Download
slide1 n.
Skip this Video
Loading SlideShow in 5 Seconds..
University of Arizona Security Awareness Campaign PowerPoint Presentation
Download Presentation
University of Arizona Security Awareness Campaign

University of Arizona Security Awareness Campaign

234 Views Download Presentation
Download Presentation

University of Arizona Security Awareness Campaign

- - - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

  1. University of Arizona Security Awareness Campaign Kelley Bogart University Information Security Coordinator Gil Salazar Network Administrator University of Arizona

  2. Agenda • Why Awareness • Challenges • Solutions • Benefits • Costs • Initiatives • Demonstration

  3. Why Awareness? Campus Policy, Standards & Guidelines • Privacy Guidelines • Acceptable Use Policy • Security Policy – Draft • Supporting Security Standards & Guidelines • Business Continuity & Disaster Recovery • Incident Reporting • Management Responsibilities for Security • Networked Device Security

  4. Why Awareness? (cont) • Heightened Activity • Regulatory Drivers • FERPA • HIPPA • GLBA • State Legislation (House Bills) • Online Privacy Statement • Misuse of State of Arizona Equipment • Many more to come

  5. Why Awareness? (cont.) • Relationship of Privacy & Security • Roles and Responsibilities

  6. Where to start and how? • Step 1: Where are we now? Current Situation Assessment • Step 2. Where do we want to be? Strategic Direction • Step 3 - How do we plan to get there? Implementation Planning • Step 4 - How will we monitor progress? Monitoring

  7. Goal: Set the stage for all security efforts by bringing about a change in attitudes, which will change the campus culture. University of Arizona Characteristics Level 5 CONTINUOUS IMPROVEMENT Threats are continually reevaluated based on changing threat population and security incidents. Additional or more cost effective alternatives are continually identified. The practice of Security is considered a component of the campus culture. Security Awareness is viewed as a business enabler. Level 4 COMMON PRACTICE The integration of Security programs and services in the campus departments is complete. Security is involved at the onset of projects. U of A is considered as a Security Awareness Best Practice campus. General acceptance of campus-wide standards based on Security Infrastructure and displayed through noticeable behavior change. Staff, faculty and students actively and visibly participate in the programs and services. Security incidents are reported immediately to the appropriate area. Level 3 INTEGRATION Level 2 ACKNOWLEDGEMENT Realization that existing Information Security processes are fragmented. Executive level support and involvement is visible. Some Security Awareness interventions are implemented and are ongoing. Level 1 COMPLACENCY Security Policies & Standards are minimal and may or may not be documented. Security Incidents are viewed as someone else's problem. Existing programs and services are perceived as sufficient. Security is viewed as an enforcer.

  8. Challenges • Funding & Resources • Diversity and Decentralization • Varied Audiences • Administrators • Students • Staff • Faculty • Technical vs. Non-technical

  9. Solutions • Message vs. Delivery Method • Timeline / Opportunities • Surveys • Include WIIFM - What’s in it for me? • Include Knowledge, Skill and Attitude • The What, How & Why or Want to do

  10. The following three slides are a consistent message we communicate or incorporate in our awareness / education efforts to help reinforce the message that Security is Everyone's responsibility! That technology alone cannot keep us secure. People are the last layer of defense.

  11. The key to security is embedded in the word security. U - R - IT SEC--Y YOU ARE IT!

  12. If not you, who? If not now, when?

  13. During your typical day, you may be exposed to situations where you become aware of an attempt to breach an area of security. You need to be prepared to: Protect Detect React

  14. Benefits • Heightened Awareness • Key Partnerships formed • Campus wide understanding, acknowledgement and support • Recognition of Security Office • Increased reporting & requests

  15. Costs • Pamphlets • Security Awareness Day • Dedicated Staff • Posters

  16. Initiatives • Monthly “Brown Bag” Presentations • Customized group presentations • Redesigned Security Page security.arizona.edu • Campus Security Awareness Day security.arizona.edu/awarenessday.html • New Employee Orientation Handout

  17. Initiatives (cont.) • Pamphlets • Privacy Basics - Guide to Protecting Personal Information • Risk Reduction - Computer Protection and Prevention • Security Basics - Guide for Protecting Your Computer • Computer Security and Privacy Information - What everyone needs to know • Security Awareness Posters security.arizona.edu/posters.html

