Presentation is loading. Please wait.

Presentation is loading. Please wait.

Cyber Security Awareness Why people are of N o 1 importance… CERN Computer Security Team (2009) L. Cons, S. Lopienski, S. Lüders, D. Myers “Protecting.

Published byRoland Cole Modified over 9 years ago

Similar presentations

Presentation on theme: "Cyber Security Awareness Why people are of N o 1 importance… CERN Computer Security Team (2009) L. Cons, S. Lopienski, S. Lüders, D. Myers “Protecting."— Presentation transcript:

1 Cyber Security Awareness Why people are of N o 1 importance… CERN Computer Security Team (2009) L. Cons, S. Lopienski, S. Lüders, D. Myers “Protecting Office Computing, Computing Services, GRID & Controls”

2 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 2 About Security Security is not a synonym for safety. Security is a system property (not a feature). Security is a permanent process (not a product). Security is difficult to achieve, and only to 100%-ε: ► Complexity of systems & code ► No metrics to measure “security” ► No testing methods, proving that a system is “secure” (“phase-space problem”) Security is as high as the weakest link: ► Defender needs to protect against all possible attacks (currently known, and those yet to be discovered) ► Attacker chooses the time, place, method

3 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 3 “If your kid just got the driving-license, you might wish for a ‘small’ accident, so it is aware of the risks, and drives with care.” The Learning Curve Oops !!??? …a user listing… A defaced web- page…

4 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 4 Protect your Assets ! Control who can do/access what: ► Have your PC centrally/IT managed ( free patching, firewalling, anti-virus) ► DON’T use administrator rights except when really needed (the “rule of least privilege”) ► Control published information Everyone can upload whatever… Configuration well doc’d in Google… http://cern.ch/security/webapps http://cern.ch/security/Recommendations/sysadmin-checklist.html

5 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 5 Rule of Least Privilege (for Experts) Control who can do/access what: ► Restrict root, admin, sudo access to those who really need ► Run programs with least privileges ► Control published information ► Use local firewall and central syslogs ► Harden your system, remove services which are not needed Everyone can upload whatever… Configuration well doc’d in Google… http://cern.ch/security/webapps http://cern.ch/security/Recommendations/sysadmin-checklist.html

6 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 6 Coding Practices (for Experts) Security is part of software development cycle ► Keep code simple, split it up, make sure that each part works correctly ► Choose safe defaults, limit resource usage, fail gracefully & securely ► Test and review the code with respect to security ► Document, but control the accessibility Don’t trust input data !!! Input data is the single most common reason of security- related incidents. http://cern.ch/securesoftware

7 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 7 Who owns the consequences ? Can you allow for: ► Loss of resources… ► Loss of data… ► Loss of functionality… ► Loss of control… ► Loss of reputation… This boils down to CHF €€ ££ $$ ¥¥ !! Are you prepared to take the full responsibility ? Are you in the hierarchical position to really take it ?

8 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 8 Hacked oscilloscope (running Win XP SP2) Security risks are everywhere !!! Lack of input validation & sanitization Confidential data on CVS, Wiki, Savannah… Free passwords on Google: What about you?

9 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 9 Be Vigilant & Stay Alert !!! Email addresses can easily be faked ! Stop “Phishing” attacks: No legitimate person will EVER ask for your credentials ! http://cern.ch/security Do not trust your web browser !

10 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 10 Do not trust your web browser ! What links to www.ebay.com ? http://secure-ebay.com http://www.ebay.com\cgi-bin\login?ds=1%204324@%31%33%37 %2e%31%33%38%2e%31%33%37%2e%31%37%37/p?uh3f223d http://www.ebaỵ.com/ws/eBayISAPI.dll?SignIn http://scgi.ebay.com/ws/eBayISAPI.dll?RegisterEnterInfo&siteid=0& co_partnerid=2&usage=0&ru=http%3A%2F%2Fwww.ebay.com&rafId=0 &encRafId=default    The answers are not obvious even for IT professionals !

