Download as PDF, PPTX
![© Air Force Association
Example: [base password] [site]
Gmail: [Ronald123!] [GMA] = Ronald123!GMA
Facebook: [Ronald123!] [FAC] = Ronald123!FAC
12
Passwords - Different
• Use different passwords for each login (e.g. Gmail and Facebook)
– 73% of people do not
Ronald’s Old Password: Ronald123!
New Passwords: Ronald123!FAC and Ronald123!GMA](https://image.slidesharecdn.com/unitfour-principlesofcybersecurity-160420142337/75/Unit-four-principles-of-cybersecurity-13-2048.jpg)
Uploaded byErdo Deshiant Garnaby
Unit+four+ +principles+of+cybersecurity
This document provides an overview of cybersecurity principles and threats. It discusses the goals of cybersecurity - confidentiality, integrity and availability. It describes common cybersecurity tools like encryption, access controls, backups and redundant systems that support these goals. The document also outlines various types of malware threats like viruses, worms, Trojan horses, botnets and keyloggers. Additionally, it covers social engineering techniques used in phishing and outlines best practices for strong password management to help protect against attacks.
More Related Content
Similar to Unit+four+ +principles+of+cybersecurity
Unit+four+ +principles+of+cybersecurity
- 1. AIR FORCE ASSOCIATION’S NATIONALYOUTH CYBER EDUCATION PROGRAM CYBERPATRIOT www.uscyberpatriot.org UNIT FOUR Principles of Cybersecurity
- 2. AIR FORCE ASSOCIATION’S NATIONALYOUTH CYBER EDUCATION PROGRAM CYBERPATRIOT www.uscyberpatriot.org SECTION ONE Cybersecurity Goals and Tools
- 3. © Air ForceAssociation • 3 Goals of information security: ‐ Maintain information confidentiality • Making sure only approved users have access to data ‐ Maintain information integrity • Data Integrity: assurance that information has not been tampered with or corrupted between the source and the end user • Source Integrity: assurance that the sender of the information is who it is supposed to be ‐ Maintain information availability • Ensuring data is accessible by approved users when needed The CIA Triad Source: http://www.techrepublic.com/blog/it-security/the-cia-triad/
- 4. © Air ForceAssociation • Confidentiality ‐ Encryption • Passwords, encryption keys ‐ User access control • controlling which users have access to networks and what level of access each user has • Integrity ‐ Encryption ‐ User access control ‐ File permissions • Customizable settings that only allow certain users to view and edit files ‐ Version control systems/backups • Availability ‐ Offsite data storage/backups ‐ Redundant architecture (hardware and software) The CIA Triad: Tools of the Trade
- 5. © Air ForceAssociation • Process of verifying the identity of a user • Used to control access to a resource • Methods: ‐ Passwords ‐ Physical “keys” (key chains, swipe cards) ‐ Biometrics (fingerprints, retina scanning) • Threats: ‐ Brute force cracking • Test every possible combination of letters, numbers, and characters until the password is found ‐ Dictionary cracking • Test words and combinations of words found in the dictionary or from a slightly shorter list of words known to be commonly used in passwords 4 Authentication/Encryption Password: * * * * * * * *
- 6. AIR FORCE ASSOCIATION’S NATIONALYOUTH CYBER EDUCATION PROGRAM CYBERPATRIOT www.uscyberpatriot.org SECTION TWO Building Strong Passwords
- 7. © Air ForceAssociation Building Strong Passwords NOT… 6 C L O U D S S U N Source: tamutimes.tamu.edu Remember…….
