We will explore various tools, techniques, & procedures to ensure our environment's safety & security. Leave with a list of ideas you can use today within your library.
3. Agenda
• Understanding Anonymity, Privacy, and Everything in Between
• Protecting Yourself
• Getting Hacked
• Best Security Tool: A Policy That Is Followed
• Tools for Protecting Your Network
6. Cloak of Invisibility
Top reasons why people want to hide their IP address:
1. Hide their geographical location
2. Prevent Web tracking
3. Avoid leaving a digital footprint
4. Bypass any bans or blacklisting of their IP address
5. Perform illegal acts without being detected
7. Onion Routing, Tor Browsing
• Technique for anonymous communication to take place over a network.
The encryption takes place at three different times:
• Entry Node
• Relay Node
• Exit Node
• Tor is made up of volunteers running relay servers. No single router knows
the entire network (only its to and from).
• Tor can bypass internet content filtering, restricted government networks
(like China) or allow people to be anonymous whistle blowers.
• Tor allows you to gain access to “.onion” websites that are not accessible
via a normal web browser.
• Communication on the Dark Web happens, via Web, Telnet, IRC, and other
means of communication being developed daily.
8. Cloak of Invisibility
How do you Hide an 800lb Gorilla?
• Use Free Wifi (To Hide your location)
• Use a Secure Web Browser
• Use a Private VPN
• Go back to Dial-up
• Setup RF Data Transfer over CB Radio
Waves
• Use Kali linux to hack someone else’s
Wifi Encryption.
• Setup long-range Wireless Antennas
9. Cloak of Invisibility
• How to hide yourself?
• Private VPN
• You want a TOTALLY anonymous service.
• Look for one that keeps no log history (Verify via reviews)
• Look at Bandwidth & Available Servers
• Recommendations:
• Private Internet Access (PIA)
• TorGuard VPN
• Pure VPN
• Opera Web Browser
• Avast AntiVirus (SecureLine)
• Worst Case: Free WIFI
11. Dial Up?
• Use an ISPs like NetZero that can be registered with fictitious personal
information, and to which you can connect with caller ID disabled
• Makes it a bit more difficult to identity “you”
12. Free WiFi
• Sometimes a good alternative if
you need to do something
anonymously
• Nothing is ever 100% anonymous
• Some public wifi does track
websites you access, what you
do, etc.
• Make sure your computer name
you are using doesn’t include your
actual name
14. Best Tips and Practices
Do
• Use a device that you’ve never
signed into anything ”personal
on”.
• Pro Tip: buy a computer from a
Pawn Shop or Garage Sale
Don’t
• While on a VPN or any other
anonymous tool; don’t sign into
personal accounts (banks, social
media, etc).
• If posting, don’t use anything
that could be associated to you
15. Easy Wins for Privacy
• 10 Minute Email
• https://10minutemail.com/
• Temporarily get an email box that’s anonymous and disappears after 10
minutes
• Dr Cleaner (Mac) or Eraser (Win) can overwrite files on your
computer with “blank” data to make file recovery near impossible.
• Tools like Recuva is free softwares to allow you to restore deleted files.
16. What People Pay For Your Data
• https://www.fortinet.com/blog/industry-trends/the-true-value-of-
data.html
• Credit Card Numbers: 50 cents to 2.50 per card.
• Bank Account Information (logins/information): $1.00 to $70
• Medical Records: $10-$20
22. Tools For Use
• Sites to protect yourself all the time (not free)
• IdentityGuard.com
• LifeLock.com
• Sites to monitor when breached data gets related (this is free)
• Haveibeenpwned.com
• Password Management Sites (like lastpass.com)
• Don’t have the same password for all your sites.
• Don’t write your passwords down on a post-it-note and leave it at your desk
26. Credit Card Tools for Online Shopping
• Check out Privacy.Com
• https://privacy.com/join/473XB
ßshameless plug
27. Basic Tips
• Accept only people you know to personal and professional accounts
• Never click on links from people you don’t know.
• Especially if they are using a url shortner: bit.ly, tinyurl.com, etc
• https://www.urlvoid.com/ - test the website to see if its safe
• https://snapito.com/ gets a screenshot of what will load on the site
• https://www.site-shot.com/ get a screenshot of what will load on site
• If there are people claiming to be you on social media, it’s best to get
your account “verified” on those social media platforms
• This lets users distinguish that you’re the actual official account
• Dual factor authenticate all of your social media logins
28. Checking Your Accounts / Name Online
• Use this site to check your usernames: https://namechk.com/
• The next is a tool searches through your email with things you may
have signed up for (I've paid for their premium service as well, not
really worth it, the free does just
fine) https://brandyourself.com/privacy-overview.
• This tool: https://email-lookup.online/index.php searches public
searches to see what links. Its similar
to https://www.spokeo.com/email-search.
29.
30. Myths
• I’m/my library not worth being attacked.
• Hackers won’t guess my password.
• I/we have anti-virus software.
• I’ll/we know if I/we been compromised.