11 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 11 ► Do incident forensics ► Leave “ON”, dis- connect & don’t touch ► Recover… ► Analyze causes & apply lessons learned ► Have your PC centrally/IT managed ► Keep passwords secret & change them regularly ► Patch immediately ► Control access to all your assets ► Monitor traffic ► Maintain up-to-date anti-virus software ► Be vigilant & stay alert ► Deploy “Defense-in-Depth” ► Don’t log in as administrator ► Enable local firewall ► Be vigilant & stay alert YOU&US YOU Security is a permanent process Budget & Resources YOU Response PreventionProtection Detection

12 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 12 ► Monitor traffic ► Deploy intrusion detection (host-, network-based) ► Maintain up-to-date anti-virus software ► Enable & monitor syslogs ► Be vigilant & stay alert ► Do incident forensics ► Leave “ON”, dis- connect & don’t touch ► Recover… ► Analyze causes & apply lessons learned ► Patch immediately ► Keep passwords secret & change them regularly ► Apply proper coding & configuration practice ► Control access to all your assets ► Deploy “Defense-in-Depth” ► Segregate networks ► Tighten down firewalls ► Be vigilant & stay alert YOU&US YOU Security is a permanent process Budget & Resources YOU Response PreventionProtection Detection

13 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 13 The operational circular #5 defines the rules for the use of CERN computing facilities. Personal use is tolerated or allowed provided: ► Frequency and duration is limited and resources used are minimal ► Activity is not illegal, political, commercial, inappropriate, offensive, detrimental to official duties Restricted personal use: ► Applications known to cause security and/or network problems ► e.g. IRC, Tor, P2P (eDonkey, BitTorrent, …) ► see http://cern.ch/security/software-restrictions Respect confidentiality and copyrights ► Illegal or pirated data (software, music, video, etc.) is not permitted General Computing at CERN http://cern.ch/ComputingRules

14 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 14 Security is a system property and can be achieved to 100%-ε. YOU are responsible for securing your service(s) (i.e. ε): ► As user, developer, system expert or administrator ► As a project manager or line manager Therefore: ► Provide funding and resources ► Close vulnerabilities: prevent incidents from happening ► Check access rights and stick to the principle of least privileges ► Review your configuration & coding practices ► Be vigilant and stay alert ! The Computer Security Team can provide assistance. Summary

15 Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” — slide 15 More Information… CERN Computing Rules OC#5, subsidiary service rules & Computer Security information: Please report incidents to: Security contacts (Departments): Security contacts (Experiments): http://cern.ch/security Computer.Security@cern.ch Pierre Charrue (BE), Vittorio Remondino (TE), Peter Jurcso (DSU), Flavio Costa (FP), Catharina Hoch (HR), David Myers (IT), Joel Closier (PH), Gustavo Segura (SC), Timo Hakulinen (GS) Peter Chochula (ALICE), Giuseppe Mornacchi (ATLAS), Eric Cano (CMS), Gerhart Mallot (COMPASS), Niko Neufeld (LHCb), Alberto Gianoli (NA62), Francesco Cafagna (TOTEM), Technical-Network Administrator (TN).

Download ppt "Cyber Security Awareness Why people are of N o 1 importance… CERN Computer Security Team (2009) L. Cons, S. Lopienski, S. Lüders, D. Myers “Protecting."

Similar presentations

Secure Email and Web Browsing Sébastien Dellabella – Computer Security Team.

Secure and Web Browsing Sébastien Dellabella – Computer Security Team.
How things go wrong. The lucky one and the unlucky one Dr. Stefan Lüders (CERN Computer Security Officer) 3 rd (CS) 2 /HEP Workshop, Grenoble (France)

How things go wrong. The lucky one and the unlucky one Dr. Stefan Lüders (CERN Computer Security Officer) 3 rd (CS) 2 /HEP Workshop, Grenoble (France)
3 rd Control System Cyber-Security Workshop A Summary of this year’s meeting Dr. Stefan Lüders (CERN Computer Security Officer) with contributions from.