- 8. © Air ForceAssociation 1234 7 Passwords NOT GOOD! This is Ronald Donald’s Password:
- 9. © Air ForceAssociation • Passwords of 8 characters consisting of Numbers only: 100 million + Lower case: 2.8 trillion + Upper case: 210 trillion + Symbols: 7.2 quadrillion 8 Passwords - Complex Cracked in < one second Cracked in eleven minutes Cracked in fifteen hours Cracked in three weeks Ronald’s Old Password: 1234 New Password: Pa123! • Always use at least 3 of the following: Numbers Lower case letters Upper case letters Symbols (% # * & ! : { “ > |) Source: www.howsecureismypassword.net
- 10. © Air ForceAssociation Six or fewer characters Seven characters Eight characters Nine characters Ten characters • Brute force attacks can run 4 billion calculations per second 9 Passwords - Lengthy Ronald’s Old Password: Pa123! New Password: Password123! Cracked in three minutes Cracked in five hours Cracked in three weeks Cracked in five years Cracked in 526 years • Always use at least 8 characters
- 11. © Air ForceAssociation Do not Share Your Password with ANYONE 10 Passwords – Only Yours
- 12. © Air ForceAssociation • Any of the top 10,000 passwords will be broken immediately • 91% of people have one of the 1,000 most popular passwords • Almost half of all people use one of the 100 most popular 11 Passwords - Unique Ronald’s Old Password: Password123! New Password: Ronald123! – letmein – dragon – 111111 – baseball – iloveyou – trustno1 – password – 123456 – 12345678 – abc123 – qwerty – monkey – 1234567 – sunshine – master – 123123 – welcome – shadow
- 13. © Air ForceAssociation Example: [base password] [site] Gmail: [Ronald123!] [GMA] = Ronald123!GMA Facebook: [Ronald123!] [FAC] = Ronald123!FAC 12 Passwords - Different • Use different passwords for each login (e.g. Gmail and Facebook) – 73% of people do not Ronald’s Old Password: Ronald123! New Passwords: Ronald123!FAC and Ronald123!GMA
- 14. © Air ForceAssociation • The longer you keep a password the longer attackers have to try and crack it • Changing your passwords regularly can help foil cracking attempts as they happen • It’s best to change your passwords at least every few months 13 Passwords – Short Term
- 15. © Air ForceAssociation • Do not use dictionary words ‐ Fend off dictionary cracking attacks by using passphrases 14 Passwords NOT Simple Where’s the beef? Wh D@ B33f? WhD@B33f?
- 16. © Air ForceAssociation • User ID is publicly available • Using it as a password = Giving it away 15 Passwords – NOT User ID
- 17. © Air ForceAssociation • Do not use any personal info – can be easily found by other means ‐ Name ‐ Birthday ‐ Pet’s Name ‐ Mother’s Maiden Name ‐ Hometown 16 Passwords – NOT Name Old Gmail Password: Ronald123!GMA New Password: WhD@B33f?GMA Old Facebook Password: Ronald1234FAC New Password: WhD@B33f?FAC
- 18. © Air ForceAssociation Building Strong Passwords NOT… 17 Source: tamutimes.tamu.edu Remember……. Complex Lengthy Only Yours Unique Different Short Term Simple User ID Name
- 19. AIR FORCE ASSOCIATION’S NATIONALYOUTH CYBER EDUCATION PROGRAM CYBERPATRIOT www.uscyberpatriot.org SECTION THREE Cyber Threats 18
- 20. © Air ForceAssociation • Dumpster Diving: Thieves sift through garbage for receipts with credit card information, medical forms with social security numbers, or other documents with PII • Shoulder Surfing: By looking over your shoulder as you type, thieves can glean your passwords, account information, and other sensitive information • Simple, but often overlooked threats 19 Physical Threats
- 21. © Air ForceAssociation • Basic personal practices that keep computers and data safe ‐ Lock your computer when in public areas ‐ Shield your keyboard when you type passwords ‐ Do not let strangers use your computer ‐ Keep sensitive information in secure places 20 Cyber Hygiene
- 22. © Air ForceAssociation Portable or handheld devices that have data or can connect to another device that has data 21 What are mobile devices?
- 23. © Air ForceAssociation 22 Securing Mobile Devices Risk Fix 1. Easily stolen and lost 2. Often not encrypted 3. Targets of malware, tools for attackers 4. Can be compromised via wireless 5. Applications collect information 1. Guard your devices 2. Set a strong passcode 3. Use anti-malware and updates 4. Avoid using open networks 5. Customize security settings
- 24. © Air ForceAssociation • Social Engineering: Manipulating people into giving up personal information 23 Online Threats Thrift Shopping Room M@ckelm0re Guests Ry@nLew1s | Send M@ckelm0re: Yo man I got the illest sweaters yesterday Ry@nLew1s: Really? What are we talkin? Wool? Pullover? Cardigan? Ry@nLew1s: I got a dope cardigan last week. Only 99 cents. M@ckelm0re: A couple of sick purple pullovers. Dont know if I need 2 tho….whats ur address? I will drop 1 in the mail for u.
