Social Computing Systems
|
|
|
- Maria Hopkins
- 5 years ago
- Views:
Transcription
1 Social Computing Systems Walter S. Lasecki EECS 498/598, Winter 2018 (
2 Today Privacy and security risks/threats Privacy-related design considerations in social computing Privacy in human computation and crowdsourcing
3 Why do we care about privacy?
4 Definitionz Privacy is the ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. Wikipedia
5 Definitionz Privacy is the ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively. Wikipedia that doesn t sound very social. So why do we care?
6 Why do we want things to be private? Unintentional social disclosure Direct threat to our (or our liked-ones ) safety or assets Some things are just embarrassing (private vs public disclosure) The ability to steal or harm people via information or access Overall: Because there are risks to having all information public in an imperfect world.
7 What do we want to be private? Embarrassing or personal content (e.g., photos / audio) Account or status information (e.g., location logs / shopping history) Information that people could use to track or attack us Access information (e.g., work servers / PCs / smart-home controls) Things we just don t WANT people to see Controls people could use to gain over parts of our lives?
8 Privacy vs. Security Privacy: your data is not being seen / shared with others Security: you data is not being manipulated / stolen
9 Sources of Privacy Leaks
10 Surveillance / Monitoring
![[Web]](/docs-images/83/87497994/images/11-0.jpg "Surveillance /")
11 [Web] Surveillance / Monitoring
12 Government Agencies
13 Non-government Organizations Groups with a cause (e.g., Anonymous) Groups / collectives with fewer clear causes (e.g., 4chan) Stealing info/access, denial of service attacks, etc. Further a mission or belief. Mostly. (You can debate the details of their vigilantism) Stealing info/access, denial of service attacks, etc. Now, for bullying, retaliation, or teh LOLs ( clearly a technical term) Individuals Lone wolf hackers, identity thieves, con artists, etc. Motivation and methods vary widely Surveillance stalking
14 Types of Data Risk (some examples. not a complete list.)
15 TYPE: Personal Content Examples: Erin Andrews case: stalker recorded nude video and posted online Particularly high profile case + $75million civil suit Countless examples of cyberbullying in online settings (often w/ K-12 children) Often involve sharing embarrassing content or information (real or plausible fake) Many have lead to suicides (or attempts) due to emotional toll Publically visible grades Private/semi-private comments made public E.g., Mitt Romney s 47% comment (those who feel entitled ) E.g., that kinda-mean thing you said about one friend to another via private message Overall: most personal content leaks affect social capital / relationship status
16 TYPE: Personal Information Examples: Account info (e.g., bank, etc.) Usage / access permissions (e.g., servers, etc.) Social media access (e.g., hacked FB or Twitter accounts) many more Overall: Information that can be used to do direct harm / fraud
17 TYPE: Personal Status For example
18 STATUS: Location Risks
19
20
21 Finding You Using Your Friends Sadilek et al.
22 STATUS: Records Medical records Purchase records Interaction records Court records Search logs... Ex. attack: CC statements saying you paid for a flight in Dec., and bought an inflatable reindeer
23 What else? [ There are many examples. Let s name some. ]
24 Privacy / Threats in Crowdsourcing
25
26 Types of Threats: Extraction Walter S. Lasecki 26
27 Types of Threats: Extraction Exploitation Walter S. Lasecki 27
28 Types of Threats: Extraction Exposure Walter S. Lasecki 28
29 Types of Threats: Extraction Reconstruction Jan ec aro le Do e Walter S. Lasecki 29
30 Types of Threats: Extraction Reconstruction Jan ec aro le Do e Walter S. Lasecki 30
31 Types of Threats: Manipulation Individuals lenht length length sun worker aggregation length Walter S. Lasecki 31