  18. First Set

  19. First Set

  20. First Set

  21. Second Set

  22. Second Set

  23. Second Set

  24. Goal: Set the stage for all security efforts by bringing about a change in attitudes, which will change the campus culture. University of Arizona Characteristics Level 5 CONTINUOUS IMPROVEMENT Threats are continually reevaluated based on changing threat population and security incidents. Additional or more cost effective alternatives are continually identified. The practice of Security is considered a component of the campus culture. Security Awareness is viewed as a business enabler. Level 4 COMMON PRACTICE The integration of Security programs and services in the campus departments is complete. Security is involved at the onset of projects. U of A is considered as a Security Awareness Best Practice campus. General acceptance of campus-wide standards based on Security Infrastructure and displayed through noticeable behavior change. Staff, faculty and students actively and visibly participate in the programs and services. Security incidents are reported immediately to the appropriate area. Level 3 INTEGRATION Level 2 ACKNOWLEDGEMENT Realization that existing Information Security processes are fragmented. Executive level support and involvement is visible. Some Security Awareness interventions are implemented and are ongoing. Level 1 COMPLACENCY Security Policies & Standards are minimal and may or may not be documented. Security Incidents are viewed as someone else's problem. Existing programs and services are perceived as sufficient. Security is viewed as an enforcer.

  25. Questions

  26. § ¦ µ Gil Salazar UA Network Administrator Kelley Bogart Information Security Coordinator

  27. Agenda • State of the Internet today • Viruses, Worms & Spies! • How to Protect Yourself

  28. State of the Internet Today Internet goes thru your computer

  29. Some Local StatisticsUniversity of Arizona Campus Cyber attacks per day # of outside to inside attacks : 64,959 # of Inside to outside attacks : 60,040 # of Inside to Inside attacks : 6,941 Total of related victim machines : 593,734

  30. Threat Follows Value The 1950s American bank robber Willie Sutton was asked why he robbed banks. He said he robbed banks because, “That’s where the money is.” Today, the money is in Cyberspace! The Internet provides for criminals the two capabilities most required for the conduct of criminal activities: Anonymity & Mobility

  31. Do The Math • Spam mailed to over 100 million inboxes • If 10% read the mail and clicked the link • = 10 million people • If 1% of people who went to site signed up for 3-days free trial • = (100,000 people) x ($0.50) = $50,000 • If 1% of free trials sign up for 1 year • = (1,000 people) x ($144/yr) = $144,000/yr

  32. Situation: It is getting scary! Most attacks occur here Why does this gap exist? Product ship Vulnerability Discovered | Potential attack Software Modified Patch released Patch deployed at home/office

  33. exploitcode patch 331 180 151 1 ZoTob 25 Nimda SQL Slammer Welchia/ Nachi Blaster Exploit Timeline • Days From Patch to Exploit • The average is now nine days for a system to be reverse-engineered Why does this gap exist? Days between patch and exploit

  34. Exploit Survival Time • The SANS Institute has studied what it calls the "survival time" of an unprotected computer hooked up to the Internet. • A year ago, the average time before it was compromised was about 55 minutes. • Today it's 20 minutes. • On the UA campus it can be less then ONE MINUTE.

  35. State of the Internet Questions? • Why do criminals use the internet today? • To be Anonymous & Mobile

  36. Viruses, Worms & Spies

  37. Virus: • Old “traditional” viruses usually required human interaction • You have to save it, run it, share floppy disks • E-mailing a program / document, without knowing it is infected • Typically just attach themselves to programs & documents, and then depend on humans to propagate • This is changing…

  38. How It Spreads • E-mail • Instant Messenger • Networks • P2P/Filesharing software • Downloads • Floppy disks, Flash Drives. CDs, etc.

  39. Sample E-Mail................... This has a virus attached! • To: user@email.arizona.eduSubject: Notify about your e-mail account utilization. From: support@arizona.edu • Dear user of Arizona.edu gateway e-mail server, • Your e-mail account will be disabled because of improper using in next three days, if you are still wishing to use it, please, resign your account information. For further details see the attach. For security reasons attached file is password protected. The password is "03406". Best wishes, The Arizona.edu team http://www.arizona.edu

  40. Questions? Virus: • What is the most common way viruses are spread today? • E-Mail

  41. Worms: • Sub-class of Virus • Replicated Automatically without human help • Example is e-mail address book attack • Bogs down networks and Internet • Zotob, Blaster are examples

  42. Worms: • Scary part – you don’t have to do anything but turn your computer on! • Or make a simple click.

  43. Trojan Horse • Program that appears to be a “good” program, but really isn’t • Might do what it is supposed to, plus a whole lot more! • programs installed in this category use several methods to enter the computer; • Web, e-mail, spyware

  44. Botnets or “Zombies” • Botnets are networks of captive computers (often called zombies) that are created by trojans or worms that have infected unprotected PCs. • These networks are frequently used to send spam and initiate distributed denial of service (DDoS) attacks.

  45. Questions? Worms: • What is it called when a program sneaks onto your computer? • A Trojan

  46. Phishing

  47. Have you ever received an email that says something like this? “We suspect an unauthorized transaction on your account. To ensure that your account is not compromised, please click the link below and confirm your identity.” OR “During our regular verification of accounts, we couldn’t verify your information.Please click here to update and verify your information.”

  48. This is a typical “phishing” attempt