Presentation from SIA 2006 What Every Employee Needs to Know About Information Security by Ben Rothke

1. What Every Employee Needs to Know About Information Security Ben Rothke, CISSP

6. Universal Goals of Information Security Confidentiality Integrity Authentication Interception Modification Fabrication Are my communications private? Has my communication been altered? Who am I dealing with?

7. Today’s security threats include Lost backup tapes Hackers Risk matrix Software Patches Power grid Data center Poor token management Political Malicious end-users Angry Customers Regulatory compliance Contractors Telco Poor revocation processes Terrorists Legal liability Unions External Environmental DR/BCP Internal External Unhappy customers Physical security Disgruntled employees Consultants Third-party Clients Operational Audit Lack of budget Vendor bankruptcy Software vulnerabilities Forensics Crypto keys Lack of staff Fraud Poor risk assessment Hactivists Spyware Blogs Insecure software Wireless Google No documentation Organized crime China India Illegal downloads Web-scripting Viruses Worms Malicious software Laptop stolen Phishing Identity theft DoS BlackBerry Social engineering Competition Information leakage E-mail

8. The risks are real

23. E-mail safety

33. Phishing

34. Phishing

35. Phishing

38. Conclusions

41. Ben Rothke CISSP, CISM brothke@gmail.com