Anatomy of Phishing Campaigns: A Gmail Perspective
|
|
|
- Grant Hines
- 5 years ago
- Views:
Transcription
1 SESSION ID: HT-R03 Anatomy of Phishing Campaigns: A Gmail Perspective Nicolas Lidzborski Ali Zand Gmail & G Suite Security Engineering Lead Google Anti-Abuse Research team #RSAC
2 Phishing 101
3 Is phishing still a thing? Hello! We reviewed your account and decided a compatible account for for the instagram rules and we wanted to give you a verified badge. ( ) Eligible send us your real name Username, and password we can send you a verified badge. Thank you, The Instagram team.
4 Phishing is actually prolific and effective!
5 Gmail sees over 100M phishing s per day!
6
7 Successful Hijacking 25% 7% Phishing Credential Leaks 12% Keyloggers Source: Data breaches, phishing, or malware?: Understanding the risks of stolen credentials
8 Phishing is a global issue!
9
10 Attackers use IPs from variety of countries
11 Targets are everywhere Source: Google
12 Components of a phishing campaign Target website sending infrastructure Target users Credential exfiltration website templates People managing operation
13 Open-source Phishing Campaign Engine Sent Opened 82% 8% Links Clicked Submitted Data 6% 5% Phishing Success Overview % of Success Jan 2018 Feb 2018 Mar 2018 Apr 2018 May 2018 Jun 2018 Jul 2018 Source: gophish dashboard
14 Campaigns are small and short lived phishing s per campaign minutes campaign half life (median)
15 The three guards Delivery Vector Target User Target Service
16 Defeat the Delivery Vector Defeat the User is accepted User interacts with phishing Your account is blocked. CLICK HERE Defeat the Target Service Stolen authenticator logs in the phisher (ie. bank)
17 Defeat the Delivery Vector is accepted
18 Anti-Phishing Infrastructure
19 Reputation analysis Clustering Content understanding
20 Feature reputation Feature Extraction domain.org x xxxx.tld
21 Name / domain spoofing G00gle Feature Extraction G00gle Tech Support support.google.com.phish.org Match
22 Visual similarity Match
23 Harnessing AI to keep the bad out
24 How to defeat ML? Evasion Make attack a moving target
25 Evasion: simple cloaking by IP subnet and domains deny deny deny deny deny deny deny deny deny deny deny deny deny deny deny deny deny deny deny deny from from from from from from from from from from from from from from from from from from from from paypal.com 112.2o7.com firefox.com apple.com zeustracker.abuse.ch virustotal.com adminus.net aegislab.com alienvault.com antiy.net avast.com team-cymru.org eset.com fireeye.com microsoft.com kernelmode.info malwaredomainlist.com wilderssecurity.com eset-la.com blogs.eset-la.com
26 Evasion: block by user agent if(in_array($_server['remote_addr'],$bannedip)) { header('http/ Not Found'); exit(); } if(strpos($_server['http_user_agent'], 'google') or strpos($_server['http_user_agent'], 'msnbot') or strpos($_server['http_user_agent'], 'Yahoo! Slurp') or strpos($_server['http_user_agent'], 'YahooSeeker') or strpos($_server['http_user_agent'], 'Googlebot') or strpos($_server['http_user_agent'], 'bingbot') or strpos($_server['http_user_agent'], 'crawler') or strpos($_server['http_user_agent'], 'PycURL') or strpos($_server['http_user_agent'], 'facebookexternalhit')!== false) { header('http/ Not Found'); exit; }
27 How to defeat ML? Evasion Deception Make attack a moving target Make ML and user see different things
28 Deception: Human Perception vs Machine
29 How to defeat ML? Evasion Deception Confusion Make attack a moving target Make ML and user see different things Trick the user to provide ML with misleading data
30 Confusion: fake affinity via reply To cancel the termination request reply to this mail.
31 Confusion: fake affinity via reply
32 How to defeat ML? Evasion Deception Confusion Make attack a moving target Make ML and user see different things Trick the user to provide ML with misleading data
33 Defeat the User User interacts with phishing Your account is blocked. Update your credit card information CLICK HERE
34 Attention is a limited capacity resource
35 How to fool users? Habits Safe and Familiar Pressure Embarrassment and Fear Vanishing Reward Limited opportunity
36 Familiar user interface Source:
37 Technical support reaching out
38 Thanks from X-rated Using embarrassment or fear X-rated THANKS FOR SHARING X-rated now has automated video sharing to your social media account Thanks X-rated Decline Sharing No need to share your videos to your friends and family ever again because this new revolutionary sharing feature does it for you! Automatically!
