Intro To Cybersecurity

Download Intro To Cybersecurity

Post on 28-Jan-2015

103 views

Category:

Technology

1 download

Embed Size (px)

DESCRIPTION

This presentation introduces low/no cost measures any organization can and should employ. This version of the presentation is offered by the New England Water Works Association's IT and Security and Preparedness committees in operator training and certification courses.

TRANSCRIPT

<ul><li> 1. Intro to Cybersecurity NEWWA5-May, 2009 </li></ul> <p> 2. PresentationTop Five No-Cost Suggestions Size and Shape of the Threat Technology Primer Characteristics of an Attack Securing the Organization Resources and Tools Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 3. Top Five No-Cost Suggestions Use passwords, use them well Individual logons Complex passwords Rotating schedule Utilize automatic updates Operating system Antivirus Remove unnecessary programs and components Create policies Protect system information Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 4. Size and Shape of the Threat 2008 Data Breach 2008 - # of 200820072006 Breaches Total Soars ITRC Reports 47%Business 24036.6%28.9%21%Increase over 2007Educational13120%24.8%28%Government/Military11016.8%24.6%30%Health/Medical 97 14.8%14.6%13%Financial/Credit 78 11.9%7%8%For 2008Financial BusinessEducation Gvt/MilitaryMedical Insider Theft 2.4% 5.6%1.8% 3.4%2.4%Hacking 3.5% 6.1%2.7% 0.8%0.8% Data on the Move1.7% 7.3% 3%4.3%4.4% Accidental 0.8% 3.0%6.1% 3.0%1.5% ExposureSubcontractor 0.8% 3.5%1.5% 2.3%2.3% Source: Identity Theft Resource Center, 2008 Data Breach Total SoarsCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 5. Size and Shape of ThreatCyberspy threat is growing Senate testimony from Joseph Weiss:Found evidence of 125+ control system breachesImpacts range from significant environmentaldamage to deathCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 6. High Profile AttacksDavis-Besse Nuclear Power Northeast Blackout Australian Sewage Release Olympic Pipeline (3 fatalities) Worcester Airport Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 7. IT vs. PC SecurityTOPICINFORMATION TECHNOLOGY PROCESS CONTROLAnti-virus/Mobile CodeCommon/ Widely UsedUncommon/Impossible to deploySupport Technology Lifetime3-5 Years Up to 20 YearsOutsourcing Common/Widely Used Rarely used Application of PatchesRegular/Scheduled Slow (Vendor specific) Change Management Regular/ScheduledRare Time Critical ContentGenerally delays accepted Critical due to safety Availability Generally delays accepted 24x7x365xforeverSecurity Awareness Good in both private and public Poor except for physicalsectorSecurity Testing/Audit Scheduled and mandatedOccasional testing for outagesPhysical Security Secure Remote and Unmanned 2002 PA Knowledge LimitedCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 8. Technology Primer Domain Name Service Directory Assistance for the Internet: Hello, operator? Im trying to reach Microsoft (www.microsoft.com).InternetPhone System Domain Name ServerTelephone Book/Directory (DNS21.REGISTER.COM)(411) Uniform Resource Locator (URL)Persons Name (www.microsoft.com) (Joe Smith) IP AddressTelephone Number (207.46.199.30) (617-555-1234)Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 9. Technology Primer Most stuff gets in Almost everything Internetgets out DMZServer IntrusionPrevention WAN Limited, specific traffic Intrusion DetectionSystem System LANEthernet Almost everything gets outAlmost nothing gets inClient PCClient PC Client PCCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 10. Characteristics of an Attack Types of Attackers Typical Steps Script kiddiesTarget identification Insider Reconnaissance Terrorist attacks System exploits Nation states Keeping access Covering tracks Sources of Attacks Viruses and worms Email Hostile web pages Direct attacks Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 11. What is Phishing? Appears to be a legitimate email Contains a false URL (1) that links to illegitimate site (2) Have different objectives:Obtain personal account informationPlant viruses/worms Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 12. Securing the Organization Layered ModelSKiP Method Human Security Knowledge in PracticeApplication StepsOperating system Customize vendorNetwork softwarePhysical Harden and secure the network Prepare Detect Respond Improve Repeat Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 13. Securing the Organization No/Low Cost Approaches Pull the Plug No network/internet connection/accessThis means modems tooDont make it easy Protect system design/architecture (consultants)Raise consciousnessCreate policies (e.g. Internet usage)Use what you have Passwords, PASSWORDS, PASSWORDS!Remove unused software/componentsDisable operating system componentsCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 14. Securing the Organization Remove unused software/componentsWindows Components Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 15. Securing the Organization Remove unused software/componentsWindows Components Programs Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 16. Securing the Organization Remove unused software/componentsWindows Components Programs Services Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 17. Securing the Organization: 7 StepsMicrosofts Security Guide for Small Businesshttp://www.microsoft.com/smallbusiness/support/security-toolkit-pdf.mspx Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 18. Securing the Organization: 7 StepsStep 1: Secure client computersAutomatic updates Antivirus Software firewalls (free with XP, commercialproducts for others)Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 19. Securing the Organization: 7 StepsStep 2: Secure data Backups File permissions Encryption Step 3: Internet usage policy Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 20. Securing the Organization: 7 StepsStep 4: Secure the Network Use a firewall (hardware and/or software) Use strong passwords Use wireless security features Close unnecessary network ports Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 21. Securing the Organization: 7 StepsStep 5: Secure the Servers Physical protection and isolation Reduce privileges Understand the options Step 6: Secure the Applications Use available security options Update the software Restrict access Step 7: Manage Clients from the Server Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 22. Securing the Organization: 7 StepsSome / High Cost Methods Intrusion prevention systems Prevents protocol exploitations, HTTP attacks, SYN floodattacks, FTP attacks, ICMP attacks, and application attacks ExpensiveFirewalls Rule-based port filteringInexpensive, complicatedIntrusion detection systems Monitoring, auditing, forensics, and reporting of activityCheap (free), complicatedCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 23. Social EngineeringUsers are the weakest link. Attackers are patient and persistent Who was Kevin Mitnick? When you combine an inclination for deceiving people withthe talents of influence and persuasion you arrive at theprofile of a social engineer.Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 24. Social EngineeringCourtesy of xkcd.com: http://xkcd.com/538/ Copyright 2005-2009, Bridge-Soft, LLC. All rights reserved. 25. Web Resourceswww.us-cert.gov www.cert.org www.first.org www.isa.org (SP99) www.microsoft.com/security Jon.DiPietro@Bridge-Soft.comCopyright 2005-2009, Bridge-Soft, LLC. All rights reserved. </p>

Recommended

View more >