Cyber security expert Vinod Sencha discusses the importance of cyber security and various cyber threats. He notes that the only truly secure system is one that is powered off, locked in a bunker, and guarded. The document then outlines key cyber security concepts like the CIA triad of confidentiality, integrity and availability and discusses common cyber attacks like phishing, malware, ransomware, and business email compromise. It also addresses emerging threats during the COVID-19 pandemic. The document stresses the importance of security awareness, strong passwords, backups, and patching systems to help protect against cyber attacks.
Cyber Security Awareness introduction. Why is Cyber Security important? What do I have to do to protect me from Cyber attacks? How to create a IT Security Awareness Plan ?
Cyber Security 101: Training, awareness, strategies for small to medium sized...Stephen Cobb
I developed "Cyber Security 101: Training, awareness, strategies for small to medium sized business" for the second annual Small Business Summit on Security, Privacy, and Trust, co-hosted by ADP in New Jersey, October 2013.
This is a basic presentation about cybersecurity to share awareness about various security threats and how you can protect yourself from them. In the preview window the formatting is off, but when downloaded it can be viewed with no problems. This is for my Info Security Policy Management class at Governors State University.
** Cyber Security Course: https://www.edureka.co/cybersecurity-certification-training **
This Edureka PPT on "Cybersecurity Fundamentals" will introduce you to the world of cybersecurity and talks about its basic concepts. Below is the list of topics covered in this session:
Need for cybersecurity
What is cybersecurity
Fundamentals of cybersecurity
Cyberattack Incident
Follow us to never miss an update in the future.
Instagram: https://www.instagram.com/edureka_learning/
Facebook: https://www.facebook.com/edurekaIN/
Twitter: https://twitter.com/edurekain
LinkedIn: https://www.linkedin.com/company/edureka
Advanced Cybersecurity Risk Management: How to successfully address your Cybe...PECB
Main points covered:
• Understanding the inverted economics of cyber security, the incentives for cyber crime and its effect on the growing threat
• Inefficiencies with the traditional approaches to cyber risk assessment and why we are not making more progress in enhancing cyber defenses
• Resetting roles and responsibilities regarding cyber security within organizations
• Developing empirical, cost-effective cyber risk assessments to meet the evolving threat
Our presenter for this webinar is Larry Clinton, the president of the Internet Security Alliance (ISA), a multi-sector association focused on Cybersecurity thought leadership, policy advocacy, and best practices. Mr. Clinton advises both industry and governments around the world. He has twice been listed on the Corporate 100 list of the most influential people in corporate governance. He is the author of The Cyber Risk Handbook for Corporate Boards. PWC has found the use of this Handbook improves cyber budgeting, cyber risk management and helps create a culture of security. The Handbook has been published in the US, Germany, the UK and Latin America. He is currently working on a version for the European Conference of Directors Associations as well as versions for Japan and India. Mr. Clinton also leads ISA, public policy work built around their publication “The Cyber Security Social Contract” which the NATO Center of Cyber Excellence in Estonia asked for a briefing on.
Recorded Webinar: https://www.youtube.com/watch?v=8qVtoqi37X8
Cyber Security Awareness introduction. Why is Cyber Security important? What do I have to do to protect me from Cyber attacks? How to create a IT Security Awareness Plan ?
Cyber Security 101: Training, awareness, strategies for small to medium sized...Stephen Cobb
I developed "Cyber Security 101: Training, awareness, strategies for small to medium sized business" for the second annual Small Business Summit on Security, Privacy, and Trust, co-hosted by ADP in New Jersey, October 2013.
This is a basic presentation about cybersecurity to share awareness about various security threats and how you can protect yourself from them. In the preview window the formatting is off, but when downloaded it can be viewed with no problems. This is for my Info Security Policy Management class at Governors State University.
** Cyber Security Course: https://www.edureka.co/cybersecurity-certification-training **
This Edureka PPT on "Cybersecurity Fundamentals" will introduce you to the world of cybersecurity and talks about its basic concepts. Below is the list of topics covered in this session:
Need for cybersecurity
What is cybersecurity
Fundamentals of cybersecurity
Cyberattack Incident
Follow us to never miss an update in the future.
