Ethical Hacking & Information Security. Justin David G. Pineda Asia Pacific College

Size: px
Start display at page:

Download "Ethical Hacking & Information Security. Justin David G. Pineda Asia Pacific College"

Transcription

1 Ethical Hacking & Information Security Justin David G. Pineda Asia Pacific College

2 Topics for today: Is there such thing as ethical hacking? What is information security? What are issues that need to be addressed? Information security as a discipline Do we need a cybercrime law?

3 About: Justin David Pineda Lecturer at Asia Pacific College Currently, Sr. Application Security Specialist at The Coca-Cola Company In the past: Security Analyst, SilverSky BS Computer Science, DLSU Certifications earned: Certified Ethical Hacker (CEH) CompTIA Security+ ISO Foundation Cisco Certified Network Associate IBM DB2 Academic Associate Microsoft Technology Associate (MTA) Security

4 Is there such thing as ethical hacking?

5 Is there such thing as ethical hacking? A hacker exploits weaknesses in a computer system. Hacking or cracking which refers to unauthorized access into or interference in a computer system (RA 8792, E-Commerce Law) Someone with an advanced understanding of computers and computer networks (A Guide to the World of Computer Wizards) Ex. Hacking with a Pringles tube (from BBC News)

6 What separates good from bad hackers? They both exploit weaknesses in a computer system or network. The difference is permission and scope. White hat good guys Black hat bad guys Gray hat good in the morning; bad in the evening With this definition, what s the classification of Anonymous?

7 Hacking trend

8 Steps in Hacking Reconnaissance Scanning Gaining Access Maintaining Access Covering Tracks

9 Reconnaissance Observation Research about your target Start from online tools Netcraft Archive Web Data Extractor Job opportunities

10 Scanning Look for open opportunities nmap, hping

11 Firewalking

12 Gaining & Maintaining Access Password Guessing Privilege Escalation Executing Malicious Codes Copying files

13 Covering Tracks Delete or modify audit trails

14 What is information security?

15 What is information security? Protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats. (U.S. National Information Systems Security)

16 The CIA triad

17 The CIA Triad explained Confidentiality Protection against unauthorized access. Integrity Protection against unauthorized modification. Availability Protection against Denial of Service (DoS)

18 Examples:

19 Remember the 3-way handshake!

20 Information Security vs. IT Security Information Security has many domains. Access control, telecommunications and network security, Information security governance and risk management, Software development security, Cryptography, Security architecture and design, Operations security, Business continuity and disaster recovery planning, Legal, regulations, investigations and compliance, Physical (environmental) security from CISSP s domains on ISC2 IT Security only focuses on software and hardware technologies.

21 Defense in Depth

22 Definition of Protection Past & Present PROTECTION = PREVENTION Example: Gate, Network Firewall Problem: What if the thief climbs over the gate? Problem 2: What if there is a DoS attempt in a web server on port 80.

23 Definition of Protection Past & Present PROTECTION = PREVENTION + (DETECTION + INCIDENT RESPONSE) Example: Motion detector tools, anti-virus for host device, Intrusion Detection System (IDS) for network.

24 Reality Check You cannot eliminate all risks. You do not have a lot of money to buy all controls to mitigate the risks. You need to prioritize.

25 Least Privilege A user/program must be able to access only the information and resources that are necessary for its legitimate purpose. It is the essence of all domains in information security

26 Separation of Duties (SOD) The concept of having more than one person required to complete a task. Keys to the kingdom Example: How payroll is computed, approved, delivered etc.

27 Policies HR Policies Clean desk policy Acceptable Use Policy Internet policy Data security policy Password Policy

28 Physical Security Natural barriers Authentication (something to you know, something that you have, something that you are) Gates and dogs Guards

29 Network Security Firewalls Intrusion Detection Systems (IDS) Unified Threat Management (UTM) Data Loss Prevention (DLP)

30 Host Security Port Security Anti-virus User access (standard, admin, super admin)

31 Application Security Encryption Patches, hotfixes

32 What issues need to be addressed?

33 Focus on 2 critical issues Social Engineering Web Application Attacks

34 Social Engineering Social engineering is the hacker/attacker's clever manipulation of the natural human tendency to trust to obtain information that will allow him to gain unauthorized access to a valued system. (Social Engineering Fundamentals) 90% of successful hacking activities are done using social engineering.

35 Steps in Social Engineering Information Gathering Developing Relationships Stalk in social networking sites Mail-outs Forensic analysis Facebook apps Cognitive biases (returning the favor, share interests) Exploitation People become less reasonable when in state of shock or strong affect.

