Information Security Awareness - PowerPoint PPT Presentation

Loading...

PPT – Information Security Awareness PowerPoint presentation | free to view - id: 75d0-Njg0O



Loading


The Adobe Flash plugin is needed to view this content

Get the plugin now

View by Category
About This Presentation
Title:

Information Security Awareness

Description:

Information Security Awareness. Basic Training for the Campus Community ... institutions ensure the security and confidentiality of any individual's ... – PowerPoint PPT presentation

Number of Views:570
Avg rating:3.0/5.0
Slides: 83
Provided by: SAB17
Category:

less

Write a Comment
User Comments (0)
Transcript and Presenter's Notes

Title: Information Security Awareness


1
Information Security Awareness
  • Basic Training for the Campus Community

2
Information Security Awareness
  • What are we protecting?
  • Our personal data
  • Students personal data
  • Critical systems-email, network, file storage
  • What are we protecting them from?
  • Information exposure
  • DOS-Denial of Service
  • Malicious Editing
  • How do these things happen?
  • Direct attacks
  • Hacker gets remote control access to a
    computer
  • DOS attack, such as a virus worm
  • Network/email slowed or stopped
  • Lack of physical security
  • computer stolen or paperwork viewed

3
Information Security Awareness
  • Virus/Security Impact at UWM
  • Worst yet? Blaster virus, August 2003
  • Support Hours (non-IMT) 175 hours
  • Employee Downtime (non-IMT) 149 hours

4
Information Security Awareness
  • Virus/Security Impact at UWM
  • UWM Help Desk Virus/Security Help Request Hours
  • 485 hours
  • 683 hours
  • 1037 hours

5
Information Security Awareness
  • UWM Computer Use Policy
  • Harassing other users, stealing passwords and
    corrupting files will not be tolerated.
  • Only UWM students, faculty and staff members are
    authorized to use IMT computers. You may not
    permit anyone else to use your computer account.
  • Everyone is expected to do their share of
    avoiding waste of limited resources.
  • Do not attempt to break into any computers or use
    any other person's computer account without their
    permission.
  • In general, common sense reigns.
  • http//www.uwm.edu/IMT/Computing/Docs/csdGuideline
    .html

6
Information Security Awareness
  • Federal Legislation
  • GLBA (Graham Leach Bliley Act)
  • Financial Modernization
  • institutions ensure the security and
    confidentiality of any individuals personal
    financial information
  • bank and credit card account numbers
  • credit histories
  • social security numbers used in conjunction with
    financial transactions
  • FERPA
  • HIPAA

7
Information Security Awareness
  • Federal Legislation
  • FERPA (Family Educational Rights and Privacy Act)
  • Protects the privacy of student educational
    records
  • HIPAA
  • Health Insurance Portability and Accountability
    Act
  • Protect personally identifiable health
    information

8
Information Security Awareness
  • Where do I get computer help?
  • Decentralized campus IT environment
  • Ask your supervisor what their dept. policy is
  • General information and questions?
  • UWM Help Desk 229-4040
  • Email help_at_uwm.edu
  • Virus or security questions?
  • Help desk
  • http//security.uwm.edu
  • virus_at_uwm.edu
  • csirt_at_uwm.edu

9
Information Security Awareness
  • Where do I get computer help?
  • When to contact Campus Police
  • Feel your or others personal safety is at risk
  • Believe a law has been violated
  • Believe your identity or other theft has occurred
  • When in doubt, call campus PD x9911

10
Information Security Awareness
  • Prevention and Awareness to avoid threats
  • Virus Protection
  • Spyware Prevention/Awareness
  • System Hardening-stop hackers!
  • Social Engineering and other threats
  • Email Safety Tips
  • Safer Surfing
  • Passwords
  • Fraud/Identity Theft
  • Physical Information Security

11
Information Security Awareness
  • Virus Protection
  • What is a computer Virus?
  • Generally speaking
  • A virus is a computer program, usually disguised
    as something else, (mail, game, joke) that is
    designed to automatically spread itself to other
    computer users.
  • Clogs networks by spreading itself
  • Creates great expense in cleanup and downtime

12
Information Security Awareness
  • Virus Protection
  • Most common Computer Virus delivery at UWM
  • An email with an attachment that appears to have
    been intentionally sent by someone you regularly
    communicate with

13
Information Security Awareness
  • How do computers get infected?
  • Opening Email Attachments
  • How does it work?
  • Open a bad attachment
  • Actually a disguised program that does 2 things
  • creates an email server on your computer
  • uses your address book to email itself to
    everyone you know, thus it looks like its from
    you!
  • Your friend opens it too and the cycle
    continues..

