04EACSession46.pptxVIP专享VIP免费原创优质

InformationSecurity–CreatingAwareness,EducatingStaff,andProtectingInformationSession46ChrisAidan,CISSPInformationSecurityManagerPearsonTopicsCoveredDataPrivacySpyware&AdwareSPAM&SPIMPhishingPasswordsSocialEngineeringEmail&ChatServicesSecuringWorkstationsDataBackupsEquipmentDisposalDataRecoveryDemoDataDisposalAccessRightsPhysicalSecurityEmergingThreatsIncidentResponseCreatingAwarenessQuestionsUsefulLinksWhySecurity?LiabilityPrivacyConcernsCopyrightViolationsIdentityTheftResourceViolationsReputationProtectionMeetExpectationsLaws&RegulationsUnderstandingThreatsWhatisvaluable?Whatisvulnerable?Whatcanwedotosafeguardandmitigatethreats?Whatcanwedotoprepareourselves?MostbelievetheywillwinlotterybeforegettinghitbymaliciouscodeProtectingInformationlike:SocialSecurityNumberDriverslicensenumberInsurancenumbersPasswordsandPIN’sBankinginformationKeepSensitiveDataPrivateTerminologyHackers–whitehat–greyhat–blackhatDOS&DDOS1337(Leet)speakWarezScriptkiddiesSpyware&Adware(Scumware)Spyware-ApplicationsthatmonitoractivitywithoutexpresspermissionAdware-Applicationsthatmonitoractivitywithexpresspermission–ReadtheEULASPAM&SPIMSPAM-–JunkemailSPIM-SPAMhascometoInstantMessaging–Uncontrolledviewing(pop-upwindows)–BotgeneratedPhishingPhishingisacomputerscamthatusesSPAM,SPIM&pop-upmessagestotrickusintodisclosingprivateinformation(SocialSecurityNumber,CreditCards,bankingdata,passwords,etc)–Oftensentfromsomeonethatwe“trust”orareinsomewayassociatedwithus–Appearstobealegitimatewebsite–Embeddedinlinksemails&pop-upmessage–PhishingemailsoftencontainspywaredesignedtogiveremotecontroltoourcomputerortrackouronlineactivitiesSelectagoodone–Atleast7characters–Mixtureofupperandlowercasecharacters–Mixtureofalphaandnumericcharacters–Don’tusedictionarywordsKeeppasswordssafeChangethemoftenDon’tshareorreusepasswordsTwo-factorauthenticationPasswordsSocialEngineeringSocialEngineeringistheartofpryinginformationoutofsomeoneelsetoobtainaccessorgainimportantdetailsaboutaparticularsystemthroughtheuseofdeceptionEmail&ChatServicesEmailandchataresentincleartextovertheInternetDatacaneasilybecapturedandreadbysavvycomputerusersandsystemsadministratorsSafeguardsshouldbeputintoplacepriortousingtheseprogramsforsending/receivingsensitiveinformationlikeSocialSecurityNumbersEnhanceOurWorkAreaSecuritySecureworkstations–Lockoursystems(Ctrl-Alt-Delete)–Shutdown–Runuptodatevirusscanningsoftware–Passwordprotectfiles–Applysoftwarepatches–Installcablelocks–RunadesktopfirewallIsOurDataBeingBackedUp?TestbackupsSecurelystorebackupmedia(offsite)RestrictaccesstowhocanperformrestorationEquipmentDisposalWhathappenstooldcomputerwhentheyarereplaced?Dothosesystemscontainsensitiveinformation?SeveralprogramstosecurelyremovedatafromcomputersystemsarecommerciallyavailableDataRecoveryDEMODumpsterDivingWeneverknowwhoislookinginourtrashShredsensitivedocumentsSecureshredbarrels,andmakesurethatproperhandlingproceduresareinplaceAccessRightsOnlyallowaccessthatisabsolutelyrequiredDon’tgrantaccountsbasedonthefactthataccess“may”berequiredUseleastprivilegeaccesspoliciesthatstateaccesswillonlybegrantedifrequired,notbydefaultAreaccountsremovedandpasswordschangedwhensomeonechangesjobsoristerminated?Perf...