Computer Security CST8316 PDF

Computer Security CST8316  Security Concerns  Unauthorized users accessing confidential or sensitive corporate data (disgruntled former employee, hacker, etc)  Intercepting or listening to network traffic (particularly wireless)  Malicious outside attacks on ne...

Computer Security CST8316  Security Concerns  Unauthorized users accessing confidential or sensitive corporate data (disgruntled former employee, hacker, etc)  Intercepting or listening to network traffic (particularly wireless)  Malicious outside attacks on network servers  Property/data loss due to theft  Property/data loss due to fire  Online transactions  Viral Infection  User Security Solutions  Firewall (hardware or software)  Stringent permissions to ensure that all users are limited to necessary data  Authentication  Data encryption to avoid packet interception  Antivirus software updated regularly  Local policies to restrict system capabilities  Limiting systems (ie. No USB ports or optical drives/writers so that data can’t be put in or taken from system) Physical Security Solutions  Avoiding loss due to theft  Tamper resistant screws  Alarms on systems  Closed circuit monitoring  Inventory the hardware regularly  Industrial system anchors and locks  Physical authentication (proximity card access, finger/thumb print reader, etc)  Limit access to servers to very few people Social Engineering  Social Engineering is effectively “hacking” a person in order to gain unauthorized access  Phishing  Impersonating  Shoulder surfing  Bait drive “accidentally” left behind  Identity theft  Plan for Disaster  Make daily server backups and mirrors so that one can be on site and one off site  Always have plenty of extra hardware on hand, exact replacements whenever possible to limit downtime  Prepare (well in advance) a plan to deal with different types of disasters (server crash/drive failure, network attack, theft) and begin damage control  Disaster Prevention  Disaster of some sort will occur (not a matter of if, it’s a matter of when)  Maintain your server/equipment room  Constant temperature  Not in a basement to avoid flood damage  High quality surge suppression, line conditioning and power backup equipment should be used at all times  Employ all necessary deterrents (within reason) to stave off theft Disaster Prevention  Educate your users (without overwhelming them) about inherent dangers  Set up systems yourself  have a common image whenever possible that can be reloaded quickly  Uncheck “hide known file extensions”  Implement software in OS that will “undo” any unauthorized environment manipulation (such as Deep Freeze)  Disaster Prevention  Use the proper tools for the job (ie don’t substitute network intrusion software for firewall software)  Understand your personal legal and financial liabilities in the event of a disaster (it can go far beyond losing your job)  If data must be transported off site (like onto a laptop for a business trip) you must be prepared for the possible consequences of that data falling into the wrong hands More Points About Security  You will have to act as a security advocate from time to time if you expect the data and property under your control to be safe. You can be held legally accountable for loss that you could have prevented  Methods for breaching security evolve as quickly as measures to prevent them. You will have to show determination and vigilance if you want to keep your data/assets more than somebody wants to take them A Few More Security Tips  Security Policies exist in most corporate environments, and all employees are expected to be familiar with them  Rename Administrator account and create false admin account. Most hackers target Administrator accounts (already have username, just hack the password)  Limit login attempts on accounts (if it fails x times, account is suspended) Backups  A backup solution usually involves completing a full backup at the beginning of the week and then one of two options for the remainder of the week:  Differential backup – backs up all files that have been accessed or altered since the last full backup.  Incremental Backup – Backs up all files that have been accessed or altered since the last backup of any kind  Which type of backup you use largely depends on how frequently your department has historically had to access the backups Authentication  Authentication is used to confirm the identity of an authorized user that is accessing a resource  Two factor authentication is most common and will usually consist of two out of the three following options:  Something you are  Something you have  Something you know  Authentication is done periodically or as a user goes further into a system Secure Deletion of Data from Devices  Hard disk drives  Software that’s designed to overwrite data on a hard disk repeatedly (such as DBAN)  Hard disk degaussing  Hard disk destruction/pulverization  Optical disk  Many office shredders have a slot specifically for optical disks  EOL devices  Typically involves using industrial shredding services Security  Principle of Least Privilege  When used in the context users, the principle of least privilege is employed to ensure that all users have full access to all resources necessary to do their jobs, but nothing more.  Chain of Custody  Detailed documentation about the handling of an item that may be used in litigation that ensures the integrity and admissibility of evidence. Always document exactly how you found it (the system, component, whatever it was), exactly when, everything you did with it and who you handed it over to. Security  Mantrap – a mechanism that only allows one person at a time to pass into a secure area. Mantraps are designed to mitigate tailgating, a practice which an unauthorized person passes into a restricted area by following very closely behind a person who does have access.  Honeypot – a decoy server designed to look very convincing in order to lure unauthorized users. Typically used to gather information on threats such as frequency, type and origin. Passwords  Clients should be encouraged (or forced) to change their password regularly.  Longer passwords are generally better, and adding some complexity is better still. Make use of upper and lowercase letters as well as numerals and special characters.  Let clients know that using the same password for numerous resources/sites/accounts is a security risk.  Password Confidentiality  A study of commuters on the Tube (subway) in London, England found that 64% of office workers asked gave away their office computer password for a cheap pen.  The same study repeated a year later saw that number increase to 90%.  A different study found that 70% of office workers would give a stranger their password for a piece of chocolate.  That figure includes the 34% who gave it up freely before they knew they were getting anything in return.