39 Hi, stranger! Credential leaks for sextortion I know the password123, this is your password, and I sent you this message from your account. If you have already changed your password, my malware will be intercepts it every time. You may not know me, and you are most likely wondering why you are receiving this , right? In fact, I posted a malicious program on adults (pornography) of some websites, and you know that you visited these websites to enjoy (you know what I mean). While you were watching video clips, my trojan started working as a RDP (remote desktop) with a keylogger that gave me access to your screen as well as a webcam. Immediately after this, my program gathered all your contacts from messenger, social networks, and also by . What I've done? I made a double screen video. The first part shows the video you watched (you have good taste, yes... but strange for me and other normal people), and the second part shows the recording of your webcam.
40 Dear Customer, Thank you for choosing XXXXXX. Service interruption... We are currently upgrading our server to give you the best of our service. We require you to upgrade your account details to avoid service being interrupted. A separate confirmation will be sent with your contract terms and conditions once your upgrade has been successfully processed. For more details please log in to your XXXXXX Control Panel: Sincerely, Sebastian Gonzalez XXXXXXX Head of Customer Service
41 ... with ironic anti-phishing training
42 Entice you with the promise of a prize...
43 and ask nicely for your bank credentials
44 The life of a message Attachment download Sync Message open Link click External Website Reply Send Delivery Reclassification
45 Delivery Attachment download Sync Message open Link click External Website Reply Send Delivery Reclassification
46 Sync Attachment download Sync Message open Link click External Website Reply Send Delivery Reclassification
47 Message open Attachment download Sync Message open Link click External Website Reply Send Delivery Reclassification
48 Big and obvious warning banners This message seems dangerous
49 Message open: warning banners Re: Security Banner Design Charlie Samuel This message seems dangerous The sender s account may have been compromised. Avoid clicking links, downloading attachments, or replying with personal information. If you Know the sender, consider alerting them (but avoid replying to this ). Report Looks Safe
50 Reclassification Attachment download Sync Message open Link click External Website Reply Send Delivery Reclassification
51 Phishing locality: co-worker warning via outbreak banners
52 Link click Attachment download Sync Message open Link click External Website Reply Send Delivery Reclassification
53 Suspicious Link Warning
54 Suspicious Link Warning
55 Real Time Check
56 Reply Attachment download Sync Message open Link Click External Website Reply Send Delivery Reclassification
57 Out of Domain Warning
58 Defense in depth Antivirus check Preview Attachment download Sanitize Sync Reject Warning banners Restricted actions Suspicious prompt Message open Link click External Website Safe browsing check Delivery Reply Out of domain warning Reclassification Deep Scanning Send
59 Look ahead for malicious remote content
60 Protect against domain and employee spoofing
61 Defeat the Target Service Phisher using the stolen authenticator
62 Sign In Challenge SUCCEED ALLOW User Normal workflow Sign In Challenge Can t Continue DENY Hacker Hijacker workflow??? VICTIM
63 Attackers are adapting RSA SecurID Phisable 2FA Mobile Platforms
64 Monitor for unusual activity Faking user geolocation/ browser configuration Use second factor Phish for second factor Use phishing resistant authentication Use a different attack method
65 Raising the bar
66 FIDO U2F tokens
67 Make it mandatory and phishing resistant for employees
68 Apply what you learned today Build defenses in depth Use phishing resistant solutions Apply domain specific defenses Monitor unusual activity on accounts
69 Takeaways: next week Ensure your outgoing s are all strongly authenticated (DKIM, DMARC). Use a password manager and 2FA.
70 Takeaways: over the next 3 months Start plan for phishing resistant 2FA solutions for all employees. Enable advanced security options for incoming s.
71 Takeaways: over the next 6 months Investigate Brand Indicators for Message Identification (BIMI). Investigate FIDO2 for service auth.