32 Types of Threats: Manipulation Uncoordinated Groups weight sun potato worker aggregation length Walter S. Lasecki 32
33 Types of Threats: Manipulation Coordinated Groups sun sun sun sun worker aggregation length Walter S. Lasecki 33
34 Types of Threats: Manipulation of Iterative Workflows Walter S. Lasecki 34
35 Sources of Threats: Individuals Extract unfiltered info View sensitive info Steal partial info Add noise to responses Disrupt iterative workflows Walter S. Lasecki 35
36 Sources of Threats: Groups Large-scale individual attacks Reconstruct info Disrupt systems responses Produce an undesired answer Walter S. Lasecki 36
37 Raising an Army Could malicious requesters hire workers for group attacks? Walter S. Lasecki 37
38 Raising an Army Could malicious requesters hire workers for group attacks? How many workers will be willing to help? Walter S. Lasecki 38
39 Experiment: Credit Card Extraction Attack [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Target Walter S. Lasecki 39
40 Experiment: Credit Card Extraction Condition Return rate Baseline 73.8% [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Walter S. Lasecki 40
41 Experiment: Credit Card Extraction Condition Return rate Baseline 73.8% Innocent 62.1% [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Walter S. Lasecki 41
42 Experiment: Credit Card Extraction Condition Return rate Baseline 73.8% Innocent 62.1% Malicious 32.8% [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Walter S. Lasecki 42
43 Experiment: OCR Manipulation Attack [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Manipulation Threats in Crowd-Powered Systems. CSCW 2014.] Target Walter S. Lasecki 43
44 Results: OCR Manipulation Condition Return rate Baseline 73.8% [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Manipulation Threats in Crowd-Powered Systems. CSCW 2014.] Walter S. Lasecki 44
45 Results: OCR Manipulation Condition Return rate Baseline 73.8% Innocent 75.0% [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Manipulation Threats in Crowd-Powered Systems. CSCW 2014.] Type sun Walter S. Lasecki 45
46 Results: OCR Manipulation Condition Return rate Baseline 73.8% Innocent 75.0% Malicious 27.9% [W.S. Lasecki, J. Teevan, E. Kamar. Information Extraction and Manipulation Threats in Crowd-Powered Systems. CSCW 2014.] Type sun Walter S. Lasecki 46
47 Results: OCR Manipulation sun sun Response Baseline Innocent Malicious sun 12% 75% 28% gun 36% 16% - fun 26% 7% - lun 14% 1% - jun 9% 1% - other 3% - - length % Walter S. Lasecki 47
48 Convincing Workers to Attack Some workers are already willing (~30%) How do we convince the rest? Money? Story? What else? Walter S. Lasecki 48
49 The Effects of Price Idea: To increase participation, let s pay more In theory All workers are better paid by helping us In practice $ Walter S. Lasecki 49
50 Experiment: Credit Card Extraction Attack Target Walter S. Lasecki 50
51 The Effect of Price Walter S. Lasecki 51
52 The Effect of Price Walter S. Lasecki 52
53 The Effect of Price Walter S. Lasecki 53
54 The Effect of Price Walter S. Lasecki 54
55 Why do Some Workers Still Help? Are workers just jerks? Walter S. Lasecki 55
56 Why do Some Workers Still Help? Are workers just jerks? Not really. Many even warned others, but Walter S. Lasecki 56
57 Why do Some Workers Still Help? Are workers just jerks? Not really. Many even warned others, but You know what, I had the same issue today [... I] didn t pay it much mind when it happened. Walter S. Lasecki 57
58 Can We Trust the Crowd? Some worker won t complete suspicious work A few workers will complete tasks regardless Very few will report issues Might be susceptible to: - monetary incentives - false reasons Walter S. Lasecki 58
59 Pre-Filtering Walter S. Lasecki 59
60
61 [ In-class Attack Activity ] < attack me (hypothetically, not for real!) >
62 Today Privacy and security risks/threats Privacy-related design considerations in social computing Privacy in human computation and crowdsourcing
