Security Concerns and Solutions

Security Concerns

• Unauthorized users accessing sensitive corporate data (e.g., disgruntled ex-employees, hackers).
• Intercepting/listening to network traffic (especially wireless).
• Malicious outside attacks on network servers.
• Property/data loss due to theft.
• Property/data loss due to fire.
• Online transactions.
• Viral infections.

User Security Solutions

• Firewalls (hardware or software).
• Strict user permissions limiting access to necessary data.
• Authentication methods.
• Data encryption to prevent interception.
• Regularly updated antivirus software.
• Local policies restricting system capabilities.
• Limiting system access (e.g., no removable drives).

Physical Security Solutions

• Theft prevention (e.g., tamper-resistant screws, alarms).
• Closed circuit monitoring.
• Regular hardware inventory.
• Secure system anchors and locks.
• Physical authentication (e.g., proximity cards, fingerprint readers).
• Limited server access.

Social Engineering

• Social engineering is a type of "hacking" that manipulates people to gain unauthorized access.
• Phishing.
• Impersonation.
• Shoulder surfing.
• Baiting (leaving a decoy to lure users).
• Identity theft.

Plan for Disaster

• Make daily server backups and mirrors (one on-site, one off-site).
• Maintain extra hardware for quick replacements to minimize downtime.
• Prepare a plan for various disasters (e.g., server crash, drive failure, network attack, theft).
• Begin damage control.

Disaster Prevention

• Disasters are inevitable.
• Maintain optimal server/equipment room conditions (temperature, location).
• Avoid basements to reduce flood damage.
• Use high-quality surge protection and backup power systems.
• Implementing deterrents to reduce theft.

Disaster Prevention (User Focus)

• Educate users about security risks.
• Implement backup/restore system images.
• Avoid concealing file extensions.
• Implement software undoing unauthorized changes.

Disaster Prevention (Technical)

• Use the correct tools (e.g., do not substitute network intrusion software for firewalls).
• Understand personal legal/financial liabilities relating to data breaches.
• If transporting off-site data, be mindful of potential consequences for data falling into the wrong hands.

More Points About Security

• Act as a security advocate to protect data and assets.
• Methods used to compromise security evolve, so constant vigilance is required.

A Few More Security Tips

• Security policies exist (all employees must be familiar).
• Rename administrator accounts and create false accounts (hackers often target Administrator accounts).
• Limit login attempts to protect accounts.

Backups

• Backup strategies typically involve a full backup at the beginning of the week.
• Subsequent backups can be differential (changes since last full) or incremental (changes since last backup).
• Backup frequency depends on department access patterns.

Authentication

• Authentication validates user identity accessing a resource.
• Two-factor authentication is common (something you are, have, or know).
• Periodic authentication is often required within a system.

Secure Deletion of Data

• Hard drives: software overwrites data repeatedly (e.g., DBAN), degaussing or physical destruction.
• Optical disks: many shredders have slots for disks; employing industrial shredding services is advised for discarded EOL devices.

Security (Policy & Procedures)

• Principle of Least Privilege: users only have access to the information necessary for their jobs.
• Chain of Custody: detailed documentation trails the handling of evidence.

Security (Methods)

• Mantrap: secure area allowing only one person at a time to pass (mitigates tailgating).
• Honeypot: decoy server to lure attackers and gather threat intelligence.

Passwords

• Encourage/force regular password changes.
• Longer, more complex passwords (upper/lowercase, numbers, symbols) are better.
• Avoid reusing passwords for multiple accounts.

Password Confidentiality

• Studies show significant percentages of workers share passwords for small incentives.
• Password security is crucial, and companies need to implement safeguards and policies to prevent breaches.