This document provides an overview of basic cybersecurity threats and preventions for non-IT professionals. It discusses recent cyber incidents, the main cyber threats including phishing and malware, and the human factors that often enable incidents like careless information sharing. It also covers basic prevention methods, including multi-factor authentication, password management, and social media security practices. Response and recovery procedures are discussed as well, emphasizing the importance of having cybersecurity policies, training programs, and incident response plans in place.

1. CYBERSECURITY 101
Understanding basic threats and preventions

2. WHAT WE’LL COVER
Not designed for IT professionals!
• Recent Incidents
• Basic overview
• Basic threat landscape
• Incident lifecycle
• Basic prevention
• Response policy template

4. 2018 INCIDENTS

7. IT’S EVERYONE’S PROBLEM!
• Cybersecurity is NOT just IT’s problem.
• IT
• Emergency Management
• Law Enforcement
• And everyone in your organization

8. HUMAN FACTOR
• Vast majority of incidents due to human error
• Phishing, social engineering
• Enabled by agency and employee use of social media
• Careless info access/dissemination
• Public spaces
• Public wifi
• Unlocked computers
• Lack of caution

9. THE THREAT

10. MOST COMMON ENDUSER THREATS
• Phishing
• Malware (including ransomware)
• Social Engineering/Vishing
• Social Media Threats
• Credential Reuse/poor password management
• Unauthorized Physical Access

11. MOST COMMON SYSTEM LEVEL THREATS
• Unpatched software
• SQL Injection Attack
• Cross Site Scripting (XSS)
• Denial-of-Service (Dos)
• Session Hijacking/Man-in-the-Middle Attacks

12. OUTCOMES
• Release of protected information
• Unauthorized control of systems
• Unauthorized access to information
• Data loss
• Loss of productivity
• System shutdowns
• Financial theft
• Law suits
Worst case: Somebody gets hurt or killed.
Second worst case: Somebody gets fired.

13. LIFECYCLE

14. PREVENTION
• What have you done to prepare?
• What policies are in place?
• What training is in place?
• How are the policies enforced?
THINGS YOU MUST HAVE
• Emergency Operations Plan
• Cybersecurity Policy
• Acceptable Use Policy

15. PHISHING EXAMPLE

16. MALWARE

17. PROTECTION

18. SOFTWARE BASED
• Virus protection/detection
• Malware detection
• Firewalls
• Check websites/programs at virustotal.com

19. PASSWORD MANAGEMENT
• Never reuse passwords!
• Phrases instead of passwords
• Include letters/numbers/symbols
• Use an encrypted password manager
• Available from anywhere
• Encrypted end-to-end
• Allows sharing with other users (without revealing
the actual password)
• Review of top contenders at Wirecutter

21. MULTI-FACTOR AUTHENTICATION
• Enable multi-factor authentication whenever possible.
• Requires you to do two things to
• All popular social media sites allow it.
• https://twofactorauth.org/ for list of sites that support two-factor
authentication.

22. PHYSICAL ACCESS

23. PUBLIC SPACES

24. SOCIAL MEDIA BASICS
• Assume everything you post is public
• Don’t share personal info
• Use proper privacy settings
• Practice strong security
• Regularly check security and privacy settings

25. MORE SOCIAL MEDIA
• Don’t share other people’s personal info without permission.
• Don’t friend people you don’t know!
• Never friend somebody more than once (the 2nd is often a spoofed account)
• Limit posts to be viewable by only your friends
• Limit post and photo tagging
• Remove location services
• Limit or remove 3rd party applications

26. MITIGATION
• What steps have you
taken?
• What steps can you
take?
• Monitoring
• Early Reporting
• Training
• Insurance
• Backups
• Redundancy

27. WHAT’S ALREADY HAPPENED?

29. EARLY REPORTING
• Encourage people to report suspicious emails, texts, phone calls, people, etc.
• Don’t punish them for reporting that they may have done something dumb!

30. POLICIES AND TRAINING
• Develop clear, easy to understand policies
• Acceptable use of technology
• Reporting guidelines
• Facility access
• TRAIN, TRAIN, TRAIN
• Basic cybersecurity training should be provided for every person with
access to your facility

31. RESPONSE
• Do you have a response plan?
• Does everybody know how to recognize an
incident?
• Does your staff know what to do if they suspect an
incident?
• Who do you call for help?

32. RECOVERY
• What’s your recovery plan?
• Beyond just the technology
• Who do you call for help?

33. SAMPLE INCIDENT ANNEX
https://1drv.ms/w/s!At2Gwcs7z-oh3Ubt7QNXAZ-HHeM2

34. REFERENCES
• National Cyber Incident Response Plan, Department of Homeland Security, 2016
• Computer Security Incident Handling Guide (Revision 2) National Institute of
Standards and Technology, 2012
• Washington State Significant Cyber Incident Annex, Washington Military
Department – Emergency Management Division, 2015
• ISO/IEC 27032 – Information Technology – Security techniques – Guidelines for
cybersecurity, International Standards Organization, 2012

35. ANNEX PARTS
• Policies
• Sets expectations
• Situation/Assumptions
• Requires all components to be in place
• Concept of Operations
• Will require local discussion
• Responsibilities
• EM/IT/LE
• Expect some pushback

36. MAJOR CYBER INCIDENT CHECKLIST
• Action items
• Pre-Incident Phase
• Response Phase
• Recovery/Demob
Phase

37. COMMON ISSUES
• Most organizations lack a comprehensive cybersecurity policy that vests
responsibility with every employee.
• Those that have policies don’t enforce them
• A greater number of incidents occur than are reported in any formal way
• Lack of response plans leads to slow recognition, response, recovery.
• Lack of individual security leaves entire organization at risk

38. QUESTIONS?
Contact me:
Sarah Miller, MPA, CEM
Chair, IAEM Emerging Technology Caucus
Vice-President, IAEM Region 10
sarah@skmillerconsulting.com
twitter: @scba