network security allan g. dyer cissp, mhkcs, miap, aidpm, msc (tech), bsc past chair, issg, hkcs;...
TRANSCRIPT
Network Security
Allan G. DyerCISSP, MHKCS, MIAP, AIDPM, MSc (tech), BSc
Past Chair, ISSG, HKCS; President, AVAR
Education SuccessSven Jaschan• German Teenager• School Student• Wrote software worth
>US$157,000
•Worldwide Headlines•Interview with Stern Magazine•Job with Securepoint - German IT Security Company
Education Success?
• estimated damages of US$157,000 for 4 specimen victims
• Created Netsky and Sasser Worms• Arrested May 2004
– Tip-off from school friends– Confessed after arrest
• Netsky.Z attacked educational sites: www.educ.ch, www.medinfo.ufl.edu, www.nibis.de
Education Failure
• He "had not considered the consequences or the damage"
• "everyone in Jaschan's class knew what he was doing"
• "some of them helped him distribute [the worms]"• Parents did not recognise the significance:
– 'Papa, I've put out a computer worm.' – 'Sven, you didn't do anything stupid, did you?'
Education Improvements
• Students need to learn about Information Security and Ethics– Protect Themselves– Respect Others
What Is Information Security?
CIAConfidentiality
IntegrityAvailability
Meet The Threats:
Viruses, Worms, Trojans
Meet The Threats:
Spyware
Meet The Threats:
Spam
Meet The Threats:
Phishing
Meet The Threats:
Criminals
Meet The Threats:
PornInappropriate Content
"Ordinary" Organisation
InternetFirewall
"Ordinary" Organisation
• Trusted Users Inside– Users are already Trained
• Threats Outside
A School
InternetFirewall
SAMS
Classrooms
A School
• Firewall is still a useful control point
• Many users (pupils) with minimal computer knowledge
• Some users may be mischievous or malicious
• SAMS an attractive target
SAMS
• Attendance Records– Hide skiving– Sell the service
• Test or Exam Results
• Personal Details– Intimidate or Blackmail others
SAMS: Gaining Access
• Guess Passwords
• Unattended Computer
• Network Sniffing
• Keystroke Loggers
How Young?
• Some macro viruses probably written by 10 to 12 year olds
• Primary Students…– Joke programs?– Plagiarism?
Are
HackersEvil?
The "Hacker Ethic"
• Curiosity
• Exploring
• Learning
• Testing and Pushing Limits
• Freedom
HKCERT/CC• Hong Kong Computer Emergency Response
Team Coordination Centre• Established February 2001• Under Hong Kong Productivity Council, funded by
Innovation & Technology Fund• Virus Alerts:
– http://www.hkcert.org/valert/valert.html
• Security Alerts:– http://www.hkcert.org/salert/salert.html
Questions?
http://www.yuikee.com.hk/computer/info-ctr/newsletter/