Loading presentation...

Present Remotely

Send the link below via email or IM

Copy

Present to your audience

Start remote presentation

  • Invited audience members will follow you as you navigate and present
  • People invited to a presentation do not need a Prezi account
  • This link expires 10 minutes after you close the presentation
  • A maximum of 30 users can follow your presentation
  • Learn more about this feature in our knowledge base article

Do you really want to delete this prezi?

Neither you, nor the coeditors you shared it with will be able to recover it again.

DeleteCancel

Make your likes visible on Facebook?

Connect your Facebook account to Prezi and let your likes appear on your timeline.
You can change this under Settings & Account at any time.

No, thanks

Security Awareness Training 2013

No description
by

Jeet Jariwala

on 9 January 2014

Comments (0)

Please log in to add your comment.

Report abuse

Transcript of Security Awareness Training 2013

RYCOM Security Awareness Training

Information Security
is Everyone's
Business


Basics of Information Security

About This Course
This security training course is part of the “RYCOM Security Awareness Program” and is designed to bring you up-to-date knowledge of information security.

By finishing this course and reading all the documents in the “RYCOM Policy Binder”, you will have a better understanding of all RYCOM corporate policies and procedures
“RYCOM Policy Awareness Agreement” MUST be signed once your finish this training to acknowledge your understanding and commitment to follow all RYCOM policies and procedures.
Course Objectives
Module 1: Basics of Information Security
Module 2: Avoiding Virus, Worms and Trojans
Module 3: Password Management
Module 4: Social Engineering
Module 5: Social Networking Security
Module 6: Physical Security
Module 7: WiFi Security




Most small and medium size businesses are not convinced that cybercriminals are after them. In the recent survey of 1000 small business owners, 85% believed that big enterprises are more targeted than small businesses. More than 54% of the small businesses believe they are more prepared than big organizations on protecting company and their customers’ data.

However, in reality, cybercriminals do not discriminate between large, medium or small size businesses as long as there is profit. Any company with weak cyber security measures could become a target.
Six Questions
What is information security?

What are we protecting?

Who is responsible for information security?

How much security is enough?

What is information security policy?

Do we need information security policy?

What Is Information Security?
Information security encompasses all the ways in which we protect our information assets and capabilities from unauthorized access, modification or destruction and other forms of attack. It is how we defend our computer systems and all of our valuable information, which in today’s information age is absolutely critical to our organization.
But what exactly are we protecting?
E-mail Message
Data File
Personal
Information
Medical Information
Written
Information
Data On
Removable Media
Financial
Data
Internal Process
Who Is Responsible for Protecting all of These?
Information security is a shared responsibility of security personnel, management and all employees. Everyone can and should make a positive difference.
Information Security is Everyone's Business
We are counting on you!!
How Much Security is Enough?
Too little or too much security are both disastrous.
Too little security could lead to dangerous security breaches and tremendous loss to the organization
Too much security could put unnecessary strain on productivity and encourage employees to find shortcuts or workarounds to “simplify" things


What Is Information Security Policy?
Information security policies are sets of rules and practices
that define how information resources are protected and therefore set the level of security for an organization.

Depending on the business nature of the organization, the security level may be very high or relatively low.

It is important that the level of security must be appropriate
to the organization and different departments within the organization.

Do We Need Information Security Policy?

Virus, Worms Trojan

Avoid, Detect, Respond
What is a Virus, Worm and Trojan?
They are malicious programs that exploit a software weakness in order to gain control of your computer and cause harm. Very often, they are self-replicating and spread from one computer to another.

They could be hidden in almost any kind of file and transmitted in any way that a file can be transmitted (such as via e-mail, internet downloads, removable media, etc).

How Do You Know If You are Infected?
Your password no longer works

Cyber criminals will often change your password after hacking into your account, so they can have exclusive access to it.
If you believe the information on your computer is stolen or your work computer is comprised, please contact our IT department or security team immediately!!!

Remember to play safe, it is far better to report a system that is not compromised than not report a system that is compromised!!!

How Do You Know If You are Infected?
when your browser opens unwanted sites that you are not trying to access, or opens web pages that you can not close.
Sometimes ,cyber criminals will re-program your computer to take you to web sites you do not want to go to.

