1. Traveling Safely SIRT IT Security Roundtable Harvard Townsend IT Security Officer harv@ksu.edu May 8, 2009

2. Agenda What and where are the risks? Using Internet cafes and WiFi hot spots safely (is that possible?!) Protecting your eID and other passwords Protecting your personal and financial info Airport risks Laptop security Things to do before you leave Beware of export restrictions on certain technologies K-State VPN service 2

3. What are the risks? Identity theft Financial fraud/theft Physical theft (like your laptop) Information loss/theft (personal, institutional, passwords, acct info) 3

4. Where are the risks? Internet cafés WiFi hot spots Any public computer, even some private ones (e.g. hotel business center) Airports ATM machines 4

5. Internet Cafés Technology typically not managed well. Susceptible to: Worms, Trojan horses, etc. Keyloggers USB thumb drive infections Browser cache, temporary files, deleted files, log data leave a trace of your activity Staff sometimes part of the conspiracy 5

6. Internet Cafés What can you do about it? Avoid them altogether, or just use them for innocuous activities like checking the weather, bus/train/flight schedules, tourist sites Research locations before you leave or ask someone you trust (hotel concierge?) to determine which ones are reputable Never use them for financial transactions If at all possible, dont use your K-State eID and password Make sure it has antivirus software running and up-to-date – do a manual scan if possible; check for firewall too Or run a free web-based AV check (like Trends HouseCall - http://housecall.trendmicro.com/), although this can be time- consuming and youre paying for your time on the computer http://housecall.trendmicro.com/ Check installed programs, programs running in memory for anything suspicious 6

7. Internet Cafés What can you do about it? When you delete a file, use a secure delete tool like Eraser (if you can install programs on the computer) NEVER let it save your login/account information in the browser Clear the browser cache, cookies, history before you leave Firefox – Pull down Tools menu, select Clear Private Data, check all the boxes, select Clear Private Data now IE – Pull down Tools menu, select Delete Browsing History…, select Delete All Watch for shoulder-surfing Dont leave your computer unattended with any sensitive information showing, or authenticated sessions open (lock the screen) Carry your own programs on a USB flash drive (browser, AV software, email client, password safe, VPN client, Secure erase, etc.) Summary – AVOID or BE PARANOID! 7

8. Other public computers Treat them ALL with suspicion Hotel business centers Probably better than Internet café, esp. at reputable hotel, but even those are not without risk They typically use an acct with Administrator privileges, so anyone can install anything Use same precautions as Internet Cafés Dont use for financial transactions, your eID/password, or other sensitive sessions if at all possible Plug your own laptop in if possible; turn off File/Printer sharing 8

9. Other public computers Public libraries In U.S., have extensive filtering that can prevent some malware too. Might be better managed than other public computers, depending on the staff at that library Public Kiosks Danger, Will Robinson! (just check the weather and news) 9

10. The WiFi Dilemma Its SOOO useful and SOOO risky Unsecured wireless networks are very easy to snoop – someone near you or even across the street can watch ALL of your traffic Are freely available programs that watch WiFi traffic looking for anything that looks like a username and password, or account info Hotels – just because you have to register or authenticate doesnt mean its secure. They typically are not encrypted and you dont know who is in the room next to you. 10

11. Wireless security Use K-States VPN service to access K- State systems; this does NOT protect your other Internet traffic Dont do financial transactions or other sensitive work in public WiFi zones, if possible General wireless security: www.onguardonline.gov/wireless.html www.onguardonline.gov/wireless.html Wireless terminology: www.onguardonline.gov/wireless.html#glossary www.onguardonline.gov/wireless.html#glossary 11

12. Protecting your eID 12 Avoid using it in Internet Cafés and other public computers, if possible Use K-State VPN service to access K- State resources when possible Change your eID password when you get home as a precaution

13. Protecting Your Personal and Financial Information Take all the online precautions mentioned thus far Always know where your passport is Stow it securely on your person Hide it in your hotel room or put it in a safe Beware of pick-pockets Conceal your valuables Dont let a vendor/server take your credit card out of your sight Pay with cash as much as possible (so you dont have to use your credit card) Let your credit card companies know your travel destination and dates (can now do this online with some major credit cards) 13

14. ATM security ATM skimming devices rampant in Europe, happens in U.S. too Organized crime involved Look for indicators of tampering with the keypad or card swipe/feed mechanism Only use ATMs in the lobby of reputable banks; esp. beware of solitary ATMs in secluded places at night Watch for people looking over your shoulder Make a few large withdrawals instead of many smaller ones 14