Instagram: https://www.instagram.com/edureka_learning/
Facebook: https://www.facebook.com/edurekaIN/
Twitter: https://twitter.com/edurekain
LinkedIn: https://www.linkedin.com/company/edureka
Advanced Cybersecurity Risk Management: How to successfully address your Cybe...PECB
Main points covered:
• Understanding the inverted economics of cyber security, the incentives for cyber crime and its effect on the growing threat
• Inefficiencies with the traditional approaches to cyber risk assessment and why we are not making more progress in enhancing cyber defenses
• Resetting roles and responsibilities regarding cyber security within organizations
• Developing empirical, cost-effective cyber risk assessments to meet the evolving threat
Our presenter for this webinar is Larry Clinton, the president of the Internet Security Alliance (ISA), a multi-sector association focused on Cybersecurity thought leadership, policy advocacy, and best practices. Mr. Clinton advises both industry and governments around the world. He has twice been listed on the Corporate 100 list of the most influential people in corporate governance. He is the author of The Cyber Risk Handbook for Corporate Boards. PWC has found the use of this Handbook improves cyber budgeting, cyber risk management and helps create a culture of security. The Handbook has been published in the US, Germany, the UK and Latin America. He is currently working on a version for the European Conference of Directors Associations as well as versions for Japan and India. Mr. Clinton also leads ISA, public policy work built around their publication “The Cyber Security Social Contract” which the NATO Center of Cyber Excellence in Estonia asked for a briefing on.
Recorded Webinar: https://www.youtube.com/watch?v=8qVtoqi37X8
What is cyber security. Types of cyber attacks. Web based attacks. System based attacks. Injection attack, Cross-site scripting attack, DNS spoofing, Denial-of-service attack, brute force attack, virus, worms, Trojan horse.
Cybersecurity Awareness Training Presentation v2021.08DallasHaselhorst
This free cybersecurity awareness training slide deck is meant to be used by organizations and end users to help them better understand ways they can avoid scams, cyber attacks, and become more security aware. This slide deck is based on version 2021.08 of our wildly popular slide deck we originally released as open-source in September 2019. In just over 6 months, version 1.0 was downloaded thousands of times and in over 150 countries!
On our website, you will also find several other related goodies. For example, we have free and downloadable worksheets referenced in the training. These worksheets provide material that attendees can take back home with them to try out and continue the security conversation. We also have free cybersecurity quizzes that are based directly off of this material so anyone can test their awareness knowledge. We even have a downloadable 'certificate of completion' for this training, which allows attendees to fill-in their name and date so they can then print it out to show others (or even their employer) that they are now more cyber aware.
https://www.treetopsecurity.com/cat
On our website, we also have a video/webinar presentation of this material if you would like to share it with others.
https://www.treetopsecurity.com/cat#video
Do you want to take this content and present it in your own community or business? Fantastic! You may download this slide deck as editable content. This allows you to make changes and present it at your local library, business events, co-working spaces, schools, etc. The latest version is always available on our website as a Microsoft PowerPoint presentation (.pptx) or Google Slides using ‘Make a Copy’. Those downloadable versions from our website also include speaker notes to provide talking points or tips for anyone delivering the content.
https://www.treetopsecurity.com/slides
Cyber Security Awareness Session for Executives and Non-IT professionalsKrishna Srikanth Manda
Cyber Security Awareness Session conducted by Lightracers Consulting, for Management and non-IT employees. In this learning presentation, we will look at - What is Cyber Crime, Types of Cyber crime, What is Cyber Security, Types of Threats, Social Engineering techniques, Identifying legitimate and secure websites, Protection measures, Cyber Law in India followed by a small quiz.
This presentation includes 60+ slides that mainly deals with three Computer Security aspects i.e
1. Security Attacks and Threats
2. Security Services
3. Security Mechanisms
Along with that we've also includes Security Awareness and Security Policies
Introduction
What is Cyber Crime?
Computer crime, or cybercrime, is crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target.
What is Cyber Security?
C
yber security, also known as computer security or IT security, is the protection of information systems from theft or damage to the hardware, the software, and to the information on them, as well as from disruption or misdirection of the services they provide. It includes controlling physical access to the hardware, as well as protecting against harm that may come via network access, data and code injection and due to malpractice by operators,whether intentional, accidental, or due to them being tricked into deviating from secure procedures.
