Carver-IT Security for Librarians
โข
1 likeโข754 views
This talk was provided by Blake Carver of LYRASIS during the NISO Webinar, Digital Security: Securing Library Systems, held on Wednesday, November 9, 2016
More Related Content
What's hot
What's hot (19)
Viewers also liked
Viewers also liked (20)
Similar to Carver-IT Security for Librarians
Similar to Carver-IT Security for Librarians (20)
More from National Information Standards Organization (NISO)
More from National Information Standards Organization (NISO) (20)
Recently uploaded
Recently uploaded (20)
Carver-IT Security for Librarians
- 1. IT Security For Librarians Blake Carver LYRASIS Systems Administrator
- 2. Everything You Need To Know Use Good Passwords Stay Paranoid & Vigilant Use Routine Backups Keep Everything Patched / Updated Think Before You Share Or Connect Intro
- 3. Other Things Passwords are Key ALL Software Has Flaws Security Is Complicated Everyone Plays A Part
- 4. If Vs. When Somethings are IFs, somethings are WHENs Some things are Likely Some things Possible
- 5. โ โ โ โ โ โ โ โ Bad Guys? Hackers? Crackers? Criminals? Intro
- 9. โ โ โ โ โ โ โ โ Security Cyber Security? IT Security? Safety? Information Security? Information Literacy? The Digital Divide? Intro
- 10. โSecurity is two different things: It's a feeling & It's a reality โ Bruce Schneier โ TedxPSU Intro
- 12. Security & Privacy are, Getting Better, But they're Getting Worse FasterIntro
- 13. Why does this keep happening? The Internet was built for openness and speed More Things Online โ More Targets Old, out-of-date systems and budget shortfalls New poorly designed systems Surveillance is the business of the Internet
- 14. Vulnerabilities โ โ โ โ โ โ โ โ Intro The vulnerability can be exploited remotely Used without any account credentials Not easily noticed or repaired The attack can be used, reused and scaled Chained and used with other common vulnerabilities
- 18. ALL the tools and attacks only ever get bigger better faster stronger cheaper easier and more common.
- 19. Not much of this crime is new Automation Distance "Technique Propagation" (โOnly the first attacker has to be skilled; everyone else can use his software.โ) Intro
- 20. The technology of the internet makes the bad guys vastly more efficient. Intro
- 21. It's Safe Behind The Keyboard Hacking is a really safe crime. Comparatively. To other real life crime
- 22. Intro
- 23. Where Are They Working? โข Social Networks โข Search Engines โข Advertising โข Email โข Web Sites โข Web Servers โข Home Computers โข Mobile Devices Intro
- 24. This is the work of a rogue industry, not a roguish teenager Intro
- 25. What Are They After? โข PINs โข Passwords โข Credit Cards โข Bank Accounts โข Usernames โข Contact Lists โข Emails โข Phone Numbers โข Your Hardware... Intro
- 26. http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/?utm_source=feedburn
- 27. Personal information is the currency of the underground economy Intro
- 28. Personal information is the currency of the entire Internet economy Intro
- 30. What's It Worth?Credit Cards: $5-$30 Basic or โRandomโ$5-$8 With Bank ID# $15 With Date of Birth $15 With Fullzinfo $30 Payment service accounts: $20-$300 containing from US$400 to $1,000 between $20 and $50 containing from $5,000 to $8,000 range from $200 to $300 Bank login credentials: $190-$500 A $2,200 balance account selling for $190. $500 for a $6,000 account balance, to $1,200 for a $20,000 account balance Online premium content services: $.55-$15 Online video streaming($0.25 to $1) premium cable channel streaming services ($7.50) premium comic book services ($0.55) professional sports streaming ($15) Loyalty, community accounts: $20-$1400 A major hotel brand loyalty account with 100,000 points for sale for $20 An online auction community account with high reputation marks priced at $1,400 "The Hidden Data Economy" study by MacAfee October 2015
- 32. "None of this is about being "unhackable"; itโs about making the difficulty of doing so not worth the effort." Intro
- 33. Intro
- 35. Think Differentโฆ Have A Hacker Mindset Have A Security Mindset Intro
- 36. Building a Defensible Library Lock Things Down Grant Least Privilege Whitelisting - Patches โ Limit Admins Threat Modeling Everything With An IP Address Matters Training New Instincts Never Without The WHY
- 37. Libraries Live Below The Security Poverty Line(Wendy Nather) We simply can't afford to reach a great level of security Few or no IT People Few or no Security People Hard to keep up with technology and security Maintenance, planning, strategy are 2nd to OMG Depend on consultants, vendors, family, patrons, friends, volunteers, etc...
- 38. What Does A Library Need To Protect? OPAC / ILS Staff Computers Databases Printers / Copiers Website Servers Backups Printers Cameras Wi-Fi Routers Routers Cell Phones Ipads Laptops
- 39. Things (The IoT) โ Security is an afterthought. โ The lack of security education by most of the stakeholders โ The lack of security education by consumers โ Security is a cost center โ Security makes things more expensive โ Security makes things hard to use
- 40. Locking Down Computers โข Patching and Updating โOS and *ALL* Applications โข Whitelisting โข BIOS passwords โข SteadyState / DeepFreeze / SmartShield โข Check for USB additions โข Admin โข Donโt use Windows? โข Donโt use IE? IT Security For Libraries
- 41. Donโt Forget โข Check the internet for usernames/passwords for your library (e.g. pastebin.com) โข HTTPS โข Is your domain name going to expire? โข Is you SSL Cert going to expire? โข Typo Squatters? IT Security For Libraries
- 42. Thumb Drives
- 43. http://www.pewinternet.org/files/2015/09/2015-09-15_libraries_FINAL.pdf Offer Training At Your Library
- 44. The correlation between effort & results is questionable You could have no security and be lucky. You could have great security and just get really unlucky and have a determined hacker.
- 45. Do something to make the bad guys job harder
- 46. Perfect is the enemy of the Good
- 47. Remember: This about your libraryโs security and protecting your libraryโs brand and reputation and your patrons. The only way this can happen is if security and risk management become regular parts of library conversation.
- 48. Everything You Need To Know Use Great Passwords Strong (Long, Complex) Unique Stay Paranoid & Vigilant Never Trust Anything or Anyone Always Double Check Think Before You Click Use Routine Backups Keep Everything Patched / Updated Think Before You Share Intro
- 49. Building a Defensible Library Lock Things Down Grant Least Privilege Whitelisting - Patches โ Limit Admins Threat Modeling Everything With An IP Address Matters Training New Instincts Never Without The WHY
- 50. IT Security For Librarians Blake Carver LYRASIS Systems Administrator