1. Computer Security and Risks

2. Slide 2 Computer Security and Risks Beekman chapter includes: –Computer Crime –Security: Reducing Risks –Privacy, Freedom and Ethics –Security and Reliability

3. Slide 3 Computer Crime Theft by computer –Money –Goods: phone calls, software piracy, intellectual property, … –Information: company secrets, personal identities, … –Computer resources: virus, DOS attacks, …

4. Slide 4 Employee Theft Most electronic crimes are committed by disgruntled employees and other insiders. E.G. An employee duplicated an entire library of computerized machining instructions then took a job with a competitor.

5. Slide 5 Identity Theft Thieves collect personal information –Credit card –Drivers license –SIN, Passport Then use to –Access government services –Buy things

6. Slide 6 Identity Theft Don’t need a computer –Dumpster diving –Credit card skimming –ATM front-end –People give away information

7. Slide 7 Identity Theft Phishing Brand spoofing

8. Slide 8 Phishing

9. Slide 9 Protecting Yourself Beekman, p. 389

10. Slide 10 Software Sabotage Risks –Virus –Worm –Trojan horse –Spyware –DOS Attacks Protection

11. Slide 11 Virus Program code that attaches itself to a program –Operating system or application program When program executes the virus code copies itself to other programs Can destroy data

12. Slide 12

13. Slide 13 Virus Macro virus –Attach to documents Email virus –Attachments

14. Slide 14 Vaccines Antivirus software –Search for known viruses –Identify them –Remove them

15. Slide 15 Use Anti-virus Software –Install and update anti-virus software UofC IT anti-virus web page Free software: McAffee –ISP might provide free –Otherwise buy it (McAffee, Norton, …)

16. Slide 16 Email Virus Detection ISP mail server (UofC IT and CPSC) –Scans incoming and outgoing messages, notifies user if finds virus (strips attachments), and quarantines the message –Also filters file types:.exe,.com,.scr,.pif,.rar, and.zip –User can recover message from quarantine If you suspect: don’t open the attachment –Scan in email program, or save to disk and then scan with virus detection software

17. Slide 17 Sober Source: Calgary Herald

18. Slide 18 Email Virus Detection From: virusalert@cpsc.ucalgary.cavirusalert@cpsc.ucalgary.ca Subject: WARNING - VIRUS (Worm.Sober.U) IN MAIL TO YOU Date: November 25, 2005 10:20:55 AM MST (CA) My email last Friday

19. *** VIRUS ALERT *** Dear user, This is an automatically generated message from the University of Calgary, Department of Computer Science (CPSC). The CPSC email system has detected a piece of email with a virus called: Worm.Sober.U in an email addressed to you from: The Subject of this email was: Mail delivery failed Delivery of the original email has been stopped. A copy of the message has been placed under quarantine. Please visit the CPSC Maia Mailguard system located: http://imgw1.cpsc.ucalgary.ca/mail to view your quarantined messages. You will be required to log into this system using your CPSC Email address and your CPSC Login Password. For your reference, here are some selected headers from the email: ------------------------------------------------------------------ Date: Fri, 25 Nov 2005 10:20:55 -0700 (MST) From: ?@S010600112f1f983b.cg.shawcable.net (Empty if virus is known to forge sender address) To: Subject: Mail delivery failed Received: dpwtlcd.com (S010600112f1f983b.cg.shawcable.net [68.147.104.66])

20. Slide 20 Worm Program that travels independently over computer networks, seeking uninfected sites Replicates and starts up thousands of processes Overloads a system

21. Slide 21 The Cost of Worms Nimba, Sept. 18, 2001 In 24 h infected 2.2 million computers Microsoft Windows Huge traffic disabled web and email servers Damaged system files

22. Slide 22 Trojan Horse Program that performs a useful task while also being secretly destructive A logic bomb responds to a particular event Cannot replicate E.G. Logon Trojan horse

23. Slide 23 Denial of Service Attacks Web servers are sent millions of bogus requests Overloads the system Consequently they shut down Service is denied legitimate users

24. Spyware

25. Slide 25 Spyware (Adware) –Secretly sends data about our web surfing to a spy –Spy sells data to advertisers –Software unknowingly downloaded with other free software or music –Can result in pop-up ads

26. Slide 26 New Twist

27. Slide 27 SONY Source: Calgary Herald

28. Slide 28 Protection from Spyware Don’t –download free stuff –enter online contests Do –use antispyware software –UofC IT Antispyware PageUofC IT Antispyware Page

29. Slide 29 Protection from Viruses and Spyware Use anti-virus software –Update frequently Update your operating system –Automatic updates and security patches –MicrosoftMicrosoft –MacintoshMacintosh

30. Slide 30 Computer Security: Reducing Risks Disaster Planning –backup power –monitoring, alarms –backup of data –redundant sites or hot sites

31. Slide 31 Computer Security: Reducing Risks Physical Access Restrictions –something you have: key, ID card you know: password, personal information you do: signature, … About you: Biometics

32. Slide 32 Passwords The most common tool for restricting access to computer systems Weekness –user –sustained guessing program guesses words from online dictionaries

33. Slide 33 Password Guidelines Don’t use –real words –names –plurals –common expressions –reversal

34. Slide 34 Passwords Do –mix letters and numbers –change frequently –keep secret

35. Slide 35 Firewall Objective: to keep internal network secure from the outside It is a hardware device or software through which all traffic must pass Firewall LANWAN

36. Slide 36 Firewall Always on Internet service is a problem –use a router –see IT website for Firewall informationIT website for Firewall information