- 25. © Air ForceAssociation • Phishing: fraud attempts perpetrated by random attackers against a wide number of users • Spear-phishing: fraud attempts targeted at specific people based on their membership or affiliation with a the spoofed group ‐ e.g. fraudulent emails sent to Microsoft employees aiming to steal Microsoft secrets • Vishing: Attempts to manipulate people into giving up PII over the phone • Smishing: Attempts to manipulate people into giving up PII by text message (SMS) 24 Social Engineering Methods
- 26. © Air ForceAssociation Sincerely, Customer Service Barclays *Phishing attempts are rarely this obvious, but these are useful errors to look for 25 How to Spot Phishing Emails Spoofed email address Spelling Errors/Typos ALL CAPS Asks for Personally Identifying Information Executable attachment or link to a Website Signed by a department, not an individual Source: www.Vanish.org
- 27. © Air ForceAssociation • Report phishing attempts so other people aren’t victimized • Go to the legitimate website of the spoofed organization (not through a link in the email) • Follow the site’s procedure for reporting • Report the spoof to your email provider 26 Reporting Email Scams
- 28. © Air ForceAssociation • Malicious Software = Malware • Software designed and written to: ‐ Steal information ‐ Spy on users ‐ Gain control of computers • Categorized by ‐ How it spreads ‐ What it does 27 Malware: What is it?
- 29. © Air ForceAssociation • V • T • Z • K • B • L • S 28 Malware: What is it? iruses/Worms rojan Horses ombies and Botnets eyloggers ackdoors ogic/Time Bombs pyware
- 30. © Air ForceAssociation • Viruses: Can infect and spread but need human assistance ‐ People download infected email attachments, shared files, spoof links, etc. ‐ Example: ILOVEYOU virus • Worms: Can infect and spread without human assistance ‐ Example: Sasser worm 29 Malware: Viruses/Worms
- 31. © Air ForceAssociation • Trojan horse: Program with a hidden malicious function ‐ It looks like something you want ‐ It does something you do not want • Can cause computer crashes and be used by attackers to gain remote access to your system or steal information 30 Malware: Trojan Horses
- 32. © Air ForceAssociation • Zombies (a.k.a bots): compromised computers under the control of an attacker ‐ Make it possible for someone else to control your computer from anywhere in the world • Botnet: a collection of compromised computers (zombies) under the control of an attacker ‐ Attackers pool the computing power of all of the zombie machines to launch huge spam attacks or to bring down websites through Distributed Denial of Service (DDoS) attacks ‐ DDoS attacks direct massive amounts of communication requests and traffic to websites in attempt to overwhelm their servers 31 Malware: Zombies and Botnets
- 33. © Air ForceAssociation • Keylogger: Tracks users’ keystrokes, obtains passwords and other personal information • Especially dangerous, because they track everything a user does, not just what they do on an unprotected Internet browser 32 Malware: Keyloggers My Computer Password: * * * * * * Attacker’s Computer Password: Q W E R T Y Keylogger
- 34. © Air ForceAssociation • Backdoor: An entry point into a program without all the normal, built- in security checks • Programmers sometimes install backdoors when they develop programs so that they can manipulate a program’s code more easily during troubleshooting and testing ‐ Sometimes they forget to close them • Attackers use malware like viruses, worms, and Trojan Horses to install backdoors on the computers they infect 33 Malware: Backdoors
- 35. © Air ForceAssociation • Logic/time bomb: Malware designed to lie dormant until a specific logical condition is met ‐ A particular person logs in ‐ A specific date or time ‐ A message is received 34 Malware: Logic/Time Bombs 00:00:00
- 36. © Air ForceAssociation • Spyware: Collects information about you, without your knowledge or consent ‐ Keyloggers are a type of Spyware Malware: Spyware 35
- 37. © Air ForceAssociation Anti-malware Software 36 Quarantines and removes infected files Scans files for matches in databases of known malware Alerts you when a match is identified or a suspect program attempts to run Source: www.zdnet.com Source: www.pcworld.com Source: www.royalpccare.com Source: www.digital-defender.com