1 #UPAugusta2016

2

3 Today’s Topics What are Deadly IT Sins? Know them. Fear them. Fix them. #UPAugusta201 6

4 What are Deadly IT Sins? Common security pitfalls that are often overlooked … …putting your network and data at risk! #UPAugusta201 6

5

6 Are you afflicted? Mobile Negligence Unsafe practices 64% of users don’t lock their phones Malware Growth Android malware up 1800% in the last 12 months Data Theft Financial Consequences Lost Productivity +

7 The path to absolution Make sure you can manage and secure your mobile devices and your corporate network Mobile Device Management: Enforce strong passwords Control unwanted/unknown apps Block Android malware Mobile Network Protection: Next-generation Firewall Mobile Network Access Control Advanced Threat Protection

8

9 Mac Malice As Macs become more common in corporate environments, attackers are increasingly targeting them. Macs are an easy target because they often lack endpoint protection Malware signed with a working Apple Developer ID is on the rise Macs host and spread Windows malware Don’t let Macs be the chink in your security armour!

10 Example: Mac Ransomware

11 Turn that malice into loving care 1.Keep unsigned applications off your Macs 2.Ensure your Macs are secured with business-grade endpoint protection 3.Provide your Macs the same loving policies you provide your Windows systems Common security loophole Web control policies for PC users are enforced on their Windows machines. But if the policy doesn’t extend to Macs, they become the weak link in your security.

12

13 Unsecure Wi-Fi Project Warbike, London: 107,000 wireless networks surveyed 27% had poor or no security Highest density in streets with high numbers of small business Unsecure Wi-Fi puts your network and your data at risk

14 Examples: WiFi Attacks Passive Attacks ￮ Evesdropping… Snooping data ￮ Impossible to detect… Steal contents Active Attacks ￮ Access the network ￮ Setup Man in the Middle ￮ Snoop Traffic ￮ Redirect Users ￮ Authenticate to servers ￮ Steal Data ￮ Denial of Service Passive Attack Active Attack

15 Be a Saint not a Sinner 1.Use business grade WiFi access points 2.Enforce standard network security policies 3.Scan all network traffic 4.Block access for insecure mobile devices 5.Provide connection profiles for your users 6.Keep guest networks separate 7.Keep it simple The Forrester Wave: Wireless Local Area Network Solutions, Q3 2014, Forrester Research, Inc., August 29, Make sure your Wi-Fi network – and the data on it – is secure. Forrester 5 S’s Scalable Shared Simplified Standardized Secure

16

17 Un-encrypted billion s sent every day Data loss Snooping

18 Quiz: What’s Your Phishing IQ

19

20 Facebook Quizzes

21

22 Example: Sinfully Unencrypted Laptops

23 Redemption the easy way Your checklist for encryption: 1.Use full-disk encryption on all laptops 2.Use server encryption 3.Encrypt your (see Sin #4) 4.Implement file encryption across cloud and mobile devices 5.Reporting, Management, Auditing

24

25 Delinquent Web Filtering 40,000 New web threats every day $400M Stolen through GameOver malware Blogs Web Hosting Business Shopping Education Technology Entertainment Automotive Health Adult Top 10 infected web site categories 80% Malware on legitimate sites

26 Example Web Attack Drive-by-download from a hijacked website or an with a malicious link Initial malware redirects based on what it’s working with (Windows/Mac, IE/Safari, Java) Exploit pack attempts to leverage a number of vulnerabilities Download of a malicious payload Malware calls home with sensitive data Entry Point Distribution Exploit Infection Execution

27 Exorcising Delinquent Web Filtering Web Security Checklist: Spam filtering Real-time URL reputation filtering Web malware scanning JavaScript emulation Behavioral Analysis HTTPS Scanning Advanced threat detection Real-time cloud updates Business-grade AV with HIPS + Protection Everywhere Users Go!

28 Share what you’ve learned today with the rest of your team. Follow the link to find an hour-long video that expands on what we’ve discussed today. info.grcs.com/7-deadly-it-sins Questions?

29 © Sophos Ltd. All rights reserved. grcs.com