72 Questions?
73 Thanks.
FAQ. Usually appear to be sent from official address
FAQ 1. What is Phishing Email? A form of fraud by which an attacker masquerades as a reputable entity in order to obtain your personal information. Usually appear to be sent from official email address
How to recognize phishing s
Phishing email messages, websites, and phone calls are designed to steal money, steal data and/or destroy information. Cybercriminals can do this by installing malicious software on your computer or stealing
Phishing. Eugene Davis UAH Information Security Club April 11, 2013
Phishing Eugene Davis UAH Information Security Club April 11, 2013 Overview A social engineering attack in which the attacker impersonates a trusted entity Attacker attempts to retrieve privileged information
Webomania Solutions Pvt. Ltd. 2017
The other name for link manipulation is Phishing or you can say link manipulation is type of phishing attack done generally to mislead the user to a replica website or a looka-like of some well-known site.
Quick Heal AntiVirus Pro Advanced. Protects your computer from viruses, malware, and Internet threats.
AntiVirus Pro Advanced Protects your computer from viruses, malware, and Internet threats. Features List Ransomware Protection anti-ransomware feature is more effective and advanced than other anti-ransomware
How Enterprise Tackles Phishing. Nelson Yuen Technology Manager, Cybersecurity Microsoft Hong Kong
How Enterprise Tackles Phishing Nelson Yuen Technology Manager, Cybersecurity Microsoft Hong Kong Hackers turning to easy marks - Social engineering Phishing was the #1 threat vector (> 50%) for Office
Manually Create Phishing Page For Facebook 2014
Manually Create Phishing Page For Facebook 2014 While you are creating phishing page manually you have to do a lot of work Web Templates -- For importing premade template for Gmail, Facebook from SET.
Wayward Wi-Fi. How Rogue Hotspots Can Hijack Your Data and Put Your Mobile Devices at Risk
Wayward Wi-Fi How Rogue Hotspots Can Hijack Your Data and Put Your Mobile Devices at Risk 288 MILLION There are more than 288 million unique Wi-Fi networks worldwide. Source: Wireless Geographic Logging
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
SOCIAL NETWORKING'S EFFECT ON BUSINESS SECURITY CONTROLS
SOCIAL NETWORKING'S EFFECT ON BUSINESS SECURITY CONTROLS Jon Hanny Director of Information Security and Assurance, Buckley Sandler LLP Gaurav Chikara Senior Security Engineer, Cooley LLP AGENDA Social
Train employees to avoid inadvertent cyber security breaches
Train employees to avoid inadvertent cyber security breaches TRAIN EMPLOYEES TO AVOID INADVERTENT CYBER SECURITY BREACHES PAGE 2 How much do you know about cyber security? Small business owners often lack
Competitive Matrix - IRONSCALES vs Alternatives
Competitive Matrix - IRONSCALES vs Alternatives Traditional Awareness and Training Features IRONSCALES SEG PhishMe Wombat Knowbe4 Sans Institute Simulation & Training Compliance PCI/DSS, HIPAA, GLBA to
One Phish, Two Phish, Three! Building an Active Threat Management Framework for Malicious
One Phish, Two Phish, Three! Building an Active Threat Management Framework for Malicious Email - Ron Weiss, Incident Response Team lead Disclaimer: The information in this presentation is based on lessons
DMARC Continuing to enable trust between brand owners and receivers
DMARC Continuing to enable trust between brand owners and receivers February 2014 1 DMARC Defined DMARC stands for: Domain-based Message Authentication, Reporting & Conformance (pronounced dee-mark ) 2
Quick recap on ing Security Recap on where to find things on Belvidere website & a look at the Belvidere Facebook page
Workshop #7 Email Security Previous workshops 1. Introduction 2. Smart phones & Tablets 3. All about WatsApp 4. More on WatsApp 5. Surfing the Internet 6. Emailing Quick recap on Emailing Email Security
Protect Your Endpoint, Keep Your Business Safe. White Paper. Exosphere, Inc. getexosphere.com
Protect Your Endpoint, Keep Your Business Safe. White Paper Exosphere, Inc. getexosphere.com White Paper Today s Threat Landscape Cyber attacks today are increasingly sophisticated and widespread, rendering
Addressing Credential Compromise & Account Takeovers: Bearersensitive. Girish Chiruvolu, Ph.D., CISSP, CISM, MBA ISACA NTX April 19
Addressing Credential Compromise & Account Takeovers: Bearersensitive OTPS Girish Chiruvolu, Ph.D., CISSP, CISM, MBA ISACA NTX April 19 Impact Across Every Industry Phishing: Low Cost, Big Impact for
Office 365 Buyers Guide: Best Practices for Securing Office 365
Office 365 Buyers Guide: Best Practices for Securing Office 365 Microsoft Office 365 has become the standard productivity platform for the majority of organizations, large and small, around the world.
