Security 101 Harper P. Johnson Information Technology Services Director of Information Security

Security 101 Confidentiality Integrity Availability At the Intersection: Secure Productivity

Security 101 Identity and Information Theft

Passwords Weak passwords cracked in seconds Don’t use common words or text phrases Choose a combination of letters, numbers, caps/lowercase, and non-alpha-numeric (Special characters) Sharing is bad (sorry)

SPAM Don’t be a spam zombie

Viruses Previous: Viruses written by anti-social misfits Current: financial gain, hackers-for-hire write viruses Deliver infected machines to spammers Going rate: $600 per 10,000 machines per week If you don’t know the source don’t click it, delete it

Phishing Affected up to 4.7% of Americans (1.78M) “Phishing”: collecting private info through various scams, ~ 3.2% of current s Exploding: $1.2B toll to US banks, credit card companies, now more regionalized Desired success rate: 3% Typical: starts with purporting to be from established company (eBay, bank, etc.) For more info:

Local Phishing sample Dear Customer, We are contacting you to remind you that our Account Review Team identified some unusual activity in your account. In accordance with Arizona State Savings & Credit Union's User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved. We encourage you to sign on and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure. To view and perform the verification process, please click on the link below: Arizona State Savings & Credit Union is committed to maintaining a safe environment for our customers. To protect the security of your account, our bank employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the Online Banking system for unusual activity. Thank you for your prompt attention to this matter. Please understand that this is a security measure meant to help protect you and your account. We apologize for any inconvenience. Sincerely, Arizona State Savings & Credit Union, Customer Service.

Real site

Sample Phishing site

Sample phishing information

Desktop/Laptop Security S-A-F-E S oftware Updates A ntivirus Protection F irewall E radicate Spyware

Software Updates –Top priority in securing your PC. –Most obvious are Windows & Office Updates. –Most updates close security “holes” in software products

Antivirus A ntivirus Protection –Lots to choose from! –What to look for when selecting a product: Able to scan as well as hard drive Able to create a scan schedule Able to automate the update process Price Bundled with other things (OneCare) –NAU provides to Faculty and Staff

Firewall –A primary method for keeping a computer secure from intruders –Built into recent versions of major OS Windows XP SP2 Mac OS X –Limits network traffic in and out of your computer –Wireless networks at home? Firewall (usually comes turned off) Limit access to your MAC addresses

Spyware E radicate Spyware –What spyware is Malicious software Intercepts or takes partial control of a computer's operation Without the knowledge or consent of that machine's owner –What spyware does The not-so-bad –Monitors where you go online –Marketers The really bad –Can give someone else control of your computer –Can record keystrokes

Physical Security

Lock/Log Off/Turn Off –Lock when you walk away –Log Off overnight –Turn Off for the weekend –Lock your office door Back Up and Clean Up –Prevent Lost work and productivity –Don’t dispose of old computers unless properly degaussed

Incident Reporting Know your local contacts Other national sites: For everyone: For Parents and kids: For Phishing: – Arizona: – s_and_links.htmhttp://gita.state.az.us/security/security_web_site s_and_links.htm ID Theft: Spam:

Summary –Be cautious and think before providing personal data –Protect your passwords –Update frequently (automatically!) Home and Office –Use your antivirus software & keep it updated If you don’t have it, get it! –Scan for spyware frequently –Have a firewall in place –Remember physical access restrictions