Fundamentals of e security
1 / 47

Fundamentals of e-Security - PowerPoint PPT Presentation

  • Uploaded on

Fundamentals of e-Security. James Kerr Office of Technology Services June, 2005. Acknowledgements & Credit.

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'Fundamentals of e-Security' - nessa

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
Fundamentals of e security

Fundamentals of e-Security

James Kerr

Office of Technology Services

June, 2005

Acknowledgements credit
Acknowledgements & Credit

Many thanks to Charles Morrow-Jones, Director of Network Security, Office of the CIO, and Steve Romig, Director of the OSU Incident Response Team. This presentation is based on their presentation, “CyberSecurity for Managers” presented in June, 2005.

Fundamentals of e-Security

Fundamentals of e security

  • To help you understand some basics about information security

  • To give you some resources that will help you when you need to expand on this base

Fundamentals of e-Security


  • What and who are we worried about, and why?

  • What can you do about it?

  • How are incidents detected and handled?

Fundamentals of e-Security

C i a

The University’s entire information processing environment rests on the assumption that we have:

  • Confidentiality-prevent unauthorized disclosure (Threat: unauthorized access)

  • Integrity-ensure accuracy and authenticity (Threat: altered, deleted, or added data)

  • Availability-ensure that information and systems are there when we need them (Threat: Denial of service)

Fundamentals of e-Security

Other concerns
Other Concerns

  • Liability: someone can use our computers to do bad things that leave us with the liability

  • Reputation: security issues can make us look bad, affecting parental trust, recruiting

  • Legal: a growing body of law requires that we do certain things to secure our systems (FERPA, HIPAA)

  • Financial: security issues cost money, directly or indirectly

  • Traceability, auditability: bad things happen, and you need to find out what and why (and sometimes who)

Fundamentals of e-Security


A bad day at the Wild West University…

Two press releases describing the loss of private information from a university’s system:

Fundamentals of e-Security

Fundamentals of e security

Initial Report ‑‑ March 5, 2003, 10:00p.m.

On Sunday, March 2 at 7:20 p.m., computer systems personnel at WWU discovered a computer malfunction. The affected computer system was immediately shut down, and detailed analysis was begun.

What happened?

The malfunction was assessed to be the result of a deliberate attack from the Internet. Subsequent analysis revealed that a security weakness in an administrative data reporting system was exploited by writing a program to input millions of Social Security numbers. Those SSNs that matched selected individuals in a WWU database were captured, together with e‑mail address, title, department name, department address, department phone number, and names/dates of employee training programs attended. It is important to note that no student grade or academic records, or personal health or insurance information was disclosed.

Is there evidence that the stolen data have been misused or disseminated?

WWU, in conjunction with the U.S. Attorney's Office, the U.S. Secret Service, and other law enforcement agencies, has focused its efforts since Sunday evening on identifying the perpetrator(s) of the break‑in and recapturing the stolen data.. To date there is no evidence that the stolen data have been distributed beyond the computer(s) of the perpetrator(s).

Fundamentals of e security

What is WWU doing about this?

WWU's highest priority has been to identify the source of the attack and to cooperate with law enforcement authorities to capture the perpetrator(s), and any associated computers and data. Our second priority will be to assess the extent of further data exposure ‑ if any ‑ and to establish a proactive communication program with affected individuals and the WWU community.

How many individual records were exposed?

Approximately 55,200 individuals had some of the above data exposed. This group includes current and former students, current and former faculty and staff, and job applicants.

How will affected individuals be notified?

The University is currently developing a communication plan and will contact affected individuals as soon as possible. At this juncture, there is no evidence that the data have been further exposed or misused. To send a comment or question to the WWU Incident Response Team, please e‑mail (do not send your Social Security number in any e‑mail message).

WWU regrets this incident and commits to do whatever is required to ensure the integrity of the data of all our past and present colleagues.

