IT Security Goal: Make it difficult enough to deter hacking so its not worth their time

Transcription

1 Security: More Than a Thumb and a Blanket

2 IT Security Goal: Make it difficult enough to deter hacking so its not worth their time

3 Live Threat Map Norse ( has a Live Threat map that computes over 1,500 risk factors for millions of IP addresses every day.

4 Difficulties of IT Security There are no turnkey solutions. Every situation has to be looked at independently. User Friendly. Balance of complexity and ease of use.

5 Difficulties of IT Security In other words How far do you want to go with it?

6 Security is as strong as it s weakest link End users Password strength Security of access points into your network Hardware & software up to date

7 End users scams. Don t automatically open attachments. Phishing.

8 End users Phishing From address Link redirection Grammar

9 End users Phishing From address To address log-in portal.

10 End users Pwned: adj. "dominated, humiliatingly defeated, taken over"

11 Passwords

12 Passwords Everyone hates passwords almost as much as they do being hacked. In order for a password to be useful it has to be complex and difficult to guess.

13 Passwords Use Strong Passwords: Longer passwords are better. Nonsensical combination of letters. FHriTPloL (hard to remember)

14 Passwords Use Strong Passwords: First letter of each word of a phrase TOTWHTFIFI ( The only thing we have to fear is fear itself - FDR) Alpha-numeric with combination of upper and lower case. T0TWH2f1f!

15 Bad passwords: password PASSWORD Passw0rd Pa$$w0rd Passwords

16 Passwords More bad passwords: qwerty Dictionary rover

17 Passwords Dictionary Attack Uses list of words and common passwords Brute Force Attack Tries every possible combination of letters/numbers a - ZZZZZZZZ

18 Passwords password T0TWH2f1f!

19 Passwords

20 Password Management Who is going to manage your passwords and how are they going to do that? LastPass 1Password RoboForm

21 Network Access Points How can somebody get onto your network? Physical Access Wireless Access

22 Network Access Points Physical Access Who has the key? What can they do once they are inside the cabinet?

23 Network Access Points Physical Access NG-2014 Electronic Cabinet Lock (Nest Guard) Grant/restrict access to designated personnel. Keypad and PROXCARD Reader. Central office software for remote programming.

24 Network Access Points Physical Access NG-2014 (Nest Guard)

25 Network Access Points Physical Access Disable unused switch ports?

26 Network Access Points Physical Access

27 Network Access Points Physical Access Enable Port Security?

28 Network Access Points Physical Access

29 Network Access Points Wireless Access The introduction of wireless to previously only physically accessible networks created additional security concerns.

30 Network Access Points Wireless Access Change default password!!! Set up wireless security!!!

31 Network Access Points Wireless Access Standard Meaning Security Level WPA2 Wireless Protected Access v2 Best WPA Personal (aka WPA-PSK) WPA Enterprise WEP Open Network Wireless Protected Access (For home and small office) Wireless Protected Access (For enterprise networks and requires authentication server) Wired Equivalent Privacy (Outdated) Good Good Poor No security

32 Network Access Points Wireless Access (side note) Common Standard Frequency Theoretical Speed ac 5GHz Mbit/second n 2.4GHz 150 Mbit/second g 2.4GHz 54 Mbit/second b 2.4GHz 11 Mbit/second

33 Network Access Points Wireless Access SSIDs: Change default SSID Wireless users cannot easily detect router type. Hide SSID Not really a security feature may help keep unauthorized users off your network.

34 Network Access Points Wireless Access Xirrus WiFi Inspector Software/Network-Management/Wi-Fi-Inspector

35 Security Updates - Hardware Firmware Updates Vendors randomly release updated firmware/software when adding features or vulnerabilities are detected.

36 Software Updates/Patch Windows Antivirus Web Browser Vendor Software Security Updates - Software

37 Zero-Day Vulnerability Refers to a hole in a software that is unknown to the vendor and can be exploited by a hacker.

38 Alter timings Put intersection into flash. Alter Dynamic Messaging Signs. How Bad Could It Get?

39 Your Online Privacy Court record searches by state Social Phishing Westport Parkway, La Vista, NE People Search IP Address location

40 Summary IT Security is a balance of complexity and usability. The level of Security desired is always proportional to cost of implementation and ongoing maintenance as well as how much inconvenience can be tolerated by those affected.

41 Questions?