Anti-virus / Anti-spyware software scans every file on your hard drive, every bit of data in memory, files you download and all e-mail messages. It compares them to a library of signatures. If it finds a match, it quarantines or removes the file thereby eliminating the infection
You can use third party tools ( such as: PSI – personal software inspector, free for personal use ) to check the state of all programs installed on your computer to ensure they are always at the latest update.
Slow computer
Ad pop-ups
Newly installed tool bars
Newly installed programs
Odd programs being started at start up
Not be able to clear certain items such
as cookies and items
Website redirection
Symptoms
RYCOM IT administrators set your antivirus software to automatically update in order to protect your computer with the latest signature files. You should ensure this process is working properly!
Avoiding
Think before you click—Delete suspicious e-mails without opening them (such as those from unknown users with attachments).

Use anti-virus software and keep it up-to-date, ensure “auto-protect” and “schedule scan” features are enabled.

Ensure e-mail application does not automatically download pictures when you open or preview e-mail messages.

Never forward e-mails that you think may be infected with viruses.

Contact the IT department for any abnormalities in your computer (ex. Computer runs slower than usual, uses more resources, slow for networking, unusual upload or download activity without user’s initiation, etc.)
Best Practices
Password
Management

“With your password, I can get access to your computer, spy on your activities, steal your other passwords, and eventually monitor everything that goes on in your organization.

And best of all, since I will be using your account, it will all look like it was done by YOU!”

The Threats Against Passwords
Your user name and password are to authenticate you to the computer and network, that is to prove you are who you say you are and grant you the access to approved resources.

A password cracker program can be used to guess your password by trying thousands of combinations of numbers, letters and special characters every second.

Steps of breaching your personal security ( example )
Follow the logic below, you can have a basic understanding of how your personal information could be compromised ( this is only one of many ways ):

1. First, attackers will try to find out the sites you visited
Your browsing history is in the cookies and stored in your browser’s cache, nicely named and unencrypted . There are many ways this could be done, as simple as if you click on a malicious link .
Because the critical sites such as your online banking and VPN for work usually have very good security defense, the attacker will not start with such sites. Attackers will start with less critical sites such as online forums you visited or an e-greeting card site you used once in a while.

2. The attackers will now launch online password cracker programs and try to get your password on the non-critical sites described above.

3. Due to the fact that it is very common for people to use the same passwords for different accounts, once the user ID and password paring is obtained, hackers will go to the critical sites you visited and try to login.

A
strong password
could help
!!!

RYCOM Password Requirements
To satisfy the security requirements in our organization, passwords must be set under the following rules:
1. Passwords must have a minimum 8 characters
2. Passwords must have at least 3 of the following 4 types of
characters
Upper case letter
Lower case letter
Number
Non alphabetic character (such as $, &, >,!)
3. Keep in mind that the system will automatically enforce you to change your windows password every 60 days. Any of your last 13 used passwords will not be accepted by our system.

Tips for Strong Passwords
To protect your password from cracker programs, use a strong password, which:

a. Does NOT have personal information such as the name of your dog or your
favorite sport, etc. , possibly followed by a 0 or 1 (they always make you
use a number, don’t they? )

b. Does NOT use words that can be found in a dictionary.

c. Does NOT have the last 4 digits of your social insurance number.

d. Does NOT have your date of birth, your spouse’ or your child’s.

c. Use as many characters as possible (The longer the password, the harder it
is to crack)

Tips for Strong Passwords and Remembering IT !!!
There are software tools also available for secure password creation. With using such tools, passwords are highly secure and extremely hard to crack or guess.
an example of such tools is Secure Password Generator from PC-Tools, there are both online ( please click here ) and offline versions.



Detecting
Strange Phone Call(s)
Strange Email
Suspicious Person
Dumpster Diving
Avoiding
Be vigilant
Do not provide personal information or information about your organization
Do not reveal personal or financial information in email
Do not respond to email solicitations for this information
Don't send sensitive information over the Internet before checking a website's security
Warning signs of
Email Fraud
You must act ‘now’ or the offer won’t be good.
You’ve won a ‘free’ gift, vacation, or prize.” But you have to pay for postage and handling” or other charges.
You must send money, give a credit card or bank account number, or have a check picked up by courier.” You may hear this before you have had a chance to consider the offer carefully.