15. Airports High risk of theft 16,000 laptops lost or stolen in airports in US and Europe PER WEEK!! Will cover laptop security later Dont let valuables out of your site, esp. at security screening; criminals target airports and create diversions to distract you while they steal your laptop 15

16. Airports Use same precautions with the public WiFi in airports that you would in any public WiFi hot spot Beware of the oft-seen but bogus Free Public WiFi ad hoc/computer-to-computer wireless network – dont try to connect to it General rule – dont connect to unknown wireless networks 16

17. 17 Laptop Security Never leave unsecured laptop unattended Use a locking security cable Hotel room Public locations, coffee shop Conferences, training sessions Cost $15-$50, combination or key lock Dont leave it in view in your vehicle Dont trust the trunk - remember the quick release lever inside the vehicle? Use strong password on all accounts Dont store sensitive info on it, but if you have to, encrypt the entire hard drive (K-State uses PGP Whole Disk Encryption software for this purpose): http://www.k-state.edu/infotech/security/pgp http://www.k-state.edu/infotech/security/pgp

18. 18 Laptop Security Dont let it out of your sight when you travel Be particularly watchful at airport security checkpoints Always take it in your carry-on luggage Never put it in checked luggage Use a nondescript carrying case One that doesnt look like a laptop carrying case Remove the manufacturer logo from the case Be careful when you take a nap in the airport Wrap the carrying case strap around your body Use the locking security cable to secure it

19. 19 Tracking & Recovery Software If stolen, the computer contacts the company the next time its on the Internet; the company then traces it and contacts law enforcement to recover it; inconsistent results outside the U.S. Computrace LoJack for Laptops from Absolute Software (www.absolute.com) is an examplewww.absolute.com Pre-installed in BIOS on many laptops Dell HP Have to buy the license to activate Costs about $30-$50 per year

20. Before you leave home Backup your data Record identification information Record make, model, serial number of laptop Take pictures of it Label it with ownership and contact info Write down credit card acct. numbers and phone numbers for credit/debit card companies (and take it with you) If leaving the country, notify the financial institutions whose accounts you will use (destination and dates of travel) Notify the U.S. state department if going to a volatile location: https://travelregistration.state.govhttps://travelregistration.state.gov 20

21. Export Controls Export broadly defined by Feds, includes actual shipment of any covered goods or items Export Administration Regulations (EAR) by the Commerce Dept. controls technology Intl Traffic in Arms Regulations (ITAR) by the State Dept. controls weapons (duh) K-States University Research Compliance Office (URCO) has training available http://urco.ksu.edu/http://urco.ksu.edu/ 21

22. Cisco VPN client? Civilian Solutions: Restricted Encryption and Unrestricted Cisco's restricted strong encryption solutions may be exported or re-exported to most civilian/commercial end users located in all territories except the embargoed destinations and countries designated as supporting terrorist activities. Countries listed in Part 746 of the EAR as embargoed destinations requiring a license are Cuba, Iran, North Korea, Sudan, and Syria. See list of countries with embargos at http://www.bis.doc.gov/policiesandregulations/regionalconsid erations.htm http://www.bis.doc.gov/policiesandregulations/regionalconsid erations.htm 22

23. Cisco VPN client? Government Solutions: Restricted Encryption Government entities not located in the following countries require a U.S. export license in order to obtain restricted non-retail strong encryption items: Austria, Australia, Belgium, Canada, Czech Republic, Cyprus, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Japan, Latvia, Lithuania, Luxembourg, Malta, Netherlands, New Zealand, Norway, Poland, Portugal, Slovakia, Slovenia, Spain, Sweden, Switzerland, United Kingdom, United States. 23

24. 24 Virtual Private Network (VPN) Encrypts all network traffic between your computer and the K-State border Makes your computer appear to be on campus to get access to restricted resources Does NOT necessarily encrypt everything that goes to the Internet (split tunneling) Also does not encrypt traffic once it is on campus

25. 25

26. 26 Virtual Private Network (VPN) Must install VPN Client software Information and software available at : http://www.k-state.edu/infotech/networks/vpn/ http://www.k-state.edu/infotech/networks/vpn/ Cannot use it on campus yet (to secure your wireless, for example); will be able to soon. If can get to Internet but not K-State, modify the Transport configuration: Enable Transparent Tunneling IPSec over TCP

27. 27 Disconnected Connected

28. Whats on your mind? 28

29. USB Flash Drive Security No confidential data! Too easy to lose, easy target of theft Dont use it as a backup device Erase files so they arent recoverable Encrypt files on it with TrueCrypt or - Encrypted USB flash drives Ironkey very popular - https://www.ironkey.com/ https://www.ironkey.com/ View demo? 29