Information Security Awareness, Safety, and Protecting

Information

Jay James R. Arroyo, CEH, CCNSPNetwork and Security Administrator

Information and Communication Technology Division

Security AwarenessSecurity awareness is the knowledge of potential threats and the ability to anticipate what types of security issues and incidents. Officers, staff, and job orders may face in their day-to-day functions. Technology alone cannot provide adequate information security. Awareness and personal responsibility are critical to the success of any information security program.

Why Security?

Liability Privacy Concerns Copyright Violations Identity Theft Resource Violations Reputation Protection Meet Expectations Laws & Regulations

Information Security Involves three elements

Confidentiality: Ensuring information is disclosed to, and reviewed exclusively by intended recipients / authorized individuals.

Threats include Phishing, Malware and unpatched systems (both operating systems and applications).

Information Security Involves three elements

Integrity: Ensuring the accuracy and completeness of information and processing methods.

Business process improvement and verification processes.

Information Security Involves three elements

Availability: Ensuring that information and associated assets are accessible, whenever necessary, by authorized individuals.

Disaster Recovery / Business Continuity planning.

Security in General

Security: The quality or state of being secure Freedom from danger Freedom from fear, anxiety or care Freedom from uncertainty or doubt

Security in General

Safety: The condition of being safe Freedom from exposure to danger Exemption from hurt, injury or loss Knowledge of or skill in methods of avoiding or

disease

Why is information security important today?

High degree of networking Sensitive information stored on computers Hacking is a sport for students and enthusiasts Cracking is business for criminals! Theft of credit card data or identity theft can lead to

uncontrollable damage and nuisances of all kind privacy

The Internet is a very special place…

Distance is irrelevant Networked systems are prime targets The knowledge to act as a computer criminal can be

acquired everyone If there are no log files there are no traces of any

wrong-doing Any crime or event can remain undetected for months

The Internet is a very special place…

Cybercrime is hard to follow up on International police cooperation is not easy If Cybercrime is not a crime in a country, there

are no crimes Any security measures can very easily lead to an

abrogation of essential freedoms

Understanding Threats

What is valuable? What is vulnerable? What can we do to safeguard and mitigate threats? What can we do to prepare ourselves? Most believe they will win lottery before getting hit by malicious

code

Internet Users

http://www.internetlivestats.com/internet-users/philippines/

Attack Trends

• Increasing sophistication• Decreasing costs• Increasing attack frequency • Difficulties in patching systems• Increasing network connections,

dependencies, and trust relationships

Threats

• A threat is any potential danger to information and systems

• 3 levels of cyber threats

• Unstructured

• Structured

• Highly structured

Unstructured Threats

• Individual/small group with little or no organization or funding

• Easily detectable information gathering • Exploitations based upon documented flaws• Targets of opportunity • Gain control of machines• Motivated by bragging rights, thrills, access to resources

Structured Threats• Well organized, planned and funded• Specific targets and extensive information gathering to

choose avenue and means of attack• Goal-data stored on machines or machines themselves• Exploitation may rely on insider help of unknown flaw• Target drives attack• Organized crime/black hat hackers

Highly Structured Threats• Extensive organization, funding and planning over an

extended time, with goal of having an effect beyond the data or machine being attacked

• Stealthy information gathering • Multiple attacks exploiting unknown flaws or insider help• Coordinated efforts from multiple groups• “Cyber warfare”

Risk Handling Discussion• Risk reduction (countermeasures, HVA)• Risk transference (insurance)• Risk acceptance (may happen)• Risk rejection (do nothing)• Security assessments are an important part

of risk management• Penetration testing• Identify all vulnerabilities and threats to

information, systems and networks

Contingency Planning Components

• How to handle disruption? • Business continuity• Disaster recovery• Incident response

Recovery Strategy • A recovery strategy provides direction

to restore IT operations quickly and effectively

• Backup methods• Alternate sites• Equipment replacement• Roles and responsibilities • Cost considerations

Business Continuity Plan• A comprehensive written plan to maintain or resume

business operations in the event of a disruption• Continue critical business operations • Jeopardize normal operations• Most critical operations• May require alternate sites (hot, warm, cold)• What do we need to KEEP going?

