Device Management and Security NTM 1700/1702

Learning Outcomes Students will manipulate multiple platforms and troubleshoot problems when they arise. Students will protect local devices from security threats including viruses, malware, and adware using current best practices and technologies. NTM 1700

Cybercrime Hacker/hacking Identify theft Acceptable use policies Piggybacking Identify theft Rogue Wi-Fi hotspots Acceptable use policies Acceptable Use Policies Locate acceptable use policies for Weber State http://www.weber.edu/ppm/Policies/6-22_StudentCode.html See Student Responsibilities (C16) NTM 1700

Computer Virus Small software program that spreads from one device to another Viruses can be benign or have a negative effect. Stoned Virus – “This PC is now stoned, legalize marijuana” (boot sector virus) Michelangelo – ran on his birthday March 6th, affected the boot sector of the computer or disk. Boot Sector is the most basic or root section of a disk. It is the first place a computer looks for executable files. NTM 1700

NTM 1700

What does it do? Interferes with computer operation May corrupt or delete data May delete entire hard drive NTM 1700

How is it spread? Via email attachments Funny images Greeting cards Audio or video files Via instant messaging messages Internet downloads Hid in pirated software If you don’t know the source, don’t open it. NTM 1700

Is my Computer Infected? Runs slower than usual Stops responding or locks up frequently Crashes and restarts every few minutes Applications do not work properly (distorted menus/dialog boxes) Drives are not accessible Items do not print correctly See unusual error messages http://www.kaspersky.com/internet-security-center/threats/mac NOTE: Common signs of a computer virus. However, many could be caused by hardware or software problems that have nothing to do with a virus. Make sure you install MS Malicious Software Removal Tool and keep your antivirus software up-to-date. NOTE: Windows functions that can be affected Double extension on an attachment you recently opened Antivirus program disabled and can’t be restarted Antivirus program can’t be installed or will not run New icons appear that you did not put there or icons not associated with installed programs Strange sounds or music plays from speakers unexpectedly A program disappears even though you did not intentionally uninstall it http://windows.microsoft.com/en-us/windows/does-computer-have-virus#1TC=windows-7 NTM 1700

HOW to remove? Need some type of virus removal tool Keep it updated Run full scans on the computer Some spyware and computer virus programs will reinstall themselves even after being removed. NTM 1700

How does an antivirus program inoculate a program file? Records information about program Attempts virus file removal Uses information to detect if virus tampers with file Quarantines infected files Keeps file in separate area of hard disk Information such as file size and creation date Quarantines infected files it cannot remove NTM 1700

Built-IN Antivirus Programs Windows Defender http://windows.microsoft.com/en-us/windows7/products/features/windows-defender http://windows.microsoft.com/en-us/windows/understanding-defender-realtime-protection#1TC=windows-7 IOS Gatekeeper Most of the software will also protect against worms and Trojan horses http://anti-virus-software-review.toptenreviews.com/op Ten Reviews by Randall Sutherland for 2014 http://www.apple.com/osx/what-is/security.html NTM 1700

Antivirus Programs AVG Antivirus AVAST Pro Antivirus McAfee VirusScan Norton AntiVirus G Data AntiVirus BullGuard Antivirus http://anti-virus-software-review.toptenreviews.com/ Most of the software will also protect against worms and Trojan horses NTM 1700

Prevention Never open an attachment containing an executable file from an e-mail. Executable extensions include Exe Com vbs An executable file can cause damage Scan all downloaded programs or files You can protect yourself against viruses with a few simple steps: Even with a secured operating system, buying virus protection software is a nice safeguard. Avoid programs or files from unknown sources (like the Internet) Use of commercial software purchased on CDs will eliminate most of the risk from traditional viruses. Set your default, so that any files are automatically scanned before downloaded. NTM 1700

