The document provides an overview of various cyber security solutions and concepts. It discusses 13 sections related to cyber security including access control solutions, vulnerability analysis, gap analysis, penetration testing, web application security, log analysis, network traffic analysis, information security policy design, and security products identification. Each section provides 1-3 paragraphs explaining the topic and key considerations.

1. SOCIAL MEDIA SECURITY
USERS GUIDE
CYBER SECURITY SOLUTIONS
ALAN HOLYOKE
PHI 235

3. WEBSITES SECURITY
As you can see by the diagram to
the left, there are numerous browsers and
websites that you and I utilize on a daily
basis, an ever growing reality that keeps
us “connected” to everyone and
everything that we may want to be
connected to.
In regards to Cyber Security Solutions,
this guide will explain the thirteen different
sections covering everything from Access
Control to Gap Analysis to Information
Security Policy and everything in
between.
Well, let’s take a journey, shall we….

4. Access control solutions
Access control solutions allow companies to determine who can
go where and when. An audit trail shows the details of who passed
through your access control entry and exit devices. Events recorded
to a head end computer may be linked to video, paging, or alarm
functions. By combining software and hardware, your system can be
controlled, queried, or programmed from anywhere on your network
or via a secure web browser.

5. They give you a complete picture of each employees activity by
days, weeks, and the times they passed though any access controlled
door in your facility. Your records will show whether they passed through
during your regular working hours or off hours. Our access systems are
based on time tested, user friendly software and allow for monitoring and
control in remote sites throughout your existing network.
Access control solutions
(continued)

6. Vulnerability analysis
Vulnerability analysis, also known as vulnerability assessment, is a
process that defines, identifies, and classifies the security holes
(vulnerabilities) in a computer, network, or communications
infrastructure. In addition, vulnerability analysis can forecast the
effectiveness of proposed countermeasures and evaluate their actual
effectiveness after they are put into use.

7. Vulnerability analysis
(continued)
Vulnerability analysis consists of several steps:
 Defining and classifying network or system resources
 Assigning relative levels of importance to the resources
 Identifying potential threats to each resource
 Developing a strategy to deal with the most serious potential
problems first
 Defining and implementing ways to minimize the consequences if an
attack occurs.

8. Vulnerability analysis
(continued)
If security holes are found as a result of vulnerability analysis, a
vulnerability disclosure may be required. The person or organization
that discovers the vulnerability, or a responsible industry body such as
the Computer Emergency Readiness Team (CERT), may make the
disclosure. If the vulnerability is not classified as a high level threat, the
vendor may be given a certain amount of time to fix the problem before
the vulnerability is disclosed publicly.

9. Vulnerability analysis
(continued)
The third stage of vulnerability analysis (identifying potential threats)
is sometimes performed by a white hat using ethical hacking
techniques. Using this method to assess vulnerabilities, security experts
deliberately probe a network or system to discover its weaknesses. This
process provides guidelines for the development of countermeasures to
prevent a genuine attack.

10. gap analysis
A technique that businesses use
to determine what steps need to be
taken in order to move from its
current state to its desired, future
state. Also called need-gap analysis,
needs analysis, and needs
assessment.

11. gap analysis
(continued)
 Listing of characteristic factors (such as attributes, competencies,
performance levels) of the present situation ("what is")
 Listing factors needed to achieve future objectives ("what should
be"), and then
 Highlighting the gaps that exist and need to be filled. Gap analysis
forces a company to reflect on who it is and ask who they want to be
in the future.

12. Penetration testing
A penetration test is a proactive and authorized attempt to evaluate the
security of an IT infrastructure. This is done by safely attempting to exploit system
vulnerabilities such as:
• The Operating System (OS)
• Service and Application flaws
• Improper Configurations
• Validating the Efficiency of Defensive Mechanisms
Such assessments are also useful in validating the efficiency of end-users’
adherence to company security policies.

13. Penetration testing
(continued)
A penetration test is a test whose results validate the risk posed by
specific security vulnerabilities or flawed processes. This enables IT
management and security professionals to prioritize remediation efforts.
By embracing more frequent and comprehensive penetration testing,
organizations can more effectively anticipate emerging security risks
and prevent unauthorized access to critical systems and valuable
information.

14. Web application security
Web Application Security is an
internet security audit, performed by
experienced security professionals. A key
feature of the service, and one which
cannot be covered by relying solely on
automated testing, is application testing.
The service is designed to rigorously
push the defenses of internet networks
and applications.

15. Web application security
(continued)
It is suitable for commissioning, third party assurance, post-attack
analysis, audit and regulatory purposes where independence and quality
of service are important requirements.
A final written report provides an analysis of any security or service
problems discovered together with proposed solutions, links to detailed
advisories and recommendations for improving the security of the service
under test.
The Web Application Testing service can be used to ensure
compliance with PCI DSS v2.0 requirement 11.3, (penetration testing) as it
includes both network and application layer testing.