14
Information Security Awareness
  • What can I do to prevent this?
  • Use care when opening attachments
  • You should never open an attachment unless you
    can answer YES to all three of the following
    conditions
  • I know exactly what this file is
  • I have scanned this file with my virus scan AND I
    have ensured that my virus scan was recently
    updated
  • I have verified the identity of the sender and
    their intentions via email or phone call.

15
Information Security Awareness
  • Anti-Virus Software
  • Campus License of Mcafee Virus scan
  • Can use at home
  • Available in ccls, download
  • Preconfigured for
  • Auto-updates
  • Full scans
  • No yearly subscription fees
  • Daily monitoring for virus trends

16
What Virus Protection Can Do
  • Detect Virii transmitted via e-mail, downloads,
    floppy disks, etc. before you get infected
  • Clean valid data files infected with a virus.
  • Detect delayed payload virii that are sitting on
    your hard drive or floppies.

17
What Virus Protection Cant Do
  • Recover files deleted by a virus.
  • Restore system files modified, damaged, or
    deleted by a virus.
  • Turn a virus-only file into useable data.
  • Remove some system and boot record infectors.

18
Information Security Awareness
  • Where do I get virus protection?
  • Campus Computer Labs
  • Links at http//security.uwm.edu

19
Information Security Awareness
  • Do I already have virus protection?
  • Departmental computers If you dont see the
    McAfee shield (below) on your computer in the
    bottom right hand corner contact help person for
    information on what you should be using on your
    office computer

20
Virus Hoaxes
  • Often you will see e-mails warning of some new
    virus that is making the rounds and erasing
    peoples hard drives, or doing some other
    terrible damage. Odds are its a hoax.
    Forwarding these warnings to everyone you know
    only propagates misinformation, and causes
    unnecessary panic.

21
Information Security Awareness
  • How do I know if I have a virus on my computer?
  • Strange behavior or you get a Mcafee pop-up
  • Unusual performance problems
  • Suspect you clicked on something bad
  • Where can I go for help if I think I have a virus
    on my computer?
  • Your areas computer help staff
  • Campus help desk 229-4040 or security.uwm.edu
    website
  • virus_at_uwm.edu

22
Information Security Awareness
  • How do I initiate a scan?
  • Whole hard drive
  • Single file
  • Remember
  • Anti Virus products are only as good as their
    last update!

23
Information Security Awareness
  • If McAfee finds a virus on my computer, now what?
  • It may clean it automatically
  • It may not be able to clean it because it is a
    program that is running
  • Restart in safe mode (hit f8 during
    pre-windows boot up)
  • Run scan again or manually clean it up
  • Check for documentation about the virus it
    identifies
  • http//vil.mcafee.com
  • http//securityresponse.symantec.com

24
Information Security Awareness
  • Practical McAfee Skills
  • Right Click on the McAfee Shield in the System
    Tray
  • Note the Update Now option
  • Choose VirusScan Console
  • Know how to start a full scan
  • Know how to view logs
  • Vil.mcafee.com
  • Know how to scan a single file
  • Know how to do simple research on a virus
  • Virus detection vs virus infection

25
Information Security Awareness
  • Spyware
  • Spyware is software that is installed on a
    computer to covertly gather information through
    your internet connection.
  • -used by Advertisers and Market Researchers

26
Information Security Awareness
  • Spyware
  • Spyware lurks on as many as 80 of computers
    nationwide, according to the National Cyber
    Security Alliance, a trade group.
  • In a recent survey, 31 of online shoppers said
    they were buying less than before because of
    security issues.
  • Fed up over problems stemming from viruses and
    spyware, some computer users are giving up or
    curbing their use of the Web
  • -LA Times article http//www.latimes.com/business/
    la-fi-fedup14jan14,0,111456.story?collla-home-hea
    dlines
  • .