63 Next Class - Lecture Topic: NONE! but there is a BIG QUIZ coming in a week!
Personal Cybersecurity
Personal Cybersecurity The Basic Principles Jeremiah School, CEO How big is the issue? 9 8 7 6 5 4 3 2 1 Estimated global damages in 2018 0 2016 2018 2020 2022 2024 2026 2028 2030 Internet Users Billions
EADS up. stop think connect
EADS up stop think connect You text, you play games, you share photos and video. You update your status, you post comments, you probably spend some time in a virtual world. Being online connected through
Security+ Guide to Network Security Fundamentals, Fourth Edition. Chapter 1 Introduction to Security
Security+ Guide to Network Security Fundamentals, Fourth Edition Chapter 1 Introduction to Security Objectives Describe the challenges of securing information Define information security and explain why
Cyberspace : Privacy and Security Issues
Cyberspace : Privacy and Security Issues Chandan Mazumdar Professor, Dept. of Computer Sc. & Engg Coordinator, Centre for Distributed Computing Jadavpur University November 4, 2017 Agenda Cyberspace Privacy
Protecting your Data in the Cloud. Cyber Security Awareness Month Seminar Series
Protecting your Data in the Cloud Cyber Security Awareness Month Seminar Series October 24, 2012 Agenda Introduction What is the Cloud Types of Clouds Anatomy of a cloud Why we love the cloud Consumer
Quick recap on ing Security Recap on where to find things on Belvidere website & a look at the Belvidere Facebook page
Workshop #7 Email Security Previous workshops 1. Introduction 2. Smart phones & Tablets 3. All about WatsApp 4. More on WatsApp 5. Surfing the Internet 6. Emailing Quick recap on Emailing Email Security
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 1 Introduction to Security
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 1 Introduction to Security Objectives Describe the challenges of securing information Define information security and explain why
NORTON WI-FI RISK REPORT: U.S. Results
NORTON WI-FI RISK REPORT: U.S. Results Research Objective Norton by Symantec commissioned its second annual online survey, this year expanded to 15 global markets, in order to better understand consumers
Employee Security Awareness Training
Employee Security Awareness Training September 2016 Purpose Employees have access to sensitive data through the work they perform for York. Examples of sensitive data include social security numbers, medical
Threat Modeling. Bart De Win Secure Application Development Course, Credits to
Threat Modeling Bart De Win bart.dewin@ascure.com Secure Application Development Course, 2009 Credits to Frank Piessens (KUL) for the slides 2 1 Overview Introduction Key Concepts Threats, Vulnerabilities,
How to Build a Culture of Security
How to Build a Culture of Security March 2016 Table of Contents You are the target... 3 Social Engineering & Phishing and Spear-Phishing... 4 Browsing the Internet & Social Networking... 5 Bringing Your
Online Threats. This include human using them!
Online Threats There are many dangers from using the web (and computer in general). One should watch out for malware, automated programs designed to cause harm to you, your data, and your system. You are
About Lavasoft. Contact. Key Facts:
About Lavasoft Lavasoft is the original anti-malware company, creating award-winning, free security and privacy software since 1999. Born of the belief that online security should be available to everybody,
Why you MUST protect your customer data
Why you MUST protect your customer data If you think you re exempt from compliance with customer data security and privacy laws because you re a small business, think again. Businesses of all sizes are
Newcomer Finances Toolkit. Fraud. Worksheets
Newcomer Finances Toolkit Fraud Worksheets Ottawa Community Loan Fund Fonds d emprunt Communautaire d Ottawa 22 O Meara St., Causeway Work Centre, Ottawa, ON K1Y 4N6 Tel: 613-594-3535 Fax: 613-594-8118
The purchaser of the ebook is licensed to copy ebook for use with immediate family members only.
Copyright 2017 Leah Nieman www.leahnieman.com All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form by any means, electronic, mechanical,
Who We Are! Natalie Timpone
Who We Are! Natalie Timpone Manager of Security Business Management Office Enterprise Security Awareness Manager Carmelo Walsh Security, Risk, and Compliance Security Awareness Subject Matter Expert Who
Cyber Smarts Using Social Media Wisely
Cyber Smarts Using Social Media Wisely Posted on March 24, 2016 by Shridevi Stock Photo You have access to the world s largest museum, art gallery, library and social group ever created. You also have
Norton Online Reputation Report: Why Millennials should manage their online footprint
Norton Online Reputation Report: Why Millennials should manage their online footprint UK May 2016 Methodology A quantitative survey was conducted online among 1,000 mobile users aged 18-34 years who own
Configuring Twitter for a More Secure Social Networking Experience
CPF 00006-18-CID361-9H 8 November 2018 Configuring Twitter for a More Secure Social Networking Experience Basic Notes About Social Media The internet s social media ecosystem is vast. To some people, social
Troubleshooting and Cyber Protection Josh Wheeler
May 4, 2016 Troubleshooting and Cyber Protection Josh Wheeler Network Security Network Security Risks Video Network Security Risks Article Network Security Risks Data stealing or disruption of network
Epistemo: A Crowd-Powered Conversational Search Interface
Epistemo: A Crowd-Powered Conversational Search Interface Saiganesh Swaminathan saiganes@cs.cmu.edu Ting-Hao (Kenneth) Huang tinghaoh@andrew.cmu.edu Irene Lin iwl@andrew.cmu.edu Anhong Guo anhongg@cs.cmu.edu
Attackers Process. Compromise the Root of the Domain Network: Active Directory
Attackers Process Compromise the Root of the Domain Network: Active Directory BACKDOORS STEAL CREDENTIALS MOVE LATERALLY MAINTAIN PRESENCE PREVENTION SOLUTIONS INITIAL RECON INITIAL COMPROMISE ESTABLISH
FREQUENTLY ASKED QUESTIONS
FREQUENTLY ASKED QUESTIONS In order to better assist you with the transition to our new home banking service, we wanted to provide you with a list of anticipated questions and things that may need your
Common Scams and Fraud. Charlottesville/Albemarle County TRIAD Group
Common Scams and Fraud Charlottesville/Albemarle County TRIAD Group What We ll Cover 3 parts of a scam or fraud Common scams What can you do? Common Scams Three Parts of Any Scam or Fraud 1. Victim has
To receive money, just share your enrolled address or U.S. mobile phone number with a friend and ask them to send you money with Zelle.