16. Web application security
(continued)
Areas Covered by Web Application Testing
 Configuration errors
 Application loopholes in server code or scripts
 Advice on data that could have been exposed due to past errors
 Testing for known vulnerabilities
 Reducing the risk and enticement to attack
 Advice on fixes and future security plans

17. Web application security
(continued)
Typical Issues Discovered in an Application Test
o Cross-site scripting
o SQL injection
o Server misconfigurations
o Form/hidden field manipulation
o Command injection
o Cookie poisoning
o Well-known platform vulnerabilities
o Insecure use of cryptography

18. Web application security
(continued)
Typical Issues Discovered in an Application Test (continued)
o Back doors and debug options
o Errors triggering sensitive information leak
o Broken ACLs/Weak passwords
o Weak session management
o Buffer overflows
o Forceful browsing
o CGI-BIN manipulation
o Risk reduction to zero day exploits

19. Log analysis
Log Analysis lets you
analyze unstructured data to
help identify, isolate and resolve
problems. The software
integrates data from multiple
sources including logs, events,
metrics, support documents and
trouble tickets.

20. Network traffic analysis
Network analysis is the process of capturing network traffic and
inspecting it closely to determine what is happening on the network.
This is accomplished by two different monitoring techniques:
 Router Based – Monitoring functionalities that are built into the routers
themselves & do not require and additional installation of hardware or
software.
 Non-Router Based - Monitoring techniques require additional hardware
and software to be installed and provide greater flexibility.

21. Information security
Policy design
The first step to creating an effective information security policy is
evaluating information assets and identifying threats to those assets. Some
assets within an organization will be more valuable than others, but
monetary value should not be the only factor. Determining both the
monetary value and the intrinsic value of an asset is essential in
accurately gauging its worth.

22. Information security
Policy design
(continued)
To calculate an asset’s monetary value:
An organization should consider the impact if that asset’s data,
networks or systems are compromised in any way.
To calculate an asset’s intrinsic value:
An organization must consider a security incident’s impact on
credibility, reputation and relationships with key stakeholders.

23. Information security Policy design
(continued)
When assessing potential threats, external and internal threats must be
considered. External threats include viruses, worms, Trojan horses,
hacking attempts and anything that tries to break an organization’s
security infrastructure from the OUTSIDE.
Internal threats include abuse of critical systems and data, surfing
objectionable Internet content, and inappropriate Internet use. The real
costly danger with internal threats comes from perpetrators having
extensive access to the network from the INSIDE.

24. Information security Policy design
(continued)
Since an information security policy will have an effect on people
throughout the organization, a team should take the responsibility for
drafting the policy together. This team should include executives, IT
administrators, information security experts, human resource managers,
public relations managers, legal counsel and IT auditors. Approval for the
policy should come from the highest possible level in the corporate
environment.

25. Security products identification
There are several security products on the market. Here is a list of a
few of those security products:
Passport Laminates
Passport laminates range from a clear film overlay to Covid
holographic and Fasver printed security laminates, featuring overt, covert,
and forensic security devices. All laminates are custom designed to suit
the document and the application equipment.

26. Security products identification
(continued)
ID Card Laminates
Covid holographic and Fasver printed security laminates protect ID
cards against forgery and counterfeit attempts. Most companies will work
with each client to create custom originations that integrate with the
background artwork and personalized data to deliver cohesive designs
that are attractive, original, easy to authenticate, and highly secure.

27. Security products identification
(continued)
Polycarbonate Solutions
Polycarbonate solutions provide security both in and on identity
documents and enable color personalization on ID cards. Fasver printed
security layers can be embedded within polycarbonate cards and
passport data pages to help authenticate genuine ID documents and
prevent counterfeiting. Covid holographic patches add security to the
card’s surface while protecting the Unichroma-enabled color personalized
data.

28. Security products identification
(continued)
Seals, Labels, and Hot Stamp Foils
Our seals, labels, and hot stamp foils are used by governments
worldwide to protect signatures on official documents, and to secure and
authenticate document pouches and vehicle stickers.
Card Personalization
Imagedata D2T2 ribbons generate vibrant colors and high-definition
print for photos, background imagery, text, and bar codes, making them
ideal for the personalization of secure and non-secure ID cards.

29. Cyber security surveys
Forty-seven percent of surveyed
organizations have suffered a cyber-attack in
the past year – and a frightening 13 percent
say they do not even know if they have been
attacked.
These are among the results of the 2013
Cyber Security Study conducted by
Information Security Media Group and
commissioned by Bit9.