36 Types of Social Engineering Attacks Physical Shoulder surfing Dumpster diving (ex. Argo) Tailgating War driving, chalking, walking etc. Online Phishing Pharming Spear phishing Vishing

37 Countermeasures Create, implement and harden security policies Comply with physical security standards This should be done periodically. Resistance Training for specified employees Social Engineering Land Mines (SANS, David Gragg) Are doors locked? Do security guards check all students for ID? Security Awareness Training for employees People easily forget policies. It needs enforcement. Call-back policy, key questions, bogus questions Incident Response

38 Web Application Attacks A lot of people are using the Internet and doing transactions there. A lot of websites are not checked whether it is safe for users to use. It s possible that applications follow proper coding standards but versions/functions are vulnerable.

39 Usual attacks: SQL Injection Cross Site Scripting (XSS) Session Hijacking Directory Traversal Cross Site Request Forgery (CSRF) Web Goat demonstration Download it here t_project

40 Web Application Security Advice Include security in all SDLC steps. Refer to the Open Web Application Security Project (OWASP) when writing web applications. Use both source code analyzer and vulnerability scanner to check the status of your application.

41 Information Security as a Discipline

42 Information Security as a Discipline InfoSec is a relatively new field. It is starting to grow because a lot of businesses are transitioning to online. Virtual money is same as physical money. There are still few professionals who are in this field. Supply is low, demand is high. CS and IT major courses are good infosec foundations. You can opt to choose infosec in thesis.

43 Security Certifications CompTIA Security+ EC-Council Certified Ethical Hacker, Certified Security Analyst, Certified Hacking & Forensics Investigator etc. SANS GIAC Certified Reverse Engineering Malware, Incident Handler, Intrusion Analyst etc. ISACA Certified Information Systems Auditor etc. ISC2 Certified Information Systems Security Professional (CISSP), etc.

44 Do we need a cybercrime law?

45 Do we need a cybercrime law? Of course, we need one. R.A or Cybercrime Prevention Act is a mixture of several issues. Cybercrime Law should not only focus on the limitation of Freedom of Expression. Cybercrime Law should protect the people.

46 What kind of cybercrime law do we need? A law that compels for-profit organizations like banks to follow certain best standards to protect client data found in bank accounts. A law that compels telecom companies to ensure that data that pass their infrastructure are sent and received to the intended recipients. A law that compels government offices to securely store personal data that are found in their computer system.

47 Thank you very much. Q&A Justin David Pineda Asia Pacific College

CIT 480: Securing Computer Systems. Putting It All Together

CIT 480: Securing Computer Systems. Putting It All Together CIT 480: Securing Computer Systems Putting It All Together Assurance 1. Asset identification 1. Systems and information assets. 2. Infrastructure model and control 1. Network diagrams and inventory database.

More information

Ingram Micro Cyber Security Portfolio

Ingram Micro Cyber Security Portfolio Ingram Micro Cyber Security Portfolio Ingram Micro Inc. 1 Ingram Micro Cyber Security Portfolio Services Trainings Vendors Technical Assessment General Training Consultancy Service Certification Training

More information

Hacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK

Hacker Academy Ltd COURSES CATALOGUE. Hacker Academy Ltd. LONDON UK Hacker Academy Ltd COURSES CATALOGUE Hacker Academy Ltd. LONDON UK TABLE OF CONTENTS Basic Level Courses... 3 1. Information Security Awareness for End Users... 3 2. Information Security Awareness for

More information

CISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker. Upcoming Dates. Course Description. Course Outline

CISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker. Upcoming Dates. Course Description. Course Outline CISSP CEH PKI SECURITY + CEHv9: Certified Ethical Hacker Learn to find security vulnerabilities before the bad guys do! The Certified Ethical Hacker (CEH) class immerses students in an interactive environment

More information

E-guide Getting your CISSP Certification

E-guide Getting your CISSP Certification Getting your CISSP Certification Intro to the 10 CISSP domains of the Common Body of Knowledge : The Security Professional (CISSP) is an information security certification that was developed by the International

More information

ANATOMY OF AN ATTACK!

ANATOMY OF AN ATTACK! ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable

More information

Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data

Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V3.0, MAY 2017 Multiple Layers of Protection Overview Password Salted-Hash Thank you

More information

Introduction to Penetration Testing: Part One. Eugene Davis UAH Information Security Club February 21, 2013

Introduction to Penetration Testing: Part One. Eugene Davis UAH Information Security Club February 21, 2013 Introduction to Penetration Testing: Part One Eugene Davis UAH Information Security Club February 21, 2013 Ethical Considerations: Pen Testing Ethics of penetration testing center on integrity (ISC)² Code

More information

ETHICAL HACKING & COMPUTER FORENSIC SECURITY

ETHICAL HACKING & COMPUTER FORENSIC SECURITY ETHICAL HACKING & COMPUTER FORENSIC SECURITY Course Description From forensic computing to network security, the course covers a wide range of subjects. You will learn about web hacking, password cracking,

More information

Certified Ethical Hacker (CEH)