Disaster Recovery Plan• A comprehensive written plan to return business operations

to the pre-disruption state following a disruption• Restore IT functions (prep and restore) • Jeopardize the normal operations• Includes all operations• RETURN TO NORMAL BUSINESS OPERATIONS• WHAT DO WE NEED TO DO IN CASE OF A DISASTER?

Plan Testing, Training and Exercising

• Testing is a critical to ensure a viable contingency capability• Conduct plan exercises• TTXs are useful

Policies and Procedures• Establish security culture• Establish best security practices• Define goals and structure of security program• Educate personnel• Maintain compliance with any regulations • Ex: email policy, Internet usage, physical security

Physical Security Countermeasures• Property protection (door, locks, lightening) • Structural hardening (construction)• Physical access control (authorized users)• Intrusion detection (guards, monitoring)• Physical security procedures (escort visitors, logs) • Contingency plans (generators, off site storage) • Physical security awareness training (training for suspicious

activities)

Personal Security • Practices established to

ensure the safety and security of personnel and other organizational assets

• It’s ALL about people• People are the weakest link• Reduce vulnerability to

personnel based threats

Personal Security Threat Categories

• Insider threats-most common, difficult to recognize• Includes sabotage and unauthorized disclosure of

information• Social engineering-multiple techniques are used to gain

information from authorized employees and using that info in conjunction with an attack

• Not aware of the value of information

Social EngineeringSocial engineering is the human side of breaking into a corporate network. Social engineering involves gaining sensitive information or unauthorized access privileges by building inappropriate trust relationships with insiders.

Social engineers manipulate people into speaking/acting contrary to their normal manner. The goal of a social engineer is to fool someone into providing valuable information or access to that information. In most cases the attacker never comes face-to-face with the victim, but they get the information or the access they need to commit fraud nearly 100% of the time.

Social Engineering Pretexting - is when a social engineer develops a storyline that he or she is able to portray to the target. It provides the justification for the questions being asked.

Impersonation - posing as an employee. It is a technique used by social engineers to deceive people.

Protect from Phishing and Email scams

Who is the email from? Look at the "From:" field. Is the sender's name or email address familiar to you? Does it use a webmail account like Hotmail or Gmail when it claims to be from your bank?

Is there a URL in the email? Where's the hyperlink going to? To see where the hyperlink is actually going, hover over it with your mouse (don’t click it). The true URL will be displayed on the bottom in the status bar. When in doubt, don’t click on it! As a best practice, never click on links in emails, texts, or social network sites. Instead, type the site address into the browser yourself (www.picpa.com.ph) to ensure that the browser goes to the expected site.

Protect from Phishing and Email scams

Is there a threat of immediate detrimental action if you don’t respond with personal information? A message demanding an immediate response deserves a good dose of skepticism.

Does the email refer to a current news event? Major news events such as large-scale catastrophes or the death of celebrities are quickly followed by a wave of phishing messages touting the same news events in their subject lines or email body. Phishers are hoping that overeager users will let their guard down and click on their proffered URL links in their haste for more information.

Protect from Phishing and Email scams

Does the tone of the email from friends or colleagues sound right? Filter the messages based on what you know of the purported sender(s) and how they typically write.

Protect from Phishing and Email scams

What if I don’t have anything of value?

People often assume they have nothing worth stealing. They think, "Why would somebody want something from me? I don't have any money or anything anyone would want." On the contrary, if a social engineer can assume your identity, he or she can convince your friends to do something. Or you can pay their bills. Or they can commit crimes in your name. No matter who you are, or who you represent, you have value to a criminal.

The single most important key to avoiding phishing and email scams is to not give sensitive information to anyone unless you can verify that they are who they claim to be and that they have a legitimate need for access to the information.

Dumpster Diving• Improperly discarded memos, organizational

charts, or policy manuals could be used for footprinting (the art of gathering information or pre-hacking). Social engineers commonly research a predetermined target and determine the best opportunities for exploitation. Dumpsters provide a huge amount of information, including the information a hacker needs to impersonate an employee.

How do you protect yourself and your company?Social engineering attacks may be inevitable in the world today for the simple reason that humans are easy targets; nevertheless, that does not mean that attacks are unpreventable.

