Internet Security

1
Internet Security

• In the 21st Century
• Presented by Daniel Mills

2
Why is security important?

• The power of computers is information storage and
  processing
• The power of the Internet is information
  transmission
• The problem is protecting information from
  attacks of theft or corruption

3
Common ThreatsTo computers

• Insecure Passwords
• Software vulnerabilities
• Malware
• Viruses
• Spyware
• Adware
• Phishing

4
Common ThreatsTo networks and the Internet

• Insecure Passwords
• Unencrypted Information
• Hacking or Cracking
• Spam

5
PasswordsWhy are they important

• Secure passwords protect both the User and the
  Provider. For example if a Users
• Email password is compromised their account could
  be used to send spam. This causes the
  Providers mail server to be blacklisted by other
  email providers.
• PPP password is compromised an attacker or pirate
  could impersonate the User and cause legal
  ramifications for both the User and Provider.

6
Passwords

• Password attack types
• Dictionary Attacks take seconds to minutes
• Brute force take hours to days
• The objective is to prevent dictionary attacks
  and make brute force attacks as difficult as
  possible

7
Passwords

• Common Rules
• At least 8 characters
• Alphanumeric
• Not a dictionary word or based on the username
• Dont use the same password everywhere
• Other Rules
• Include special characters
• Completely Random

8
Passwords

• Ten most common passwords according to PC
  Magazine
• password
• 123456
• qwerty
• abc123
• letmein
• monkey
• myspace1
• password1
• link182
• (your first name)

9
Computer ProtectionUpdate Software

• One of the most important things Users can do is
  keep their software up to date. Updated software
  provides many benefits including but not limited
  to
• Closing security holes and exploits
• Providing new features that improve experience
  and help protect against attacks
• Faster and more responsive

10
Computer ProtectionSoftware Update
ExamplesPhishing Protection

• Firefox 3.0
• Internet Explorer 7

11
Computer ProtectionSoftware Update
ExamplesDomain Highlighting

• Internet Explorer 8
• Google Chrome

12
Computer ProtectionAnti-Malware

• The next thing Users need to pay attention to is
  anti-malware. There are two types of malware
• Viruses
• Spyware or Adware
• It is important to have protection from both
  forms of malware by using either a single
  software suite such as McAfee or Trendmicro or
  with multiple programs such as AVG with Ad-Aware.

13
Computer ProtectionFirewall

• Firewalls protect the computer from active
  external attack. There are two types of
  firewalls
• Software which run on the the computer they
  protect and require extra installation and setup
• Hardware which are built in to many home routers
  and do not require extra setup

14
Computer ProtectionClean Up Tips

• Dont scan the computer from its native
  environment, instead either
• Remove the hard drive and scan it in another
  computer or
• Use a Linux LiveCD or LiveUSB disk
• Consider that if the infection is bad enough you
  may have to back up important documents and start
  from scratch but make sure scan the backup

15
Network ProtectionEncyption

• The best thing Users can do to protect their data
  in transmission is to make sure important
  information is encrypted. Modern 3DES or AES
  based encryptions take months or years to crack
  and provides plenty of protection for even the
  most sensitive data.

16
Network ProtectionWireless Encryption

• Three common types from worst to best
• WEP or Wire Equivelent Privacy, the oldest and
  most easily cracked
• WPA or WiFi Protected Access, stopgap to fix WEP
  problem but still good
• WPA2 is the best, it has not yet been cracked and
  it is required for WiFi Certification on all new
  devices

17
Network ProtectionHTTPS vs HTTP

• HTTP is the protocol used to view and send data
  to webpages. HTTPS is the same except it is run
  through a SSL or Secure Socket Layer which
  encrypts the information as it passes between the
  User and the web server.
• HTTPS requires a certificate be obtained by the
  web server from a certificate authority which
  will take many steps to verify the authenticity
  and identity of the purchaser.

18
Network ProtectionSpam

• Spam is becoming a bigger and bigger problem with
  both internal and external sources. The two most
  common are
• Foreign servers in countries such as Russia or
  China
• Bot Nets consisting of computers infected with
  viruses such as Confiker

19
Network ProtectionProvider Level Spam Protection

• Every mail server should have spam protection.
  There are three common methods of protecting
  email at the server level
• Software built into the mail server such as
  SpamAssasin
• An appliance such as Barracuda
• A third party provider such as Postini

20
Network ProtectionProvider Level Spam Protection

• There are also some technologies that can make it
  more difficult for spammers to forge information
  like from addresses. The more email providers
  that adopt these technologies the harder it will
  be for spammers
• SPF or Sender Policy Framework is a DNS record
  that provides a list of authorized servers to
  send email from a domain
• DKIM or Domain Key Identified Mail is mail that
  is signed by the sending server
• A third party provider such as Postini

21
Network ProtectionUser Level Spam Protection

• If the User is not satisfied with the Provider
  level protection, or they want to take care of
  filtering them selves they have two basic options
• Protection that is built into most modern email
  software
• Third party software either as part of their
  security suite or individual

22
Network ProtectionUser Level Spam Protection

• Most of the time filtering will be more than
  enough protection for all users. However there
  are some techniques that every User should or can
  follow to protect themselves.
• Avoid posting email addresses in public locations
  such as social network sites or forums
• Use separate emails one for private and one for
  public
• Use more than 3 or 4 letters in the username
• Avoid emails like info, support, service, etc.

23
Questions andContact Information

• Daniel Mills
• Senior Technical Specialist
• Peak Internet
• daniel.mills_at_peakinternet.com
• http//peakinternet.com
• http//blog.peakinternet.com