Consumer FAQs 1. What is Zelle? Zelle is a fast, safe and easy way to send money directly between almost any bank accounts in the U.S., typically within minutes 1. With just an email address or U.S. mobile
Methodology USA UK AUSTRALIA CANADA JAPAN N=1,008 MOE=+/-3% N=1,044 MOE=+/- 3% N=1,028 MOE=+/- 3% N=1,025 MOE=+/- 3% N=1,005 MOE=+/- 3%
Norton by Symantec commissioned an online survey across nine countries in order to better understand consumers public Wi-Fi perceptions and practices, unveiling consumer misconceptions and worries about
MOBILE THREAT LANDSCAPE. February 2018
MOBILE THREAT LANDSCAPE February 2018 WHERE DO MOBILE THREATS COME FROM? In 2017, mobile applications have been a target of choice for hackers to access and steal data, with 86% of mobile threats coming
Chapter 6 Network and Internet Security and Privacy
Chapter 6 Network and Internet Security and Privacy Learning Objectives LO6.1: Explain network and Internet security concerns LO6.2: Identify online threats LO6.3: Describe cyberstalking and other personal
SECURITY ON PUBLIC WI-FI New Zealand. A guide to help you stay safe online while using public Wi-Fi
SECURITY ON PUBLIC WI-FI New Zealand A guide to help you stay safe online while using public Wi-Fi WHAT S YOUR WI-FI PASSWORD? Enter password for the COFFEE_TIME Wi-Fi network An all too common question
Managing IT Risk: What Now and What to Look For. Presented By Tina Bode IT Assurance Services
Managing IT Risk: What Now and What to Look For Presented By Tina Bode IT Assurance Services Agenda 1 2 WHAT TOP TEN IT SECURITY RISKS YOU CAN DO 3 QUESTIONS 2 IT S ALL CONNECTED Introduction All of our
The Cyber War on Small Business
The Cyber War on Small Business Dillon Behr Executive Lines Broker Risk Placement Services, Inc. Meet Our Speaker Dillon Behr Executive Lines Broker Risk Placement Services, Inc. Previously worked as Cyber
Review Ch. 3 Connecting to the World s Information. 2010, 2006 South-Western, Cengage Learning
Review Ch. 3 Connecting to the World s Information 2010, 2006 South-Western, Cengage Learning Networks Two linked computers is a network A network of computers located within a short distance is called
Student E-Safety Induction
Central College Nottingham Student E-Safety Induction Academic Year 2015-16 Training & Learning Technologies September 2015 E-Safety It is important to the College that all students know how to stay safe
PBX Fraud Information
PBX Fraud Information Increasingly, hackers are gaining access to corporate phone and/or voice mail systems. These individuals place long distance and international calls through major telecom networks
Lecture 41 Blockchain in Government III (Digital Identity)
Blockchains Architecture, Design and Use Cases Prof. Sandip Chakraborty Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Lecture 41 Blockchain in Government III
Panda Security 2010 Page 1
Panda Security 2010 Page 1 Executive Summary The malware economy is flourishing and affecting both consumers and businesses of all sizes. The reality is that cybercrime is growing exponentially in frequency
SOCIAL NETWORKING'S EFFECT ON BUSINESS SECURITY CONTROLS
SOCIAL NETWORKING'S EFFECT ON BUSINESS SECURITY CONTROLS Jon Hanny Director of Information Security and Assurance, Buckley Sandler LLP Gaurav Chikara Senior Security Engineer, Cooley LLP AGENDA Social
Mobile Security / Mobile Payments
Mobile Security / Mobile Payments Leslie K. Lambert CISSP, CISM, CISA, CRISC, CIPP/US, CIPP/G VP, Chief Information Security Officer Juniper Networks Professional Techniques - Session T23 MOBILE SECURITY
WEB OF DECEIT. Why are seniors targeted?
