3 Most Common Threats Of Information Security


Published on

  • Be the first to comment

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide
  • These differences lie primarily in the approach to the subject, the methodologies used, and the areas of concentration. Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data may take: electronic, print, or other forms. Computer security can focus on ensuring the availability and correct operation of a computer system without concern for the information stored or processed by the computer.
  • A rootkit is malware which consists of a program (or combination of several programs) designed to take fundamental control (in Unix terms "root" access, in Windows terms, "Administrator" or "Admin" access) of a computer system, without authorization by the system's owners and legitimate managers
  • A denial-of-service attack ( DoS attack ) is an attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted, malevolent efforts of a person or persons to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even DNS root servers . Loss of confidentiality E-mails are sent in clear over open networks E-mails stored on potentially insecure clients and mail servers Loss of integrity No integrity protection on e-mails; body can be altered in transit or on mail server
  • POP, IMAP over ssh, SSL – protokoli PGP – enkripcija I dekripcija
  • Viruses Programs that can be attached to emails and are spread as files from individual to individual. Viruses are intentionally destructive Worms Self replicating computers programs, similar to computer viruses however do not require other programs or documents to spread. Trojans non-replicating malicious programs which appears harmless or even useful to the user but when executed harms the user’s System Spyware Programs installed on computers which record and send your personal information – includes marketing info( visited sites, lists of your software, your interests ,etc…) Phishing attempt to fraudulently acquire sensitive information, such as password and financial information, through email or an instant message
  • In computer security, social engineering is a term that describes a non-technical kind of intrusion that relies heavily on human interaction and often involves tricking other people to break normal security procedures. A social engineer runs what used to be called a "con game". Social Engineering is clever manipulation of the natural human tendency to trust. As a rule, public sector employees care about the jobs they do and try their best to be helpful. “ Social engineering attacks are mostly financially driven, with the attacker looking to obtain confidential information. Some of the common tactics used for such attacks are forging identities, exploiting the inability of people to realize the value of the data held by them or the know-how to protect data. Most users perceive a false sense of security once they install an anti-virus or anti spam solution. That’s why along with providing security solutions, we look to educate our customers on the various current and evolving security threats that take place and how to be immune from them.” said Govind Rammurthy CEO, MicroWorld.
  • 3 Most Common Threats Of Information Security