31. Understanding Breaches and Hacks
• A hack involves a person or group to gain authorized access to a
protected computer or network
• A breach typically indicates a release of confidential data (including
those done by accident)
• Both of these require different responses if breaches/hacks occur.
32.
33. The Costs Of Breaches
• This year’s study found the average consolidated total cost of a data breach
is 3.9 million dollars and in the US the average is actually higher at 8.19
million.
[IBM 2019
http://www-03.ibm.com/security/data-breach/]
• Data Breached Companies Experience…
• People loose faith in your brand
• Loss in patrons
• Financial Costs
• Government Requirements,
Penalties, Fees, etc.
• Sending of Notifications
• Payment of Identity Protection or
repercussions.
https://betanews.com/2016/02/10/the-economic-cost-of-being-hacked/
38. BackTrack can get you ALOT
• BackTrack was a Linux distribution that focused on security based on
the Knoppix Linux distribution aimed at digital forensics and
penetration testing use. In March 2013, the Offensive Security team
rebuilt BackTrack around the Debian distribution and released it
under the name Kali Linux.
https://en.wikipedia.org/wiki/BackTrack
39.
40.
41. You as a Organization - Obligations
• You are obligated to protect the data and privacy of:
• Employees
• Customers
• Business Partners/Vendors/Etc.
• Sometimes, we forget we house a lot of personal and identifying information about our employees and
customers.
• Employees Social/Payroll/HR
• Customer Records/Accounts/History
• What employees/customers are accessing on the web
• A sniffing tool, key logger, or fake DNS redirects can monitor not only the sites people are accessing but what they use
for their username / password
42. Steps – Communication and Speed!
• Communicate
• People will ask “How long did you know XYZ happened” - know this information before communicating to them
an attack occurred.
• If you discover a breach, hack, or any other compromise that may have the impact of data being stolen or
viewed, you MUST communicate quickly and effectively.
• While every scenario is different and has different factors – groups that move faster with the information they
know (as soon as they know it) they are generally better off long term (ie don’t’ wait months as you “investigate”
the issue. Give people time to protect themselves)
• Don’t over communicate and have one spokesperson
• Be clear and concise. Too many details can be harmful.
43. Other Points on Communication
• Once you know a breach has occurred, by law you are required to
inform customers if their data has been compromised.
• Some states have deadlines of when the announcement has to be made
• Every impacted person must be told that a data breach has
occurred, when it occurred, and what kind of information was
compromised.
• Answer: what are you doing to provide a remedy and should they do
• (next slide)
44. what are you doing to provide a remedy and should they do
You as the Organization
• Build a website with information
about the breach
• Offer a Toll Free number people
to call in for questions
• If the possibility of social
information provide contact
information for Equifax, Experian
and Transunion, and the quick
links for fraud protection.
Them as Impacted Parties
• Fraud Protection (if necessary)
• Request them to change their
passwords if their password was
compromised
• Highlight if they use this password
on OTHER sites to change those
passwords too
45.
46.
47. Step 2 - Investigate
• You will most likely need to hire an outside cyber security
firm – they have the tools and resources to track what might
have been stolen and who stole it.
• Solve which computers and accounts were compromised, which
data was accessed (viewed) or stolen (copied) and whether any
other parties – such as clients, customers, business partners, users,
employees. Was the stolen data encrypted or unencrypted?
• Also involve folks from the people you pay for services
(depending on where the breach occurred) such as ISPs, Web
Hosting Providers, Security Software, Firewall Vendors, etc.
• Contact your local, county or state police computer crimes
unit and the FBI, which can do forensic analyses and provide
valuable guidance
48. Step 3 – More Communication and Follow Up
• If you notify more than 500 impacted people from a breach, many
states will also require you to file a notice with your state attorney
general’s office.
• HIPPA, FERPA, CIPA, and all those other scary acronyms have requirements
and regulations – make sure none of those rules are violated.
49. Legal Stuff
• There are a lot of laws that help a
certain level of security standards.
The landscape of these laws is
evolving as the level of threats
increase.
• There is compliance standards that
organizations should reach for
security as well – as a precaution and
preventive measure to mitigate risk.
• The ISO/IEC 27000 family of standards
helps organizations keep information
assets secure.
• https://www.iso.org/isoiec-27001-
information-security.html
51. Increases Efficiency
• Having a security policy allows you to be consistent in your approach
to issues and how processes should work.
• It should outline how and what to do, and repeatable across your
organization.
• Everyone is doing XYZ the same way and on the same page.
52. Accountability, Discipline, and Penalties
• Think of it as a contract – for legal purposes – that you have taken the steps
needed to secure your organization.
• Need to define penalties when violations occur. People need to know the
consequences are for failure to comply – both from a legal and HR standpoint
or even access permissions.
• Policies and procedures provide what the expectation is and how to achieve
that expectation. It should define what the consequence are for failure to
adhere.
53. Education For Employees
• By reading these policies (and signing them), it helps educate your
employees (and users) the sense of ownership for assets and data.