Phishing Read Behind The Lines
Phishing Read Behind The Lines Veljko Pejović veljko@cs.ucsb.edu What is Phishing? "Phishing attacks use both social engineering and technical subterfuge to steal consumers' personal identity data and
Evolution of Spear Phishing. White Paper
Evolution of Spear Phishing White Paper Executive Summary Phishing is a well-known security threat, but few people understand the difference between phishing and spear phishing. Spear phishing is the latest
Cyber Security Guide. For Politicians and Political Parties
Cyber Security Guide For Politicians and Political Parties Indian Election Integrity Initiative Design by ccm.design Cover Image by Paul Dufour Helping to Safeguard the Integrity of the Electoral Process
How to Build a Culture of Security
How to Build a Culture of Security March 2016 Table of Contents You are the target... 3 Social Engineering & Phishing and Spear-Phishing... 4 Browsing the Internet & Social Networking... 5 Bringing Your
Phishing. What do phishing s do?
Phishing We have become all too familiar with phishing emails but if that s the case, why do we as a community still fall victim? In this newsletter our goal is to provide you with some basic information
Best Practices Guide to Electronic Banking
Best Practices Guide to Electronic Banking City Bank & Trust Company offers a variety of services to our customers. As these services have evolved over time, a much higher percentage of customers have
Target Breach Overview
Target Breach Overview Q: Media reports are stating that Target experienced a data breach. Can you provide more specifics? A: Yes, Target has confirmed that it experienced unauthorized access to its systems
Phishing Activity Trends Report August, 2006
Phishing Activity Trends Report, 26 Phishing is a form of online identity theft that employs both social engineering and technical subterfuge to steal consumers' personal identity data and financial account
Security and Privacy. Xin Liu Computer Science University of California, Davis. Introduction 1-1
Security and Privacy Xin Liu Computer Science University of California, Davis Introduction 1-1 What is network security? Confidentiality: only sender, intended receiver should understand message contents
Don t blink or how to create secure software. Bozhidar Bozhanov, LogSentinel
Don t blink or how to create secure software Bozhidar Bozhanov, CEO @ LogSentinel About me Senior software engineer and architect Founder & CEO @ LogSentinel Former IT and e-gov advisor to the deputy prime
Phishing Discussion. Pete Scheidt Lead Information Security Analyst California ISO
Phishing Discussion Pete Scheidt Lead Information Security Analyst California ISO 2 Phish What is Phishing Types of Phish 3 Phish What is Phishing Attackers (Phishers) would email (cast their nets) far
Cyber Hygiene Guide. Politicians and Political Parties
Cyber Hygiene Guide Politicians and Political Parties Canadian Election Integrity Initiative Design by ccm.design Cover Image by Songquan Deng Helping to Safeguard the Integrity of the Electoral Process
Security and Privacy
E-mail Security and Privacy Department of Computer Science Montclair State University Course : CMPT 320 Internet/Intranet Security Semester : Fall 2008 Student Instructor : Alex Chen : Dr. Stefan Robila
WHITEPAPER. Protecting Against Account Takeover Based Attacks
WHITEPAPER Protecting Against Account Takeover Based Email Attacks Executive Summary The onslaught of targeted email attacks such as business email compromise, spear phishing, and ransomware continues
Attacking Your Two-Factor Authentication (PS: Use Two-Factor Authentication)
Attacking Your Two-Factor Authentication (PS: Use Two-Factor Authentication) 08 Jun 2017 K-LUG Technical Meeting Rochester, MN Presented by: Vi Grey Independent Security Researcher https://vigrey.com Who
How to Conquer Targeted Threats: SANS Review of Agari Enterprise Protect
How to Conquer Targeted Email Threats: SANS Review of Agari Enterprise Protect A SANS Product Review Written by Dave Shackleford May 2017 Sponsored by Agari 2017 SANS Institute Introduction: Email Is a
Fighting Phishing I: Get phish or die tryin.