A challenge for senior citizens who embrace the computer age is knowing how to avoid online fraud. Although people of all ages are at risk, statistics show that when it comes to online safety, seniors
PCI Compliance. What is it? Who uses it? Why is it important?
PCI Compliance What is it? Who uses it? Why is it important? Definitions: PCI- Payment Card Industry DSS-Data Security Standard Merchants Anyone who takes a credit card payment 3 rd party processors companies
The Money Is in the Square Cash Lets Users Funds to Friends
The Money Is in the Email Square Cash Lets Users Email Funds to Friends By: WALTER S. MOSSBERG October 15, 2013 Square now has a service that makes transferring money to a friend as easy as sending them
Identity Theft and Online Security
Identity Theft and Online Security Agenda Identity Theft - What is it and how are we at risk? Social Media - How much online security do we have? Protection - How can we enhance our security online and
Discount Kaspersky PURE 3.0 internet download software for windows 8 ]
![Discount Kaspersky PURE 3.0 internet download software for windows 8 ]](/thumbs/71/65538451.jpg "Discount Kaspersky PURE 3.0 internet download software for windows 8 ]")
Discount Kaspersky PURE 3.0 internet download software for windows 8 ] Description: Extended benefits Award-winning protection against all types of Internet threats Online shopping, banking and social
Cybersecurity. Topic Background
Cybersecurity Topic Background The growth of the Internet has allowed nations, organizations, and people to connect in ways previously unimagined. This new interconnectivity has allowed for collaboration,
Express Monitoring 2019
Express Monitoring 2019 WHY CHOOSE PT EXPRESS MONITORING PT Express Monitoring provides a quick evaluation of the current signaling network protection level. This service helps to discover critical vulnerabilities
Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
Assistance with University Projects? Research Reports? Writing Skills? We ve got you covered! www.assignmentstudio.net WhatsApp: +61-424-295050 Toll Free: 1-800-794-425 Email: contact@assignmentstudio.net
SMART DEVICES: DO THEY RESPECT YOUR PRIVACY?
SMART DEVICES: DO THEY RESPECT YOUR PRIVACY? Systems and Mobile Research Lab, Department of Computer Science and Engineering INDIAN INSTITUTE OF TECHNOLOGY KHARAGPUR Presenter: Sandip Chakraborty sandipc@cse.iitkgp.ac.in
McAfee S DO s AnD DOn ts Of Online Shopping
McAfee s Do s and don ts OF Online Shopping Table of Contents Foreword by Parry Aftab, 3 Online Safety Expert Online Shopping: The Real Deal 4 The DO s and DON Ts 5 Summary 17 Resources 18 Happy Online
The Learner can: 1.1 Describe the common types of security breach that can affect the organisation, such as:
Unit Title: OCR unit number 38 Level: 3 Credit value: 12 Guided learning hours: 100 Unit reference number: Security of ICT Systems D/500/7220 Candidates undertaking this unit must complete real work activities
ANDROID PRIVACY & SECURITY GUIDE ANDROID DEVICE SETTINGS
ANDROID PRIVACY & SECURITY GUIDE WESNET The Women s Services Network Smartphones store a lot of personal information, including email or social media accounts, reminders and notes, the number of steps
IS Today: Managing in a Digital World 9/17/12
IS Today: Managing in a Digital World Chapter 10 Securing Information Systems Worldwide losses due to software piracy in 2005 exceeded $34 billion. Business Software Alliance, 2006 Accessories for war
Security Now. Howard Verne. Is My Private Information Safe?