The field is of growing importance due to the increasing reliance on computer systems in most societies and the growth of "smart" devices,including smartphones, televisions and tiny devices as part of the Internet of Things – and of the Internet and wireless network such as Bluetooth and Wi-Fi.
Some organizations are turning to big data platforms, such as Apache Hadoop, to extend data accessibility and machine learning to detect advanced persistent threats.
Vulnerabilities and Attacks
Vulnerability is a system susceptibility or flaw, and much vulnerability are documented in the Common Vulnerabilities and Exposures (CVE) database and vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities as they are discovered.
An exploitable vulnerability is one for which at least one working attack or "exploit" exists.
To secure a computer system, it is important to understand the attacks that can be made against it, and these threats can typically be classified into one of the categories below.
You've seen the headlines. You're beginning to understand the importance of cybersecurity. Where do you begin? It's important to understand the common methods of attack and ways you can begin to protect your organization today. For more information on our cybersecurity education please visit FPOV.com/edu.
A Webinar on cyber Security Awareness and Digital Safety is hosted on the 7th of June, 2020. Sthir Yuwa in association with Information Security Response Team Nepal and Center For Cyber Security Research and Innovation conducted successfully. There were almost 70 participants on this webinar.
What is cyber security. Types of cyber attacks. Web based attacks. System based attacks. Injection attack, Cross-site scripting attack, DNS spoofing, Denial-of-service attack, brute force attack, virus, worms, Trojan horse.
Cybersecurity Awareness Training Presentation v2021.08DallasHaselhorst
This free cybersecurity awareness training slide deck is meant to be used by organizations and end users to help them better understand ways they can avoid scams, cyber attacks, and become more security aware. This slide deck is based on version 2021.08 of our wildly popular slide deck we originally released as open-source in September 2019. In just over 6 months, version 1.0 was downloaded thousands of times and in over 150 countries!
On our website, you will also find several other related goodies. For example, we have free and downloadable worksheets referenced in the training. These worksheets provide material that attendees can take back home with them to try out and continue the security conversation. We also have free cybersecurity quizzes that are based directly off of this material so anyone can test their awareness knowledge. We even have a downloadable 'certificate of completion' for this training, which allows attendees to fill-in their name and date so they can then print it out to show others (or even their employer) that they are now more cyber aware.
https://www.treetopsecurity.com/cat
On our website, we also have a video/webinar presentation of this material if you would like to share it with others.
https://www.treetopsecurity.com/cat#video
Do you want to take this content and present it in your own community or business? Fantastic! You may download this slide deck as editable content. This allows you to make changes and present it at your local library, business events, co-working spaces, schools, etc. The latest version is always available on our website as a Microsoft PowerPoint presentation (.pptx) or Google Slides using ‘Make a Copy’. Those downloadable versions from our website also include speaker notes to provide talking points or tips for anyone delivering the content.
https://www.treetopsecurity.com/slides
Cyber Security Awareness Session for Executives and Non-IT professionalsKrishna Srikanth Manda
Cyber Security Awareness Session conducted by Lightracers Consulting, for Management and non-IT employees. In this learning presentation, we will look at - What is Cyber Crime, Types of Cyber crime, What is Cyber Security, Types of Threats, Social Engineering techniques, Identifying legitimate and secure websites, Protection measures, Cyber Law in India followed by a small quiz.
This presentation includes 60+ slides that mainly deals with three Computer Security aspects i.e
1. Security Attacks and Threats
2. Security Services
3. Security Mechanisms
Along with that we've also includes Security Awareness and Security Policies
Introduction
What is Cyber Crime?
Computer crime, or cybercrime, is crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target.
What is Cyber Security?
C
yber security, also known as computer security or IT security, is the protection of information systems from theft or damage to the hardware, the software, and to the information on them, as well as from disruption or misdirection of the services they provide. It includes controlling physical access to the hardware, as well as protecting against harm that may come via network access, data and code injection and due to malpractice by operators,whether intentional, accidental, or due to them being tricked into deviating from secure procedures.
The field is of growing importance due to the increasing reliance on computer systems in most societies and the growth of "smart" devices,including smartphones, televisions and tiny devices as part of the Internet of Things – and of the Internet and wireless network such as Bluetooth and Wi-Fi.
Some organizations are turning to big data platforms, such as Apache Hadoop, to extend data accessibility and machine learning to detect advanced persistent threats.