Certified Ethical Hacker (CEH) Certified Ethical Hacker (CEH) COURSE OVERVIEW: The most effective cybersecurity professionals are able to predict attacks before they happen. Training in Ethical Hacking provides professionals with the

More information

Computer Information Systems (CIS) CIS 105 Current Operating Systems/Security CIS 101 Introduction to Computers

Computer Information Systems (CIS) CIS 105 Current Operating Systems/Security CIS 101 Introduction to Computers Computer Information Systems (CIS) CIS 101 Introduction to Computers This course provides an overview of the computing field and its typical applications. Key terminology and components of computer hardware,

More information

Certified Ethical Hacker

Certified Ethical Hacker Certified Ethical Hacker Certified Ethical Hacker Course Objective Describe how perimeter defenses function by ethically scanning and attacking networks Conduct information systems security audits by understanding

More information

Software Development & Education Center Security+ Certification

Software Development & Education Center Security+ Certification Software Development & Education Center Security+ Certification CompTIA Security+ Certification CompTIA Security+ certification designates knowledgeable professionals in the field of security, one of the

More information

CSWAE Certified Secure Web Application Engineer

CSWAE Certified Secure Web Application Engineer CSWAE Certified Secure Web Application Engineer Overview Organizations and governments fall victim to internet based attacks every day. In many cases, web attacks could be thwarted but hackers, organized

More information

Course 831 Certified Ethical Hacker v9

Course 831 Certified Ethical Hacker v9 Course 831 Certified Ethical Hacker v9 Duration: 5 days What You Get: CEH v9 Certification exam voucher 5 days of high quality classroom training 18 comprehensive modules 40% of class hours dedicated to

More information

Certified Cyber Security Analyst VS-1160

Certified Cyber Security Analyst VS-1160 VS-1160 Certified Cyber Security Analyst Certification Code VS-1160 Vskills certification for Cyber Security Analyst assesses the candidate as per the company s need for cyber security and forensics. The

More information

CompTIA Cybersecurity Analyst+

CompTIA Cybersecurity Analyst+ CompTIA Cybersecurity Analyst+ Course CT-04 Five days Instructor-Led, Hands-on Introduction This five-day, instructor-led course is intended for those wishing to qualify with CompTIA CSA+ Cybersecurity

More information

Advanced Ethical Hacking & Penetration Testing. Ethical Hacking

Advanced Ethical Hacking & Penetration Testing. Ethical Hacking Summer Training Internship Program 2017 (STIP - 2017) is a practical oriented & industrial level training program for all students who have aspiration to work in the core technical industry domain. This

More information

How Breaches Really Happen

How Breaches Really Happen How Breaches Really Happen www.10dsecurity.com About Dedicated Information Security Firm Clients Nationwide, primarily in financial industry Services Penetration Testing Social Engineering Vulnerability

More information

Securing Your Web Application against security vulnerabilities. Alvin Wong, Brand Manager IBM Rational Software

Securing Your Web Application against security vulnerabilities. Alvin Wong, Brand Manager IBM Rational Software Securing Your Web Application against security vulnerabilities Alvin Wong, Brand Manager IBM Rational Software Agenda Security Landscape Vulnerability Analysis Automated Vulnerability Analysis IBM Rational

More information

90% of data breaches are caused by software vulnerabilities.

90% of data breaches are caused by software vulnerabilities. 90% of data breaches are caused by software vulnerabilities. Get the skills you need to build secure software applications Secure Software Development (SSD) www.ce.ucf.edu/ssd Offered in partnership with

More information

Data Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle

Data Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle Data Security and Privacy : Compliance to Stewardship Jignesh Patel Solution Consultant,Oracle Agenda Connected Government Security Threats and Risks Defense In Depth Approach Summary Connected Government

More information

CEH: CERTIFIED ETHICAL HACKER v9

CEH: CERTIFIED ETHICAL HACKER v9 CEH: CERTIFIED ETHICAL HACKER v9 SUMMARY The Certified Ethical Hacker (CEH) program is the core of the most desired information security training system any information security professional will ever

More information

Ethical Hacking and Prevention

Ethical Hacking and Prevention Ethical Hacking and Prevention This course is mapped to the popular Ethical Hacking and Prevention Certification Exam from US-Council. This course is meant for those professionals who are looking for comprehensive

More information

How NOT To Get Hacked

How NOT To Get Hacked How NOT To Get Hacked The right things to do so the bad guys can t do the wrong ones Mark Burnette Partner, LBMC -Risk Services October 25, 2016 Today s Agenda Protecting Against A Hack How should I start?

