Staying Safe in Cyberspace

What do YOU do online? Send and receive Send and receive Shop Shop Research Research Instant messaging/chat Instant messaging/chat Social networking/blogging Social networking/blogging

What are the dangers? Malicious attachments Malicious attachments Malicious websites Malicious websites Phishing/fraudulent s Phishing/fraudulent s Merchants with weak security Merchants with weak security Search results (yes, really!) Search results (yes, really!)

Now what? Does all this bad stuff mean you should give up on the web? Does all this bad stuff mean you should give up on the web? NO WAY!

Get online! Stay connected with family Stay connected with family Communicate with friends Communicate with friends Keep up on current events Keep up on current events Plan vacations Plan vacations What else? What else?

security: Phishing Phishing/vishing messages Phishing/vishing messages –Use scare tactics/threats –May “borrow” graphics to look more real –May use poor English –Ask for info the business already has –May be multi-pronged

security: 419 Scams “I am a descendant of royalty…” “I am a descendant of royalty…” –Most common is “fund transfer” scam –Request bank account numbers –May also request fees to cover transaction –Never, EVER respond!

security: Malicious attachments Bad guys use to spread malware Bad guys use to spread malware –Beware of unsolicited attachments –Use an provider that scans attachments –Keep your antivirus software up to date

security: Malicious links Bad guys know we’re getting wise to attachments–they entice you to click links instead Bad guys know we’re getting wise to attachments–they entice you to click links instead –Adult content –Breaking news –Shocking video

security: Malicious links

Instant messaging Do you use chat? Do you use chat? –Only accept chat requests from people you know –Don’t click unsolicited links –Don’t accept unsolicited file transfers

Social Networking and Blogging Facebook, MySpace, LinkedIn, etc… Facebook, MySpace, LinkedIn, etc… –Understand and use privacy settings –Only “friend” people you know –Information posted here makes you a more public person!

What can I do? Want to know a secret? Want to know a secret? –You don’t need to be a geek to stay safe online!

What can I do? Be skeptical and ask questions! Be skeptical and ask questions! –Did I really win a foreign lottery? –Does my bank need to be reminded of my account number? –Will the software in that ad really make my computer faster if I click “OK?”

My favorite things… (Just like Oprah, but without the flattering lighting!) Surf Safer—use Firefox! Surf Safer—use Firefox! –Consider moving away from Internet Explorer

Surf Safer Use a phishing filter! Use a phishing filter! –McAfee SiteAdvisor (free) –Rates search results –Prevents you from visiting known-bad websites

Shop Safer When using a credit card online, always look for: When using a credit card online, always look for: – –Closed padlock Your CC# is encrypted in transit Your CC# is encrypted in transit

Safer Choose a good provider! Choose a good provider! –Is your scanned for viruses? –Will it attempt to alert you about phishing? Ask around—what providers do trusted friends use? Ask around—what providers do trusted friends use? –Are they generally happy? –Do they get a lot of spam?

safer No provider is perfect! No provider is perfect! –Unfortunately, they all get spam

safer Cast a wary eye upon messages Cast a wary eye upon messages –Don’t be afraid to call your bank, ISP, or other businesses about phishing messages

Handling phishing messages Don’t: Don’t: –Call any provided number –Reply to them via –Click any links or fill out any forms

Handling phishing messages Do… Do… –Call your bank on a known-good number Known-good: from the back of your card or bank statement Known-good: from the back of your card or bank statement –Report the message to your provider –Report the message to the FTC Forward to Forward to

Other types of fraud… Many types of fraud started offline but found new life on the Internet Many types of fraud started offline but found new life on the Internet –Phone scams –Check scams –Text message scams

Phone scams—”vishing” Register with the National Do Not Call registry Register with the National Do Not Call registry – –Scammers will not honor this list! –Remain on guard, report scam calls to the FTC: FTC-HELP

Check scams Arrive in “snail mail,” and may include: Arrive in “snail mail,” and may include: –Foreign business offers –Rental schemes –Overpayments –Sudden riches Get more info on check scams at Get more info on check scams at

Text message scams Do you have a mobile phone? Do you have a mobile phone? Do you use it for text messaging? Do you use it for text messaging? –Even if you don’t, scammers can still send messages to your phone –Disable text service if you don’t use it –NEVER respond to an unsolicited text message

In conclusion… It’s not possible or necessary to know about every threat It’s not possible or necessary to know about every threat Remain skeptical Remain skeptical Continue learning Continue learning Ask questions! Ask questions!

More information Be SeKUre blog Be SeKUre blog – Security workshops Security workshops – Be SeKUre on Twitter Be SeKUre on Twitter –

Contact me! Julie C. Fugett, CISSP, CCE Information Security Analyst The University of Kansas