons: •  Does the system focus on the data, opera6ons or the

users of the system? •  What level should the security system operate from?

Should it be at the level of hardware, opera6ng system or applica6ons package?

•  Should it be simple or sophis6cated? •  In a distributed system, should the security be centralised

or spread? •  How do you secure the levels below the level of the

security system?

Security Models

A security model is a means for formally expressing the rules of the security policy in an abstract detached way.

The model should be: •  easy to comprehend •  without ambigui6es •  possible to implement •  a reflec6on of the policies of the organisa6on.

Accuracy, Integrity, and AuthenEcity

•  A secure computer system must maintain the con6nuing integrity of the informa6on stored in it. Accuracy or integrity means that the system must not corrupt the informa6on or allow any unauthorized malicious or accidental changes to it.

•  In network communica6ons, a related variant of accuracy known as authen6city provides a way to verify the origin of data by determining who entered or sent it, and by recording when it was sent and received.

Threats to Security •  There are three key words that come up in discussions of computer

security: –  vulnerabili6es, –  threats, and –  countermeasures.

•  A vulnerability is a point where a system is suscep6ble to a\ack. •  A threat is a possible danger to the system: e.g. a person, a thing (a faulty

piece of equipment), or an event (a fire or a flood). •  Techniques for protec6ng your system are called countermeasures.

VulnerabiliEes •  Examples:

physical vulnerabili6es natural vulnerabili6es hardware and so5ware vulnerabili6es media vulnerabili6es emana6on vulnerabili6es communica6ons vulnerabili6es human vulnerabili6es

•  There is a lot of varia6on in how easy it is to exploit different types of vulnerabili6es. For example, tapping a cordless telephone or a cellular mobile phone requires only a $199 scanner from Radio Shack.

Threats •  Threats fall into three main categories:

natural threats uninten6onal threats inten6onal threats The inten6onal threats can come from insiders or outsiders. Outsiders can include: foreign intelligence agents terrorists criminals corporate raiders crackers

Inside or Outside?

•  Although most security mechanisms protect best against outside intruders, survey a5er survey indicates that most a\acks are by insiders. Es6mates are that as many as 80% of system penetra6ons are by fully authorized users.

The Insider

•  There are a number of different types of insiders: disgruntled employee, the coerced employee, and the greedy employee. One of the most dangerous types of insiders may simply be lazy or untrained. He or she doesn’t bother changing passwords, doesn’t learn how to encrypt files, doesn’t get around to erasing old disks, and leaves sensi6ve printout in piles on the floor.

Countermeasures

•  There are many different types of countermeasures ,methods of protec6ng informa6on. In the next several lectures, we will survey these methods: computer security communica6ons security physical security

InformaEon and Its Controls •  Informa6on security is almost as old as informa6on itself. •  innova6ons are inevitably followed by methods of harnessing the new

technologies and protec6ng the informa6on they process. –  within five years of the introduc6on of the telephone in 1881, a patent

applica6ons was filed for a voice scrambler;

–  in the 1920s, the use of telephone wiretaps by government and criminals resulted in a public outcry, leading to legisla6on banning most wiretapping;

–  in the 1940s, concerns about controlling the prolifera6on of informa6on about atomic energy led to the Atomic Energy Act of 1946. This act created a Restricted Data category of informa6on requiring special protec6on.

Debates –  One ongoing debate in the computer security world is over the

government’s restric6on of technological informa6on. –  The government needs to protect certain kinds of informa6on, such as

na6onal defense data. –  Par6cular security technologies, for example, cryptology, are very

effec6ve at safeguarding such informa6on. Should the government be able to control who can and cannot buy such technologies?

–  Another debate concerns the involvement of the government in manda6ng the protec6ng of nongovernment informa6on.

Computer Security: Then and Now

•  In the early days of compu6ng, computer systems were large, rare, and very expensive. Those organiza6ons lucky enough to have a computer tried their best to protect it. Computer security was just one aspect of general plant security.