30. Data leak prevention solutions
Data leak prevention solution is a system that is designed to detect
potential data breach or data ex-filtration transmissions and prevent them. It
does this by monitoring, detecting and blocking sensitive data while in-use
(endpoint actions), in-motion (network traffic), and at-rest (data storage). In
data leakage incidents, sensitive data is disclosed to unauthorized personnel
either by malicious intent or by an inadvertent mistake. Such sensitive data
can come in the form of private or company information, intellectual property
(IP), financial or patient information, credit-card data, and other information
depending on the business and the industry.

31. Cyber hygiene
Cyber hygiene refers to steps that computer users can take to improve their
cybersecurity and better protect themselves online.

32. Cyber hygiene (continued)
The best practices are not new technologies, but fairly common sense
ideas that need to become part of an enterprise culture. The common
practices are listed below:
• Eliminate unnecessary data and keep tabs on what is left;
• Ensure essential controls are met and regularly audit to in order consistent
implementation;
• Change default credentials;
• Avoid shared credentials;
• Implement a firewall or access control list (ACL) on remote
access/administration services;
• Utilize IP blacklisting;

33. Cyber hygiene (continued)
The common practices are continued below:
• Update anti-virus and other software consistently;
• Audit user accounts;
• Restrict and monitor privileged users;
• Monitor and filter outbound network traffic;
• Test applications and review codes;
• Change the approach to event monitoring and log analysis;
• Define ‘suspicious’ and ‘anomalous’ (then look for whatever ‘it’ is);
• Increase awareness of social engineering;
• Train employees and customers to look for signs tampering and fraud;

34. Cyber investigation
A cyber investigation investigates those
offences that are committed against
individuals or groups of individuals with a
criminal motive to intentionally harm the
reputation of the victim or cause physical or
mental harm to the victim directly or indirectly,
using modern telecommunication networks
such as Internet (Chat rooms, emails, notice
boards and groups) and mobile phones
(SMS/MMS).

35. Information security policy
Information security policy is a set of
policies issued by an organization to
ensure that all information technology
users within the domain of the
organization or its networks comply with
rules and guidelines related to the
security of the information stored
digitally at any point in the network or
within the organization's boundaries of
authority.

36. Comprehensive cyber security solution
Government agencies need to proactively
protect their critical applications, data and
processes from external and internal threats
throughout their entire life cycle. By taking a
comprehensive and integrated approach to
application vulnerability management, agencies
can measurably improve operational security,
mitigate risks, and reduce costs.

37. Cite list
http://www.advancetechnology.com/electronic-security-access-control-solutions
http://searchmidmarketsecurity.techtarget.com/definition/vulnerability-analysis
http://www.businessdictionary.com/definition/gap-analysis.html#ixzz35hkTYaoA
http://www.coresecurity.com/penetration-testing-overview
http://www.netcraft.com/security-testing/web-application/
http://www-03.ibm.com/software/products/en/ibm-smartcloud-analytics---log-
analysis
http://www.cse.wustl.edu/~jain/cse567-06/ftp/net_monitoring.pdf

38. Cite list (continued)
http://www.isaca.org/Journal/Past-Issues/2005/Volume-6/Pages/JOnline-Creating-
and-Enforcing-an-Effective-Information-Security-Policy1.aspx
http://www.itwsbi.com/Products/SecurityProducts.aspx
https://www.bit9.com/resources/research-reports/2013-cyber-security-study/
http://vimeo.com/41847642
http://www.aig.com/Chartis/internet/US/en/CyberHygieneDocument_031214_tcm317
1-586930.pdf
http://pursuitmag.com/cyber-crime-terms-and-definitions/
http://www.techopedia.com/definition/24838/information-security-policy
http://www-304.ibm.com/industries/publicsector/us/en/contentemplate1/!!/xmlid=148819/

39. Computing with the “Cloud”
Most people when they here the word “cloud” they think of
the clouds in the sky, that would be only logical. But from a
computing standpoint, the “Cloud” is simply a technology that
uses the Internet and remote servers to:
 Maintain data and applications
 Allows users to access
applications without
installation .
 Allows users access to their
personal files from any
computer that has access to
the Internet.
 Centralizes storage, memory,
processing, and bandwidth.In regards to your Yahoo email account, that software is
managed by Yahoo.
Your Gmail account software is managed by Google.

40. HTTPS
(HYPERTEXT TRANSFER PROTOCOL SECURE)
• Install HTTPS Everywhere on your Web browser.
• HTTPS Everywhere is a Firefox, Chrome, and Opera extension
that encrypts any communication that you may have with major
websites.
• More specifically, this extension encrypts your Web browsing
sessions, protecting you from hackers and spy agencies that
scoop up unencrypted traffic across the Internet.
http://www.youtube.com/watch?v=8nRlsaWfo30