More information

Course 831 EC-Council Certified Ethical Hacker v10 (CEH)

Course 831 EC-Council Certified Ethical Hacker v10 (CEH) Course 831 EC-Council Certified Ethical Hacker v10 (CEH) Duration: 5 days What You Get: CEH v10 Certification exam voucher 5 days of high quality classroom training 18 comprehensive modules 40% of class

More information

IT Technician Pathways Course Guide

IT Technician Pathways Course Guide IT Technician Pathways Course Guide Stage Computer Retail Sales and Support Course Name or Topic Introduction to Retail or Business Fundamentals Related 3 rd Party Certifications C-ID IT-MC C-ID BUS 100

More information

CompTIA CSA+ Cybersecurity Analyst

CompTIA CSA+ Cybersecurity Analyst CompTIA CSA+ Cybersecurity Analyst Duration: 5 Days Course Code: Target Audience: The CompTIA Cybersecurity Analyst (CSA+) examination is designed for IT security analysts, vulnerability analysts, or threat

More information

Cyber Security. February 13, 2018 (webinar) February 15, 2018 (in-person)

Cyber Security. February 13, 2018 (webinar) February 15, 2018 (in-person) Cyber Security Presenters: - Brian Everest, Chief Technology Officer, Starport Managed Services - Susan Pawelek, Accountant, Compliance and Registrant Regulation February 13, 2018 (webinar) February 15,

More information

Certified Secure Web Application Engineer

Certified Secure Web Application Engineer Certified Secure Web Application Engineer ACCREDITATIONS EXAM INFORMATION The Certified Secure Web Application Engineer exam is taken online through Mile2 s Assessment and Certification System ( MACS ),

More information

Designing and Building a Cybersecurity Program

Designing and Building a Cybersecurity Program Designing and Building a Cybersecurity Program Based on the NIST Cybersecurity Framework (CSF) Larry Wilson lwilson@umassp.edu ISACA Breakfast Meeting January, 2016 Designing & Building a Cybersecurity

More information

University of Pittsburgh Security Assessment Questionnaire (v1.7)

University of Pittsburgh Security Assessment Questionnaire (v1.7) Technology Help Desk 412 624-HELP [4357] technology.pitt.edu University of Pittsburgh Security Assessment Questionnaire (v1.7) Directions and Instructions for completing this assessment The answers provided

More information

Define information security Define security as process, not point product.

Define information security Define security as process, not point product. CSA 223 Network and Web Security Chapter One What is information security. Look at: Define information security Define security as process, not point product. Define information security Information is

More information

4 Information Security

4 Information Security 4 Information Security 1. Identify the five factors that contribute to the increasing vulnerability of information resources, and provide a specific example of each one. 2. Compare and contrast human mistakes

More information

E-guide CISSP Prep: 4 Steps to Achieve Your Certification

E-guide CISSP Prep: 4 Steps to Achieve Your Certification CISSP Prep: 4 Steps to Achieve Your Certification Practice for the exam and keep your skills sharp : Thank you for downloading our CISSP certification guide. Aside from this handy PDF, you can also access

More information

ITU CBS. Digital Security Capacity Building: Role of the University GLOBAL ICT CAPACITY BUILDING SYMPOSIUM SANTO DOMINGO 2018

ITU CBS. Digital Security Capacity Building: Role of the University GLOBAL ICT CAPACITY BUILDING SYMPOSIUM SANTO DOMINGO 2018 GLOBAL ICT CAPACITY BUILDING SYMPOSIUM ITU CBS SANTO DOMINGO 2018 Digital Capacity Building: Role of the University 18 20 June 2018 Santo Domingo, Dominican Republic Dr. Nizar Ben Neji Faculty of Sciences

More information

Computer Information Systems (CIS) CIS 105 Current Operating Systems/Security CIS 101 Introduction to Computers

Computer Information Systems (CIS) CIS 105 Current Operating Systems/Security CIS 101 Introduction to Computers Computer Information Systems (CIS) CIS 101 Introduction to Computers This course provides an overview of the computing field and its typical applications. Key terminology and components of computer hardware,

More information

CyberVista Certify cybervista.net

CyberVista Certify cybervista.net ONLINE CYBERSECURITY CERTIFICATION TRAINING CyberVista Certify ONLINE CYBERSECURITY CERTIFICATION TRAINING CyberVista Certify CyberVista offers the industry s most comprehensive cybersecurity training

More information

Security Issues and Best Practices for Water Facilities

Security Issues and Best Practices for Water Facilities Security Issues and Best Practices for Water Facilities Standards Certification Jeff Hayes Business Development Manager Beijer Electronics Education & Training Publishing Conferences & Exhibits 2013 ISA

More information

"Charting the Course... Certified Information Systems Auditor (CISA) Course Summary

Charting the Course... Certified Information Systems Auditor (CISA) Course Summary Course Summary Description In this course, you will perform evaluations of organizational policies, procedures, and processes to ensure that an organization's information systems align with overall business

