1. P RINCIPLES OF N ETWORKING S ECURITY C HAPTERS 3 & 4 Matt Lavoie NST281-01

3. Matt Lavoie NST281-01 C HAPTER 3: O PERATIONAL AND O RGANIZATIONAL S ECURITY

4. Security in Your Organization  Policy: A broad statement of accomplishment  Procedure: The step-by-step method to implement a policy  Standards: Mandatory elements of implementing a policy  Guidelines: Recommendations related to a policy

5. Security in Your Organization  Policy Lifecycle:  Plan  Implement  Monitor  Evaluate  Establish a security perimeter

6. Physical Security  Mechanisms to restrict physical access to computers and networks  Locks (combination/biometric/keyed)  Video surveillance, logs, guards  A room has six sides  Physical barriers (gates/walls, man-traps, open space)

7. Environmental Issues  HVAC Systems: Climate control  UPS/Generators: Power failure  Fire Protection: Detect/suppress  Off-Site Backups: Bad stuff happens

8. Other Issues  Wireless  Wi-Fi / Cellular / Bluetooth  Electromagnetic Eavesdropping  TEMPEST  Location  Bury the sensitive stuff

10. Matt Lavoie NST281-01 C HAPTER 4: T HE R OLE OF P EOPLE IN S ECURITY

11. Social Engineering  Making people talk  Questions, emotions, weaknesses  Obtaining insider info (or having it)  Knowledge of security procedures  Phishing  Impersonation

12. Social Engineering  Vishing  Trust in voice technology (VoIP, POTS)  Shoulder surfing  Observation for passcodes, PINs, etc  Reverse social engineering  Victim initiates contact

13. Poor Security Practices  Password selection  Too short  Not complicated  Easy to guess  Information on a person  Password policies  Can encourage bad behavior

14. Poor Security Practices  Same password, multiple accounts  One compromises all  Piggybacking  Controlled access points  Dumpster Diving  Sensitive information discarded

15. Poor Security Practices  Installing software/hardware  Backdoors/rogue access points  Physical access by non-employees  Control who gets in  Pizza and flowers  Legitimate access, nefarious intentions

16. People as a Security Tool  Security Awareness  Training/refreshers  Be alert  Don’t stick your head in the sand  Individual User Responsibilities  Keep secure material secure

18. In a properly secured environment, people are the weakest link A system with physical access is a compromised system What Have We Learned?

19. Questions and Answers