Recognizing, Detecting and Preventing Cyber Security Threats...•Now known to hackers as a victim and will be subject to future attacks. ... •No system is 100% perfect -since threats

CyberHygienePractices 11/30/17

Bloustein Local Government ResearchCenter 1

2017AnnualGovernmentalAccounting&AuditingUpdateConference

RutgersBusinessSchoolByMarcPfeiffer,AssistantDirectorBlousteinLocalGovernmentResearchCenter

RutgersUniversity

Recognizing,DetectingandPreventingCyberSecurityThreats



BOTTOMLINE▪ Criminalstrytomanipulatepeopleinto

divulgingpersonalorbusinessinformationortrickthemintoschemestodefraud

▪ Criminalscanbeindividualsorpartofindustrialized,cybercrimebusinesses

Nosinglefixsincethethreatskeepchanging;It’saperpetutalbattle



WHYSHOULDICARE?

•60%ofemployeeswillclickaphishinglink

•30%ofthemwillactuallygiveuporganizationcredentials

•20%statedtheywouldselltheirorganizationalpassword

REALITY:thebulkofsuccessfulattackscomebecauseanemployeeclickedon

somethingtheyshouldn’thave

TypesofAttacksandThreats• TargetedAttacks– Governmentagenciesaregenerallytargets– Italsohappensifsomethinggoeswrong

• MassAttacks– Thisstemsfromsuccessfulemailphishing,socialengineering,plus“bruteforce”attacksonnetworks

• Man-in-the-MiddleAttack:– Alinktoalog-insitethatlookslegit,butisfraudulentandwillstealyourcredentials

• Unsecurehumans– Clickingonthewronglink/openingthewrongfile– Anemployeewhostealsdataforresaleorillegaluse



SomeCommonTerms

Malware

Destructiveformofcomputersoftwaretransmittedbyemailandwebsitelinks

Viruses,Trojans.Rootkits.Worms.Spyware.Crimeware. Adware



Phishingaformofsocialengineeringthatappearsasemailoratextmessagethatattackersusetogainlogincredentialsoraccountinformation

Anditsevilcousin,thetargetedSpear-PhishorVish,usingvoicetofoolyou

PHISHINGEMAILSEXAMPLES

Phishingemailposesasanimportantemailfromatrustedorganization

– Anotificationfromthepostoffice,UPS,FedExshippinginformingtherecipientofadelivery

– Amessagefromautilityproviderorretaileraboutanoverduebill

– Analertabouttherecipient’staxreturn– Invoicesornoticesforgoodsandservices(Amazon,Costco)

– Fakecreditcardrewardschemes– Directionfromyouremployer,i.e.,needtolog-inbecauseyoulostsomepermission

Eachvariationreliesonourinstincttoactonmessagesthatappeartobeurgent



• Clickingonanattachmentoralinkembeddedinasuspiciousemaillaunchesaprogramthatencrypts(orrewrites)yourfiles.



THISISRANSOMWARE!SOWHATHAPPENS?

• Thefilesareheldforransom;thehackerwhosenttheemailwillrequireapaymentfromyoubeforetheywill(hopefully)sendyouthekey(alineofcomputercode)thatdecryptsthefilesandrestorethem.

• Hopeyouhavebackupstorestoreyoursystem;otherwiseyoupay!

• Nowknowntohackersasavictimandwillbesubjecttofutureattacks



WHEN EMAIL TURNS EVIL!!!

EMAILASSOURCEOFMALWARE?

- Embedded,butfakelinksenticeyoutoopenharmfulwebsites

- Spoofed“from”addresses

- Attachmentscanhaveembeddedvirusesormalware;MSOfficedocumentscanhavemaliciousmacrosinthemorrequeststolinktootherfilesfromafileyoudownloaded.Otherattachmentsincludehtmlandzip.

- Couponsandadvertisementswith“hiddenagendas”

- Alwayswithsuggestionthatyouneedsomething,orcouldgetsomethingforabargain.



PROTECTYOURSELFFROMEVILEMAIL



• Learntohoverandreadlinks!

• Besuspiciousofunexpectedemails

• Donotdownloadoropenattachmentsyouarenotexpecting:• Confirmfirstwiththesenderifitlooksimportant• Orjustdeleteit

• Alwaysbesuspicious(donotletyourguarddown)

• Ifitdoesn’tlookright,it’snotright

• Donotlogintoanaccountfromanemaillinkunlessyouverifyit’salegitemailandsite

• Neverunsubscribefromagroupthatyouareunfamiliarwithordidnotsubscribeto



• Usestrongpasswordsorbetteryetpass-phrases; donotusenames,dateofbirths,oranythingknownaboutyou.Andvarythem.– Particularlyforfinancialsites,siteswithyourcreditcardinformation,andemail.