More information

Curso: Ethical Hacking and Countermeasures

Curso: Ethical Hacking and Countermeasures Curso: Ethical Hacking and Countermeasures Module 1: Introduction to Ethical Hacking Who is a Hacker? Essential Terminologies Effects of Hacking Effects of Hacking on Business Elements of Information Security

More information

CPTE: Certified Penetration Testing Engineer

CPTE: Certified Penetration Testing Engineer www.peaklearningllc.com CPTE: Certified Penetration Testing Engineer (5 Days) *Includes exam voucher, course video, an exam preparation guide About this course Certified Penetration Testing Engineer certification

More information

Security. Protect your business from security threats with Pearl Technology. The Connection That Matters Most

Security. Protect your business from security threats with Pearl Technology. The Connection That Matters Most Security Protect your business from security threats with Pearl Technology The Connection That Matters Most Committed to Your Future When it comes to your business, security can mean many things. But to

More information

Building the Cybersecurity Workforce. November 2017

Building the Cybersecurity Workforce. November 2017 Building the Cybersecurity Workforce November 2017 Our Global Footprint Measuring Kaplan University s Educational Impact For every career path +1MM students annually served Facilities in 30+ countries

More information

CS 356 Operating System Security. Fall 2013

CS 356 Operating System Security. Fall 2013 CS 356 Operating System Security Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5 Database

More information

ISC2 EXAM - CISSP. Certified Information Systems Security Professional. Buy Full Product.

ISC2 EXAM - CISSP. Certified Information Systems Security Professional. Buy Full Product. ISC2 EXAM - CISSP Certified Information Systems Security Professional Buy Full Product http://www.examskey.com/cissp.html Examskey ISC2 CISSP exam demo product is here for you to test the quality of the

More information

AURA ACADEMY Training With Expertised Faculty Call Us On For Free Demo

AURA ACADEMY Training With Expertised Faculty Call Us On For Free Demo ETHICAL HACKING (CEH) CURRICULUM Introduction to Ethical Hacking What is Hacking? Who is a Hacker? Skills of a Hacker? Types of Hackers? What are the Ethics and Legality?? Who are at the risk of Hacking

More information

SECURITY & PRIVACY DOCUMENTATION

SECURITY & PRIVACY DOCUMENTATION Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive

More information

CompTIA Security+ Malware. Threats and Vulnerabilities Vulnerability Management

CompTIA Security+ Malware. Threats and Vulnerabilities Vulnerability Management CompTIA Security+ Lecture Six Threats and Vulnerabilities Vulnerability Management Copyright 2011 - VTC Malware Malicious code refers to software threats to network and systems, including viruses, Trojan

More information

PASS4TEST. IT Certification Guaranteed, The Easy Way! We offer free update service for one year

PASS4TEST. IT Certification Guaranteed, The Easy Way!  We offer free update service for one year PASS4TEST \ http://www.pass4test.com We offer free update service for one year Exam : SY0-301 Title : CompTIA Security+ Certification Exam (SY0-301) Vendor : CompTIA Version : DEMO 1 / 5 Get Latest & Valid

More information

Mobile MOUSe HACKING REVEALED ONLINE COURSE OUTLINE

Mobile MOUSe HACKING REVEALED ONLINE COURSE OUTLINE Mobile MOUSe HACKING REVEALED ONLINE COURSE OUTLINE COURSE TITLE HACKING REVEALED COURSE DURATION 20 Hour(s) of Self-Paced Interactive Training COURSE OVERVIEW The Hacking Revealed course teaches individuals

More information

The GenCyber Program. By Chris Ralph

The GenCyber Program. By Chris Ralph The GenCyber Program By Chris Ralph The Mission of GenCyber Provide a cybersecurity camp experience for students and teachers at the K-12 level. The primary goal of the program is to increase interest

More information

EC-Council C EH. Certified Ethical Hacker. Program Brochure

EC-Council C EH. Certified Ethical Hacker. Program Brochure EC-Council TM H Program Brochure Course Description The (CEH) program is the core of the most desired information security training system any information security professional will ever want to be in.

More information

This ethical hacking course puts you in the driver's seat of a hands-on environment with a systematic process.

This ethical hacking course puts you in the driver's seat of a hands-on environment with a systematic process. EC Council Certified Ethical Hacker V9 This ethical hacking course puts you in the driver's seat of a hands-on environment with a systematic process. Here, you will be exposed to an entirely different

More information

CHAPTER 3. Information Systems: Ethics, Privacy, and Security

CHAPTER 3. Information Systems: Ethics, Privacy, and Security CHAPTER 3 Information Systems: Ethics, Privacy, and Security CHAPTER OUTLINE 3.1 Ethical Issues 3.2 Threats to Information Security 3.3 Protecting Information Resources LEARNING OBJECTIVES n Describe the

