Foundation MIS - Guide to Computer SecurityPresentation Transcript
Cal Poly Pomona Foundation Security Awareness Brown Bag Series Sponsored by Foundation MIS Beginners Guide to Computer Security
Beginners Guide to Computer Security Threats and Countermeasures
Provide an overview of the most
common threats and how to build
Spam Security Tools Anti-Virus Software Security Policies Passwords Firewalls Encryption Summary Importance Of Security Threats to Data Viruses Trojan Horse Programs Vandals Attacks Data Interception Scams
Good News – Bad News
Internet transforms and greatly improves our lives
Opened the door to an increasing number of security threats from which individuals, families and business must protect themselves
Consequences of attacks can range from the mildly inconvenient to the completely debilitating
Important data can be lost
Privacy can be violated
Computer can even used by an outside attacker to attack other computers on
Threats to Data
Come from a very small minority
A car thief can steal only one car at a time
Single hacker working from a single computer can generate damage to a large number of computer networks
A general knowledge of security threats and how to protect yourself is essential
Most widely known security threat due to extensive press coverage.
What is a virus?
Computer programs that are written by devious programmers and are designed to replicate themselves and infect computers when triggered by a specific event.
Example - Macro viruses attach themselves to files that contain macro instructions (routines that can be repeated automatically, such as sending email) and are then activated every time the macro runs.
Benign - cause annoying interruptions such as displaying a comical message when striking a certain letter on the keyboard
More destructive - cause such problems as deleting files from a hard drive or slowing down
How to “catch” it
A computer can be infected with a virus only if the virus enters through an outside source
an attachment to an email
a file downloaded from the Internet.
When one computer on a network becomes infected, the other computers on the network – or for that matter other computers on the Internet – are highly susceptible to contracting the virus.
Trojan Horse Programs
Delivery vehicles for destructive computer code
Appear to be harmless or useful software programs, such as computer games, but are actually enemies in disguise
Trojan Horse Programs
Can delete data, mail copies of themselves to e-mail address lists and open up computers to additional attacks
Can be contracted only by
copying the Trojan horse program to a computer
downloading from the internet or
opening an email attachment
Web sites have come alive through the development of such software applications as ActiveX and Java Applets
enable animation and other special effects to run, making web sites more attractive and interactive
However, the ease with which these applications can be downloaded and run has provided a new vehicle for inflicting damage
Vandals can take on the form of a software application or applet that causes destruction of various degrees
A vandal can destroy a single file or a major portion of a computer system
Innumerable types of network attacks have been documented, and they are commonly classified in three general categories:
access attacks, and
denial of service (DoS) attacks.
Reconnaissance - information gathering activities by which hackers collect data that is used to later compromise networks
Software tools, such as sniffers and scanners, are used to map out and exploit potential weaknesses in home computers, web servers and applications
Example – password cracking software
Access attacks are conducted to gain entry to e-mail accounts, databases and other confidential information
DoS attacks prevent access to all or part of a computer system.
Usually achieved by sending large amounts of jumbled or other unmanageable data to a machine that is connected to the Internet, blocking legitimate traffic from getting through.
Even more malicious is a Distributed Denial of Service attack (DdoS) in which the attacker compromises multiple machines or hosts.
The intercepting perpetrators might eavesdrop on communications or even alter the data packets being transmitted
Various methods to intercept data
IP spoofing, for example, entails posing as an unauthorized party in the data transmission by using the internet protocol (IP) address of one of the data recipients
Stakes are higher as they've got easy access to millions of people on the internet
May contain a hyperlink to a web site that asks you for personal information, including your password
May contain a solicitation for your credit card information in the guise of a billing request
Never give out your password, billing information or other personal information to strangers online
Be mindful of who you're talking with before you give out personal information
Don't click on hyperlinks or download attachments from people/web sites you don't know
Be skeptical of any company that doesn't clearly state its name, physical address and telephone numbe