Cybersecurity Awareness Rusty Haferkamp, CISO Central National Bank rhaferkamp@cnbwaco.com

Who is this guy and why do we care what he says? Microsoft, CISCO, HP, Dell, CompTIA Certifications Contractor for Army, Navy, and Air Force (Top Secret Clearance) Small Business Owner, Loyal Wacoan Currently focused on financial institution trends in tech as the Chief Information Security Officer at Central National Bank What is a Cybersecurity Awareness? Educating others about policies and procedures for working with information technology with a focus on security. Sometimes it is called Info Security or infosec.

Agenda Passwords Viruses, Malware Spam and Email Phishing Scams Hacktivism Card Skimming Corporate Account Takeover Personal Computers at Home / Mobile What should I do if…

Password Strategy A Bad Password Can Be Cracked In A Few Seconds by a dictionary attack. Passphrases are Better than Passwords A Passphrase Usually Has Spaces Longer Than Any Random String Of Letters That An Ordinary Person Could Remember 123456 password 12345678 qwerty 12345 123456789 football 1234 1234567 baseball welcome 1234567890 abc123 111111 1qaz2wsx dragon master monkey letmein login princess qwertyuiop solo passw0rd starwars

Malware Malware is short for malicious software and essentially covers all virus types. Free Stuff – music, movies, file sharing (dark web) Clickbait – alluring links to draw you in Ransomware using Crypto”variants” – These viruses encrypt files on your computer and any other files it can touch on the same network. They usually have a message that appears out of nowhere with a phone number to call with instructions for paying the ransom. The ransom gets you a code to decrypt your data.

Email Spam Fodder – everything all at once to muddy the waters and challenge the spam filter or firewall Phishing – cast a big net and see what comes in Spearphishing – target a specific person or role #1 Threat Trend included in Social Engineering Are you expecting something from Jim@firesell.biz Why is Michelle Holland sending something out at 3AM? Have doubts? Throw it out

What if the Facebook photo changer was a trick? Hacktivism is the act of hacking, or breaking into a computer system, for a politically or socially motivated purpose. The individual who performs an act of hacktivism is said to be a hacktivist. “Anonymous” is a loosely associated international network of activist and hacktivist EVENT: Paris, Charlie Hebdo #JeSuisCharlie What if the Facebook photo changer was a trick? https://www.youtube.com/watch?v=ybz59LbbACQ

Card Skimming Does something look out of place? Added on, protruding, mismatch, etc. Try and pull it off, wiggle it, report it

Corporate Account Takeover more than stealing money ASHLEY MADISON “I’ve got their profile right in front of me, all their work credentials,” explained Biderman. “It was definitely a person here that was not an employee but certainly had touched our technical services.” ANTHEM The data breach is being linked to the Chinese government and Chinese government-sponsored entities, including researchers.9 The FBI has been in the process of connecting the same dots, while the organization ThreatConnect matched up the patterns between the malware used in the Anthem attack with the malware used in the breach of a small U.S. defense contractor.

Corporate Account Takeover cont… Spearphishing Email – Bad guy emails wiring instructions using a spoofed email address with instructions HOMEWORK! Go to CNBWACO.COM/BLOG “VIDEO: Protecting Your Business from Spear Phishing” The best safeguard—especially when the communication involves financial transactions (such as wire transfers)—is to pick up the phone and give the email’s sender a call. If the sender is at lunch, wait to take action on the email until they’ve returned and you’ve had the chance to speak with them.

Home and Mobile Security IoT “Internet of Things” is HUGE, Gartner predicts 6.4 BILLION connected devices in 2016, iPhones, Printers, Watches, Refrigerators, Light Bulbs, Cars Public WiFi – Don’t Use Never login to online banking or any site you don’t want something stolen Use the same logic at home that you would at work.

What Should I Do? Keep your computers up to date. Patches are good. Backup files Use strong passwords, don’t use the same pwd for everything Beware - Hyperlinks in Emails, Word Docs, Excel Spreads, PDFs can be dangerous Refrain from following the rabbit down the hole in email or on the web. Most Important Takeway!