Stay Secure: Best Practices for Safe Computing

1
Stay Secure Best Practices for Safe Computing

• http//www.antibodynet.com

2
Stay Secure

• Best Practices for Safe Computing

3
Vulnerabilities

• Physical security
• Passwords
• Social engineering
• Phishing
• Network security

• Remote access
• Wireless networks
• Encryption
• Public computers
• Viruses and spyware

4
Growing Threats
Source CERT Coordination Center, March 2005.
Source Anti-Phishing Working Group, March 2005.
Source Webroot/Earthlink SpyAudit Report, 2005.
Source Webroot/Earthlink SpyAudit Report, 2005.
5
Physical Security

• Security begins with controlling physical access
  to PCs, servers, and handheld PDA/telephones.
• Log off systems when stepping away.
• Use screen saver password protection.
• Always keep computers in sight when traveling.

6
Passwords

• Account names and passwords are powerful
  combinations that should be carefully guarded.
• Never use passwords based on
• Your name
• Names of spouses, children. or pets
• Social security numbers
• Anniversary or birth dates
• Favorite sports teams
• Words in the dictionary

7
Social Engineering

• Hackers often try conning victims into revealing
  sensitive information.
• Social engineering attacks leverage natural
  inclinations to help one another.
• Never provide account or password information to
  a caller.
• Never toss account or password information in the
  trash.

8
Phishing

• Phishing victims are tricked into revealing
  personal or proprietary information.
• Phishing attempts are often disguised to look
  like legitimate e-mail account inquiries.
• Avoid becoming a phishing victim by
• Never providing account or sensitive information
  in response to an e-mail or instant message.
• Never clicking on links within suspicious e-mail
  or instant messages.

9
Network Security

• Proper security consists of several layers
• Physical access
• Account requirements
• Firewalls
• Firewalls open and close doors providing access
  to data.
• Firewalls can be both software and hardware based.

10
Remote Access

• Enabling remote access presents unique challenges
• Networks and data must be opened to authorized
  remote users.
• In addition to authenticating remote users,
  communications between the user and the
  organizations systems must also be protected.
• VPNs are the most popular method of securely
  supporting remote users.
• Do not use remote connection programssuch as
  pcAnywhere or GoToMyPCwithout first obtaining
  authorization.

11
Wireless Networks

• Ease of deployment and ever decreasing costs have
  spurred 802.11 deployments.
• Most wireless networks are insecure.
• Help prevent intrusions and data loss
• Disable File and Print Sharing
• Leverage WEP and WPA, when possible

12
Encryption

• Encryption which jumbles the contents of a file
  or transmissionoffers an additional measure of
  security.
• Windows offers built-in encryption features
• VPN support
• EFS
• To properly decode encrypted information,
  recipients require a cipher.

13
Public Computers

• Public computers are insecure.
• Avoid using public computers to
• Send or receive e-mail
• Make Internet-based purchases
• Access any sensitive or confidential information
• If you must use a public computer
• Ensure passwords are not stored
• Flush the browser cache
• Delete session history

14
Viruses

• Do not click on e-mail attachments without first
  confirming they are virus free.
• Download applications and programs only from
  known and trusted vendors.
• Always run and routinely update antivirus
  software.

15
Spyware

• Spyware and adware programs
• Slow PC performance
• Track and report your behavior to third parties
• Could result in others controlling your PC
• Avoid infestation by
• Running and regularly updating an antispyware
  application
• Download only critical applications from trusted
  companies
• Avoid software from unknown companies

16
Patch Management

• Software updates are regularly released.
• Regular deployment of these patches helps keep
  a system secure.
• Its particularly important to keep antivirus and
  antispyware applications updated.
• Windows Update automates the deployment of
  Windows patches.
• Patches can introduce errors.
• The IT department obtains and tests patches
  before deployment dont deploy updates on work
  systems yourself.

17
Final Steps

• Questions?
• Thanks for attending.