Security Now Howard Verne Is My Private Information Safe? NO!! Millions of people s Information has been stolen to date Target, Home Depot Even Albertsons have been some of the largest/well known break-ins
WEB SECURITY WORKSHOP TEXSAW Presented by Solomon Boyd and Jiayang Wang
WEB SECURITY WORKSHOP TEXSAW 2014 Presented by Solomon Boyd and Jiayang Wang Introduction and Background Targets Web Applications Web Pages Databases Goals Steal data Gain access to system Bypass authentication
The Credential Phishing Handbook. Why It Still Works and 4 Steps to Prevent It
The Credential Phishing Handbook Why It Still Works and 4 Steps to Prevent It Introduction Phishing is more than 20 years old, but still represents more than 90% of targeted attacks. The reason is simple:
Security at the Digital Cocktail Party. Social Networking meets IAM
Security at the Digital Cocktail Party Social Networking meets IAM What I m going to talk about Social Networking and its benefits Social Networking is an Identity Management System But not always a very
SOCIAL NETWORKING IN TODAY S BUSINESS WORLD
SOCIAL NETWORKING IN TODAY S BUSINESS WORLD AGENDA Review the use of social networking applications within the business environment Review current trends in threats, attacks and incidents Understand how
Protect Your Endpoint, Keep Your Business Safe. White Paper. Exosphere, Inc. getexosphere.com
Protect Your Endpoint, Keep Your Business Safe. White Paper Exosphere, Inc. getexosphere.com White Paper Today s Threat Landscape Cyber attacks today are increasingly sophisticated and widespread, rendering
Ages Donʼt Fall for Fake: Activity 1 Don t bite that phishing hook! Goals for children. Letʼs talk
Ages 11-14 Donʼt Fall for : Activity 1 Don t bite that phishing hook! Children play a game where they study various emails and texts and try to decide which messages are legit and which are phishing scams.
Train employees to avoid inadvertent cyber security breaches
Train employees to avoid inadvertent cyber security breaches TRAIN EMPLOYEES TO AVOID INADVERTENT CYBER SECURITY BREACHES PAGE 2 How much do you know about cyber security? Small business owners often lack
Q WEB APPLICATION ATTACK STATISTICS
WEB APPLICATION ATTACK STATISTICS CONTENTS Introduction...3 Results at a glance...4 Web application attacks: statistics...5 Attack types...5 Attack trends...8 Conclusions... 11 2 INTRODUCTION This report
Practical Cyber Security for Architects of Small Firms (1 AIA CEU)
Practical Cyber Security for Architects of Small Firms (1 AIA CEU) with Angela Render Thunderpaw.com 571-331-5941 Transforming Architecture LLC is a Registered Provider with The American Institute of Architects
PRIVACY AND ONLINE DATA: CAN WE HAVE BOTH?
PAPER PRIVACY AND ONLINE DATA: CAN WE HAVE BOTH? By Peter Varhol www.actian.com ignificant change has arrived in how computing and storage consumes data concerning individuals. Merchants, data collection
Threat analysis. Tuomas Aura CS-C3130 Information security. Aalto University, autumn 2017
Threat analysis Tuomas Aura CS-C3130 Information security Aalto University, autumn 2017 Outline What is security Threat analysis Threat modeling example Systematic threat modeling 2 WHAT IS SECURITY 3
WHAT IS CORPORATE ACCOUNT TAKEOVER? HOW DOES IT HAPPEN?
WHAT IS CORPORATE ACCOUNT TAKEOVER? Corporate Account Takeover (also referred to as CATO) is a type of fraud where criminals gain access to a business financial accounts to make unauthorized transactions.
Insider Threat Program: Protecting the Crown Jewels. Monday, March 2, 2:15 pm - 3:15 pm
Insider Threat Program: Protecting the Crown Jewels Monday, March 2, 2:15 pm - 3:15 pm Take Away Identify your critical information Recognize potential insider threats What happens after your critical
Let s Hack NFC. How does NFC work? How could we hack it? Where are the weaknesses? What are the security implications?