•  Security concerns focused on physical break-ins, the5 of computer equipment, and the5 or destruc6on of disk packs, tape reels, and other media.

•  Insiders were also kept at bay. Few people knew how to use computers, and thus the users could be carefully screened.

Later On •  By the 1970s, technology was transformed, and with it the ways in which

users related to computers and data. Mul6-programaming, 6me-sharing, and networking changed the rules.

•  Telecommunica6ons --- the ability to access computers from remote loca6ons --- radically changed computer usage. Businesses began to store informa6on online. Networks linked minicomputers together and with mainframes containing large online databases. Banking and the transfer of assets became an electronic business.

New Abuses •  The increased availability of online systems and informa6on led to abuses.

Instead of worrying only about intrusions by outsiders into computer facili6es and equipment, organiza6ons now had to worry about –  computers that were vulnerable to sneak a\acks over telephone lines, and –  informa6on that could be stolen or changed by intruders who didn’t leave a

trace. •  Individuals and government agencies expressed concerns about the

invasion of privacy posed by the availability individual financial, legal, and medical records on shared online databases.

The PC World •  The 1980s saw a new dawn in compu6ng. With the

introduc6on of the PC, individuals of all ages and occupa6ons became computer users. This technology introduced new risks. Precious and irreplaceable corporate data were now stored on diske\es, which could now be lost or stolen.

•  As PCs proliferated, so too did PC networks, electronic mail, chat rooms, and bulle6n boards, vastly raising the security stakes. The 1980s also saw systems under a\ack.

The Future

•  The challenge of the next decade will be to consolidate what we’ve learned --- to build computer security into our products and our daily rou6nes ,to protect data without unnecessarily impeding our access to it, and to make sure that both products and standards grow to meet the ever- increasing scope of challenge of technology.

What is Cyberspace?

Cyberspace is a worldwide network of computers and the equipment that connects them, which by its very design is free and open to the public (the Internet)

As Stanley Konter, CEO of Savannah's Sabre Technologies, notes, "The problem has gotten more prevalent with always-on, high-speed internet access. Attackers are always out there looking for that type of computer."

Viruses Viruses infect computers through email attachments and file sharing. They delete files, attack other computers, and make your computer run slowly. One infected computer can cause problems for all computers on a network.

Hackers Hackers are people who “trespass” into your computer from a remote location. They may use your computer to send spam or viruses, host a Web site, or do other activities that cause computer malfunctions.

Identity Thieves

People who obtain unauthorized access to your personal information, such as Social Security and financial account numbers. They then use this information to commit crimes such as fraud or theft.

Spyware Spyware is software that “piggybacks” on programs you download, gathers information about your online habits, and transmits personal information without your knowledge. It may also cause a wide range of other computer malfunctions.

Cyber-safety is a common term used to describe a set of practices, measures and/or actions you can take to protect personal information and your computer from attacks. First, let’s talk about some common cyber-safety threats and the problems they can cause . . .

Cyber-safety & Threats

TOP SEVEN CYBER-SAFETY ACTIONS

1. Install OS/Software Updates

2. Run Anti-virus Software

3. Prevent Identity Theft

4. Turn on Personal Firewalls

5. Avoid Spyware/Adware

7. Back up Important Files

Additional information about each of the actions below is provided on slides 8-14. Faculty and staff should work with their technical support coordinator before implementing these measures.

6. Protect Passwords

§  Updates-sometimes called patches-fix problems with your operating system (OS) (e.g., Windows XP, Windows Vista, Mac OS X) and software programs (e.g., Microsoft Office applications).

§  Most new operating systems are set to download updates by default. After updates are downloaded,

you will be asked to install them. Click yes!

§  To download patches for your system and software, visit: §  Windows Update: h\p://windowsupdate.microso5.com to get or ensure you have all the latest

opera6ng system updates only. Newer Windows systems are set to download these updates by default.

§  Microso5 Update: h\p://www.update.microso5.com/microso5update/ to get or ensure you have all the latest OS and Microso5 Office so5ware updates. You must sign up for this service.

