Announcements

1
Announcements

• Tonight is for catching up on a couple of talks
• File permissions talk
• Cryptography talk from last week
• Security Challenge Hint
• 3 Software Demonstrations
• Schedule changes
• Privacy policy mailed to me
• Book Reviews are upcomingdoes anyone need book
  ideas?

2
INLS 187

• October 7, 2004
• Prevention and Detection

3
Prevention and Detection

• Tonights talk is about personal security and
  privacy
• Will describe my privacy space framework
• Privacy/Security as a process
• Personal Toolkit suggestions

4
The Privacy Space

• A loosely defined collection of tools, systems
  and services that protect our privacy and
  personal security.
• No definite boundaries, just a cloud

5
Framework

• Five Categories dealing with privacy or security
  from the end users perspective
• Awareness
• Prevention
• Detection
• Response
• Recovery

6
Note

• In the class schedule, the Nov. 18 class will be
  devoted to Response Recovery issues, so if we
  dont hit those as hard tonight, thats why

7
Awareness

• Anything that conveys information without
  requiring the user to act. Awareness features
  are informative and help you monitor what is
  going on.

8
Prevention

• A feature or tool that is used as a precaution.
  Encryption or digital signatures are preventative
  in nature. Secure deletion of electronic
  documents is a good example of a preventative
  feature.

9
Detection

• Tools or features that scan or actively look for
  potential problems. Often, detection tools are
  always running in the background a virus scanner
  is a common detection tool that looks for malware
  and certain dangerous operations being performed
  in memory.

10
Response

• Features and tools that help you get back to
  normal. Restoring to the last known good state,
  patching bugs that allowed intruders to gain
  unauthorized access, and re-installing corrupted
  files are examples.

11
Recovery

• Taking action after a problem has been detected
  is a response. Canceling your credit card after
  it has been stolen, or blocking incoming network
  traffic from certain IP addresses are examples of
  a response.

12
The Privacy/Security Process
13
Examples

• Antivirus prevention detection
• Personal Firewall also p d
• Spyware detector detection
• Backups recovery
• Books/this class awareness
• Marking items as spam to be filtered response

14
Features

• The more a tool or system covers all of the
  categories, the more complete and comprehensive
  it must be.
• Makes it possible to consider an optimum toolkit.

15
Basic Optimum Toolkit

• Has features in each of the categories, probably
  multiple times
• Inclusions
• Personal Firewall
• Anti-virus
• Spam filter
• Spyware detector/remover
• VPN

16
Basic Toolkit Cont.

• Proxies, or some ability to surf anonymous
• Password keeper
• File system encryption
• Good file access control/sharing
• File hashes/checksums for downloads
• E-mail encryption
• System logs
• Backups
• Task Manager/advanced process viewer
• Web content filteringcookie controls
• Secure deletion--webwasher

17
Enhancements

• Auditing capabilities
• Scan for vulnerabilities, check that settings are
  correct (eg Shields Up at grc.com)
• Imaging of entire hard diskdd or Ghost
• Keylogging detection
• Filesystem cleanupWindowWasher
• P2P interference detection or detection of
  logging of P2P traffic
• Newer countermeasures? Exoinfo detection?
• Others?