• Everything from advice on choosing the proper passwords, to
providing guidelines for file transfers and data storage, internet access
and rules, will help to increase employees’ overall awareness of
security and how it can be strengthened
54. Addresses Threats and Risks
• A good policy should address all threats, strategies to decrease the
vulnerabilities of those threats, and how to recover if those threats
became actionable.
• This makes the “what do we do if someone hacks our network” a
defined process already and who to call and what to do to mitigate
further damage.
55. Access Definitions and Permissions
• A good policy would outline who accesses what and why. This makes
reporting a security violation easier and streamlined.
• Policies are like bouncers at a night club
• It states who has access to the VIP section of the club, why, and any reasons
to allow entry.
• Without these rules, VIP wouldn’t be really VIP.
57. Why do People Attack?
• Financial Gain
• Stocks
• Getting Paid
• Selling of information
• Data Theft
• For a single person
• For a bundle of people
• Just Because
• Malicious
58. How to navigate and prevent wrong turns
• Who are the people we’re
trying to avoid?
Hacker Groups
• Lizard Squad. ...
• Anonymous. ...
• LulzSec. ...
• Syrian Electronic Army. ...
• Chaos Computer Club (CCC) ...
• Iran's Tarh Andishan. ...
• The Level Seven Crew. ...
• globalHell.
59. So what Do You Need to Protect?
• Website(s)
• ILS
• Staff Computers
• And what they do on them
• Patron Computers
• And what they do on them
• Network
• And what people do on them
• Stored Data, Files, etc.
• Business Assets
• Personal Assets
• ….anything and everything that is plugged in…
60. Outside
• Modem Router Firewall
Switches
• Servers
End User
• Phones
• Computers
• Laptops
61. Outer Defenses (Routers/Firewalls)
• Site to Site Protection (Router to
Router or Firewall to Firewall)
• Encrypted over a VPN Connection
• Protection With:
• IDS
• IPS
• Web filtering
• Antivirus at Web Level
• Protecting INBOUND and OUTBOUND
62. Unified Threat Management
• Single Device Security
• All traffic is routed through a unified
threat management device.
63. Areas of Attack On Outer Defense
External Facing Applications
• Anything with an “External IP”
• NAT, ONE to ONE, etc.
• Website
• EZProxy Connection
• Custom Built Web Applications
or Services
Internal Applications
• File Shares
• Active Directory (usernames /
passwords)
• Patron Records
• DNS Routing
• Outbound Network Traffic
• Who is going where
64. Attacks
• Man in the Middle
• Sitting between a conversation and either listening or altering the data as its sent
across.
• DNS Spoofing (https://null-byte.wonderhowto.com/how-to/hack-like-pro-spoof-dns-
lan-redirect-traffic-your-fake-website-0151620/) set up a fake website and let people
login to it.
• D/DoS Attack (Distributed/Denial of Service Attack)
• Directing a large amount of traffic to disrupt service to a particular box or an entire
network.
• Could be done via sending bad traffic or data
• That device can be brought down to an unrecoverable state to disrupt business
operations.
• Sniffing Attacks
• Monitoring of data and traffic to determine what people are doing.
68. Updates, Patches, Firmware
• Keeping your system updated is important.
• Being on the latest and greatest
[software/update/firmware] isn’t always
good.
• Need to test and vet all updates before
implementation
• If you can – build a dev environment to
test and validate.
69. Casper Suite / JAMF - https://www.jamf.com/products/jamf-pro/
72. Protecting End Devices
• Protecting Assets
• Business Assets
• Thefts
• Hacking
• Personal Devices
• Security Risk
• Usually pose an INBOUND threat
to your network
73.
74. Passwords
• Let’s talk about Passwords
• Length of Password
• Complexity of password
requirements
• DO NOT USE POST IT
NOTES
• A person’s “every day
account” should never
have admin rights to
machines.
• That includes your IT
Folks!
90. IT Admin Tricks for Security
• Administrative Accounts are easy to figure out if they
are something like “administrator” ”root” or “power
users”. At the same time, no employee should have
their account as a full admin.
• Instead, give them their own username for admin access (like
brian.admin)
• Change the default “login” pages for sites to something
that’s not www.mysitename.com/login. Bots look for
this and attack.
• My Drupal Site login page is www.evolveproject.org/catpower
• User Awareness is key to any secure organization. Teach
users how to identify potential threats and how to
respond quickly.
• Avoid shared accounts. One account should only be
used by one person.
101. Email for Kids
• There are service providers that can help manage kid’s emails and
help protect them.
• Google has an option where you can manage a Google Account for
your child:
https://support.google.com/families/answer/7103338?hl=en
102. Apple iOS Parental Controls
• https://support.apple.com/en-us/HT201304
• https://www.apple.com/families/
107. Advance Cyber Protection Tools
• MDR / NDR Solutions (Managed Detection Response / Network
Detection Response)
• Network detection and response (NDR) products detect abnormal
system behaviors by applying behavioral analytics to network traffic
data.
• Security information and event management, SIEM for short, is a
solution that helps organizations detect, analyze, and respond to
security threats before they harm business operations.