You don’t need to check out the company with anyone.” The callers say you do not need to speak to anyone including your family, lawyer, accountant, local Better Business Bureau, or consumer protection agency.
You don’t need any written information about their company or their references.”
You can’t afford to miss this ‘high-profit, no-risk’ offer.”
Warning signs of
Email Fraud
Responding
If you believe you might have revealed sensitive information about the RYCOM, report it to your immediate supervisor or Manager. They can be alert for any suspicious or unusual activity.
If you believe your financial accounts may be compromised, contact your finance department immediately and close any accounts that may have been compromised.
Watch for any unexplainable charges to your account.
Countermeasures
Browsing in “Private Mode”
this is a common feature most browsers support. It does not record common online activities such as the sites you visited, does not cache any web content, and usually wipes any cookies stored on your system, this will reduce the chance your cookies are used to compromise your privacy and your computer.
Manage Flash cookies
you may not realize it, but if you have Adobe Flash installed on your computer (most likely you do), then Flash stores another entire separate set of cookies which will not erase by your browser even when you browse in “Private Mode”. In order to manage such cookies, you must use the “Settings Manager” on www.macromedia.com to change the settings of your Flash Player online
Avoid installing toolbars on your browser as much as possible

Many browser have hidden functions that are designed to record your online activities. Avoid installing toolbars can protect your privacy from leaking out through such toolbar plug-ins
Watch for misleading URLs
You can sometimes reveal discrepancies between the text and the real URL by rolling over the link with your mouse and looking at what is displayed beside it or at the bottom of your browser window.

Never respond to unsolicited e-mail messages that request personal information. A reputable company will never ask for your account or password information and will not use sensational phrases like
“URGENT”
Never click on links in e-mails or IM ( instant messenger ), open attachments or accept files unless you verify the legitimacy of the sender.


Make sure the website you are visiting which contains or requests personal information is secure by looking for “https” in the web address and a padlock icon in your browser window
Always navigate to your bank or other financial institution’s website by typing in the website address, rather than clicking a link from an e-mail message. Or use Google to search the financial institution first, and click the result that appears at the very beginning of the list.

More than 20% of security incidents originated WITHIN an organization. Some of these were accidental, but a surprising amount were done by malicious insiders.

A “malicious insider” is someone who has legitimate access to the internal resources and abuses it due to a variety of reasons. It could be an employee, a contractor or a temporary employee who has financial problems, wants to have revenge due to termination, or has undergone some significant experience in personal life that has turned him/her into a threat.
Proper Information Handling

Malicious insiders will dive into the garbage and find recent financial reports, strategy documents, contracts, receipts, e-mail printouts, old computer hard drives or tapes with valuable information.

The key is to safely destroy all confidential information in different types of media before disposing.

Recommendations:

Always use special tools to safely delete all important electronic format files. note: within our company, we use a internal tool called “
nuke
” to safely delete files

Always use a paper shredder to safely destroy all confidential paper information.

Use a password protected screensaver

A password protected screensaver locks your computer after a certain number of minutes of keyboard or mouse inactivity. A password is required to unlock your computer.

Use Visitor Badges and Visitor Log
When a visitor is inside RYCOM facilities, he/she might have temporary and limited access to our systems, hence, the visitor is also considered as an insider at the time.

RYCOM grants visitor badges and uses visitor logs to track the access of visitors.

Clear Your Desk

Keeping your desk secure and clean is another way to prevent the insider threat. An insider could snoop through your desk looking for confidential information, your password or even your personal items.

Before you leave for the day:
Make sure all papers, removable media and other items containing confidential information are cleared from your desk and locked away.

Ensure you have not left any confidential information on your desk, especially passwords.

Logoff your computer if you are using a desktop and take your laptop with you or lock it in your desk drawer.

Outside of the Office
Ensure possession of laptops, mobile devices, etc.
Do not work on sensitive material when using an insecure connection.
Use extreme caution when using a VPN connection on a non-secure environment. (e.g., hotel)
Be vigilant about protecting information and information systems outside of the office.
Logoff or lock your computer whenever it is left unattended. For
Microsoft Windows, press the
CTRL+ALT+DEL
keys at the
same time and click the appropriate button, or press the
Windows + L
keys at the same time
ALWAYS use a password to protect your voice-mail from snooping.
DO NOT allow a stranger to use your computer under any circumstances.

Social Networking Security
Hackers have adopted social networking
Use profile information to create targeted social engineering
Impersonate friends to launch attacks
Leverage news feeds to spread spam, scams and massive attacks.
Social Networking lead to......
An Attacker's goldmine to conduct:

Externalizing confidential / sensitive information, Personal/ Professional Separation, Account Hijacking, Privacy Issues and identity Theft, Information Harvesting
Protection is often not effective until compromise or infection takes place
Exploit trust between friends. Viral by nature.