Worms Programs that Reproduce Execute independently Travel across network connections Key difference from virus Virus dependent Host file Boot sector A computer worm is a self-replicating malware computer program. It uses a computer network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer. Infected file replicates itself, taking up all space on hard drive Infected file sent to all contacts in address book Reformat the hard drive which deletes files and programs May install hidden programs such as pirated software. This may then be distributed and sold from your pc May reduce security, allowing other to remotely access your PC You open a strange attachment Dialog boxes appear System degradation in performance occurs Someone tells you that they received an email message from you with attached files you did not send. .exe, .bat, .scr and .vbs extensions NTM 1700

NTM 1700

Trojan Horse Appear to be useful software/infects computer when application is run What do they do? Annoy Malicious Create a backdoor May erase a hard drive Do not self-replicate or infect other files Annoying – change your desktop, add silly active icons to desktop Malicious – delete files, destroy information Backdoor – allows malicious users access to your system possibly allowing confidential info or personal info to be compromised NTM 1700

Logic Bomb A virus triggered by certain logical conditions such as opening a file NTM 1700

Clickjacking Runs malicious software when a button, graphic, or link is clicked NTM 1700

Macro Virus Embedded virus in a Microsoft Office document – runs when macro enabled NTM 1700

What is Malware Programs acting without user knowledge that deliberately alter the computer’s operations http://www.microsoft.com/security/pc-security/malware-removal.aspx Short for malicious software – any software used to disrupt computer operation, gather sensitive information or gain access to private computer systems Follow the links to website definitions NTM 1700

Spyware Don’t just install Anti-spyware Be sure to run it often Short for malicious software – any software used to disrupt computer operation, gather sensitive information or gain access to private computer systems Follow the links to website definitions NTM 1700

Adware http://www.spychecker.com/spyware.html http://download.cnet.com/topics/adware http://www.lavasoft.com/ Short for malicious software – any software used to disrupt computer operation, gather sensitive information or gain access to private computer systems Follow the links to website definitions NTM 1700

scareware NTM 1700

Rootkit Program that hide on computer Allows remote access Take full control Change settings Monitor activity Access files Execute programs From Webopedia http://www.webopedia.com/TERM/R/rootkit.html Activated each time you boot your system Difficult to detect because they activate before OS completely boots up Allows installation of hidden files, processes, hidden user accounts in the systems OS Capable of intercepting data from terminals, network connections and keyboard NTM 1700

Web Bugs Invisible images or html code hidden within a web page or email that can be used to transmit information back to the source of the bug. NTM 1700