<signed> Vice President for Information Technology, Wild West University

Fundamentals of e security

Data Theft Update (October 2003)

The Wild West University regrets that one of its administrative databases was breached in March by a deliberate attack through the Internet. Thousands of names and Social Security numbers were illegally accessed and downloaded to a personal computer. Fortunately, it appears that prompt action by the Travis County District Attorney's Office, the U. S. Attorney's Office, and the U. S. Secret Service has secured the stolen data before they could be misused or further disseminated.

A WWU undergraduate student suspected of the crime was arrested by the U.S. Secret Service on March 14. His computer and related paraphernalia were seized and are being analyzed by the Secret Service.

Although the security breach and related charges facing the suspect are indeed serious, the U.S. Attorney's Office has stated officially, "At this point, there is no indication that the stolen data was further disseminated or used to anyone's detriment.“

As of October 2003, the University has successfully contacted 92 percent of the individuals known to be affected by the data theft incident, and continues its efforts to reach the remaining affected population. The University is doing everything it can to ensure the security of personal information. An underlying issue that has received attention is the University's use of the Social Security number as the unique identifier for students, faculty, staff, and other affiliates, a practice that is widespread in universities and elsewhere. The University launched a project in 2001 to migrate database systems and services to a different identifier, and important progress has been made, but the breached system continued to rely upon SSN inputs.

Questions to discuss
Questions to Discuss

1) What CIA principles were violated?

2) What other concerns did this attack raise?

3) If your information had been exposed, what would you do?

4) How much would this incident concern you if you were not affected? Would your relationship to the university matter?

5) Based on this information how would you evaluate WWU's communications to users?

6) Can you think of any similar “lurking time bombs” at OSU?


  • Scan: probing through the network to find vulnerable systems

  • Vulnerability: a weakness that might be exploited to do something “bad”

  • Exploit: using a vulnerability to gain access to a system

Fundamentals of e-Security

Terminology continued
Terminology, continued

  • Backdoor: hidden entrances to your system

  • Rootkit: tools used to hide an intruder’s presence

  • Virus, worm, trojan: old names for different sorts of “bad software”.

Fundamentals of e-Security

Terminology continued1
Terminology, continued

  • Malware: new name for viruses, worms, trojans, adware, spyware. “MALicious softWARE”

  • Adware, spyware: “commercial” software that invades your privacy, displays pop-ups, and undermines your security.

Fundamentals of e-Security

Terminology continued2
Terminology, continued

  • Bot: (short for robot) a computer running software that makes it part of a botnet, and allows others to control it remotely.

  • Botnet: a network of tens, hundreds, thousands, or tens of thousands of bots that can be used for scanning, exploiting, denial of service attacks, spamming, file sharing, and so on…

Fundamentals of e-Security

Terminology continued3
Terminology, continued

  • Encryption: a way to make data unreadable by everyone except the intended recipients

  • Authentication: the act of identifying yourself to the computer

  • Two-factor authentication: authentication that uses something you have (a key, a token card) and something you know (a password, PIN)

  • Three-factor authentication: authentication that uses something you are (biometric scan, fingerprint, retina scan, voice print) something you have (a key, a token card) and something you know (password, PIN)

Fundamentals of e-Security

Terminology continued4
Terminology, continued

  • Authorization: rights granted to a person (or a program, computer, etc) for some object (such as data in a database, login to a network)

    • Jkerr is authorized to login on this computer, but not on that one.

    • Jkerr is authorized to read this data, but not modify or delete it.

Fundamentals of e-Security

Who are we worried about
Who are we worried about?

  • Teenagers

    • A large number of attacks are perpetrated by teenagers

    • They have high interest in computers

    • They have lots of free time

    • Their morals aren’t quite fully developed

    • No perceived danger to themselves

    • “script kiddies”

    • Goals include

      • Just playing around; learning

      • Gaining social stature in the “computer underground”

      • Support their passion (file sharing, denial of service, see social stature)

Fundamentals of e-Security

Who are we worried about1
Who are we worried about?