Vulnerabilities and Attacks
Vulnerability is a system susceptibility or flaw, and much vulnerability are documented in the Common Vulnerabilities and Exposures (CVE) database and vulnerability management is the cyclical practice of identifying, classifying, remediating, and mitigating vulnerabilities as they are discovered.
An exploitable vulnerability is one for which at least one working attack or "exploit" exists.
To secure a computer system, it is important to understand the attacks that can be made against it, and these threats can typically be classified into one of the categories below.
You've seen the headlines. You're beginning to understand the importance of cybersecurity. Where do you begin? It's important to understand the common methods of attack and ways you can begin to protect your organization today. For more information on our cybersecurity education please visit FPOV.com/edu.
A Webinar on cyber Security Awareness and Digital Safety is hosted on the 7th of June, 2020. Sthir Yuwa in association with Information Security Response Team Nepal and Center For Cyber Security Research and Innovation conducted successfully. There were almost 70 participants on this webinar.
CFD Simulation of By-pass Flow in a HRSG module by R&R Consult.pptxR&R Consult
CFD analysis is incredibly effective at solving mysteries and improving the performance of complex systems!
Here's a great example: At a large natural gas-fired power plant, where they use waste heat to generate steam and energy, they were puzzled that their boiler wasn't producing as much steam as expected.
R&R and Tetra Engineering Group Inc. were asked to solve the issue with reduced steam production.
An inspection had shown that a significant amount of hot flue gas was bypassing the boiler tubes, where the heat was supposed to be transferred.
R&R Consult conducted a CFD analysis, which revealed that 6.3% of the flue gas was bypassing the boiler tubes without transferring heat. The analysis also showed that the flue gas was instead being directed along the sides of the boiler and between the modules that were supposed to capture the heat. This was the cause of the reduced performance.
Based on our results, Tetra Engineering installed covering plates to reduce the bypass flow. This improved the boiler's performance and increased electricity production.
It is always satisfying when we can help solve complex challenges like this. Do your systems also need a check-up or optimization? Give us a call!
Work done in cooperation with James Malloy and David Moelling from Tetra Engineering.
More examples of our work https://www.r-r-consult.dk/en/cases-en/
Water scarcity is the lack of fresh water resources to meet the standard water demand. There are two type of water scarcity. One is physical. The other is economic water scarcity.
Sachpazis:Terzaghi Bearing Capacity Estimation in simple terms with Calculati...Dr.Costas Sachpazis
Terzaghi's soil bearing capacity theory, developed by Karl Terzaghi, is a fundamental principle in geotechnical engineering used to determine the bearing capacity of shallow foundations. This theory provides a method to calculate the ultimate bearing capacity of soil, which is the maximum load per unit area that the soil can support without undergoing shear failure. The Calculation HTML Code included.
Cosmetic shop management system project report.pdfKamal Acharya
Buying new cosmetic products is difficult. It can even be scary for those who have sensitive skin and are prone to skin trouble. The information needed to alleviate this problem is on the back of each product, but it's thought to interpret those ingredient lists unless you have a background in chemistry.
Instead of buying and hoping for the best, we can use data science to help us predict which products may be good fits for us. It includes various function programs to do the above mentioned tasks.
Data file handling has been effectively used in the program.
The automated cosmetic shop management system should deal with the automation of general workflow and administration process of the shop. The main processes of the system focus on customer's request where the system is able to search the most appropriate products and deliver it to the customers. It should help the employees to quickly identify the list of cosmetic product that have reached the minimum quantity and also keep a track of expired date for each cosmetic product. It should help the employees to find the rack number in which the product is placed.It is also Faster and more efficient way.
Explore the innovative world of trenchless pipe repair with our comprehensive guide, "The Benefits and Techniques of Trenchless Pipe Repair." This document delves into the modern methods of repairing underground pipes without the need for extensive excavation, highlighting the numerous advantages and the latest techniques used in the industry.
Learn about the cost savings, reduced environmental impact, and minimal disruption associated with trenchless technology. Discover detailed explanations of popular techniques such as pipe bursting, cured-in-place pipe (CIPP) lining, and directional drilling. Understand how these methods can be applied to various types of infrastructure, from residential plumbing to large-scale municipal systems.
Ideal for homeowners, contractors, engineers, and anyone interested in modern plumbing solutions, this guide provides valuable insights into why trenchless pipe repair is becoming the preferred choice for pipe rehabilitation. Stay informed about the latest advancements and best practices in the field.