– Changethemperiodically(annuallyforkeyones)• Donotsharepasswords!– Anythingthathappensonthataccountgetstreatedasifyoudidit.

– Ifyoudoshareapasswordchangeittosomethinggenericbeforeandbacktosomethingcomplexafter;orchangeitafterit’suse

• Useapersonalpasswordmanager

MakingandManagingStrongPasswords



SAFEWEBBROWSING



HTTP

HTTPS



http://masterupdate.net/.....

Ifyouareunsureaboutthistypeofpop-up,searchfor“flashupdate”andgotoanadobe.com sitetocheck.Don’tdownloadfromapop-upthat’snotfromtheadobe.comwebsite.



• DONOTCLICKONsuspiciouspop-upsorunexpectedmessageswhenbrowsing!– Ifatwork,callIT;ifathome,closethewindowor,disconnect

fromnetwork

– Workiswork,nothome!

– Rememberyourwebbrowsingactivitiesaretracked(evenifyouclearthebrowserhistory)!

– DON’TCLICKonthatpop-up!

– DON’TCALLthenumberonthescreen

SafeBrowsing:@Workand@Home

• Thingsthataretoogoodtobetrue,aren’ttrue.Don’tclickonthemordeletethem

• Caughtinaloop?Shutdownandreboot

• StaySafe:Browsetrusted sites:• Knowtheaddress:HTTPvs.HTTPS,andnopasswordsonnon-https sites

• Usetwo-factorauthenticationwhenoffered• Don’tdownload“toolbars”orcleaners,unlessknownorcheckedout.Youprobablydon’tneedthem

KEEPYOURCOMPUTERUPTODATEKeepwindows,antivirus,andbrowser

updatedwithlatestversions



FormsofSocialEngineering

• In-person• Phone• Digital



BEWAREOF……phonecallersaskingforconfidentialemployeror

personalinformation,eveniftheyclaimtobefromIToravendor.ReferthemtoITsupportorhangup.

'Canyouhearme?'phonescamAdangerousnewphonescamisspreadingacrossthecountry,withfauxtelemarketersaskingunwillingvictimstorespondwithasinglewordto"Canyouhearme?"

{ }



UNFORGETTABLES

• Donotlogonandoffacomputerwhenaskedbyanotheremployeeoroutsideperson–unlessidentityisverified

• CallerIDcanbe“spoofed”• Usetwo-factorauthenticationtransactionswheneveritsavailable

• FiscalandHRpeople:POSTIVELYconfirmallemaileddirectionsforanything(especiallyforpersonnelinformationandpaymentdirection)

• Usepasscodeonmobiledevices35



• Nosystemis100%perfect- sincethreatsarealwayschanging

• Stayaware:stop,think,thenconnect• CallyourITsupportpersonwhenindoubt• Athome:www.malwarebytes.com ifyougetinfected

UH,NOPE

PUTTINGITALLTOGETHER

• Don’tbecurious– justdon’tclick• Online;freeisneverfree• Besuspicious– hoverfirstandcheckitout• Ifyoudidn’taskforit,youdon’tneedit• Never openattachmentsfromunknownpeople• Don’tinstinctivelyopenfilesfrompeopleyouknowbutwerenotexpecting;checkwiththemfirst

• LockyourPCwhenawayfromyourdesk– “Ctrl+Alt+Del>Enter”or“Windows+L”

• Testyourself:searchfor“PewCybersecurityQuiz”• www.pewinternet.org/quiz/cybersecurity-knowledge/



Youknowwhattheysay…

Formoreinformationforworkorhomeorschool:www.stopthinkconnect.org



Forfurtherdiscussionandcomments

MarcPfeiffer,AssistantDirectorBloustein LocalGovernmentResearchCenterBloustein SchoolofPlanningandPublicPolicyRutgersUniversityMarc.Pfeiffer@rutgers.edu

• SeetheTechnologyRiskManagementPapersbysearchingfor“Bloustein TechnologyRisk”

Documents

Recognizing, Detecting and Preventing Cyber Security Threats...•Now known to hackers as a victim and will be subject to future attacks. ... •No system is 100% perfect -since threats