27
Information Security Awareness
  • Spyware vs. Viruses
  • Viruses Mostly designed to propagate itself and
    damage network and computer performance
  • Spyware Designed to gain information from your
    computer by running unnoticed or providing some
    other service.
  • .

28
Information Security Awareness
  • I have an anti-virus program. Will this stop
    spyware?
  • Some spyware is detected by anti-virus products
    such as McAffee and Norton, but for the most part
    this is not the case.

29
Spyware has the potential to share personal
information with third parties without your
knowledge or consent.
30
Information Security Awareness
  • Increasing threat level!
  • Spyware type attack gains financial information
  • (http//www.eweek.com/article2/0,1759,1619842,00.a
    sp)
  • An attack in June of 2004 which had the ability
    to monitor web traffic for the purposes of
    gaining account numbers and passwords for victims
    online banking accounts.
  • While this attack also depended on other elements
    to be successful, it represents a disturbing
    trend for spyware toward increasingly invasive
    and disturbing attacks.

31
Information Security Awareness
  • Spyware two kinds voluntary vs involuntary
  • Voluntary
  • Programs installed intentionally to server a
    purpose that also report personal information to
    a third party
  • browser toolbars
  • browser help windows
  • free screensavers
  • internet speed optimizers
  • Anti-spyware programs

32
Information Security Awareness
  • Spyware
  • Voluntary Examples
  • Weatherbug
  • Webshots
  • Marketscore
  • How to avoid this?
  • 1. Google new things before installing
  • 2. Read your EULA
  • NUMEROUS ANTI-SPYWARE PRODUCTS ARE ACTUALLY
    SPYWARE!!
  • .

33
Information Security Awareness
  • Marketscore (voluntary)
  • Promises to increase your internet speed.
  • Passes ALL of your internet traffic through their
    servers

34
Information Security Awareness
  • Marketscore (voluntary)
  • Evil Eula
  • Accept Marketscore-provided software upgrades or
    changes to your system settings
  • Make reasonable efforts to configure all of the
    computers having Internet access that are used at
    home by anyone in your Household to use the
    Marketscore Network and, where allowed by company
    policy, on all such computers having Internet
    access that are used at work by anyone in your
    Household
  • Provide complete and accurate information about
    yourself and your Household as requested during
    registration for the Marketscore Network
  • Allow Marketscore to combine the information that
    you provide with information such as credit or
    prescription information from third parties

35
Information Security Awareness
  • Spyware
  • Involuntary
  • Programs you accidentally pickup on the internet
    that hook into your browser
  • symptoms include
  • Changed homepage
  • sluggish performance
  • new toolbars
  • lots more pop ups
  • How to avoid this?
  • 1. Stop using Internet Explorer
  • 2. Use a reputable anti-spyware program

36
Information Security Awareness
  • Suggested Anti-Spyware Products
  • Spybot
  • Ad-Aware
  • Giant Anti Spyware (Now Microsoft product)
  • Pest Patrol
  • Webroot Spy Sweeper
  • Other resource
  • Spywarewarrior.com

37
Information Security Awareness
  • Spybot
  • http//www.safer-networking.org/en/index.html
  • -real-time monitoring
  • -free product

38

Spybot- Main Screen
39

Spybot- Recovery Screen
40

Spybot- Immunization
41

Spybot- Immunization
42

Spybot- Update Screen
43

Spybot- Update Screen
44

Spybot- Tools/Resident
45

Spybot- Tools/System Startup
46
Information Security Awareness
  • Suggested Anti-Spyware Products
  • Spybot
  • Webroot Spy Sweeper
  • Ad-Aware
  • Giant Anti Spyware (Now Microsoft product)
  • Pest Patrol
  • Other resource
  • Spywarewarrior.com
  • http//www.pcmag.com/category2/0,1738,1639157,00.a
    sp

47
Information Security Awareness
  • Spyware
  • Prevention in detail
  • 1. Use Anti- Spyware software
  • 2. get rid of IE
  • 3. keep PC updated
  • 4. read your EULAs
  • 5. Google software that you are considering
    installing (app. Name term spyware)
  • 6. Avoid software that is advertised via
    pop-ups or SPAM.
  • .