Saudi Arabia stands as a titan in the global energy landscape, renowned for its abundant oil and gas resources. It's the largest exporter of petroleum and holds some of the world's most significant reserves. Let's delve into the top 10 oil and gas projects shaping Saudi Arabia's energy future in 2024.
Final project report on grocery store management system..pdfKamal Acharya
In today’s fast-changing business environment, it’s extremely important to be able to respond to client needs in the most effective and timely manner. If your customers wish to see your business online and have instant access to your products or services.
Online Grocery Store is an e-commerce website, which retails various grocery products. This project allows viewing various products available enables registered users to purchase desired products instantly using Paytm, UPI payment processor (Instant Pay) and also can place order by using Cash on Delivery (Pay Later) option. This project provides an easy access to Administrators and Managers to view orders placed using Pay Later and Instant Pay options.
In order to develop an e-commerce website, a number of Technologies must be studied and understood. These include multi-tiered architecture, server and client-side scripting techniques, implementation technologies, programming language (such as PHP, HTML, CSS, JavaScript) and MySQL relational databases. This is a project with the objective to develop a basic website where a consumer is provided with a shopping cart website and also to know about the technologies used to develop such a website.
This document will discuss each of the underlying technologies to create and implement an e- commerce website.
2. Which is the third largest economy?
• USA
• China
• ????
3. Importance of Cyber Security
“The only system which is truly secure is one which is
switched off and unplugged, locked in a titanium safe,
buried in a concrete bunker, and is surrounded by
nerve gas and very highly paid armed guards. Even
then, I wouldn’t stake my life on it.”
- Professor Gene Spafford
https://spaf.cerias.purdue.edu/
In security matters:
effectiveness & limitations
• There is nothing like absolute security
• We are only trying to build comfort levels, because security costs money and
lack of it costs much more
• Comfort level is a manifestation of efforts as well as a realization of their
4. Importance of Cyber Security
The Internet allows an attacker to work from anywhere on
the planet.
Risks caused by poor security knowledge and practice:
Identity Theft
Monetary Theft
Legal Ramifications (for yourself and your organization)
Sanctions or termination if policies are not followed
According to the SANS Institute, the top vectors for
vulnerabilities available to a cyber criminal are:
Web Browser
IM Clients
Web Applications
Excessive User Rights
5. Cyber Security
• Cyber security refers to the body of technologies,
processes, and practices designed to protect
networks, devices, programs, and data from attack,
damage, or unauthorized access.
7. Cyber Security is Safety
• Security:We must protect our computers and data in
the same way that we secure the doors to our homes.
• Safety: We must behave in ways that protect us
against risks and threats that come with technology.
10. What is a Secure System? (CIA Triad)
Availability
• Confidentiality – restrict
access to authorized
individuals
• Integrity – data has not
been altered in an
unauthorized manner
• Availability – information
can be accessed and
modified by authorized
individuals in an
appropriate timeframe
14. Threats and Vulnerabilities
What are we protecting our and our stakeholders
information from?
Threats: Any circumstances or events that can
potentially harm an information system by
destroying it, disclosing the information stored on
the system, adversely modifying data, or making
the system unavailable
Vulnerabilities: Weakness in an information system
or its components that could be exploited.
15. WHAT KINDS
OF THREATS
ARE THERE?
Phishing and
Spear- phishing
Attacks
Social Engineering Scams
Common Malware and
Ransomware
Business Email
Compromise
Fake websites that steal
data or infect devices
And much more
16. Phishing
Phishing refers to the practice of creating fake emails or SMS that appear to
come from someone you trust, such as: Bank, Credit Card Company, Popular
Websites
The email/SMS will ask you to “confirm your account details or your
vendor’s account details”, and then direct you to a website that looks just
like the real website, but whose sole purpose is for steal information.
Of course, if you enter your information, a cybercriminal could use it to
steal your identity and possible make fraudulent purchases with your
money.
17. Phishing Statistics
Verizon DBIR 2020: Phishing is the biggest cyber threat for
SMBs, accounting for 30% of SMB breaches
KnowBe4: 37.9% of Untrained Users Fail Phishing Tests
84% of SMBs are targeted by Phishing attacks
A new Phishing site launches every 20 seconds
74% of all Phishing websites use HTTPS
94% of Malware is delivered via email
19. Social Engineering
When attempting to steal information or a
person’s identity, a hacker will often try to
trick you into giving out sensitive information
rather than breaking into your computer.