3 rd Control System Cyber-Security Workshop A Summary of this year’s meeting Dr. Stefan Lüders (CERN Computer Security Officer) with contributions from.
1 Chapter 8 Fundamentals of System Security. 2 Objectives In this chapter, you will: Understand the trade-offs among security, performance, and ease of.

1 Chapter 8 Fundamentals of System Security. 2 Objectives In this chapter, you will: Understand the trade-offs among security, performance, and ease of.
Online Banking Fraud Prevention Recommendations and Best Practices This document provides you with fraud prevention best practices that every employee.

Online Banking Fraud Prevention Recommendations and Best Practices This document provides you with fraud prevention best practices that every employee.
Lecture 2 Page 1 CS 236, Spring 2008 Security Principles and Policies CS 236 On-Line MS Program Networks and Systems Security Peter Reiher Spring, 2008.

Lecture 2 Page 1 CS 236, Spring 2008 Security Principles and Policies CS 236 On-Line MS Program Networks and Systems Security Peter Reiher Spring, 2008.
System and Network Security Practices COEN 351 E-Commerce Security.

System and Network Security Practices COEN 351 E-Commerce Security.
ITS Offsite Workshop 2002 PolyU IT Security Policy PolyU IT/Computer Systems Security Policy (SSP) By Ken Chung Senior Computing Officer Information Technology.

ITS Offsite Workshop 2002 PolyU IT Security Policy PolyU IT/Computer Systems Security Policy (SSP) By Ken Chung Senior Computing Officer Information Technology.
Security Awareness: Applying Practical Security in Your World Chapter 6: Total Security.

Security Awareness: Applying Practical Security in Your World Chapter 6: Total Security.
Controls for Information Security

Controls for Information Security
Presented by Manager, MIS.  GRIDCo’s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to GRIDCo’s.

Presented by Manager, MIS.  GRIDCo’s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to GRIDCo’s.
Incident Response Updated 03/20/2015

Incident Response Updated 03/20/2015
Website Hardening HUIT IT Security | Sep 30 2011.

Website Hardening HUIT IT Security | Sep
Manjit kaur Manjit Kaur1. Why do we need to protect our computer from a virus? A reason why we need to protect our computer from a virus is because it.

Manjit kaur Manjit Kaur1. Why do we need to protect our computer from a virus? A reason why we need to protect our computer from a virus is because it.
General Awareness Training

General Awareness Training
© 2007 Cisco Systems, Inc. All rights reserved.Cisco Public ITE PC v4.0 Chapter 1 1 Basic Security Networking for Home and Small Businesses – Chapter 8.

© 2007 Cisco Systems, Inc. All rights reserved.Cisco Public ITE PC v4.0 Chapter 1 1 Basic Security Networking for Home and Small Businesses – Chapter 8.
Network Security Policy Anna Nash MBA 737. Agenda Overview Goals Components Success Factors Common Barriers Importance Questions.

Network Security Policy Anna Nash MBA 737. Agenda Overview Goals Components Success Factors Common Barriers Importance Questions.
Defense-in-Depth What Is It?

Defense-in-Depth What Is It?
What if you suspect a security incident or software vulnerability? What if you suspect a security incident at your site? DON’T PANIC Immediately inform:

What if you suspect a security incident or software vulnerability? What if you suspect a security incident at your site? DON’T PANIC Immediately inform:
Virtual techdays INDIA │ 9-11 February 2011 Security Discussion: Ask the Experts M.S.Anand │ MTC Technology Specialist │ Microsoft Corporation Anirudh.

Virtual techdays INDIA │ 9-11 February 2011 Security Discussion: Ask the Experts M.S.Anand │ MTC Technology Specialist │ Microsoft Corporation Anirudh.

Similar presentations

Ads by Google