48
Information Security Awareness
  • Stopping Hackers
  • All these steps help, but there are additional
    steps Windows PC users should take
  • 1. Password protect your PC and use strong
    passwords
  • 2. At home, deploy a router between you and the
    internet
  • 3. Ensure your PC is up to date and enable Auto
    Updates
  • 4. Use Virus Scan software
  • 5. Use a software firewall

49
Information Security Awareness
  • Stopping Hackers
  • 1. Secure all accounts on your PC and limit the
    number of accounts
  • Computer accounts should be
  • Password protected with a strong password
  • Limited to fewest possible number
  • (this is different on different versions)
  • Go to start/settings/control panel
  • Choose Users and groups
  • Choose Users
  • Rename the administrator account
  • Disable guest unless using Windows file sharing

50
Information Security Awareness
  • Stopping Hackers
  • What are Strong Passwords?
  • Minimum 8 characters
  • Capitalized/lower case
  • Some non-letter characters like, and
  • The trick to making passwords

51
Information Security Awareness
  • Stopping Hackers
  • Use a Router-helps hide your computer and may
    have firewall-type features.
  • Suggested if you are using Broadband at home
  • Includes Roadrunner, DSL
  • D-Link DI-604 30 Linksys BEFSR41 40

52
Information Security Awareness
  • Stopping Hackers
  • 2. Ensure your PC is up to date and enable Auto
    Updates
  • Go to start, and Windows Update
  • Alternately, open Internet Explorer and go to
  • http//windowsupdate.microsoft.com
  • -Windows XP Service Pack 2
  • AutoUpdate feature
  • May not be available on IMT or other campus
    machines
  • right click on My Computer, choose
    properties and choose the Automatic Updates
    tab

53
Microsoft Updates
  • Microsoft is continuously patching security
    flaws in its operating systems and other
    software. Without being up-to-date with security
    fixes, you leave your computer open to not only
    viruses, but also to hackers.
  • To ensure that you have the latest updates
  • Connect to the Internet
  • Click on START
  • Go to Windows Update
  • Allow the updater to be installed
  • Click on Scan for Updates
  • Select the updates you wish to download(Ensure
    that you get any Critical Updates or Security
    Updates)
  • Click on Review and Install Updates
  • Click on Install Now

54
Microsoft Updates
Select YES to this security warning to allow the
Windows updating program to be installed.
Service Pack
Critical Update
Security Update
55
Information Security Awareness
  • Stopping Hackers
  • 3. Use a Firewall
  • Firewall
  • A computer Firewall helps filter traffic and
    limits the kinds of communications your
    computer/network can have with the world

56
Information Security Awareness
  • Stopping Hackers
  • Software Firewall Products
  • Norton Personal Firewall 50

Zone Alarm free/40
57
Information Security Awareness
  • Email Safety Tips
  • Be careful with email attachments! - They can be
    an open door to your computer!
  • Avoid links to jokes, free downloads, etc. (Do
    you REALLY know where that link goes?)
  • Be aware of virus hoaxes (jdbgmgr.exe)
  • Do not submit personal data over email
  • Ssn
  • Address
  • Phone

58
Information Security Awareness
  • Email Safety Tips
  • Forged email addresses. i.e. From bob_at_uwm.com
  • This is simply text-can be forged for purposes of
    gaining personal information.
  • Do you REALLY know who you are sending that email
    to?

59
Information Security Awareness
  • Email Safety Tips
  • Your bank will not ask for personal information
    via unsolicited email
  • Neither we nor Microsoft will email you a patch
    to install via email attachment
  • Do you REALLY know who you are sending that email
    to?

60
Information Security Awareness
  • Internet Browser Safety Tips
  • Use an alternative browser
  • Mozilla Firefox (http//www.mozilla.org/)
  • Look for the Lock Icon/HTTPS when sending
    personal information over the internet
    (Panthermail Example)

61
Information Security Awareness
  • Passwords
  • Use strong passwords and change them regularly!
  • What are Strong Passwords?
  • Minimum 8 characters
  • Capitalized/lower case
  • Some non-letter characters like, and
  • The trick to making passwords

62
Information Security Awareness
  • Passwords
  • Epanther ID password characteristics
  • Do not use your name or variations of your name.
  • Do not use your address or other sequences of
    characters that someone may guess about you.
  • Use exactly 8 characters.
  • Include upper case as well as lower case letters,
    digits and non-alphanumeric characters.
  • Please do not use the backslash character.