Social Engineering can happen:
Over the phone
By text message
Instant message
Email
20. Malware = “malicious software”
Malware is any kind of unwanted software that is
installed without your consent on your computer
and other digital devices.
Viruses, Worms, Trojan horses, Bombs, Spyware,
Adware, Ransomware are subgroups of malware.
Malware
21. A virus tries to infect a carrier, which in turn
relies on the carrier to spread the virus around.
A computer virus is a program that can replicate
itself and spread from one computer to another.
Viruses
22. Direct infection: virus can infect files every time a user
opens that specific infected program, document or file.
Fast Infection: is when a virus infects any file that is
accessed by the program that is infected.
Slow infection: is when the virus infects any new or
modified program, file or document.
Great way to trick a antivirus program!
Sparse Infection: is the process of randomly infecting
files, etc. on the computer.
RAM-resident infection: is when the infection buries
itself in your Computer’s Random Access Memory.
Viruses cont.
23. Logic Bombs: is programming code that is designed to
execute or explode when a certain condition is
reached.
Most the time it goes off when a certain time is reached or a
program fails to execute. But it these bombs wait for a
triggered event to happen.
Most common use of this is in the financial/business world.
Most IT employees call this the disgruntled employee
syndrome.
Bombs
24. Trojan horse: is a program or software designed to look like a
useful or legitimate file.
Once the program is installed and opened it steals information or
deletes data.
Trojan horses compared to other types of malware is that it
usually runs only once and then is done functioning.
Some create back-door effects
Another distribution of Trojans is by infecting a server that hosts
websites.
Downfall of Trojans: very reliant on the user.
Trojans
25. Worms and viruses get interchanged commonly in the
media.
In reality a worm is more dangerous than a virus.
User Propagation vs. Self Propagation
Worm is designed to replicate itself and disperse
throughout the user’s network.
Email Worms and Internet Worms are the two most
common worm.
Worms
26. Email worm goes into a user’s contact/address book
and chooses every user in that contact list.
It then copies itself and puts itself into an attachment;
then the user will open the attachment and the process
will start over again!
Example: I LOVE YOU WORM
Email Worm
27. An Internet Worm is designed to be conspicuous to the
user.
The worms scans the computer for open internet ports
that the worm can download itself into the computer.
Once inside the computer the worms scans the
internet to infect more computers.
Internet Worms
28. Zombie & Botnet
Secretly takes over another networked computer
by exploiting software flows
Builds the compromised computers into a zombie
network or botnet
a collection of compromised machines running
programs, usually referred to as worms, Trojan horses,
or backdoors, under a common command and control
infrastructure.
Uses it to indirectly launch attacks
E.g., DDoS, phishing, spamming, cracking
29. Adware is a type of malware designed to display
advertisements in the user’s software.
They can be designed to be harmless or harmful; the adware
gathers information on what the user searches the World Wide
Web for.
With this gathered information it displays ads corresponding to
information collected.
Spyware is like adware it spies on the user to see what
information it can collect off the user’s computer to display pop
ads on the user’s computer.
Spyware unlike adware likes to use memory from programs
running in the background of the computer to keep close watch
on the user.
This most often clogs up the computer causing the program or
computer to slow down and become un-functional.
Adware and Spyware
31. Identity Theft
Impersonation by private information
Thief can ‘become’ the victim
Reported incidents rising
Methods of stealing information
Shoulder surfing
Snagging
Dumpster diving
Social engineering
High-tech methods
Identity Theft
32. Loss of privacy
Personal information is stored electronically
Purchases are stored in a database
Data is sold to other companies
Public records on the Internet
Internet use is monitored and logged
None of these techniques are illegal
Identity Theft
34. Ransomware
Ransomware is a type of
malware that restricts your
access to systems and files,
typically by encryption and then
demands a ransom to restore
access.
Often, systems are infected by
ransomware through a link in a
malicious email. When the user
clicks the link, the ransomware
is downloaded to the user’s
computer, smartphone or other
device. Ransomware may spread
through connected networks.