The single most important key to avoiding social engineering attacks is to not give sensitive information to anyone unless you can verify that they are who they claim to be and that they have a legitimate need for access to the information. Organizations and individuals can protect themselves through training and awareness as well as security-related policies and procedures.

What is an organization’s best line of defense?

Properly trained staff, not technology, is the best protection against social engineering attacks. Learn how to protect yourself and your organization against social engineering attacks by understanding social engineering tactics and knowing how to recognize scams. People are the weakest link and as a result, organizations must build a human firewall by training their people

Safe Social NetworkingPeople are getting hurt today, because they're revealing too much information online, and because they trust that other people won't steal their identities. In today's world, this is just naïve. Users of social networking sites may not think much about the way posted information might enable identity theft, home burglary and social engineering attacks and may easily get into trouble. Neither do they consider how their behavior on social media sites might affect their employer. Information security awareness training can help to decrease the likelihood of serious problems whether at home or at work.

Safe Social NetworkingMobile apps - There's no guarantee that mobile apps are free of bugs or malware. Mobile malware is capable of obtaining any and all permissions on the infected device, sending SMS messages to premium phone numbers, stealing online banking credentials & downloading other malicious code without the user's knowledge.

Safe Social NetworkingSocial Networking Sites - Sometimes hackers go right to the source, injecting malicious code into a social networking site, including inside advertisements, shortened URLs, and via third-party apps.

Safe Social NetworkingUsers – It's imperative that users understand how to safely navigate the Internet. At the same time, individuals & employees need to behave responsibly, understanding that we all have lapses in judgment, make mistakes or behave emotionally. Nobody's perfect all of the time.

Safe Social NetworkingLack of a Social Media Policy – Organizations need to spell out the goals and parameters of their enterprise's social media initiatives or they're inviting problems. Employees need proper training, if only to clear up issues regarding official social media policies, and every social media initiative needs a coordinator, i.e. a social media manager.

Safe Social NetworkingUndoubtedly, the use of social networking increases the risk of leaking sensitive information and Personally Identifiable Information (PII). There are other risks to organizations as well:

Reputational risks Data breaches ID theft Copy-right and trademark infringements Defamation and libel Loss of intellectual property Violations of industry-specific regulatory requirements eDiscovery costs

Safe Social NetworkingBest practices to all your social networking accounts and activities:

• Choose a strong password: Make it longer than eight characters, include a variety of letters, numbers, and symbols, and change it regularly. Make sure you use different passwords for each of your online accounts.

• Never save passwords in your browser: Browsers often ask if you'd like to save your password for easy access (so you don't have to enter it on your next visit). Never ever save your passwords on your computer.

• Never post information in your profile (or elsewhere) that could be used to confirm your identity. This includes home address, birth date, phone number, etc. An individual's DOB and state of birth are enough to guess a SSN with great accuracy

Safe Social Networking• Turn off the bells & whistles. Disable options, then open them one by one.

• Set up login alerts. To help protect your account, request an email from the site should someone try to login from an IP address other than yours.

• Use your privacy settings to control who gets to see your posts and profile.

• Turn off applications such as games & quizzes (Get a free goat on Farmville!). If you choose to add applications, ensure you understand and control how much information you share with the application.

• Enable secure browsing, or HTTPS when using social media sites from unsecured public networks such as those in airports, cafes or hotels. This encrypts the information you send and receive. (Look in the site's security settings)

• Get tips and advice on how to avoid threats from the site's security/privacy page.

Safe Social NetworkingSafely engage in social networking:

• Use discernment when accepting friend invitations. Only accept invitations from people you know. Cybercriminals create bogus profiles to propagate malware.

• Show "limited friends" a cut down version of your profile. This can be useful if you have associates to whom you do not wish to give full friend status.

• Remove a connection to a friend that you are no longer comfortable with.• Block individuals if they are harassing you or if you just don't want to be visible to them.• Report abuse: The most efficient way to do this is right where it occurs – in the social media site's

privacy settings.• Be careful where you click. Make sure to evaluate the potential costs/benefits of pop-ups,

applications, and invites.• Don’t be an early adopter of a new app. Give the community time to discover the security

weaknesses before you dive in.

Safe Social Networking• Avoid suspicious-looking URLs. Make it a habit to mouse over links to identify the source and proceed

with caution.

