SLAC Computer Security Annual Safety and Security Briefing 10/11/2007 Teresa Downey

National Cyber Security Awareness Month – October 2007 Month-long effort – new topic daily Linked from Computer Security page:

Security Policies DOE says… –Computer Security is as important as Physical Safety More reviews/audits –Spring ‘08 Policies –Not always a bad thing… –Set consistent boundaries –Enforce good practices

Recent SLAC Incidents User installed operating system but default password not changed –lesson: use SCCS installation/mgmt tools Person reading offsite and clicked on [infected] executable attachment –lesson: pay attention to the a/v warnings User passwords stolen offsite, several systems compromised here –lesson: protect passwords physically and electronically

Forged = Strange Bounces I didn’t send this , why am I getting this? Easy for spammers, virus writers, and me…

Forgery Example – Part 1 YIKES! Is this real??? Let’s look at headers… Click on View; then click Options

Forgery Example – Part 2 This isn’t from a SLAC computer!

Phishing - HTML Which is it? or ? That’s a lot of “teresa’s” That’s not my bank URL looks real… matches the From: line

This link would take me to somewhere in Latvia…! Phishing – Plain Text What if the bank name was correct? and only addressed to me? and the typos were gone? My only clue is the URL now Outlook converted to plain text View as HTML by right-click gray bar $ Downey, Teresa L.

Phishing - Headers Wow! This comes from somewhere in The Netherlands… Click on View; then Options

Safer Practices Convert to Plain Text automatically Can easily change to HTML if needed Set a good example: –Send Plain Text s! –Only use HTML when REALLY needed…

Social Engineering USB drive left laying around Official looking CD arrives in mail Phone calls asking for information Desperate pleas for help Dumpster diving

Reporting Security Issues Report all suspicious activity –Send to: –If urgent: call HelpDesk at x4357 (24x7) Questions? –SLAC Computer Security in breezeway today