More information

FOUNDATION CERTIFICATE IN INFORMATION SECURITY v2.0 INTRODUCING THE TOP 5 DISCIPLINES IN INFORMATION SECURITY SUMMARY

FOUNDATION CERTIFICATE IN INFORMATION SECURITY v2.0 INTRODUCING THE TOP 5 DISCIPLINES IN INFORMATION SECURITY SUMMARY FOUNDATION CERTIFICATE IN INFORMATION SECURITY v2.0 INTRODUCING THE TOP 5 DISCIPLINES IN INFORMATION SECURITY SUMMARY The Foundation Certificate in Information Security (FCIS) course is designed to provide

More information

Global Security Consulting Services, compliancy and risk asessment services

Global Security Consulting Services, compliancy and risk asessment services Global Security Consulting Services, compliancy and risk asessment services Introduced by Nadine Dereza Presented by Suheil Shahryar Director of Global Security Consulting Today s Business Environment

More information

Fundamentals of Information Systems Security Lesson 5 Auditing, Testing, and Monitoring

Fundamentals of Information Systems Security Lesson 5 Auditing, Testing, and Monitoring Fundamentals of Information Systems Security Lesson 5 Auditing, Testing, and Monitoring Learning Objective Explain the importance of security audits, testing, and monitoring to effective security policy.

More information

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 5 Host, Application, and Data Security

Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 5 Host, Application, and Data Security Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 5 Host, Application, and Data Security Objectives List the steps for securing a host computer Define application security Explain

More information

Security+ SY0-501 Study Guide Table of Contents

Security+ SY0-501 Study Guide Table of Contents Security+ SY0-501 Study Guide Table of Contents Course Introduction Table of Contents About This Course About CompTIA Certifications Module 1 / Threats, Attacks, and Vulnerabilities Module 1 / Unit 1 Indicators

More information

Course overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107)

Course overview. CompTIA Security+ Certification (Exam SY0-501) Study Guide (G635eng v107) Overview This course is intended for those wishing to qualify with CompTIA Security+. CompTIA's Security+ Certification is a foundation-level certificate designed for IT administrators with 2 years' experience

More information

Principles of ICT Systems and Data Security

Principles of ICT Systems and Data Security Principles of ICT Systems and Data Security Ethical Hacking Ethical Hacking What is ethical hacking? Ethical Hacking It is a process where a computer security expert, who specialises in penetration testing

More information

ISC2. Exam Questions CISSP. Certified Information Systems Security Professional (CISSP) Version:Demo

ISC2. Exam Questions CISSP. Certified Information Systems Security Professional (CISSP) Version:Demo ISC2 Exam Questions CISSP Certified Information Systems Security Professional (CISSP) Version:Demo 1. How can a forensic specialist exclude from examination a large percentage of operating system files

More information

CompTIA Security+ (Exam SY0-401)

CompTIA Security+ (Exam SY0-401) CompTIA Security+ (Exam SY0-401) Course Overview This course will prepare students to pass the current CompTIA Security+ SY0-401 certification exam. After taking this course, students will understand the

More information

EC-Council - EC-Council Certified Security Analyst (ECSA) v8

EC-Council - EC-Council Certified Security Analyst (ECSA) v8 EC-Council - EC-Council Certified Security Analyst (ECSA) v8 Code: 3402 Lengt h: URL: 5 days View Online The EC-Council Certified Security Analyst (ECSA) program teaches information security professionals

More information

A (sample) computerized system for publishing the daily currency exchange rates

A (sample) computerized system for publishing the daily currency exchange rates A (sample) computerized system for publishing the daily currency exchange rates The Treasury Department has constructed a computerized system that publishes the daily exchange rates of the local currency

More information

Controlled Document Page 1 of 6. Effective Date: 6/19/13. Approved by: CAB/F. Approved on: 6/19/13. Version Supersedes:

Controlled Document Page 1 of 6. Effective Date: 6/19/13. Approved by: CAB/F. Approved on: 6/19/13. Version Supersedes: Page 1 of 6 I. Common Principles and Approaches to Privacy A. A Modern History of Privacy a. Descriptions, definitions and classes b. Historical and social origins B. Types of Information a. Personal information

More information

Advanced Diploma on Information Security

Advanced Diploma on Information Security Course Name: Course Duration: Prerequisites: Course Fee: Advanced Diploma on Information Security 300 Hours; 12 Months (10 Months Training + 2 Months Project Work) Candidate should be HSC Pass & Basic

More information

About The Presentation 11/3/2017. Hacker HiJinx-Human Ways to Steal Data. Who We Are? Ethical Hackers & Security Consultants

About The Presentation 11/3/2017. Hacker HiJinx-Human Ways to Steal Data. Who We Are? Ethical Hackers & Security Consultants November 3, 2017 Hacker HiJinx-Human Ways to Steal Data Who We Are? Ethical Hackers & Security Consultants Respond To Incidents & Breaches Perform Digital Forensic Investigations Data Mine Internet Intelligence

