Chapter 4: Practical Approaches to Security Page 47-79 Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 47 Security Exhaustion At some point being told to do something but not sure what has translated into lets do nothing an hope: Fact – 63% of the respondents in a recent survey indicated they were facing security fatigue. So people start to: They are not personally at risk, there is nothing they have that anybody wants. Someone else is responsible for security, or I have stuff that will take care of everything. Nothing they do will change a thing so what will happen will happen. Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 47 Physical Security The PRIMARY risks: Unencrypted data on laptops Servers not physically secure Desktops left unprotected / no screensaver passwords Mobile devices used at work, BYOD Devices with USB ports Unreliable power sources Unsecured WiFi networks Bad backup policies Chapter 4: Practical Approaches to Security

Top Ten (Thirteen) Threats to Computers Page 48-49 Top Ten (Thirteen) Threats to Computers Infection Vectors Spam Mail/Phishing Mail BYOD (personal devices in the workplace) Wireless Attacks Bad Web Sites Adware Social Engineering Client USB thumb drives and DVDs Infection Agents Viruses Worms Trojan Horse Programs Rootkits Spyware Adware Ransomware The threats to our systems we will address Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 49 Five Imperatives Keep every computer updated Have & use protection: Have up-to-date backups Have Security protocols Regular maintenance Surprise audits Procedures for emergencies Practice “safe computing” Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 50 Configuring Windows Have Automatic Updates ON Update programs too Chapter 4: Practical Approaches to Security

Second Imperative – Have Adequate Defenses Page 52 Second Imperative – Have Adequate Defenses These are not set it and forget devices Hardware firewall – Not an issue of years but an issue of functionality Software firewall – This is software that requires updating, depend of the developer to make the call Virus Program - This is software that requires updating, depend of the developer to make the call Several Spyware / malware programs - This is software that requires updating, depend of the developer to make the call Chapter 4: Practical Approaches to Security

Second Imperative – Have Adequate Defenses Page 52 Second Imperative – Have Adequate Defenses Hardware firewall Manages Inbound Traffic Firewall Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 53-56 Step 1 – Use a Firewall Three of the top contenders per firewall.com ranging in price from $440 to $1520. Buying is not the most important part it is setting it up. Chapter 4: Practical Approaches to Security

Things to Remember about Firewalls Page 56 Things to Remember about Firewalls Don’t assume that a firewall will solve all security problems. Firewalls may be great at stopping unwanted intrusions, but they do nothing to prevent virus-laden emails or stop adware and spyware. Hardware firewalls will not manage outbound traffic, which means that should a piece of malware find its way on a computer, it could be turned into a spam server on the internet. The sole purpose of a hardware firewall is to cloak a computer and stymie inquisitive software that pings, sniffs, and queries IP addresses in the hopes of finding an open system. They must be set up properly. An enormous number of these devices are unboxed, plugged in, and considered to be installed. There is a setup process the directions will specify to configure the device for different situations. One of the biggest problems is users failing to change the device password to a user-specific one. Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 56 Test your Firewall www.grc.com This is how I know my firewall is okay Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 56-57 Software Firewalls Software firewall – Win 7 Firewall, engaged Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 56-57 Software Firewalls Type Here Chapter 4: Practical Approaches to Security

Page 57-58 User Account Control While you’re at it, why not remove the batteries from your fire alarm? Chapter 4: Practical Approaches to Security

Step 2 – Antivirus and Anti-Malware Programs Page 59-60 Step 2 – Antivirus and Anti-Malware Programs The answer is it depends who you talk to, there is no perfect here, the true cat an mouse game continues. Note an update from the manual publication has changed the top ranking product. Image courtesy of https://www.pcmag.com/article2/0,2817,2369749,00.asp Chapter 4: Practical Approaches to Security

Step 2 – Antivirus and Anti-Malware Programs Page 59-60 Step 2 – Antivirus and Anti-Malware Programs The answer is it depends who you talk to, there is no perfect here, the true cat an mouse game continues. Note an update from the manual publication has changed the top ranking product. Image courtesy of toptenreviews.com Chapter 4: Practical Approaches to Security

Step 2-Antivirus and Anti-malware Programs Page 60 Step 2-Antivirus and Anti-malware Programs Chapter 4: Practical Approaches to Security

Step 2 – Antivirus and Anti-Malware Programs Page 60 Step 2 – Antivirus and Anti-Malware Programs Chapter 4: Practical Approaches to Security

The Microsoft Response Page 61 The Microsoft Response It comes with Win 10 Chapter 4: Practical Approaches to Security

The Microsoft Response Page 61 The Microsoft Response Freeware Security: Ok performance – Win 7 Chapter 4: Practical Approaches to Security

The Microsoft Response Page 61-Update The Microsoft Response https://www.microsoft.com/en-us/wdsi/products/scanner Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats. Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 62 Fake Anti-Malware Bogus! Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 62 Fake Anti-Malware Bogus! Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 63 Fake Anti-Malware https://en.wikipedia.org/wiki/List_of_rogue_security_software Chapter 4: Practical Approaches to Security