§  Apple: h\p://www.apple.com/support §  Unix: Consult documentation or online help for system update information and

instructions. §  Be sure to restart your computer after updates are installed so that the patches can be applied

immediately.

I N S TA L L O S / S O F T WA R E U P D AT E S

R U N A N T I - V I R U S S O F T WA R E

§  To avoid computer problems caused by viruses, install and run an anti-virus program like Sophos.

§  Periodically, check to see if your anti-virus is up to date by opening your anti-virus program and checking the Last updated: date.

§  Anti-virus software removes viruses, quarantines and repairs infected files, and can help prevent future viruses.

P R E V E N T I D E N T I T Y T H E F T

§  Don't give out financial account numbers, Social Security numbers, driver’s license numbers or other personal identity information unless you know exactly who's receiving it. Protect others people’s information as you would your own.

§  Never send personal or confidential information via email or instant messages as these

can be easily intercepted. §  Beware of phishing scams - a form of fraud that uses email messages that appear to be

from a reputable business (often a financial institution) in an attempt to gain personal or account information. These often do not include a personal salutation. Never enter personal information into an online form you accessed via a link in an email you were not expecting. Legitimate businesses will not ask for personal information online.

§  Order a copy of your credit report from each of the three major credit bureaus-Equifax, Experian, and Trans Union. Reports can be ordered online at each of the bureaus’ Web sites. Make sure reports are accurate and include only those activities you have authorized.

T U R N O N P E R S O N A L F I R E WA L L S

§  Check your computer's security settings for a built-in personal firewall. If you have one, turn it on. Microsoft Vista and Mac OSX have built-in firewalls. For more information, see:

•  Mac Firewall (docs.info.apple.com/ar6cle.html?path=Mac/10.4/en/mh1042.html)

•  Microsoft Firewall ( www.microso5.com/windowsxp/using/networking/security/winfirewall.mspx)

•  Unix users should consult system documentation or online help for personal firewall instructions and/or recommendations.

§  Once your firewall is turned on, test your firewall for open ports that could allow in

viruses and hackers. Firewall scanners like the one on h\p://www.auditmypc.com/firewall-test.asp simplify this process.

§  Firewalls act as protective barriers between computers and the internet.

§  Hackers search the Internet by sending out pings (calls) to random computers and wait for responses. Firewalls prevent your computer from responding to these calls.

A V O I D S P Y WA R E / A D WA R E

§  Spyware and adware take up memory and can slow down your computer or cause other problems.

§  Use Spybot and Ad-Aware to remove spyware/adware from

your computer. §  Watch for allusions to spyware and adware in user agreements

before installing free software programs.

§  Be wary of invitations to download software from unknown internet sources.

P R O T E C T P A S S W O R D S

§  Do not share your passwords, and always make new passwords difficult to guess by avoiding dictionary words, and mixing letters, numbers and punctuation.

§  Do not use one of these common passwords or any variation of them: qwerty1, abc123, letmein, password1, iloveyou1, (yourname1), baseball1.

§  Change your passwords periodically.

§  When choosing a password: o  Mix upper and lower case letters o  Use a minimum of 8 characters o  Use mnemonics to help you remember a difficult password

§  Store passwords in a safe place. Consider using KeePass Password Safe ( h\p://keepass.info/), Keychain (Mac) or an encrypted USB drive to store passwords. Avoid keeping passwords on a Post-it under your keyboard, on your monitor or in a drawer near your computer!

B A C K U P I M P O R TA N T F I L E S

§  Reduce your risk of losing important files to a virus, computer crash, theft or disaster by creating back-up copies.

§  Keep your critical files in one place on your computer’s hard

drive so you can easily create a back up copy. §  Save copies of your important documents and files to a CD,

online back up service, flash or USB drive, or a server. §  Store your back-up media in a secure place away from your

computer, in case of fire or theft.

§  Test your back up media periodically to make sure the files are accessible and readable.