63
Information Security Awareness
  • Fraud/Identity Theft
  • My purse was stolen in December. By February, I
    started getting notices of bounced checks. About
    a year later I received information that someone
    using my identity had defaulted on a number of
    lease agreements and bought a car. In 1997, I
    learned that someone had been working under my
    Social Security number for a number of years. A
    man had been arrested and used my SSN on his
    arrest sheet. Theres a hit in the FBI computers
    for my SSN with a different name and gender. I
    cant get credit because of this situation. I
    was denied a mortgage loan, employment, credit
    cards, and medical care for my children. Ive
    even had auto insurance denied, medical insurance
    and tuition assistance denied.
  • -From a consumer complaint to the FTC, January
    2, 2001

64
Information Security Awareness
  • Fraud/Identity Theft
  • Identity Theft is the use of someone elses good
    name and credit to obtain things you will never
    pay for.
  • Fraud/Identity Theft
  • Identity Fraud vs Identity Theft
  • Identity Theft When someone gathers personal
    information about you and assumes your identity
    as your own
  • Identity Fraud Consists mainly of someone
    making unauthorized charges to your credit cart

65
Information Security Awareness
  • What are some examples?
  • Email Scams (Citibank email) http//www.uwm.edu/s
    ab2/sample.htm
  • Dumpster diving
  • Credit Card information theft
  • Lost/Stolen Wallets
  • Bogus change of address requests

66
Information Security Awareness
  • Fraud/Identity Theft
  • Statistics
  • 1. Approximately 7 million people were victims of
    identity theft in 2002. That breaks down to a
    little more than 13 identity thefts every minute.
  • 2. 85 percent of all identity theft victims find
    out about the crime only when they are denied
    credit or employment, contacted by the police, or
    have to deal with collection agencies, credit
    cards, and bills.
  • 3. On average, victims spend 600 hours to fix the
    damage. The time can add up to as much as 16,000
    in lost wages or income.
  • http//www.insideid.com/idtheft/article.php/343826
    1

67
Information Security Awareness
  • Fraud/Identity Theft
  • How Victims Information is Misused (2003)
  • 33 credit card fraud
  • 21 phone or utilities fraud
  • 17 Bank Fraud
  • 6 Loan Fraud
  • -Courtesy of FTC

68
Information Security Awareness
  • Fraud/Identity Theft

69
Information Security Awareness
  • What are some methods of stealing identities?
  • Stealing records from employer
  • Abusing access to credit reports (landlords,
    employers)
  • Email Scams (Phishing)
  • http//www.uwm.edu/sab2/sample.htm
  • Simply stealing your mail
  • Computer Hacking/Theft
  • Skimming
  • Dumpster diving
  • Credit Card information theft
  • Lost/Stolen Wallets
  • Bogus change of address requests
  • Pretext Calling

70
Information Security Awareness
  • What do thieves do with this information?
  • Open credit card and bank accounts in your
    name/credit
  • Change the billing address for current accounts
  • Take out auto loans
  • File for bankruptcy in your name
  • Identify themselves as you when being arrested
  • Obtain IDs/ driver licenses in your name
  • Open cell phone or utility bills, then not pay
  • Change of address requests

71
Information Security Awareness
  • What does it take to steal someone's identity?
  • Name
  • Social Security Number
  • D.O.B.
  • Mothers maiden name
  • Address
  • Phone number

72
Information Security Awareness
  • Fraud/Identity Theft
  • How Can I Tell if I'm a Victim of Identity Theft?
  • Monitor the balances of your financial accounts.
    Look for unexplained charges or withdrawals.
    Other indications of identity theft can be
  • failing to receive bills or other mail signaling
    an address change by the identity thief
  • receiving credit cards for which you did not
    apply
  • denial of credit for no apparent reason or
  • receiving calls from debt collectors or companies
    about merchandise or services you didn't buy.
  • -(UWM Police Department)

73
Information Security Awareness
  • Fraud/Identity Theft
  • How can I detect it?
  • Order a copy of your credit report regularly
  • When you do your taxes?
  • Credit bureaus
  • Equifax, 800-525-6285
  • Experion, 888-397-3742
  • TransUnion, 800-680-7289.