Geoffrey Vaughan Let s Hack NFC How does NFC work? How could we hack it? Where are the weaknesses? What are the security implications? Security Compass and NFC Currently we are devoting a lot of energy
FAQ: Privacy, Security, and Data Protection at Libraries
FAQ: Privacy, Security, and Data Protection at Libraries This FAQ was developed out of workshops and meetings connected to the Digital Privacy and Data Literacy Project (DPDL) and Brooklyn Public Library
How Cyber-Criminals Steal and Profit from your Data
How Cyber-Criminals Steal and Profit from your Data Presented by: Nick Podhradsky, SVP Operations SBS CyberSecurity www.sbscyber.com Consulting Network Security IT Audit Education 1 Agenda Why cybersecurity
ALIENVAULT USM FOR AWS SOLUTION GUIDE
ALIENVAULT USM FOR AWS SOLUTION GUIDE Summary AlienVault Unified Security Management (USM) for AWS is a unified security platform providing threat detection, incident response, and compliance management
Cyber Security Issues
RHC Summit 6/9/2017 Cyber Security Issues Dennis E. Leber CISO CHFS Why is it Important? Required by Law Good Business Strategy Right Thing to Do Why is it Important? According to Bitglass' 2017 Healthcare
Security Awareness. Chapter 2 Personal Security
Security Awareness Chapter 2 Personal Security Objectives After completing this chapter, you should be able to do the following: Define what makes a weak password Describe the attacks against passwords
ONLINE SAFETY. Messaging, , Vlogging and Sexting
ONLINE SAFETY Messaging, email, Vlogging and Sexting www.eitts.co.uk Contents WhatsApp & Messaging Email Vlogging Sexting THE RISKS People online are not necessarily who they say they are or seem to be.
Anti-Cyber Bullying Policy.
Anti-Cyber Bullying Policy. Bullying, in any form, is an issue that we all take very seriously at Bredon School. We accept that victims can become depressed and suicidal, and even take their own lives.
Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment
Security Awareness & Best Practices Best Practices for Maintaining Data Security in Your Business Environment Ray Colado, Information Security Analyst Raise awareness around information security to help
Scams and Schemes LESSON PLAN UNIT 1. Essential Question What is identity theft, and how can you protect yourself from it?
LESSON PLAN Scams and Schemes Essential Question What is identity theft, and how can you protect yourself from it? Lesson Overview Students learn strategies for guarding against identity theft and scams
CruiseSmarter PRIVACY POLICY. I. Acceptance of Terms
I. Acceptance of Terms This Privacy Policy describes CRUISE SMARTER policies and procedures on the collection, use and disclosure of your information. CRUISE SMARTER LLC (hereinafter referred to as "we",
PROTECTING YOUR BUSINESS ASSETS
PROTECTING YOUR BUSINESS ASSETS How to Spot Danger Before Your Computer Gets Infected, Your Site Hosts Malware, and Your Credit Card Number Gets Stolen A MyNAMS Presentation by Regina Smola @2012 Regina
Cybersecurity in 2016 and Lessons learned
Cybersecurity in 2016 and Lessons learned Dr. Yu Cai Associate Professor Program Chair, Computer Network & System Administration School of Technology Michigan Technological University cai@mtu.edu A Quick
Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity
Computer Crime and Intellectual Property Section Large-Scale Internet Crimes Global Reach, Vast Numbers, and Anonymity Anthony V. Teelucksingh Computer Crime and Intellectual Property Section (CCIPS) Criminal
Security Awareness. Presented by OSU Institute of Technology
Security Awareness Presented by OSU Institute of Technology Information Technologies Division Security Awareness Topics Social Engineering Phishing Social Networks Displaying Sensitive Information Wireless
cs1120: Exam 1 Due: Wednesday, 06 October at 3:30pm (in class)
cs1120: Exam 1 Due: Wednesday, 06 October at 3:30pm (in class) UVA ID (e.g., wrw6y) : Directions Work alone. You may not discuss these problems or anything related to the material covered by this exam
Top Ten IT Security Risks CHRISTOPHER S. ELLINGWOOD SENIOR MANAGER, IT ASSURANCE SERVICES
Top Ten IT Security Risks - 2017 CHRISTOPHER S. ELLINGWOOD SENIOR MANAGER, IT ASSURANCE SERVICES INTRODUCTION IT S ALL CONNECTED IN 2017. All of our Top 10 risks impact both us as consumers and as professionals
SANS Institute , Author retains full rights.