Fighting Phishing I: Get phish or die tryin. Micah Nelson and Max Hyppolite bit.ly/nercomp_sap918 Please, don t forget to submit your feedback for today s session at the above URL. If you use social media
BRING SPEAR PHISHING PROTECTION TO THE MASSES
E-Guide BRING SPEAR PHISHING PROTECTION TO THE MASSES SearchSecurity phishing. I n this expert tip, David Sherry describes how a combination of technical controls and user awareness training can help put
ybersecurity for the Modern Era Three Steps to Stopping malware, Credential Phishing, Fraud and More
ybersecurity for the Modern Era Three Steps to Stopping malware, Credential Phishing, Email Fraud and More www.proofpoint.com EBOOK Cybersecurity in the modern era 2 ONLY AMATEURS ATTACK MACHINES. PROFESSIONALS
ATTACHMENTS, INSERTS, AND LINKS...
Conventions used in this document: Keyboard keys that must be pressed will be shown as Enter or Ctrl. Objects to be clicked on with the mouse will be shown as Icon or. Cross Reference Links will be shown
Frequently Asked Questions (FAQ)
Your personal information and account security is important to us. This product employs a Secure Sign On process that includes layers of protection at time of product log in to mitigate risk, and thwart
RSA FRAUDACTION ANTI-PHISHING SERVICE: BENEFITS OF A COMPREHENSIVE MITIGATION STRATEGY
RSA FRAUDACTION ANTI-PHISHING SERVICE: BENEFITS OF A COMPREHENSIVE MITIGATION STRATEGY RSA CYOTA PROJECT PROPOSAL RSA FRAUDACTION ANTI-PHISHING SERVICE V.1 2011 Overview This brief highlights the benefits
STEVE GOODING JUNE 15, 2018
ARMOR: THE STATE OF THE INDUSTRY STEVE GOODING JUNE 15, 2018 Agenda 1. Welcome 2. Introduction to Armor 3. Honeypot Report 4. Black Market Report 2 ARMOR IN THE CYBERSECURITY SPACE 3 About Armor DATA CENTERS:
Quick Heal Total Security
For secure online banking, smooth Internet surfing, and robust protection for your PC. Features List Ransomware Protection Quick Heal anti-ransomware feature is more effective and advanced than other anti-ransomware
WHAT IS CORPORATE ACCOUNT TAKEOVER? HOW DOES IT HAPPEN?
WHAT IS CORPORATE ACCOUNT TAKEOVER? Corporate Account Takeover (also referred to as CATO) is a type of fraud where criminals gain access to a business financial accounts to make unauthorized transactions.
Incident Play Book: Phishing
Incident Play Book: Phishing Issue: 1.0 Issue Date: September 12, 2017 Copyright 2017 Independent Electricity System Operator. Some Rights Reserved. The following work is licensed under the Creative Commons
Deep Sea Phishing: Examples & Countermeasures
Deep Sea Phishing: Examples & Countermeasures Phishing is impersonation of a person or brand. Our focus is email-based phishing. Phishing is not malware, spam, or xss, although these often coincide. Current
Cyber Security Updates and Trends Affecting the Real Estate Industry
Cyber Security Updates and Trends Affecting the Real Estate Industry What, Why, and How? Agenda Cyber Security Today Changes to Security Standards and Trends Protecting Yourself and Your Organization Takeways
ANATOMY OF A SPEAR PHISHING ATTACK. A Menlo Security Research Report
ANATOMY OF A SPEAR PHISHING ATTACK A Menlo Security Research Report Overview Today s CISOs are trying unsuccessfully to mitigate the threat of malware and credential theft, the two greatest risks associated
Quick Heal AntiVirus Pro. Tough on malware, light on your PC.
