Jason C. Belford Information Security Briefing Staff Senate November 2, 2017 Information Security Briefing Staff Senate Jason C. Belford Chief Information Security Officer

Obligatory Legal Disclaimer This presentation is for general  educational purposes only, and is not intended as legal or specific security advice.  The presenter is neither an attorney nor associated with law enforcement.  Opinions presented  are those of the presenter, not his employing institution.  For legal and information technology security advice, please consult appropriate professionals who can address your particular needs. Slide Number

Threat Landscape Slide Number

Who are the bad guys? Slide Number Rivals Script Kitty Kiddie Nation State Actors Organized Crime Insider Threat Hacktivism Slide Number

What do they want? Slide Number Money Data Trade Secrets Access Everything Revenge Slide Number

Your Email – the Connection to Everything Slide Number https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/

How are they going to get it? Disregard for laws, policies, rules Exploit Vulnerabilities Malicious Software Social Engineering Phishing Brute Force Slide Number

Security Incidents Slide Number

It is WHEN not IF 2012 2014 2015 2013 Slide Number

Summer 2015 August 14, 2015 August 14, 2015 The University of Virginia shut down access to many of its information technology systems Friday in response to a cyberattack that originated in China, the university announced in a release. Slide Number

Winter 2016 January 20, 2016 Slide Number

UPDATE! November 22, 2016 ...the arraignment Friday of two Nigerian citizens who were extradited from Kuala Lumpur, Malaysia, to Atlanta to face charges. Damilola Solomon Ibiwoye and Olayinka Olaniyi are accused in a series of alleged “phishing scams” targeting Georgia Tech and other colleges and universities across the country. Guilty

Summer 2017 Slide Number

Fall 2017 October 12, 2017 “student accounts were compromised when a fraudulent email told students they could get a reduction in fees.” Slide Number

Most Popular Method? Slide Number

PHISHING Phishing is a fraudulent activity that attempts to acquire sensitive information such as usernames, passwords and credit card numbers by masquerading as a trustworthy and legitimate entity SCAM https://en.wikipedia.org/wiki/Phishing

Phishing for Username / Password – Example Slide Number

Phishing for Money Transfers – Example trr5r@virginia.edu accounting@gmail.com Slide Number

Phishing for Infections – Example Slide Number

Phishing for Infections – Example Slide Number

Cyber Self Defense Slide Number

https://netbadge.virginia.edu/ https://netbadge.virginia.edu/ Find the Domain https://netbadge.virginia.edu/ https://netbadge.virginia.edu/ https://netbadge.virginia.edu/ https://netbadge.virginia.edu/ Slide Number

https://netbadge.virginia.edu/ Find the Domain https://netbadge.virginia.edu/ Ignore everything before the domain! https://virginia.edu.EveLPhish.com/ Slide Number

https://netbadge.virginia.edu https://netbadge.virginia.edu/index.cgi Find the Domain https://netbadge.virginia.edu The 3rd slash may be optional if the domain is the last part of the line https://netbadge.virginia.edu/index.cgi Slide Number

What is UVA doing to help protect you from Phishing? Slide Number

Technical Controls https://securityblog.switch.ch/2015/05/07/protect- your-network-with-dns-firewall/

Non-technical Controls

Phishing Simulation – Fall 2016 Slide Number

Phishing Simulation – Fall 2016 Slide Number http://payroll.virginia.services/?rid=…

DNS Firewall Block Slide Number

2-Step Slide Number

2-Step 10 different methods

Speaking of authentication… Slide Number

Pick a good password Cav2468! Slide Number

Pick a good password Ca$d0V’n, Slide Number

Pick a good password Mr. Thomas Jefferson Slide Number

Wah-hoo-wah,wah-hoo-wah! Pick a good password Wah-hoo-wah,wah-hoo-wah! Slide Number

Pick a good password passphrase Cav2468! Ca$d0V’n, Mr. Thomas Jefferson Wah-hoo-wah,wah-hoo-wah! Number of Characters 8 9 20 25 Character Classes 4 3 How Secure? Weak Very Strong Time to Crack? ~ 1 minute ~ 2 hour 1.25 thousand trillion centuries 5.53 trillion trillion centuries Slide Number

My Advice Freeze your credit Review your credit reports and financial statements Identify the real ”domain” (only click if it makes sense) Do not open unexpected attachments Verify! Verify! Verify! Use long, unique passwords Use 2-step login for any services that allow it Back up your files, regularly Do not provide sensitive information over email When in doubt, stop and ask Slide Number

He who knows best knows how little he knows. --Thomas Jefferson Questions ? He who knows best knows how little he knows. --Thomas Jefferson