• Never click on unsolicited links containing celebrity gossip, natural disasters, political scandals etc. Scammers quickly build malicious websites designed to trick users into installing malware or sending donations to replicated websites.

• Never copy & paste a link into your address bar unless you know where the link goes. Doing so will bypass you browser's security controls.

• Never post your whereabouts or your vacation plans. You're only helping burglars to plan their break-in.

• Never give up your login credentials. Social engineers are equipped with enough information to trick you into believing the request is from a legitimate authority.

• Ask permission before posting someone’s picture or publishing a conversation that was meant to be private.

• Respect the law, including those laws governing defamation, discrimination, harassment and copyright.

Online PrivacyEvery day we share information about ourselves with businesses. We do this when you take advantage of all kinds of services, including Internet searches, social networking, mobile and more. When we use these services, we’re sharing information about ourselves with friends, businesses, and affiliates. That information is often shared and sold between businesses and advertising networks.

Online PrivacyHere are a few tips to help you protect your personal information online:

1. Examine the seals and privacy policies that Internet companies post on their websites before using their product. As internet companies become more established, their policies may change, but their clients will be less likely to inform themselves of the change.

2. Before making a purchase from an online retailer, first ensure that the company or individual is legitimate and that you are not dealing with hackers posing as an online store. Do they ensure that the transaction is secure and encrypted? Does the site provide offline contact information, including a postal address?

3. Beware sites that offer some sort of reward or prize in exchange for your contact information or other personal details.

Online Privacy4. Refrain from giving out your full name, address, birth date, or any other

personal information that could be used to impersonate you (identity theft) or gain access to your accounts.

5. Periodically review the privacy and security settings on your Internet accounts and adjust them to your personal comfort level. Do not rely on "recommended" settings or default settings; and ensure they haven’t been reset through an automatic update.

6. Periodically review and delete apps and games you no longer use that have access to your accounts and devices.

7. Log out of websites and browsers when you are done. Never leave your online accounts open.

Online Privacy8. The best offense is a good defense: Safety and security starts with

protecting your computer. Install a security suite (antivirus, antispyware, and firewall) that is set to update automatically. Make sure that you are regularly applying updates for your operating system. Be sure that you are running the most up to date version of your Web browser. Keeping these critical components up to date ensures that you are protected from commonly exploited attacks.

9. Make sure that your password is long, complex and combines letters, numbers, and symbols (if allowed). Ideally, you should use a different password for every online account you have.

10. Know what action to take if you suspect unusual activity or a breach.

Online PrivacyKnowing how to navigate the Internet safely is essential to maintaining your privacy online. Remember that YOU decide what information about yourself to reveal, when, why, and to whom.

Creating AwarenessEducate staff

• Train staff• Document processes and outline expectations

Research potential candidates• Perform background & credit checks

Track system changes• Audit system access• Audit system changes

Create & communicate policies:• Define document and system disposal processes• Define backup procedures• Define clean work area policies• Define computer usage policies

Core Features

Sleek, portable, quiet, compact, rugged, shippable form factorIntel-based hardware delivers professional-grade performance & reliabilityOnboard high-gain 802.11a/b/g/n/ac wireless supporting packet injection & monitor modeOnboard Bluetooth supporting device scanning & monitor modeRuns Pwnix, a custom Debian distro based on Kali LinuxOver 100 OSS-based pentesting tools including Metasploit, SET, Kismet, Aircrack-NG, SSLstrip, Nmap, Hydra, W3af, Scapy, Ettercap, Bluetooth/VoIP/IPv6tools, and moreSimple web-based administration and in-product updates with “Pwnie UI“One-click Evil AP & Passive Recon servicesPersistent reverse-SSH access to your target network6 unique covert channels for remote access through application-aware firewalls and IPSSupports HTTP proxies, SSH-VPN, & OpenVPNOut-of-band SSH access over 4G/GSM cell networks (with optional GSM adapter accessory)Wired NAC/802.1x/RADIUS bypass capabilityUnpingable and no listening ports in stealth modeLocal console access via HDMI

Technology

Pwn Plug

Technology

https://www.pwnieexpress.com/

THANK YOU!

Jay James R. Arroyo, CEH, CCNSPNetwork and Security Administrator

Mobile: 0916.221.88.77Email: jjrarroyo@nbi.gov.ph