Tough on malware, light on your PC. Features List Ransomware Protection Quick Heal anti-ransomware feature is more effective and advanced than other anti-ransomware tools. Signature based detection Detects
End-to-End Measurements of Spoofing Attacks. Hang Hu, Gang Wang Computer Science, Virginia Tech
End-to-End Measurements of Email Spoofing Attacks Hang Hu, Gang Wang hanghu@vt.edu Computer Science, Virginia Tech Spear Phishing is a Big Threat Spear phishing: targeted phishing attack, often involves
PROTECTING YOUR BUSINESS ASSETS
PROTECTING YOUR BUSINESS ASSETS How to Spot Danger Before Your Computer Gets Infected, Your Site Hosts Malware, and Your Credit Card Number Gets Stolen A MyNAMS Presentation by Regina Smola @2012 Regina
Protecting Against Online Fraud. F5 EMEA Webinar August 2014
Protecting Against Online Fraud F5 EMEA Webinar August 2014 Agenda Fraud threat trends and business challenges Web fraud protection Mobile fraud protection Security operations center Example architecture
Fraud Update: Why Fraudsters Love Wires and How to Stop Them. Luis Rojas, Director, Product Management WesPay 2014
Fraud Update: Why Fraudsters Love Wires and How to Stop Them Luis Rojas, Director, Product Management WesPay 2014 Competitive Pressures Drive Fraud and Operational Risk Availability Of Information Creates
Staying Safe on the Internet. Mark Schulman
Staying Safe on the Internet Mark Schulman 1 Your Presenter Mark Schulman IT professional for almost 40 years No affiliation with any product 2 What We ll Talk About Passwords Email Safety Staying Safe
MODERN DESKTOP SECURITY
MODERN DESKTOP SECURITY I M GOING TO BE HONEST. WE RE IN THE FIGHT OF OUR DIGITAL LIVES, AND WE ARE NOT WINNING! M I C H A E L M C C A U L, C H A I R M A N, U S H O M E L A N D S E C U R I T Y C O M M
Employee Security Awareness Training
Employee Security Awareness Training September 2016 Purpose Employees have access to sensitive data through the work they perform for York. Examples of sensitive data include social security numbers, medical
CloudSOC and Security.cloud for Microsoft Office 365
Solution Brief CloudSOC and Email Security.cloud for Microsoft Office 365 DID YOU KNOW? Email is the #1 delivery mechanism for malware. 1 Over 40% of compliance related data in Office 365 is overexposed
Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment
Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment Ray Colado, Information Security Analyst Raise awareness around information security to help
Cross-site request forgery Cross-site scripting Man-in-the-browser Session hijacking Malware Man-in-the-middle DNS cache poisoning DNS spoofing DNS hijacking Dictionary attacks DDoS DDoS Eavesdropping
Review Kaspersky Internet Security - multi-device 2015 online software downloader ]
![Review Kaspersky Internet Security - multi-device 2015 online software downloader ]](/thumbs/72/67088147.jpg "Review Kaspersky Internet Security - multi-device 2015 online software downloader ]")
Review Kaspersky Internet Security - multi-device 2015 online software downloader ] Description: Benefits Protecting all your connected devices the one-licence, easy-touse solution Kaspersky Internet Security
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS
10 KEY WAYS THE FINANCIAL SERVICES INDUSTRY CAN COMBAT CYBER THREATS WHITE PAPER INTRODUCTION BANKS ARE A COMMON TARGET FOR CYBER CRIMINALS AND OVER THE LAST YEAR, FIREEYE HAS BEEN HELPING CUSTOMERS RESPOND
Chapter 12. Information Security Management
Chapter 12 Information Security Management We Have to Design It for Privacy... and Security. Tension between Maggie and Ajit regarding terminology to use with Dr. Flores. Overly technical communication
How Breaches Really Happen
How Breaches Really Happen www.10dsecurity.com About Dedicated Information Security Firm Clients Nationwide, primarily in financial industry Services Penetration Testing Social Engineering Vulnerability
Phishing Activity Trends
Phishing Activity Trends Report for the Month of September, 2007 Summarization of September Report Findings The total number of unique phishing reports submitted to APWG in September 2007 was 38,514, an
CompTIA Security+ Malware. Threats and Vulnerabilities Vulnerability Management
CompTIA Security+ Lecture Six Threats and Vulnerabilities Vulnerability Management Copyright 2011 - VTC Malware Malicious code refers to software threats to network and systems, including viruses, Trojan
Security Awareness. Chapter 2 Personal Security
Security Awareness Chapter 2 Personal Security Objectives After completing this chapter, you should be able to do the following: Define what makes a weak password Describe the attacks against passwords
Table of Contents. User Guide
Table of Contents Locate Laptop Laptop Tracking & Data Security 2 Feature: 2 Port Locker Stop Information & File Leaks 3 Feature 3 BitDefender Internet Security Secure Your Every Bit 3 Feature: 3 PROTEGENT
Security & Phishing
Email Security & Phishing Best Practices In Cybersecurity Presenters Bill Shieh Guest Speaker Staff Engineer Information Security Ellie Mae Supervisory Special Agent Cyber Crime FBI 2 What Is Phishing?
