Security and Compliance with Security Standards/ Boss's Day Investigator Scott Haugaard FBI Cyber Task Force – Omaha

Topics Communication Identity Authentication Phishing Internal Employee Threats Reporting Security Events

Trends and the Future Thin Clients Cloud Computing Cellular technology going away? Regional Wifi with your Internet Service Provider Encryption and other types of authentication Two-factor authentication

UNCLASSIFIED//FOUO UNCLASSIFIED//FOUO

What is the biggest threat to your organization?

Insider Threat #1 TRUSTING EMPLOYEE Disgruntled employee Customer Service Oriented 80% Disgruntled employee Terminated Disagreement with management Policy change 19% Insider with access Paid money to complete a task Directed by foreign power Resources 1%

INFOSEC

Security and Safety are synonymous… Always have a plan!

Why do we have security in your organization? SAFETY! LIABILITY Privacy concerns Copyright violations Identity Theft REPUTATION PROTECTION CLIENT AND CUSTOMER EXPECTATIONS Compliance, laws and regulations

Do you know what to do and who to contact if a security incident occurs?

Physical Security Internal Theft Tailgating or Piggybacking into your area Shoulder surfing Lock your desk and keyboard Clean desk policy

What's in the Trash? Dumpster diving is a technique used by law enforcement and criminals to find information or contraband that has been improperly discarded. Credit cards Checks Floor plans and schematics Photocopies of Drivers Licenses Financial records

Social Networking Annually check your privacy settings Check and clear out your “Friends” list Make a point to talk to your family about security Are you volunteering too much information NEVER USE YOUR PASSWORD FROM WORK AT HOME

Mobile Device Security Personal Electronic Device (PED) Phones Tablets Laptops ALWAYS HAVE A PIN or password Encrypt your device Enable restrictions Enable “Lost” mode

Credit Reports Proactive approach to your own security Free annually: annualcreditreport.com Itemize and verify your accounts to ensure they are yours Tax Season is a good time to do this?

INFOSEC Best Practices Never write down passwords and leave unsecured Never share passwords Never click on links or open attachments to untrusted sources Use AV and Firewalls and don’t disable them Don’t send sensitive data over unencrypted channels Dispose of data properly Don’t run programs from untrusted sources Properly secure information when not in use Verify you are speaking to the correct person If something seems to good to be true, it probably is

Social Engineering Employees are the weakest link All of the security measures in your company are defeated if you share your passwords and hold the door open for someone you don’t know Attempts to gain access Confidential information and credentials Access to sensitive areas and equipment Social Engineering can take many forms: In-person Email Phone Mail

Email Most common type of attack Best Practices Phishing Malicious attachments Hoaxes SPAM Scams Best Practices Don’t talk to people you don’t know or can’t verify Don’t open attachments from unknown sources Don’t follow links Don’t attempt to “unsubscribe”

Phishing Deceptive emails to get users to click on malicious links or open attachments Enter sensitive data Run applications Websites - Can and often do look like legitimate sites Banking (US Bank, FNB) PayPal / eBay Gov’t Sites Texting Vishing – combination of Voice or video call

Common Technology Facilitated Crimes Criminal Cyber ACH Fraud Identity Theft Internet Fraud Criminal Intrusions Stalking Harassment Child Exploitation Child Pornography Child Sexual Assault Online Enticement Human Trafficking Gangs Drugs Liquor Traffic Enforcement Public Corruption

Sextortion Online exploitation of an individual to disrobe and video a sexual act for the purpose of extortion NEVER TALK TO A STRANGER

Selfies, your child producing porn We could not tell you how many children we have seen nude in front of the mirror in one of your bathrooms!!! Short term consequences Humiliation at school or other activities Extorted Suicidal thoughts or ideas Long term consequences Employment opportunities Your child will always be remember as “that person that…” Your digital video camera Your digital camera Cell phone Computer Webcam Have you had a specific conversation with your child about this topic??? Please don’t wait.

Ransomware

PHISHING UNCLASSFIED

It is small for a reason…Think about reading emails on your phone! Fraudulent Email Accounts publicrelations@armamebraska.org kperkins@armanebraska.org Kim.Perkins@armanebraska.org Kim.Perkins@nngcom.com It is small for a reason…Think about reading emails on your phone!

Fraudulent Email Accounts publicrelations@armamebraska.org – not “m”, it is “n” kperkins@armanebraska.org – webmaster has a problem Kim.Perkins@armanebraska.org webmaster has a problem Kim.Perkins@hushmail.com – never use personal email Kim.Perkins@nngcom.com – no “m”

UNCLASSIFIED//FOUO Hacktivism Attempt to cause disruption to networks and service and loss of data Actions are non-violent and not aimed at individuals, but rather a company or government entity Retaliation Recent threats – financial, Industrial Control Systems (ICS), etc.