Security Threats in the Information Age MBAA 609 R. Nakatsu

Case Study: Mat Honan gets attacked “In the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID was broken into, and hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBook.” Read the complete Wired article here.here. This is an example of social engineering.

Two-Factor Authentication When using cloud-based services, use two-factor authentication whenever possible. Three Factors are: What you know (e.g., password) What you own (e.g., cellphone) Who you are (e.g., biometric authentication) See Google two-factor authentication example.Google two-factor authentication

Security Threats On The Internet Denial of Service (DoS) Attacks : A web server is overwhelmed with requests for data in order to cripple the network. –What is a distributed denial of service (DDoS) attack? Intrusions : Human hackers gain access to an organization’s internal IT systems. –How do they occur? Malware (e.g., viruses, worms, Trojans): Malicious software programs that spread rapidly through computer systems, sometimes destroying or modifying data. –How does a computer become infected with malware?

Specific Threats: Know the Terminology Phishing: fraud where the perpetrator sends out legitimate-looking s to collect information about you, or download malware. Example: Cryptolocker (an example of ransomware). Spyware: Program that hides on your system with the intent of collecting marketing information about you and your surfing habits, and/or displaying pop up ads on your screen (e.g., keyloggers capture and record your keystrokes). Drive-by Downloads: A program that is automatically downloaded to your computer—no action on your part is necessary!

A Multi-Pronged Approach to Securing Networks Gateway security devices: these devices (e.g., firewalls and routers) protect the “front” door to the Internet, by comparing every bit of information going in and out of your network with a database of signatures. Most organizations place a firewall at the Internet entry point of their networks. Desktop security: install anti-virus/anti-malware on each computer. Data encryption: encrypt sensitive data (1) before it is sent over the Internet, (2) when it is stored on a computer, (3) when backing up data on a server.

Gateway Security Router Intranet Server Host System Intranet Server The Internet Fire wall Router Extranet

The Need for Data Encryption Every packet of data sent over the Internet traverses many public networks At any step of the way, many people could have access to those packets. The Internet can be used for transmitting highly confidential information such as credit card data or proprietary corporate data.

Data Encryption: The Basics Encryption is the process of encoding (or “scrambling”) information so that only authorized parties can read it. Plaintext: the “readable”, unencrypted message Encryption key: specifies how the message is encrypted Ciphertext: the “unreadable”, encrypted message. Public-key encryption: the encryption key is public for anyone to use and encrypt messages. The decryption key is private— only the receiving party can decrypt, or unscramble messages.

Encryption Examples You can easily encrypt Micosoft Word, Excel, and Access files. Encryption is built into Windows (Bitlocker) and OS X (FileVault) Turn on WPA2, a protocol used to secure WiFi networks SSL (Secure Socket Layer) and its successor TLS (Transport Layer Security): a protocol for encrypting information sent over the Internet. Use a VPN (Virtual private network), a technology which creates a secure, encrypted tunnel across the Internet. See next slides. Encrypt your s (PGP and OpenPGP): enables point- to-point encryption.

VPN (Virtual Private Network)

Benefits of VPNs Secures your internet connection: snoopers cannot read your s and communications. Restores your freedom: allows you to circumvent regional restrictions (i.e., geoblocking) Allows secure remote access to company resources—e.g., files, applications, printers, etc.

The Need for Digital Certificates Masquerading or spoofing means pretending to be someone you are not, or representing a Web site as an original when it is fake. A digital certificate provides identifying information of a company or individual, and is verified by an official, trusted agency known as a Certificate Authority (CA). The CA issues an encrypted digital certificate containing the applicant’s public key and a variety of other information. Digital certificates are an important part of TLS/SSL (described earlier on the encryption slide).

Other IT Solutions Have a backup strategy Practice good digital hygiene Transaction log: a log of all changes applied to a database in chronological order Creation of a DMZ (de-militarized zone): place a proxy server in this zone.

Have a Back Up Strategy! Disk drives fail: don’t be surprised if this happens to you! Strategy: Have at least three copies of your data, on at least two separate media storage devices, at least one copy offsite. –Cloud-based services like Carbonite, and Dropbox offer affordable and convenient offsite, “cloud” storage. Create a disk image (e.g., timemachine on the Mac, superduper, drivesnapshot.de, among other programs)

Digital hygiene means practicing safe behaviors on the Internet Don’t open attachments from strangers; be careful even if it’s from someone you know. Update your OS regularly. Don’t click links in . That link could lead you to a phishing site, or the link may lead you to install malicious software. Don’t download files from places you aren’t absolutely sure are safe. Stick with the well known sites. Use a firewall. The best firewall is a hardware router. Run as a limited user; do not run as an administrator. Here’s an article on how to require a password as an administrator. Here’s an article

Transaction Log Transaction records contain: Transaction identifier Time of transaction Type of transaction (e.g., read, insert, update, delete, abort) Identifier of data item affected Before-image of the data item After-image of the data item From the transaction log, you can re-create a database up to a given point in time.

Network Diagram of a DMZ DMZ: the area between the two firewalls—neither a part of the internal network nor the public Internet.