Tips For Social Networking
Using social networking sites will increase the risk of becoming the target of fraud, malware infection and cyber attack. In order to reduce such risks and being able to enjoy the benefit of social networking at the same time, the following best practices are recommended:

DO NOT
use social networking sites to discuss company matter, even if you think you are interacting with your colleague and even with using private messaging.

DO NOT
post any information that relates to the answer to the security questions for any of your accounts. ( if you have to do so, change the answer to your security questions )

Review the list of applications and sites that you grant access to your social networking sites on a regular basis, remove the access which are no longer needed.

Tips for Social Networking
DO NOT
click any links embedded in an email appearing to be coming from social networking sites. Instead, go to the site manually by entering the address in your browser and check the notification within your account.

Be very careful when clicking on the links posted on your “wall” which uses unusual URL shortening service or links for shocking or funny videos. If you don’t feel right about the web page after opening it, close the page without clicking any buttons on it to avoid scams.

Be responsible for your friends and family. DO NOT post information about other people which might be sensitive about their identity .

DO NOT
download any tools or do any software updates when prompted to do so after clicking a link posted on social networking site by others or a link in an email which appears to be from social networking site.

Wifi Security
Wireless network allow users to connect to the network in a simpler and faster way without physical cable connection. It can greatly reduce the amount of work to set up a network. However, Wireless network technology has its own unique risks which you need to be aware of.

Threats
Anything on your WiFi network can be monitored and captured. Wireless network is like a conversation, anyone close to you could potentially capture your activity and “listen in what you are saying”

When connected to a wireless network, we recommend the following as
best practice to minimize the security risk:
Pick the most secure network
For the purpose of convenience , a lot of public WiFi networks do not have any encryption, but some still do ( ex: hotels and some security-conscious coffee shops…) .
Try to
avoid
the network that have the security type “
unsecured
” if possible, and pick the one has some form of encryption. You will need to enter a password in order to connect ( ask the password from the business you are in ).

Set “Network Location” to “Public Network” ( Windows 7 )

when you connect to a wireless network with Windows 7, in the automatically prompted “
network location
” window, make sure to choose “
Public network
” as the location. In this location, windows will apply more strict firewall rules,
turn off network-discovery , file and printer sharing function
to ensure your computer is less visible to the computers around you and help to protect you from malwares on the internet.

Only connect to legitimate wireless access point

Hackers or Adversary can set up rogue wireless access point in public places and trick you to connect to it. Once you do so, hacker can intercept all the conversations between your computer and internet and cause harm.

How to tell if it is a legitimate AP? ---- look for the WiFi sign put up by the business or simply just ask.


Use VPN, at minimum for all critical sites

VPN ( virtual private network ) technology will create a unique virtual tunnel between your computer and the destination site, this tunnel is encrypted and can protect you from anyone who may try to intercept your web sessions. We recommend to use VPN at all times when you connect to a public WiFi hotspot, if this is not feasible for you, as a minimum, use VPN for all critical sites ( such as: online banking, email and social networking ... )

On RYCOM owned mobile computers, “Juniper Network Connect” is installed as the standard VPN application
Do firewalls protect us from everything?
Even if it is true that a good firewall can protect us from most direct threats, there are still many other ways to bypass a firewall’s security measure, especially if users unknowingly cooperate with hackers.
This is because firewalls must allow certain kinds of activities, (such as e-mail & web browsing), and it is through this and other vectors that hackers break into even the most well defended networks.

Ransomware
Ransomware appears to have been spreading through fake emails designed to mimic the look of legitimate businesses and through phony FedEx and UPS tracking notices.
The malware has the ability to find and encrypt files located within your Internal Storage drive, shared network drives, USB drives, external hard drives, network file shares and even some cloud storage drives. Cryptolocker will encrypt users’ files using asymmetric encryption, which requires both a public and private key. The public key is used to encrypt and verify data, while private key is used for decryption, each the inverse of the other. The bad news is decryption is impossible unless a user has the private key stored on the cyber criminals server. Currently, infected users are instructed to pay $300 USD to receive this private key. Infected users also have a time limit to send the payment. If this time elapses, the private key is destroyed, and your files may be lost forever
Do not follow unsolicited web links in email messages or submit any information to Web Pages in link.Use caution when opening email attachments.
Maintain up-to-date anti-virus software
Perform regular backups of all you important data.
Keep your operating system and software up-to-date with the latest patches.
Mitigations
Full transcript