What is spam? Spam in unsolicited e-mail message Microsoft Apple NTM 1700

What can you do? Security features in the MS Windows security center/Mac Enable Internet firewall Antispyware software Antivirus software Automatic updates www.microsoft.com/security/malwareremoval/default.mspx Trojan Remover won't look specifically for spyware, but it does scan your system for Trojans, and removes any that it finds. (Shareware/Windows) ZoneAlarm detects Trojans, and protects your PC from hackers in many other ways as well. It's a must-have for anyone concerned about security. (Free/Windows) Ad-aware detects W32.Dlder.Trojan, as well as many other kinds of spyware, and removes the ones you tell it to. (Free/Windows) Make sure that Macro Virus Protection is enabled in all Microsoft applications. Click Tools, Options in Microsoft Word. Make sure that Macro Virus Protection is enabled. NEVER run macros in a document unless you know what they do. Use the default security settings in Microsoft Office  Office has safeguards in place to help protect your programs and data from viruses. We recommend that you do not change the Office default settings to less secure security settings. Turn on the security features in the Microsoft Windows Security Center, and keep your computer updated  The easiest way to do this is to visit the Protect Your PC site, which guides you on how to use the Windows Security Center to enable the following: Internet firewall Antispyware software Antivirus software For more information about antivirus software vendors that you can sign up with, see the Microsoft Antivirus Partners site. Automatic updates from Microsoft Update  Tip   To locate the Windows Security Center in Microsoft Windows, do the following: In Microsoft Windows Vista, click the Start button , type security center in the Start Search box, and then press ENTER. In Microsoft Windows XP Service Pack 2, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Security Center. Try a subscription to Windows Live OneCare  Windows Live OneCare is a round-the-clock protection and maintenance service that you can subscribe to. Windows Live OneCare helps protect and maintain your computer by providing all-in-one functionality including virus scanning, firewall, antispyware, PC performance tuneups, and file backup and restore capability. Visit the Windows Live OneCare site for more information and to sign up for a free 90-day trial. Find out whether you really have a virus  Viruses often run without your knowledge. However, if your computer is acting strangely or if one of your programs is not working correctly, this does not necessarily mean that your computer has a virus. It is important to be aware of the specific symptoms that a particular virus causes. On the Microsoft Security Antivirus Information site, you can find information and alerts about the latest viruses, their severity, and the symptoms they cause. Check the Microsoft Security Bulletins regularly  An up-to-date list of security issues that affect Microsoft products is available on the Microsoft Security Updates site. This site provides technical information about security issues that affect specific products. If you don't want to remember to check the site regularly, you can subscribe to get security bulletin e-mail notifications for free that let you know about important security updates from Microsoft. In the past, hackers have attempted to mimic these notifications to send bogus information. However, it is not difficult to determine whether a Microsoft security-related message is genuine, because authentic Microsoft security bulletin notifications are always digitally signed and never include software updates as attachments. Instead, the notifications always link to the update on the Microsoft.com Web site. Download files only from trusted sites  When you download a file from a Web site, be sure you know the source! You should download only files that are from known, well-established companies. When in doubt, don't download the file. As an extra precaution, you can download files onto a disk separate from your hard disk, such as a floppy disk or a zip disk, and then scan the files with your virus scanner. Install only from authentic CDs  In general, installing software from authentic, commercially distributed CDs is the safest method. For example, all Microsoft CDs have holograms to prove their authenticity. Back up your data regularly  If a virus erases or corrupts files on your hard disk, a recent backup may be the only way to recover your data. Back up your entire system regularly. At the minimum, back up files that you can't afford to lose, such as documents, pictures, favorite links, address books, and important e-mail messages. For details about how to back up your specific program's data, search the Microsoft Office Online Web site. You can also use the System Tools in Microsoft Windows to back up your data, as follows: In Microsoft Windows Vista, click the Start button , click All Programs, click Accessories, click System Tools, and then click Backup status and configuration. Follow the instructions provided. In Microsoft Windows XP, click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup. Follow the instructions provided. NTM 1700

What is a firewall? Security system consisting of hardware and/or software that prevents unauthorized intrusion. NTM 1700

Networks Zombie/Botnet War driving Router Security NTM 1700

Mobile Devices Jailbreaking Rooting NTM 1700

What is phishing/pharming? Phishing: scam in which a perpetrator sends an official message (email) that attempts to obtain your personal and financial information Pharming: user is tricked into keying in personal information at a phony website NTM 1700

What is a cookie? NTM 1700 user preferences small file on your computer containing data about you (1st party) some web sites sell or trade stored in your cookies (3rd party) set browser to accept cookies, prompt you to accept cookies, or disable cookies how regularly you visit web sites interests and browsing habits temporary internet files/browser cache NTM 1700

KEYS TO REMEMBER NTM 1700 Turn on the firewall Keep antivirus software up-to-date Keep operating system software up-do-date Keep up-to-date antispyware software Know what you are installing and what it will do Carefully read all disclosures before installing Scan all downloaded programs for malware NEVER run macros in a document unless you know what they do NTM 1700

What more can you do? Limit the amount of information you provide Set up an extra e-mail account just for ads/memberships merchant forms Clear your history file when finished browsing Do not reply to spam for any reason Sign up for e-mail filtering through your internet service provider or use antispam program Use encryption Run programs like CCleaner NTM 1700

Device Management and Security NTM 1700/1702