    1. 1. Most common threats to information security Ana Meskovska [email_address] ELSA Conference Strumica, 27.11.2008
    2. 2. Contents <ul><li>Introduction </li></ul><ul><li>What is an information security threat? </li></ul><ul><li>Information security threats </li></ul><ul><li>Internet security threats </li></ul><ul><li>Most common threats, possible consequences and protection </li></ul><ul><li>Top 10 internet threats </li></ul>
    3. 3. Introduction <ul><li>Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction </li></ul><ul><ul><li>through implementation of ISMS i.e. implementation of controls (policies and procedures) </li></ul></ul><ul><ul><li>the CIA aspect - Confidentiality, Integrity and Availability </li></ul></ul><ul><li>Computer security is a branch of technology known as information security as applied to computers. </li></ul><ul><ul><li>ensuring the availability and correct operation of a computer system </li></ul></ul>
    4. 4. What is an information security threat? <ul><li>A threat is any circumstance or event with the potential to harm an information system through unauthorized access, destruction, disclosure, modification of data, and/or denial of service. </li></ul><ul><li>Threats can be: </li></ul><ul><ul><li>Natural or Human </li></ul></ul><ul><ul><li>Deliberate or Accidental </li></ul></ul>
    5. 5. Information security threats <ul><li>People / employees </li></ul><ul><li>Low awareness for information security aspects </li></ul><ul><li>Advancing the IT infrastructure, networking and distributive working </li></ul><ul><li>Improvement of complexity and effectiveness of hackers and viruses </li></ul><ul><li>Electronic mail (e-mail) </li></ul><ul><li>Fire, flood, earthquake </li></ul>
    6. 6. Information Security Breaches Survey 2008 1/3 <ul><li>What type of breaches did UK business suffer? </li></ul>
    7. 7. Information Security Breaches Survey 2008 2/3 <ul><li>How many UK businesses have disaster recovery plans? </li></ul>How many UK businesses have disaster recovery plans?
    8. 8. Information Security Breaches Survey 2008 3/3 <ul><li>How did UK businesses address the weakness that caused their worst incident? </li></ul>
    9. 9. Internet security threats <ul><li>Malware Threat </li></ul><ul><li>Threats to the Security of E-mail </li></ul><ul><li>SPAM Associated Threats </li></ul><ul><li>Social Engineering Threat (Phishing) </li></ul>
    10. 10. Most common internet threats, consequences and protection Malware threats
    11. 11. Malware threat <ul><li>Malware is software designed to destroy, steal private information or spy on a computer system without the consent of the user. </li></ul><ul><li>Malwares - malicious codes, malicious programs or malicious software </li></ul><ul><li>The most popular categories are Trojan Horses, viruses, adwares, spywares, spams, worms and root kits. </li></ul>
    12. 12. Security and productivity threats posed by malware <ul><li>Stolen user ID and passwords </li></ul><ul><li>Unauthorized access to confidential information </li></ul><ul><li>Loss of intellectual property </li></ul><ul><li>Remote control of company’s PC </li></ul><ul><li>Theft of customer data </li></ul><ul><li>Reduced network performance and bandwidth </li></ul><ul><li>Increased internet traffic and changes to browser homes pages and search engines </li></ul>
    13. 13. Protection against malwares <ul><li>Good user education is vital in fighting against malwares </li></ul><ul><li>Keep your operating system up to date by installing OS security fixes and program patches. </li></ul><ul><li>Use firewall protection </li></ul><ul><li>Install anti-spyware softwares </li></ul><ul><li>Monitor logs for unusual traffic </li></ul>
    14. 14. Most common internet threats, consequences and protection E-mail threats
    15. 15. Threats to the security of e-mail <ul><li>Disclosure of sensitive information </li></ul><ul><ul><li>Loss of confidentiality </li></ul></ul><ul><ul><li>Loss of integrity </li></ul></ul><ul><li>Exposure of systems to malicious code </li></ul><ul><li>Denial-of-Service (DoS) </li></ul><ul><li>Unauthorized accesses </li></ul>
    16. 16. Countermeasures to e-mail security <ul><li>Secure the server to client connections </li></ul><ul><ul><li>POP, IMAP over ssh, SSL </li></ul></ul><ul><ul><li>https access to webmail </li></ul></ul><ul><ul><li>Protection against insecure wireless access </li></ul></ul><ul><li>Secure the end-to-end email delivery </li></ul><ul><ul><li>The PGPs of the world </li></ul></ul><ul><ul><li>Still need to get the other party to be PGP aware </li></ul></ul><ul><ul><li>Practical in an enterprise intra-network environment </li></ul></ul>
    17. 17. When using an e-mail <ul><li>Ensure you are addressing the right person prior to sending email </li></ul><ul><li>Beware of e-mails from unknown parties (unsolicited e-mails) </li></ul><ul><li>Do not open unsolicited emails </li></ul><ul><li>Do not click on links in unsolicited emails </li></ul><ul><li>Never respond to unsolicited emails </li></ul><ul><li>e.g. ‘ You have won $1,000,000. Kindly send your bank details for crediting your account.’ These are scams also known as social engineering attacks </li></ul>
    18. 18. Precautions when using a e-mail <ul><li>Suspicious attachments must NOT be opened e.g. Executable files (with .exe, .com, .bat, .reg extensions) </li></ul><ul><li>Regularly purge unnecessary emails (including emptying the ‘Deleted Items’) to free storage space </li></ul><ul><li>Do not open/reply to spam messages </li></ul><ul><li>Avoid registering unnecessarily to mailing lists </li></ul><ul><li>Use properly configured & regularly updated spam filter, antivirus and antispyware software </li></ul><ul><li>Use firewall as well </li></ul>
    19. 19. Most common internet threats, consequences and protection SPAM
    20. 20. Security threats from SPAM <ul><ul><li>SPAM provides a cover for spreading of: </li></ul></ul><ul><ul><ul><li>Viruses </li></ul></ul></ul><ul><ul><ul><li>Worms </li></ul></ul></ul><ul><ul><ul><li>Trojans </li></ul></ul></ul><ul><ul><ul><li>Spyware </li></ul></ul></ul><ul><ul><ul><li>Phishing </li></ul></ul></ul>
    21. 21. Countermeasures <ul><li>Spam Filters </li></ul><ul><ul><li>MS Outlook, Outlook Express…(e.g. SPAMFight) </li></ul></ul><ul><ul><li>Spamfighter for Outlook and Outlook express </li></ul></ul><ul><li>Antivirus </li></ul><ul><ul><li>AVG, Symantec, McAfee, F-Secure, VIRUSfighter…. </li></ul></ul><ul><li>Antispyware </li></ul><ul><ul><li>McAfee Antispyware module, S&D , Ad-Adaware SE personal, SPYWAREfighter…. </li></ul></ul>
    22. 22. Most common internet threats, consequences and protection Social Engineering Threat (Phishing)
    23. 23. Social Engineering <ul><li>Social engineering is the art of manipulating people into performing actions or divulging confidential information </li></ul><ul><li>“ Employees without security awareness are security liabilities.” </li></ul><ul><li>Gartner Group, 2002 </li></ul>
    24. 24. Security threats from phishing <ul><li>Phishing is the criminally fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication </li></ul><ul><li>Use of Email messages and Web pages that are replicas of existing sites to fool users into submitting: </li></ul><ul><ul><li>personal, </li></ul></ul><ul><ul><li>financial or </li></ul></ul><ul><ul><li>password data </li></ul></ul>
    25. 25. Prevention <ul><li>Don't give out personal information </li></ul><ul><li>Ensure you are on the right website with the right web address </li></ul><ul><li>Use anti-phishing software – IE7 and Mozilla, McAfee, Firefox 2.0 (includes a form of anti - phishing technology) </li></ul><ul><li>Research shows that employees who are sensitive and knowledgeable about information security provide the most cost-effective countermeasure against information security violations </li></ul>
    26. 26. Top 10 internet threats
    27. 27. TOP 10 threats <ul><li>SPAM mail  </li></ul><ul><li>Phishing mail  </li></ul><ul><li>Wireless attack </li></ul><ul><li>Hacker attack </li></ul><ul><li>Web exploits  </li></ul><ul><li>Adware </li></ul><ul><li>Viruses  </li></ul><ul><li>Spyware/Trojans </li></ul><ul><li>Identity theft </li></ul><ul><li>Social engineering </li></ul>
    28. 28. Conclusion <ul><li>Avoid giving unnecessary information online (e.g. subscribing to a newsletter whereby your personal details are requested) </li></ul><ul><li>Be sure you are dealing with someone or a site that you know and trust before giving out personal information </li></ul><ul><li>Use regularly updated antivirus and antispyware software </li></ul><ul><li>Use client filters or ISPs based filters </li></ul>