Update on new Microsoft Cloud Technology
Update on new Microsoft Cloud Technology Advanced Threat Protection Thomas Collier Technical Pre-Sales OFFICE 365 PHISH PROTECTION STACK Protect during Mail Flow Protect Post Delivery Detect & Respond
Figure 11-1: Organizational Issues. Managing the Security Function. Chapter 11. Figure 11-1: Organizational Issues. Figure 11-1: Organizational Issues
1 Managing the Security Function Chapter 11 Panko, Corporate Computer and Network Security Copyright 2004 Prentice-Hall Top Management Support Top-Management security awareness briefing (emphasis on brief)
On the Surface. Security Datasheet. Security Datasheet
Email Security Datasheet Email Security Datasheet On the Surface No additional hardware or software required to achieve 99.9%+ spam and malware filtering effectiveness Initiate service by changing MX Record
Adobe Security Survey
Adobe Security Survey October 2016 Edelman + Adobe INTRODUCTION Methodology Coinciding with National Cyber Security Awareness Month (NCSAM), Edelman Intelligence, on behalf of Adobe, conducted a nationally
Custom Plugin A Solution to Phishing and Pharming Attacks
Custom Plugin A Solution to Phishing and Pharming Attacks Omer Mahmood School of Information Technology Charles Darwin University Darwin, NT, Australia Abstract - This paper proposes a new method to detect,
Phishing in the Age of SaaS
Phishing in the Age of SaaS AN ESSENTIAL GUIDE FOR BUSINESSES AND USERS The Cloud Security Platform Q3 2017 intro Phishing attacks have become the primary hacking method used against organizations. In
Spam Protection Guide
Spam Email Protection Guide Version 1.0 Last Modified 5/29/2014 by Mike Copening Contents Overview of Spam at RTS... 1 Types of Spam... 1 Spam Tricks... 2 Imitation of 3 rd Party Email Template... 2 Spoofed
Sophos Central Admin. help
help Contents About Sophos Central...1 Activate Your License... 2 Overview...3 Dashboard... 3 Alerts...4 Logs & Reports... 15 People...31 Devices... 41 Global Settings... 57 Protect Devices... 90 Endpoint
Cyber Security Guide for NHSmail
Cyber Security Guide for NHSmail Version 3.0 February 2017 Copyright 2017Health and Social Care Information Centre. The Health and Social Care Information Centre is a non-departmental body created by statute,
GUIDE TO KEEPING YOUR SOCIAL MEDIA ACCOUNTS SECURE
GUIDE TO KEEPING YOUR SOCIAL MEDIA ACCOUNTS SECURE TABLE OF CONTENTS PROTECTIVE MEASURES... 2 PREPARATION CHECKLIST... 2 IF YOU SUSPECT YOUR ACCOUNT IS COMPROMISED, THE FOLLOWING ACTIONS ARE ADVISED:...
SPOOFING. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006
SPOOFING Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Learning Objectives Students should be able to: Determine relevance of
3.5 SECURITY. How can you reduce the risk of getting a virus?
3.5 SECURITY 3.5.4 MALWARE WHAT IS MALWARE? Malware, short for malicious software, is any software used to disrupt the computer s operation, gather sensitive information without your knowledge, or gain
How WebSafe Can Protect Customers from Web-Based Attacks. Mark DiMinico Sr. Mgr., Systems Engineering Security
How WebSafe Can Protect Customers from Web-Based Attacks Mark DiMinico Sr. Mgr., Systems Engineering Security Drivers for Fraud Prevention WebSafe Protection Drivers for Fraud Prevention WebSafe Protection
Discount Kaspersky PURE 3.0 internet download software for windows 8 ]
![Discount Kaspersky PURE 3.0 internet download software for windows 8 ]](/thumbs/71/65538451.jpg "Discount Kaspersky PURE 3.0 internet download software for windows 8 ]")
Discount Kaspersky PURE 3.0 internet download software for windows 8 ] Description: Extended benefits Award-winning protection against all types of Internet threats Online shopping, banking and social
THE BUSINESS CASE FOR OUTSIDE-IN DATA CENTER SECURITY
THE BUSINESS CASE FOR OUTSIDE-IN DATA CENTER SECURITY DATA CENTER WEB APPS NEED MORE THAN IP-BASED DEFENSES AND NEXT-GENERATION FIREWALLS table of contents.... 2.... 4.... 5 A TechTarget White Paper Does
Quick Heal Mobile Security. Free protection for your Android phone against virus attacks, unwanted calls, and theft.