Steven F Burns GIAC Security Essentials Certification (GSEC) Practical Assignment Version 1.4c Threat Modeling: A Process To Ensure Application Security January 5, 2005 Abstract This paper discusses the
The Power of the Inbox Tips and Tricks for Successful Marketing
The Power of the Inbox Tips and Tricks for Successful Email Marketing Constant Contact 2015 Kimberly Beer Contact me: Midnight Productions, Inc & Constant Contact President, Constant Contact Authorized
Data Security and Privacy : Compliance to Stewardship. Jignesh Patel Solution Consultant,Oracle
Data Security and Privacy : Compliance to Stewardship Jignesh Patel Solution Consultant,Oracle Agenda Connected Government Security Threats and Risks Defense In Depth Approach Summary Connected Government
Building a Threat Intelligence Program
WHITE PAPER Building a Threat Intelligence Program Research findings on best practices and impact www. Building a Threat Intelligence Program 2 Methodology FIELD DATES: March 30th - April 4th 2018 351
Creating and Protecting Your Online Identity for Job Search. A guide for newcomers to British Columbia
Creating and Protecting Your Online Identity for Job Search Contents 1. Creating a Positive Online Presence... 2 2. Your Digital Tattoo... 3 3. Your Professional Identity... 5 4. Social Media Advice...
Using Threat Analytics to Protect Privileged Access and Prevent Breaches
Using Threat Analytics to Protect Privileged Access and Prevent Breaches Under Attack Protecting privileged access and preventing breaches remains an urgent concern for companies of all sizes. Attackers
Cyber Crime Seminar. No Victim Too Small Why Small Businesses Are Low Hanging Fruit
Cyber Crime Seminar No Victim Too Small Why Small Businesses Are Low Hanging Fruit Why Are We Here? What is Cybercrime? Why YOU may become the next victim? What do they attack? Why do they attack? How
Review Kaspersky Internet Security - multi-device 2015 online software downloader ]
![Review Kaspersky Internet Security - multi-device 2015 online software downloader ]](/thumbs/72/67088147.jpg "Review Kaspersky Internet Security - multi-device 2015 online software downloader ]")
Review Kaspersky Internet Security - multi-device 2015 online software downloader ] Description: Benefits Protecting all your connected devices the one-licence, easy-touse solution Kaspersky Internet Security
INTERNET OF THINGS. Presented By Erin Bosman & Julie Park, Morrison & Foerster LLP ACC 14th ANNUAL GC ROUNDTABLE AND ALL DAY MCLE
Friday, January 27 th, 2017 INTERNET OF THINGS Presented By Erin Bosman & Julie Park, Morrison & Foerster LLP ACC 14th ANNUAL GC ROUNDTABLE AND ALL DAY MCLE This Talk s Objectives What is the Internet
Main area: Security Additional areas: Digital Access, Information Literacy, Privacy and Reputation
Public Wi Fi Created: March 2016 Last Updated: July 2018 Estimated time: Group or individual activity: Ages: 60 minutes [10 minutes] Activity #1 [15 minutes] Activity #2 [10 minutes] Activity #3 [10 minutes]
GUIDE TO KEEPING YOUR SOCIAL MEDIA ACCOUNTS SECURE
GUIDE TO KEEPING YOUR SOCIAL MEDIA ACCOUNTS SECURE TABLE OF CONTENTS PROTECTIVE MEASURES... 2 PREPARATION CHECKLIST... 2 IF YOU SUSPECT YOUR ACCOUNT IS COMPROMISED, THE FOLLOWING ACTIONS ARE ADVISED:...
Text 1 Cell Phones Raise Security Concerns at School
Text 1 Cell Phones Raise Security Concerns at School Many people think that students having cell phones in school is a great idea 1 idea. Many parents feel that they don t have to worry as much about their
IoT Security and Risk Management
SESSION ID: GPS1-R03 IoT Security and Risk Management Tyson Macaulay Chief Security Strategist, Fortinet IoT Security is a BIG STORY! Security as a % of IT Budget 4% 7% 20 Billion+ devices? 2% Source:
FAQs FREQUENTLY ASKED QUESTIONS
FAQs FREQUENTLY ASKED QUESTIONS FREQUENTLY ASKED QUESTIONS What retailers are participating (so I know where my snaps count more)? 1 What is a qualified snap? 1 Will you tell me if my snap isn t readable?
RippleMatch Privacy Policy
RippleMatch Privacy Policy This Privacy Policy describes the policies and procedures of RippleMatch Inc. ( we, our or us ) on the collection, use and disclosure of your information on https://www.ripplematch.com/
Securing Americans Identities: The Future of the Social Security Number
Cha : Testimony, SASC 04 /25 /2017 1 Statement Before the House Ways and Means Subcommittee on Social Security Securing Americans Identities: The Future of the Social Security Number A Testimony by: James