1. Information Security: Current Threats Marc Scarborough Information Security Officer marcs@rice.edu

2. Changing Nature of Attacks Before: Prank/Defacement – Word Macro viruses that inject words into documents when printed – Web site defacements Recently: Resource “Theft” – Coordinated DDOS (Distributed Denial of Service) Attacks by remote controlling hacked computers – Hacking systems for their disk space and network speed, creating distributed repositories of stolen content 2

3. Changing Nature of Attacks Now: Targeted Attacks - Political and Financial Gain – Credit Card / Personal Information / ID Theft – Worldwide crime organizations coordinating specific attacks for specific purposes – Government Entities defining ‘Cyberwar’ 3

4. Recent Headlines 4

5. IRS: Phishing - Number One Scam 5 IRS currently defines phishing (an information gathering scam through email or phone) as their primary threat. Higher Education, including Rice University, has also seen a sharp increase in the number and complexity of phishing attacks on campus. The attacks are looking for Rice NetID’s and passwords which are used to log into our Webmail servers to send other types of scams to Internet users around the world. The scams sent from hacked Rice NetID’s include Nigerian 419 scams and Death Threat emails. Information Technology has worked diligently to slow these messages and inform the community as they arrive IRS currently defines phishing (an information gathering scam through email or phone) as their primary threat. Higher Education, including Rice University, has also seen a sharp increase in the number and complexity of phishing attacks on campus. The attacks are looking for Rice NetID’s and passwords which are used to log into our Webmail servers to send other types of scams to Internet users around the world. The scams sent from hacked Rice NetID’s include Nigerian 419 scams and Death Threat emails. Information Technology has worked diligently to slow these messages and inform the community as they arrive

6. Hannaford Credit Card Breach 6 Hannaford reported a significant credit card breach As many as 4.2 million credit card numbers were exposed. At least 1,800 were subject to fraud (so far). The breach began December 7, 2007 and was not contained until March 10, 2008. Rice University is and has been taking steps to secure our credit card transactions. More information on these steps is coming. Hannaford reported a significant credit card breach As many as 4.2 million credit card numbers were exposed. At least 1,800 were subject to fraud (so far). The breach began December 7, 2007 and was not contained until March 10, 2008. Rice University is and has been taking steps to secure our credit card transactions. More information on these steps is coming.

7. Ohio University: The Response 7 Highlights from the (Ohio) blueprint include: Implementing a perimeter firewall that will filter Internet traffic to protect computers outside of the central cluster from hacker attacks. Classifying data by the level of security required. Rice is also working towards similar goals Enhanced firewall protection for our Students and Staff Enhanced auditing of critical systems and services Highlights from the (Ohio) blueprint include: Implementing a perimeter firewall that will filter Internet traffic to protect computers outside of the central cluster from hacker attacks. Classifying data by the level of security required. Rice is also working towards similar goals Enhanced firewall protection for our Students and Staff Enhanced auditing of critical systems and services

8. More Information http://www.rice.edu/it/security/index.shtml http://www.rice.edu/it/security/index.shtml 8 Yes! We are available for IT security presentations to departments and other Rice community groups. Marc Scarborough IT Security Officer marcs@rice.edu 713.348.5735