74
Information Security Awareness
  • Free credit reports available March 1
  • Online
  • Fair and Accurate Credit Transactions Act of
    2004.
  • www.annualcreditreport.com gets you all 3
    reporting agencies
  • (actually have to type the address in!)
  • Stick with that site. There are many reporting
    companies, some with strings or costs attached
  • By Phone
  • 877-322-8228
  • By Mail
  • Fill out the form (linked below) and mail it to
  • Annual Credit Report Request Service, PO Box
    105281, Atlanta, GA 30348-5281.
    www.ftc.gov/bcp/conline/edcams/credit/docs/fact_ac
    t_request_form.pdf.

75
Information Security Awareness
  • Fraud/Identity Theft
  • How can I prevent it?-other tips
  • Shred everything with you information on it that
    you dont need
  • Place passwords on bank and credit cards
  • Store card information separately
  • Dont write pin s anywhere
  • Dont provide personal info unless you initiated
    the contact
  • More email cautions
  • Secure personal information in your home

76
Information Security Awareness
  • What can I do if I think its already happened to
    me?
  • Contact the fraud departments of any one of the
    three credit bureaus or the clearinghouse
    mentioned earlier to place a fraud alert on your
    credit file.
  • Close the accounts that you know or believe have
    been tampered with or opened fraudulently.
  • File a police report. Get a copy of the report to
    submit to your creditors and others that may
    require proof of the crime.
  • File a complaint with the FTC using the ID Theft
    Affadvit. The FTC maintains a database of
    identity theft cases used by law enforcement
    agencies for investigations.

77
Information Security Awareness
  • What can I do if I think its already happened to
    me?
  • Keep a running record of everything
  • Get it in writing!

78
Information Security Awareness
  • Resources
  • UWM Police Department
  • http//www.uwm.edu/Dept/police/identity.html
  • Federal Trade Commission
  • http//www.ftc.gov

79
Information Security Awareness
  • What can I do to physically secure my
    information?
  • Lock your workstation
  • Dont leave stuff laying around
  • Lock up when possible
  • Surplus equipment properly
  • Shred documents

80
Information Security Awareness
  • Surplus Equipment
  • Disposal
  • EHS/RM Disposal Program
  • http//www.uwm.edu/Dept/EHSRM/HAZEXCEPTIONS/escrap
    .html
  • Cascading Equipment (giving to other staff)
  • Use Autoclave or similar cleaner
  • http//staff.washington.edu/jdlarios/autoclave/

81
Information Security Awareness
  • Basic Home Computer Security Steps
  • Run Virus Scan and keep up to date
  • Run Anti-Spyware program and keep up to date
  • Password protect your PC and use strong passwords
  • Keep your Operating System and other software up
    to date
  • Limit physical access to your computer
  • Install a firewall
  • Install a router
  • Use an alternative browser
  • Backup your files on a regular basis
  • Behaviour Checklist ( I dont need to hack you
    if its easer to fool you!)
  • Be cautious with email attachments
  • Research new programs you are thinking of
    installing
  • Know where to go for help

82
Information Security Awareness
  • Resource List
  • Virus Protection
  • http//vil.mcafee.com
  • http//www3.uwm.edu/security/virus/mcafee.cfm
  • http//vil.mcafee.com/hoax.asp
  • Hacker Thwarting
  • http//www.cert.org/tech_tips/before_you_plug_in.h
    tmlIII
  • http//www.microsoft.com/security/default.mspx
  • Spyware
  • http//spywarewarrior.com/
  • http//www.safer-networking.org/en/index.html
  • http//www.mozilla.org/
  • http//www.pcmag.com/category2/0,1738,1639157,00.a
    sp
  • Email Safety
  • http//www3.uwm.edu/security/steps/step_2.cfm
  • Identity Theft
  • http//www.ftc.gov
  • http//www.fraudwatchinternational.com/idtheft/idt
    heft.htm
  • Physical Security
About PowerShow.com