security-intro.md

Intro to InfoSec

Source

Introduction to Cyber Security

• CIA-Triad:
  • Confidentiality: prevent unauthorized disclosure of information
  • Integrity: prevent unauthorized modification of information
  • Availability: ensure timely access to information

Protect the Facility

• safety of our employees is #1
• attackers can use physical attack to lower defense (fire alarm)
• physical access can lead to theft
• "I notice you don't have your badge with you. I'll walk you to the security to get you a temporary one."

Protect the Network

Threats:

• network attacks are the most common technical threat to a network
• can reach from eavesdropping to DoS
• can cause compliance and regulatory issues
• can lead to compromise of customer data resulting in loss of revenue and law suits
• our system can be used to attack others

Solutions:

• protect physical access to systems
• secure protocols when transmitting data (HTTPS)
• encrypt emails and files
• download from trusted sites
• scan all downloaded files
• don't bring media to work without prior approval
• dont' connect systems to the network without approval

Protect Yourself and Your Information

Threats:

• protect PII (Personally Identifiable Information)
• Full Name, SSN, Address, Phone Number, Biometrics

Solutions:

• hide these informations, don't carry them around in your wallet
• store personal information in a safe place at home
• shred receipts, credit offers, account statements, expired cards => dumpster divers
• don't trade these information for "goodies"
• don't respond to requests by phone, mail or online
• use firewall and anti-virus software

Social Engineering – The Greatest Threat: Trust

Threats:

• Phishing: mails usually appear to come from a well-known organization and ask for your personal information
• Pretexting: mail from someone saying that a maintenance worker will be swinging by and needs access to your rooms
• Baiting: giving some information and provoking action
• Quid Pro Quo: if you give me your information, I will give you full credit
• Tailgating: a person impersonates a delivery driver and wait outside a building. When an employee goes in, the attacker asks that the employee "hold the door", thereby gaining access through someone who is authorized to enter the company.

Solutions:

• trust no one!
• require multifactor authentication
• don't succumb to pressure
• don't leave valuable information on your desk
• don't leave your pc unlocked (super/win + L)

Email

Threats:

• through email attachments with malicious code

Solutions:

• never read unexpected mails from unknown senders
• never click links of unexpected mails
• never download unexpected files
• watch for poor grammar, misspellings, "urgent" or "money" messages

How to Defend Against Malicious Websites

Threats:

• Browser Hijacking: site doesn't let you leave the site (alerts, popups)
• "Scanned your pc and found virus!"-sites
• "Free Downloads!"-sites

Solutions:

• avoid such sites
• know how to handle Browser Hijacking: Cmd + W, Task Manager/System Monitor
• don't run your pc as admin/root
• use HTTPS
• backup your data

How to Protect your Mobile Device

• don't give other people physical access (reading data, installing apps)
• don't login into unknown networks (free wifis...)
• don't accept sharing your information with an app (location, contacts)
• turn off unused connections (mobile data, wifi, bluetooth, gps)
• use passwords (smartphone lock, apps)
• enable "Remote Wipe"
• backup your data

Good Information Security Practices

• always log off or lock your system(super/win + L)
• update systems
• use strong passwords
• never share passwordsx
• encrypt data
• backup data
• watch what you share
• don't give other people physical access (reading data, installing apps)
• report any potential breach to your security team
• THINK!