Online Security

© 2007 NetSol Technologies, Inc. All rights reserved 1
Session Two
Online Security, Threats &
Countermeasures

Online Security, Threats &
Countermeasures
 E-Mails
 Messengers
 Communities
 Maps / GPS

3
Preventing Password
from Hacking

Preventing Password from Hacking
Your password should be like your
Toothbrush, how?
 Choose a good password
 Use the password everyday
 Don’t share your password with anyone
 Change your password regularly

Preventing Password from Hacking (Cont…)
 Attacks
Brute Force Attacks
Dictionary Attacks
Password Guessing
Scripts
Man-in-the-middle attacks
Social Engineering
Shoulder Surfing / Video Recording
Spy-ware/Key Loggers
Keyboard Interceptor

(Cont…)
Controls which should be managed properly:
 Length
 Legibility
 Life
 Last passwords’ history
 Limited attempts
 Lockout duration
 Log of failed attempts
 Limited Login time
 Logon banner
 Last username
 Last successful logon

(Cont…)
Password/Pin should include:
 Upper-and lowercase letters
 Numbers (e.g. replace s with 5)
 And special characters (e.g. replace a with @)
 More words or first letter of each word of sentence
Password/Pin should NOT be:
 User Name/mother’s name
 Country / City Name etc.
 Date/year of birth
 Digits of Phone No.
 Dictionary Words
 Saved/Written anywhere
Should be different for different accounts

(Cont…)
 Protocols sending password as plain text:
 File Transfer Protocol (FTP)
 Password Authentication Protocol (PAP)
 Sites accepting password as plain text?
 Which don’t offer SSL protocol
 How can we know about SSL protocol?
 Yellow Lock icon on browser
 Hacker Profiling Project (HPP) isecom.org

Avoiding Viruses & Worms
 Prevention is better than cure
 Vaccination. Vaccine?
E.g. Antivirus program

Avoiding Viruses & Worms (Cont...)
 Types of Malicious Code:
 Viruses
 Worms
 Trojan Horses
 Hoaxes
 Logic Bombs
 Malicious Applets
 Trap Doors
 Hidden Code
 DOS Attacks
 Zombies / BotNets

Trojan Horse

Sources of Viruses & Worms
 Removable Medium
 Local Area Networks
 World Wide Web
 Wireless Network
 E-mail
 File Sharing

Preventive Measures
 Keep removable medium Read-only
 Permissions of shared media
 Lock Hard Disk Boot Sector (from BIOS)
 Admin mode vs. normal user mode
 Software Firewall
 Backup Periodically

Preventive Measures for Mobile Phones:
 Sure about the consequences of ‘Yes’ btn.
 Destroy unknown MMS messages
 Unknown Bluetooth Connections

Source: http://www.antiphishing.org

Preventive Measures for E-mail & WWW
 Spoofed e-mail address
 Unexpected attachments
 .exe, .com, .cmd, .vbs, .js, .scr, .bat, .reg etc.
attachments
 Macros of documents
 “amazon.com/skdjfhskjdfskgf/ws” and
“amazon.com.skdjfhskjdfskgf.ws”
 DNS Poisoning
 Multilingual domain name. MSN.com, ΜSΝ.com

Multilingual

Antivirus Types
 Signature based
 Behavior based
 Software based
 Hardware based

Protecting Identity

Protecting Identity (Cont…)

 Disclosing your Account/Credit Card (CC)
Info. on e-mail / Phone
 Debit card v. Credit card for E-payment
 Photocopies of Cards
 Use CC Only with “yellow lock” website
 Keep your CC/ATM receipts
 Mother’s maiden name
 Selling your computer/mobile
 Having used computer/mobile

 CC with photo
 CC Statement Security
 Your Letterbox
 Shred, to avoid dumpster diving
 Warnings/information by the Browser
 Websites of illegal software / cracks etc.
 Cracked / Illegally patched software
 Phishing

Guidelines by SBP (7 pages)
Source: http://www.sbp.org.pk/psd/2006/CardHolders_Guide_URDU.pdf

Most Targeted Industry Sectors

 Aprox.10 million Identity thefts/year in
USA
 19 people/minute
 Becoming no.1 crime after drug trafficking
 Left in cabs of London during 6 months:
4973 Laptops
5939 Pocket PCs.
63135 Mobile phonesSource: East California University, www.ecu.edu

Technical Countermeasures:
 Encryption
 Digital certificate, Pvt. Pub. Key pair
 Authenticity of Identity
 Digital Signature
 Secure Private Key
 Two factor authentication
 Secure Socket Layer (SSL)

Frauds:
 Certificate issued by an un trusted party
 Expired Certificate
 Certificate of someone else’s Site

?

Thank
You

Online Security

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (19)

Similar to Online Security

Similar to Online Security (20)

More from Muhammad Faisal Naqvi, CISSP, CISA, AMBCI, ITIL, ISMS LA n Master

More from Muhammad Faisal Naqvi, CISSP, CISA, AMBCI, ITIL, ISMS LA n Master (11)

Recently uploaded

Recently uploaded (20)

Online Security