35. Ransomware
Top Ransomware Vulnerabilities:
• RDP or Virtual Desktop endpoints without MFA
• Citrix ADC systems affected by CVE-2019-19781
• Pulse Secure VPN systems affected by CVE-2019-11510
• Microsoft SharePoint servers affected by CVE-2019-0604
• Microsoft Exchange servers affected by CVE-2020-0688
• Zoho ManageEngine systems affected by CVE-2020-10189
https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-
critical-services-heres-how-to-reduce-risk/
36. Ransomware Controls
Weapons-Grade Data Backups
Religious Patch Management
Plan to Fail Well (Incident Response Plan)
Know who to call!
Training and Testing Your People
Don’t Open that Email Link/Attachment
37. Business/Official Email Compromise
BEC is a big problem for you and your organization:
Your email is compromised.
Another employee of your organization is compromised
Almost always, these emails fall into 2 categories:
1. Downloading and spreading additional malware
automatically
2. Urging the customer to perform a financial
transaction immediately
Tips and Tricks to share with customers:
BEC made up half of cyber-crime losses in 2019; $75K
per scam
Standard phishing email awareness – don’t click links
or download attachments
Pay attention to the email address
Enable MFA for business email accounts
44. COVID-19 Cyber Threats
• Google: 18+ Million COVID-19 emails in just the one
week, in addition to 240M daily COVID-19 spam
messages
• Phishing up 667% right now
• FBI IC3: 4x complaints per day (1K before COVID-19, now
3k-4k per day)
• 148% spike in ransomware attacks due to COVID-19
• 30%-40% increase in attacker interest relating to RDP (as
measured by Shodan)
• 26% increase in e-comm web skimming in March
• Healthcare, Financial Services, Medical Suppliers and
Manufacturing, Government and Media Outlets all seeing
a large increase in cyber threats
45. Cyber Crime
Cyber Crime is a generic term that refers to all criminal
activities done using the medium of communication
devices, computers, mobile phones, tablets etc. It can be
categorized in three ways:
•The computer as a target – attacking the computers of
others.
•The computer as a weapon- Using a computer to commit
“traditional crime” that we see in the physical world.
•The computer as an accessory- Using a computer as a
“fancy filing cabinet” to store illegal or stolen information.
46.
47.
48. How do you look like to Bad guys?
66.233.160.64
52. System Hacking
system.
System hacking is a vast subject that
consists of hacking the different software-
based technological systems such as laptops,
desktops, etc.
System hacking is defined as the
compromise of computer systems and
software to access the target computer
and steal or misuse their sensitive
information.
Here the malicious hacker exploits the
weaknesses in a computer system or
network to gain unauthorized access to its
data or take illegal advantage.
Hackers generally use viruses, malware,
Trojans, worms, phishing techniques, email
spamming, social engineering, exploit
operating system vulnerabilities, or port
vulnerabilities to access any victim's
56. Global Cyber Security Trends – The next wave
Recent studies reveal three major findings:
•Growing threat to national security - web espionage becomes
increasingly advanced, moving from curiosity to well-funded and
well-organized operations aimed at not only financial, but also
political or technical gain
•Increasing threat to online services – affecting individuals and
industry because of growth of sophistication of attack techniques
•Emergence of a sophisticated market for software flaws –
that can be used to carry out espionage and attacks on Govt.
and Critical information infrastructure. Findings indicate a blurred
line between legal and illegal sales of software vulnerabilities
Mischievous activities in cyber space have expanded from
novice geeks to organized criminal gangs that are going Hi-
tech
57. Attacks today are AUTOMATED!
It’s not some dude sitting at his hacker desk all day typing out
ping commands to IP addresses via the command prompt
manually…
58. What does a Cyber Security Professional look like?
59. What does a Cyber Security Professional look like?
60. Eugene Kaspersky, CEO Kaspersky Labs, £1.1bn
James Lyne, CTO, SANS
David Ulevitch, Founder OpenDNS Katie Moussouris, Microsoft Bug Bounty creator
Dr Laura Toogood, MD Digitalis Reputation
8
Erin Jacobs, CSO at UCB Financial Services
In reality…
61. How We Protect Information?
People
Training, education, awareness, repetition
Process
Governance, oversight, policy, reporting
Technology
Firewalls, IDS/ISP
, SIEM, anti-malware
Strong passwords, Logging/monitoring
Which is the weakest link?