More information

WORKSHARE SECURITY OVERVIEW

WORKSHARE SECURITY OVERVIEW WORKSHARE SECURITY OVERVIEW April 2016 COMPANY INFORMATION Workshare Security Overview Workshare Ltd. (UK) 20 Fashion Street London E1 6PX UK Workshare Website: www.workshare.com Workshare Inc. (USA) 625

More information

Security Policies and Procedures Principles and Practices

Security Policies and Procedures Principles and Practices Security Policies and Procedures Principles and Practices by Sari Stern Greene Chapter 3: Information Security Framework Objectives Plan the protection of the confidentiality, integrity and availability

More information

Testpassport http://www.testpassport.net Exam : SY0-301 Title : Security+ Certification Exam 2011 version Version : Demo 1 / 5 1.Which of the following is the BEST approach to perform risk mitigation of

More information

HOLY ANGEL UNIVERSITY COLLEGE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY CYBER SECURITY COURSE SYLLABUS

HOLY ANGEL UNIVERSITY COLLEGE OF INFORMATION AND COMMUNICATIONS TECHNOLOGY CYBER SECURITY COURSE SYLLABUS HOLY ANGEL UNIVERSITY LLEGE OF INFORMATION AND MMUNICATIONS TECHNOLOGY CYBER SECURITY URSE SYLLABUS Course Code : 6CSEC Prerequisite : 6MPRO2L Course Credit : 3 Units (2 hours LEC,3 hours LAB) Year Level:

More information

DIS10.1 Ethical Hacking and Countermeasures

DIS10.1 Ethical Hacking and Countermeasures DIS10.1 Ethical Hacking and Countermeasures ABOUT DIS Why choose Us. Data and internet security council is the worlds top most information security certification body. Our uniquely designed course for

More information

ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE

ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE INTRODUCTION In line with commercial industry standards, the data center used by EndNote employs a dedicated security team to protect our

More information

Access Controls. CISSP Guide to Security Essentials Chapter 2

Access Controls. CISSP Guide to Security Essentials Chapter 2 Access Controls CISSP Guide to Security Essentials Chapter 2 Objectives Identification and Authentication Centralized Access Control Decentralized Access Control Access Control Attacks Testing Access Controls

More information

STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences

STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences STUDENT LEARNING OUTCOMES Beacom College of Computer and Cyber Sciences Undergraduate Programs - Bachelor B.S. Computer Game Design Upon completion of the B.S. degree in Computer Game Design, students

More information

Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment

Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment Ray Colado, Information Security Analyst Raise awareness around information security to help

More information

Cyber Security Audit & Roadmap Business Process and

Cyber Security Audit & Roadmap Business Process and Cyber Security Audit & Roadmap Business Process and Organizations planning for a security assessment have to juggle many competing priorities. They are struggling to become compliant, and stay compliant,

More information

EC-Council C EH. Certified Ethical Hacker. Program Brochure

EC-Council C EH. Certified Ethical Hacker. Program Brochure EC-Council TM C EH Program Brochure Target Audience This course will significantly benefit security officers, auditors, security professionals, site administrators, and anyone who is concerned about the

More information

A Model for Penetration Testing

A Model for Penetration Testing A Model for Penetration Testing Chuck Easttom Collin College Professional Development chuck@chuckeasttom.com Research Gate Publication Abstract Penetration testing is an increasingly integral part of cyber

More information

CHCSS. Certified Hands-on Cyber Security Specialist (510)

CHCSS. Certified Hands-on Cyber Security Specialist (510) CHCSS Certified Hands-on Cyber Security Specialist () SYLLABUS 2018 Certified Hands-on Cyber Security Specialist () 2 Course Description Entry level cyber security course intended for an audience looking

More information

n Learn about the Security+ exam n Learn basic terminology and the basic approaches n Implement security configuration parameters on network

n Learn about the Security+ exam n Learn basic terminology and the basic approaches n Implement security configuration parameters on network Always Remember Chapter #1: Network Device Configuration There is no 100 percent secure system, and there is nothing that is foolproof! 2 Outline Learn about the Security+ exam Learn basic terminology

More information

Advanced Security Tester Course Outline

Advanced Security Tester Course Outline Advanced Security Tester Course Outline General Description This course provides test engineers with advanced skills in security test analysis, design, and execution. In a hands-on, interactive fashion,

More information

Strategic Infrastructure Security

Strategic Infrastructure Security Strategic Infrastructure Security Course Number: SCPSIS Length: Certification Exam There are no exams currently associated with this course. Course Overview This course picks up right where Tactical Perimeter

More information

Cyber Criminal Methods & Prevention Techniques. By

Cyber Criminal Methods & Prevention Techniques. By Cyber Criminal Methods & Prevention Techniques By Larry.Boettger@Berbee.com Meeting Agenda Trends Attacker Motives and Methods Areas of Concern Typical Assessment Findings ISO-17799 & NIST Typical Remediation

More information

The CEH exam (312-50) is available at the ECC Exam Centre and Pearson Vue testing centers.

