Security Threats in the Information Age

MBAA 609MBAA 609R. NakatsuR. Nakatsu

Case Study: Mat Honan gets attacked

“In the space of one hour, my entire digital life was destroyed. First my Google account was taken over, then deleted. Next my Twitter account was compromised, and used as a platform to broadcast racist and homophobic messages. And worst of all, my AppleID was broken into, and hackers used it to remotely erase all of the data on my iPhone, iPad, and MacBook.”

Read the complete Wired article here.

This is an example of social engineering.

Two-Factor Authentication

When using cloud-based services, use two-factor authentication whenever possible.

Three Factors are:What you know (e.g., password)What you own (e.g., cellphone)Who you are (e.g., biometric authentication)

See Google two-factor authentication example.

Security Threats On The Internet Denial of Service (DoS) Attacks: A web server is

overwhelmed with requests for data in order to cripple the network.– What is a distributed denial of service (DDoS)

attack? Intrusions: Human hackers gain access to an

organization’s internal IT systems.– How do they occur?

Malware (e.g., viruses, worms, Trojans): Malicious software programs that spread rapidly through computer systems, sometimes destroying or modifying data.– How does a computer become infected with

malware?

Specific Threats: Know the Terminology

Phishing: Email fraud where the perpetrator sends out legitimate-looking emails to collect information about you, or download malware.

Example: Cryptolocker (an example of ransomware).

Spyware: Program that hides on your system with the intent of collecting marketing information about you and your surfing habits, and/or displaying pop up ads on your screen (e.g., keyloggers capture and record your keystrokes).

Drive-by Downloads: A program that is automatically downloaded to your computer—no action on your part is necessary!

A Multi-Pronged Approach to Securing Networks

Gateway security devices: these devices (e.g., firewalls and routers) protect the “front” door to the Internet, by comparing every bit of information going in and out of your network with a database of signatures. Most organizations place a firewall at the Internet entry point of their networks.

Desktop security: install anti-virus/anti-malware on each computer.

Data encryption: encrypt sensitive data (1) before it is sent over the Internet, (2) when it is stored on a computer, (3) when backing up data on a server.

Gateway Security

Router

IntranetServer

Host System

IntranetServer

TheInternet

Fire wall

Fire wall

RouterExtranet

The Need for Data Encryption Every packet of data sent over the Internet traverses many

public networks

At any step of the way, many people could have access to those packets.

The Internet can be used for transmitting highly confidential information such as credit card data or proprietary corporate data.

Data Encryption: The Basics

Encryption is the process of encoding (or “scrambling”) information so that only authorized parties can read it.

Plaintext: the “readable”, unencrypted message

Encryption key: specifies how the message is encrypted

Ciphertext: the “unreadable”, encrypted message.

Public-key encryption: the encryption key is public for anyone to use and encrypt messages. The decryption key is private—only the receiving party can decrypt, or unscramble messages.

Encryption Examples

You can easily encrypt Micosoft Word, Excel, and Access files.Encryption is built into Windows (Bitlocker) and OS X (FileVault)Turn on WPA2, a protocol used to secure WiFi networksSSL (Secure Socket Layer) and its successor TLS (Transport Layer Security): a protocol for encrypting information sent over the Internet. Use a VPN (Virtual private network), a technology which creates a secure, encrypted tunnel across the Internet. See next slides.Encrypt your emails (PGP and OpenPGP): enables point-to-point encryption.

VPN (Virtual Private Network)

Benefits of VPNs Secures your internet connection:

snoopers cannot read your emails and communications.

Restores your freedom: allows you to circumvent regional restrictions (i.e., geoblocking)

Allows secure remote access to company resources—e.g., files, applications, printers, etc.

The Need for Digital CertificatesMasquerading or spoofing means pretending to be someone you are not, or representing a Web site as an original when it is fake.

A digital certificate provides identifying information of a company or individual, and is verified by an official, trusted agency known as a Certificate Authority (CA). The CA issues an encrypted digital certificate containing the applicant’s public key and a variety of other information.

Digital certificates are an important part of TLS/SSL (described earlier on the encryption slide).

Other IT Solutions

Have a backup strategy Practice good digital hygiene Transaction log: a log of all changes

applied to a database in chronological order

Creation of a DMZ (de-militarized zone): place a proxy server in this zone.

Have a Back Up Strategy!

Disk drives fail: don’t be surprised if this happens to you!

3-2-1 Strategy: Have at least three copies of your data, on at least two separate media storage devices, at least one copy offsite.– Cloud-based services like Carbonite, and Dropbox offer

affordable and convenient offsite, “cloud” storage. Create a disk image (e.g., timemachine on the

Mac, superduper, drivesnapshot.de, among other programs)

Digital hygiene means practicing safe behaviors on the Internet

Don’t open email attachments from strangers; be careful even if it’s from someone you know.

Update your OS regularly. Don’t click links in email. That link could lead you to a

phishing site, or the link may lead you to install malicious software.

Don’t download files from places you aren’t absolutely sure are safe. Stick with the well known sites.

Use a firewall. The best firewall is a hardware router. Run as a limited user; do not run as an administrator.

Here’s an article on how to require a password as an administrator.

Transaction LogTransaction records contain: Transaction identifier Time of transaction Type of transaction (e.g., read, insert, update, delete, abort) Identifier of data item affected Before-image of the data item After-image of the data item

From the transaction log, you can re-create a database up to a given point in time.

Network Diagram of a DMZ

DMZ: the area between the two firewalls—neither a part of the internal network nor the public Internet.