Quick Heal Mobile Security Free protection for your Android phone against virus attacks, unwanted calls, and theft. Product Highlights Complete protection for your Android device that simplifies security
CS 161 Computer Security
Paxson Spring 2011 CS 161 Computer Security Discussion 6 March 2, 2011 Question 1 Cross-Site Scripting (XSS) (10 min) As part of your daily routine, you are browsing through the news and status updates
Safety and Security. April 2015
Safety and Security April 2015 Protecting your smartphone and your data 2 Set a passcode on your smartphone For some smartphone models: 1. Go to Settings. 2. Tap ID & Passcode. 3. Set a 4-digit passcode.
Jordan Levesque Making sure your business is PCI compliant
Jordan Levesque Making sure your business is PCI compliant Brief overview of PCIDSS What's new in PCI DSS 3.2 Why is PCI important? Dive in! Simple things you can do to be secure Tomorrows session: What
Who We Are! Natalie Timpone
Who We Are! Natalie Timpone Manager of Security Business Management Office Enterprise Security Awareness Manager Carmelo Walsh Security, Risk, and Compliance Security Awareness Subject Matter Expert Who
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS
KASPERSKY FRAUD PREVENTION FOR ENDPOINTS www.kaspersky.com KASPERSKY FRAUD PREVENTION 1. Ways of Attacking Online Banking The prime motive behind cybercrime is making money and today s sophisticated criminal
Protecting Against Online Banking Fraud with F5
Protecting Against Online Banking Fraud with F5 Fraud is a relentless threat to financial services organizations that offer online banking. The F5 Web Fraud Protection solution defends against malware,
Cyber security tips and self-assessment for business
Cyber security tips and self-assessment for business Last year one in five New Zealand SMEs experienced a cyber-attack, so it s essential to be prepared. Our friends at Deloitte have put together this
Phishing Activity Trends Report March, 2005
Phishing Activity Trends Report March, 2005 Phishing is a form of online identity theft that uses spoofed emails designed to lure recipients to fraudulent websites which attempt to trick them into divulging
Part 2: How to Detect Insider Threats
Part 2: How to Detect Insider Threats Amichai Shulman Chief Technology Officer Imperva Amichai Shulman CTO, Imperva Speaker at Industry Events RSA, Appsec, Info Security UK, Black Hat Lecturer on information
Jordan Levesque - Keeping your Business Secure
Jordan Levesque - Keeping your Business Secure Review of PCI Benefits of hosting with RCS File Integrity Monitoring Two Factor Log Aggregation Vulnerability Scanning Configuration Management and Continuous
ANATOMY OF AN ATTACK!
ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable
NHS South Commissioning Support Unit
NHS South Commissioning Support Unit ICT Anti-virus Policy This document can be made available in a range of languages and formats on request to the policy author. Version: Ratified by: V.2.1 Alliance
2 User Guide. Contents
E-mail User Guide 2 E-mail User Guide Contents Logging in to your web mail... 3 Changing your password... 5 Editing your signature... 6 Adding an e-mail account to Outlook 2010/2013/2016... 7 Adding an
with Advanced Protection
with Advanced Email Protection OVERVIEW Today s sophisticated threats are changing. They re multiplying. They re morphing into new variants. And they re targeting people, not just technology. As organizations
MRG Effitas Android AV review
MRG Effitas Android AV review 1 Contents Introduction... 3 Tests Applied... 3 Test samples... 4 Security Applications Tested... 5 Test Results... 5 Conclusions... 10 2 Introduction MRG Effitas is an independent
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting
Joe Stocker, CISSP, MCITP, VTSP Patriot Consulting Microsoft Cloud Evangelist at Patriot Consulting Principal Systems Architect with 17 Years of experience Technical certifications: MCSE, MCITP Office
Quick Heal Total Security for Android. Anti-Theft Security. Web Security. Backup. Real-Time Protection. Safe Online Banking & Shopping.
Quick Heal Total Security for Android Anti-Theft Security. Web Security. Backup. Real-Time Protection. Safe Online Banking & Shopping. Product Highlights Complete protection for your Android device that