The CEH exam (312-50) is available at the ECC Exam Centre and Pearson Vue testing centers. What is an Ethical Hacker? To beat a hacker, you need to think like one! Ethical Hacking is often referred to as the process of penetrating one s own computer/s or computers to which one has official permission

More information

CCISO Blueprint v1. EC-Council

CCISO Blueprint v1. EC-Council CCISO Blueprint v1 EC-Council Categories Topics Covered Weightage 1. Governance (Policy, Legal, & Compliance) & Risk Management 1.1 Define, implement, manage and maintain an information security governance

More information

CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001)

CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) CASP CompTIA Advanced Security Practitioner Study Guide: (Exam CAS-001) Gregg, Michael ISBN-13: 9781118083192 Table of Contents Foreword xxi Introduction xxvii Assessment Test xliv Chapter 1 Cryptographic

More information

Certified Ethical Hacker - CEH v9 Training & Certification

Certified Ethical Hacker - CEH v9 Training & Certification Certified Ethical Hacker - CEH v9 Training & Certification SecureNinja's CEH v9 (Certified Ethical Hacker) training and certification boot camp in Alexandria, VA, Dulles, VA and San Diego, CA will immerse

More information

EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led

EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led EC-Council Certified Network Defender (CND) Duration: 5 Days Method: Instructor-Led Certification: Certified Network Defender Exam: 312-38 Course Description This course is a vendor-neutral, hands-on,

More information

Security Awareness. Chapter 2 Personal Security

Security Awareness. Chapter 2 Personal Security Security Awareness Chapter 2 Personal Security Objectives After completing this chapter, you should be able to do the following: Define what makes a weak password Describe the attacks against passwords

More information

Cyber security tips and self-assessment for business

Cyber security tips and self-assessment for business Cyber security tips and self-assessment for business Last year one in five New Zealand SMEs experienced a cyber-attack, so it s essential to be prepared. Our friends at Deloitte have put together this

More information

6 MILLION AVERAGE PAY. CYBER Security. How many cyber security professionals will be added in 2019? for popular indursty positions are

6 MILLION AVERAGE PAY. CYBER Security. How many cyber security professionals will be added in 2019? for popular indursty positions are PROGRAM Objective Cyber Security is the most sought after domain, and NASSCOM projects a requirment of over 1 million trained professionals by 2025. Tevel training program is an industry & employability

More information

Instructor: Eric Rettke Phone: (every few days)

Instructor: Eric Rettke Phone: (every few days) Instructor: Eric Rettke Phone: 818 364-7775 email: rettkeeg@lamission.edu (every few days) Fall 2016 Computer Science 411 - Principles of Cyber Security 1 Please keep a copy of the syllabus handy for the

More information

New Jersey Association of School Business Officials Information Security K-12. June 5, 2014

New Jersey Association of School Business Officials Information Security K-12. June 5, 2014 New Jersey Association of School Business Officials Information Security K-12 June 5, 2014 Agenda Introduction K 12 Technology Trends Case Study (A Cautionary Tale) What Constitutes a Data Breach Data

More information

Threat Modeling. Bart De Win Secure Application Development Course, Credits to

Threat Modeling. Bart De Win Secure Application Development Course, Credits to Threat Modeling Bart De Win bart.dewin@ascure.com Secure Application Development Course, 2009 Credits to Frank Piessens (KUL) for the slides 2 1 Overview Introduction Key Concepts Threats, Vulnerabilities,

More information

Students should have an understanding and a working knowledge in the following topics, or attend these courses as a pre-requisite:

Students should have an understanding and a working knowledge in the following topics, or attend these courses as a pre-requisite: Secure Java Web Application Development Lifecycle - SDL (TT8325-J) Day(s): 5 Course Code: GK1107 Overview Secure Java Web Application Development Lifecycle (SDL) is a lab-intensive, hands-on Java / JEE

More information

Technology Risk Management in Banking Industry. Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited

Technology Risk Management in Banking Industry. Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited Technology Risk Management in Banking Industry Rocky Cheng General Manager, Information Technology, Bank of China (Hong Kong) Limited Change in Threat Landscape 2 Problem & Threats faced by Banking Industry

More information

CYBER SECURITY AND MITIGATING RISKS

CYBER SECURITY AND MITIGATING RISKS CYBER SECURITY AND MITIGATING RISKS 01 WHO Tom Stewart Associate Director Technology Consulting Chicago Technical Security Leader Protiviti Slides PRESENTATION AGENDA 3 START HACKING DEFINITION BRIEF HISTORY

More information