  • Organized Criminals

    • Goals: $$$ for spam, denial of service, identity theft, espionage, harassment

    • Botnets are a real business now-for spam, denial of service attacks, and building other botnets

    • They are high-risk operations, and more motivated to use sophisticated tools and techniques to hide their tracks

Fundamentals of e-Security

Who are we worried about2
Who are we worried about?

  • Unorganized criminals

    • Disgruntled employees (are the rest of us gruntled?)

    • Other individuals doing criminal things

    • Feb. 5, 2005 (Sophos news) – a 24-year old former AOL employee has pleaded guilty to stealing a list of 92 million email addresses of the ISP’s customers and selling it to spammers for $28,000 (=$0.0003 per address)

Fundamentals of e-Security

Who are we worried about3
Who are we worried about?

  • Legitimate users

    • People doing things that unintentionally put systems at risk, typically through experimenting with game servers, file sharing, web servers, instant messaging, etc.

    • People who carelessly click on email attachments, approving dialogue boxes that ask whether it’s OK to install extra software, respond to phishing attacks, and so on…

Fundamentals of e-Security

C y a

  • Because we are concerned about C.I.A. (and the other issues) we need to secure our systems, networks, and data.

  • Step 1: identify assets (data, services, etc)

  • Step 2: identify threats (C.I.A.) for each asset

  • Step 3: identify controls to protect our assets from these threats

Fundamentals of e-Security

Physical security
Physical Security

  • Provides for the protection of property, personnel, and facilities from illegal or criminal acts, and/or environmental disruptions

  • Physical security plan should be created that deals with control of access to the building or office

  • Plan should also address responses to environmental problems

Fundamentals of e-Security

Physical security continued
Physical Security, continued

  • Look at what you are trying to protect, and who or what you are trying to protect it from, then decide how much security is required.

  • Physical security is the first line of defense against the exploitation of computer systems

  • 70% of data theft is physical theft, usually by stealing a physical device.

  • Physical security should make device theft as difficult as possible.

Fundamentals of e-Security

Physical security continued1
Physical Security, continued

  • Access control at doors

  • Physical locks or authorization (something you have) to access systems, especially laptops

  • Key control-janitorial access, master keys

Fundamentals of e-Security

Laptop pda security
Laptop/PDA Security

  • Consider the worst case scenario: laptop is stolen

    • You don’t have access to whatever was on it

    • They do

    • Do you have backups?

    • Was sensitive data encrypted, including e-mail? (SSNs, student grades, think FERPA)

Fundamentals of e-Security

Laptop pda security continued
Laptop/PDA Security, continued

  • Apple Mac OS X supports the “file vault”, which automatically encrypts files. This should be turned on (off by default).

  • Windows 2000 and XP support EFS, the “Encrypting File System”. This should be turned on (off by default).

Fundamentals of e-Security

Account security
Account Security

  • Don’t share your accounts or passwords

  • Use “good” passwords

  • Use different passwords on different systems

  • Change your passwords

  • Lock your screen

Fundamentals of e-Security

Good password habits
“Good” Password Habits

  • Change every 60-90 days

  • Use all available characters

  • Memorize, don’t write

  • Bad: 1234, <first name> i.e. jim, buckeye, osu, brutus, lima, password

  • Good: 1Gin+2Tonic

  • Good: 47adFb2m

Fundamentals of e-Security

Data security
Data Security

  • Essential to Confidentiality and Integrity

  • Regulatory environment-FERPA and student information

  • Involves protecting data in transit, as well as in storage

  • Often requires encryption of the data

Fundamentals of e-Security

People security
People Security

  • Background screening as part of the hiring process

  • Termination best practices:

    • Remove their access

    • Dispossess them of sensitive materials

    • Repossess important materials (latest version of their projects)

Fundamentals of e-Security

People security continued
People Security, continued

  • Questions to ponder:

  • Do you know what access each employee has, including remote access?