CYBER-SAFETY AT HOME

§  Physically secure your computer by using security cables and locking doors and windows in the dorms and off-campus housing.

§  Avoid leaving your laptop unsupervised and in plain view in the library or

coffee house, or in your car, dorm room or home.

§  Set up a user account and password to prevent unauthorized access to your computer files.

§  Do not install unnecessary programs on your computer. §  Microsoft users can download the free Secunia Personal Software Inspector

(h\ps://psi.secunia.com/), which lets you scan your computer for any missing operating system or software patches and provides instructions for getting all the latest updates.

CYBER-SAFETY AT WORK

§  Be sure to work with your technical support coordinator before implementing new cyber-safety measures.

§  Talk with your technical support coordinator about what cyber-safety

measures are in place in your department. §  Report to your supervisor any cyber-safety policy violations, security flaws/

weaknesses you discover or any suspicious activity by unauthorized individuals in your work area.

§  Physically secure your computer by using security cables and locking

building/office doors and windows. §  Do not install unnecessary programs on your work computer.

CYBER-SAFETY BASICS QUICK QUIZ 1.  True or False? Viruses can be transmitted via email, email attachments or IM.

2.  People who seek out your personal information and then use it to commit crimes are called:_____________________

3.  Which of the following are ways to help prevent identity theft. (Check all that apply.) __A. Never send personal information via email or instant messages. __B. Always send personal information via email or instant messages. __C. Lock my office door. __D. Don’t tell anybody my name.

4.  True or False? Iloveyou2 is a good password. Why or why not?

5.  Which anti-virus program is available to all UC Davis students, faculty and staff for free? ________________________

6.  I just downloaded a free program online and now my computer is running very, very slowly. Which of the following most likely happened?

__A. I didn’t install the program properly. __B. I didn’t have enough space on my hard drive for the new program. __C. I downloaded spyware and/or adware, too. __D. Someone snuck in while the program was downloading and changed my password.

7.  ___________________help prevent your computer from responding to pings (calls) from hackers.

8. To fix problems with my operating system and/or application software, I should install __________________.

Answers on next slide . . .

QUICK QUIZ ANSWERS 1.  True

2.  Identity thieves 3.  A and C are correct. D would probably help too, but seems a bit extreme! 4.  False. Iloveyou2 is a very common password. 5.  Sophos Anti-Virus is free to UC Davis students, faculty and staff. 6.  C. It’s most likely that you downloaded spyware and/or adware. 7.  Firewalls 8.  OS and/or software updates (patches)

How did you do? 8-7 correct: Fantastic! You can help write the next quiz! 6-5 correct: Good. You can help write the next quiz, but we’ll check it for accuracy . . . just in case. 4-3 correct: You might want to review the material for the questions you missed.

Summary By now you should have some idea about •  Why we need computer security (preven6on, detec6on and re-ac6on)

•  What a computer security system does (confiden6ality, integrity, availability, non- repudia6on, authen6ca6on, access control, accountability)

•  What computer security exerts do (design, implement and evaluate security systems)

Summary (Cont.) Ethical decisions regarding IT security include determining which informa6on systems and data most need protec6on 65-fold increase in the number of reported IT security incidents from 1997 to 2003 Most incidents involve a: •  Virus •  Worm •  Trojan horse •  Denial-of-service

Key elements of a mul6layer process for managing security vulnerabili6es include: •  Threat assessment: to organiza6on’s computers and network •  User educa6on: of risks and preventa6ve ac6ons •  Response plan

Resources •  Network World Security Newsle\er

–  h\p://www.nwsubscribe.com –  Prac6cal advice, not a virus alert newsle\er. Especially good for the

links to other security resources at the bo\om of each ar6cle •  CERT Coordina6on Center at CMU

–  h\p://www.cert.org •  News about system threats, including viruses and other

problems. Source for OCTAVE papers and process •  Norton An6Virus Site (Symantec)

–  h\p://securityresponse.symantec.com/avcenter/ •  McAfee Security (Network Associates)

–  h\p://us.mcafee.com/virusinfo/