Preventing/Rescue from Ransomware Page 66-67 Preventing/Rescue from Ransomware Where does this stuff come from: Work computers on personal surfs Free software Downloads eBook Sites Porn Sites Pirated Movies and Music Email attachments Cloud Based file Sharing Sites Pay the ransom (typically $300 - $500) and you may or perhaps not get your data unlocked. Chapter 4: Practical Approaches to Security

Preventing/Rescue from Ransomware Page 67 Preventing/Rescue from Ransomware Chapter 4: Practical Approaches to Security

Preventing/Rescue from Ransomware Page 67 Preventing/Rescue from Ransomware To defend against these attacks: Adopt prevention programs. Strengthen email controls. Insulate infrastructure. Limit the access a workstation has based on need. “Domain Controllers” will complicate systems but improve security. If using a cloud based filing system this will not thwart the attack. Plan for the attack. Chapter 4: Practical Approaches to Security

Preventing/Rescue from Ransomware Page 67-Bonus Preventing/Rescue from Ransomware Helpful Sites: https://insights.sei.cmu.edu/sei_blog/2017/05/ransomware-best-practices-for-prevention-and-response.html https://www.business.com/articles/how-to-protect-from-ransomware-summarizing-the-best-practices/ https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/best-practices-ransomware https://businessinsights.bitdefender.com/best-practices-preventing-responding-ransomware-attacks Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 68 What To Do if Infected Be Prepared by: Chapter 4: Practical Approaches to Security

Can this Stuff Be Kept off the Computer? Page 68 Can this Stuff Be Kept off the Computer? Anti-virus will not protect you! There are programs that will Cryptoprevent: $ 15 www.foolishit.com Chapter 4: Practical Approaches to Security

Can this Stuff Be Kept off the Computer? Page 69-Update Can this Stuff Be Kept off the Computer? Alternate: HitmanPro.alert $54.95 for 3PCs https://www.hitmanpro.com/alert.aspx Chapter 4: Practical Approaches to Security

Can this Stuff Be Kept off the Computer? Page 69-Bonus Can this Stuff Be Kept off the Computer? Chapter 4: Practical Approaches to Security

Can this Stuff Be Kept off the Computer? Page 69-Bonus Can this Stuff Be Kept off the Computer? https://malwarebytes-anti-ransomware.en.softonic.com/ Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 69-70 SPAM Mail The best way to avoid spam is to use a hosted filter. The best are provided with Gmail and Outlook. It’s easy to redirect mail so it passes through Gmail. Simply configure the current email host to forward the mail to a Gmail account. Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 69-70 Spam Mail 89% of all emails are Spam 260 Billion spam emails per day Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 71 Wireless Attack Consider not using wireless inside the office firewall. Any public access wireless in your office should be outside your firewall. Always turn on security: Set up passwords and logins on routers Do not allow the WiFi to be discoverable, i.e. you must know it is there, limits accidental intrusion's. Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 72 Facebook Dangers While Face Book is almost a requirement of commercial firms today, careful use of the resource is a must. Imperative – Ban Facebook while staff is on premises Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 72-73- Bonus Safe Facebooking Managing your social media presence is a safe computing imperative. Frank Abiginale a thief turned consultant for the FBI indicates that especially Americans willingly turn over an incredible amount of information to almost anyone. http://www.trustedreviews.com/opinion/facebook-privacy-settings-protecting-what-you-care-about-2939307 Chapter 4: Practical Approaches to Security

Having a “Disaster Day” SOP Page 73 Having a “Disaster Day” SOP Do you know what you’ll do if you have a disaster? Who does what? Tools available? Policies People aware, ready and trained? Chapter 4: Practical Approaches to Security

Having a “Disaster Day” SOP Page 73 Having a “Disaster Day” SOP Do you know what you’ll do if you have a disaster? Who does what? Tools available? Policies People aware, ready and trained? Chapter 4: Practical Approaches to Security

Having a “Disaster Day” SOP Page 74 Having a “Disaster Day” SOP Do you know what you’ll do if you have a disaster? Who does what? Tools available? Policies People aware, ready and trained? Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 74-77 Some Chapter Titles Safe Computer Usage – Page 74 Social Engineering – Page 74 – 75 Staying Safe Online – Page 75 How to Prevent Infection – Page 75 – 77 A 22 item checklist of what to do to keep your system running smooth and event free Chapter 4: Practical Approaches to Security

Virtual Private Networks Page 47 Virtual Private Networks A VPN is an encrypted tunnel over a public wire between two points. This can be used by: A person on a public WiFi can mask their identity. Someone who requires their IP address to be cloaked. Someone who is transmitting confidential data over a public wire. Chapter 4: Practical Approaches to Security

Virtual Private Networks Page 77-78 Virtual Private Networks Caution – A VPN connection will normally slow down the internet connection: The Steps: A service that is signed up for costing as little as $3 a month. Once the service is arranged for a connection will normally be tunneled through the service. VPN connections will increase your security and open the internet to broader access Your IP address will be hidden from every site a connection is made to. Chapter 4: Practical Approaches to Security

Virtual Private Networks Page 78 Virtual Private Networks http://www.toptenreviews.com/software/privacy/best-proxy-services/ Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 78 Downloading Programs Chapter 4: Practical Approaches to Security

Chapter 4: Practical Approaches to Security Page 78-79 Additional Resources Chapter 4: Practical Approaches to Security