62. Social Engineering Best Practices
USE YOUR SECURITY SPIDER SENSE!
ALWAYS validate requests for
information if you’re not 100000%
sure
Call a number YOU know
Google it…
ALWAYS ASK QUESTIONS!
Is this who I think it is FOR SURE?
Did someone mention this to me
personally, or was it discussed at a staff
meeting?
Is this the FIRST I’m hearing about this?
63. BEC Best Practices
Think through Out of Office emailresponders
Avoid using free web-based email for business
Not only less-professional, but easier to hack,
typosquat, or spoof
Domains and email addresses are cheap, especially
compared to BEC
Register similar domains to yours to prevent
typosquatting e.g. delaplex.com vs. delapelx.com
Be careful about the information you share on
your website or Social Media (LinkedIn, Facebook)
about job duties or positions, especially for
positions with transactional or purchasing authority
64. Sun Tzu on the Art of War
If you know the enemy and
know yourself, you need not
fear the result of a hundred
battles.
If you know yourself but not
the enemy, for every victory
gained you will also suffer a
defeat.
If you know neither the enemy
nor yourself, you will succumb
in every battle.
65. WHAT IS FOOTPRINTING?
Definition: the gathering of information
about a potential system or network (the
fine art of gathering target information)
a.k.a. fingerprinting
Attacker’s point of view
Identify potential target systems
Identify which types of attacks may be useful
on target systems
Defender’s point of view
Know available tools
May be able to tell if system is being
footprinted, be more prepared for possible
attack
Vulnerability analysis: know what
information you’re giving away, what
weaknesses you have
66. WHAT IS FOOTPRINTING?
System (Local or Remote)
IP Address, Name and Domain
Operating System
Type (Windows, Linux, Solaris,
Mac)
Version (XP/Vista/7/10,
Redhat, Fedora, SuSe, Ubuntu,
OS X)
Usernames (and their
passwords)
File structure
Open Ports (what
services/programs are running
on the system)
Networks / Enterprises
System information for all
hosts
Network topology
Gateways
Firewalls
Overall topology
Network traffic information
Specialized servers
Web, Database, FTP, Email,
etc.
Social Media
67. Vulnerability Scanner
Functions of Vulnerability Scanner are far different
from firewall or intrusion detection system.
Vulnerability scanning tools helps you in protecting
your organization from any kind of security risks or
threats by scanning with deep inspection of
endpoints to ensure that they are configured securely
and correctly.
The prime aim of running a vulnerability scanner is to
identify the devices that are open for vulnerabilities.
68. Types of Vulnerability Scanner
Port scanner
Network vulnerability scanner
Web application security scanner
Database security scanner.
Host based vulnerability scanner
ERP security scanner.
Single vulnerability tests.
69. Virus Detection
• Simple Anti-virus Scanners
– Look for signatures (fragments of known virus code)
– Heuristics for recognizing code associated with viruses
• Example: polymorphic viruses often use decryption loops
– Integrity checking to detect file modifications
– Keep track of file sizes, checksums, keyed HMACs of contents
• Generic decryption and emulation
– Emulate CPU execution for a few hundred instructions, recognize
known virus body after it has been decrypted
– Does not work very well against viruses with mutating bodies and
viruses
not located near beginning of infected executable
70. Virus Detection
• Simple Anti-virus Scanners
– Look for signatures (fragments of known virus code)
– Heuristics for recognizing code associated with viruses
• Example: polymorphic viruses often use decryption loops
– Integrity checking to detect file modifications
– Keep track of file sizes, checksums, keyed HMACs of contents
• Generic decryption and emulation
– Emulate CPU execution for a few hundred instructions, recognize
known virus body after it has been decrypted
– Does not work very well against viruses with mutating bodies and
viruses
not located near beginning of infected executable
71. Cyber Security and Privacy Starts and
Ends with Us!
Security Tips
Commit to a disciplined practice of information
security and continue to refresh yourself so you
don’t become a point of vulnerability in our
security defenses.
72. Summary
• Cybersecurity will require a
significant workforce with
deep domain knowledge.
• Almost everything is hooked
up to the internet in some
sort of form.
• Recent events have
widened the eyes of many
security experts.
• The ability to gain access to
high security organizations,
infrastructures or
mainframes has frightened
many people.
• Could one click of the
mouse start World War III?