  • Can you guarantee they haven’t set up back-doors, especially if they were disgruntled before they left?

  • Do you have policies about sensitive materials at home, backups, etc?

Fundamentals of e-Security

People security continued1
People Security, continued

  • Social engineering-techniques that rely on weaknesses in humans rather than software; the aim is to trick people into revealing passwords or other information that compromises a target system’s security

    Modified from The Jargon File, version 4.7.7

Fundamentals of e-Security

Phishing example
Phishing example

Mis-spelled words


Fundamentals of e-Security

Phishing example1
Phishing example

<a href= "" style="font-family: monospace; font-size: 10pt;">Click here to confirm your account</a>

See PayPal site page on security

Fundamentals of e-Security

Social engineering example
Social engineering example

  • How could a person get tricked into giving out a password over the phone?

  • Much easier than you think!

Fundamentals of e-Security

Social engineering example1
Social engineering example

  • “Hi-this is Jim from Tech Services. We noticed that your network segment is down, and we’d like to try your login to verify it. What’s your password?”

  • “This is Andrew from Technology Services. Your mail spool on the server is blocked, and we need your password to clear it.”

Fundamentals of e-Security

What can i do
What can I do?

  • Lock it down!

  • Auto-install OS updates

  • Install and use anti-virus and anti-adware/spyware software

  • Personal firewall (OS X & Windows XP built-in)

  • Backups!

  • Use good password practices

Fundamentals of e-Security

What else can i do
What else can I do?

  • Use a browser other than Internet Explorer, i.e. Firefox.

  • Use a locking screensaver

  • Don’t use Instant Messaging clients

  • Cautiously use e-mail attachments

  • Don’t use password hints

  • Disable automatic logins

  • Apply paranoia as necessary

Fundamentals of e-Security

What does technology services do
What does Technology Services do?

  • Lima OTS and Columbus Network Security (division of OIT) actively scan network hosts for vulnerabilities

  • Lima OTS and Columbus Net Security actively monitor network traffic for suspicious activity

Fundamentals of e-Security

What does technology services do1
What does Technology Services do?

  • Centralize Microsoft OS patches and hotfixes

  • Centralize McAfee virus scan updates

  • Filter e-mail for spam and viruses

  • Authentication

  • Columbus blacklisting

  • Firewall for Lima network

Fundamentals of e-Security


  • Restricts access to network services, in and out

  • Personal (host) and network

Image courtesy of INetU Managed Hosting

Fundamentals of e-Security

What is coming next
What is coming next?

  • Best Practices for passwords

    • Minimum password length

    • Complexity requirements

    • Rotation change enforcement

  • Encrypted remote access

  • Two-factor authentication for laptops

    • Something you have

    • Something you know

Fundamentals of e-Security

F a q

  • How can I tell when I’ve been infected?

    • Unusual slowdown

    • Unexpected crashes, strange errors

    • Mouse movement or typing without you-”posessed”

    • OIT security blacklists-no Internet access off-campus

  • What do I do?

    • Turn it off!

    • Report it to Technology Services

    • Don’t try to backup now, it’s too late. You may spread contamination.

Fundamentals of e-Security

F a q1

  • What do you do with an infected/compromised computer?

    • Attempt disinfection/repair if it’s a known threat with proven recovery

    • Most often complete “rebuild” of the computer

    • Clean and repair data files

Fundamentals of e-Security

Useful resources
Useful Resources

  • Lima Technology Services


  • Columbus OIT Network Security


  • CIO Policies


  • Network Policies


Fundamentals of e-Security

Useful resources1
Useful Resources

  • OSU Site Licensed Software


  • Spybot Search & Destroy


  • General Spyware Information


  • FERPA and OSU


  • Phishing


Fundamentals of e-Security