This presentation was developed for a non-technical audience based on dinner-table conversations. It is designed to cover personal cybersecurity topics that don't typically get addressed in annual corporate training and some of the technical details behind those topics. Note: Because of the audience, some of the topics require additional technical discussions and/or caveats to be fully understood. These have been abstracted to keep it at a manageable level.

1. This presentation is meant to be viewed in Powerpoint
Slide Show mode for full effect of animation.
It was designed for a non-technical audience to provide
personal security measures that don’t always get
covered in corporate training and an introduction to the
technical components behind the advice.
Some of the concepts are presented at a high and/or
abstracted level and would require additional technical
information/caveats to most accurately explain.
© Brent Harrell, 2020

2. Cybersecurity 200
Beyond the Cyber Awareness Challenge
No, Tina, I don’t want to download your pirated music
© Brent Harrell, 2020

3. root@localhost:~$ pwd
Introduction
root@localhost:~$
[+] Brent Harrell OSCP | CISSP
[-] System Security Engineer
####################################################################################################
whoami
root@localhost:~$
[+] Technology is crucial but has its dangers
[-] How do we avoid getting pwned when we need or want to use the technology?
[-] What the heck is a cookie and can hackers eat them?
why are we here
[+] More than your typical Cyber Awareness Challenge (hopefully)
[-] We are going to nerd out a bit on technical details
[-] Spot bogus advertisements capitalizing on fear
© Brent Harrell, 2020

4. root@localhost:~$ pwd
Objectives
root@localhost:~$
[+] Core Topics
[-] What is hacking really, encryption, definitions ...
ls
[+] Passwords
[+] Web Attacks
[+] Social Media
[+] Final Tips
####################################################################################################
[+] Questions
© Brent Harrell, 2020

5. root@localhost:~$ pwd
Core Topics/Definitions
root@localhost:~$ what is hacking && are movies real
[+] Some movies get a few things right
[-] Recommendations: War Games, The Imitation Game
[+] Seeking to compromise digital services and components
[-] Using systems/processes in unintended ways: Misconfigurations, logic flaws
[+] In personal life: like surviving a bear attack
[-] Just be [smarter] than the people around you
[-] Typically not the target of advanced attacks unless you make yourself an
easy target
####################################################################################################
root@localhost:~$ clear
[-] Attack vectors not limited to just technical realm
© Brent Harrell, 2020

6. root@localhost:~$
[+] Confidentiality
[-] Ensuring data is only accessed by those with need to know
[!] How it applies to you: whatever you don’t want to be public
cat CIA.txt
root@localhost:~$ pwd
Core Topics/Definitions
####################################################################################################
[+] Integrity
[-] Ensuring data is not modified by unauthorized users
[!] How it applies to you: emails, file downloads, etc.
[+] Availability
[-] Ensuring data is accessible when needed
[!] How it applies to you: avoiding ransomware, failed hard drives
root@localhost:~$ clear
© Brent Harrell, 2020

7. root@localhost:~$
[+] 0-Day: a new, unpatched vulnerability
cat badness.txt
root@localhost:~$ pwd
Core Topics/Definitions
####################################################################################################
[+] Malware
[+] For more easy-to-digest definitions:
[-] https://www.malwarebyes.com/cybersecurity
Virus Inserts itself into other programs, user interaction to spread
Type Definition
Worm Self-propagating
Trojan Harmful software disguised as legitimate software
Ransomware Blocks access/discloses data unless paid to remove
------ ---------------
© Brent Harrell, 2020

8. root@localhost:~$ show Cryptography
root@localhost:~$ clear
root@localhost:~$ pwd
Core Topics/Cryptography
####################################################################################################
© Brent Harrell, 2020

9. root@localhost:~$
[+] Obscuring data in a reversible way [Confidentiality]
[-] Like a Rubik’s cube – If you jumble it up, you can repeat your steps in
reverse to get it back to normal
cat Encryption_Definition.txt
root@localhost:~$ pwd
Core Topics/Cryptography
####################################################################################################
root@localhost:~$
[+] Symmetric: a shared secret between parties
[-] Fast. Predominant type for encryption of data on a disk, in transit
cat Encryption_Types.txt
[-] HTTPS, File Encryption
[+] Asymmetric: related, but separate, keys
[-] Very slow, used for proving identities, integrity verification, and
establishing a shared secret. Very important to keep private key private.
[-] HTTPS, CAC
root@localhost:~$ clear
© Brent Harrell, 2020

10. root@localhost:~$
[+] A unidirectional algorithm (i.e. not reversible) that creates a
unique value [digest] for each set of data put through it [Integrity]
[-] Think of a meat grinder – you can’t get the cow back
cat Hashing_Definitions.txt
root@localhost:~$ pwd
Core Topics/Cryptography
####################################################################################################
[+] Salt: A value added to the data before hashing
root@localhost:~$ cat Examples.txt
[+] Passwords & Rainbow Tables
[-] password  5f4dcc3b5aa765d61d8327deb882cf99
[+] Digital Signatures
[-] passwordSALT  74836d1ccf6bfc3e7e625ba7438e85c3
[-] First hashes the data, then encrypts the message digest with the user’s
private key. Proves integrity and authenticity
© Brent Harrell, 2020

11. root@localhost:~$
[!] Use a different password for every site (min: email, financial)
[-] This can be difficult, so use a password manager like KeePass or LastPass
cat Advice.txt
[!] Do not use words that have a connection to you (e.g. kid’s name)
[-] Change your passwords (especially if you still use the one they have)
[-] DO NOT engage with them, pay them, or click links
[!] If a site allows it, use multi-factor authentication
[-] “Factors” are something you … KNOW | HAVE | ARE | CAN DO
[-] Authentication apps (e.g. Google Authenticator) are better than SMS or
email if available
root@localhost:~$ clear
root@localhost:~$ pwd
Passwords
####################################################################################################
[!] If someone emails you and proves they know your password:
© Brent Harrell, 2020

12. root@localhost:~$
[+] Which of these is most secure?
[-] A) P@s$w0rd! B) fishfleetrealspider C) ZAQ!1qazXSW@2wsx D) Az9f!9
passwd test
root@localhost:~$ pwd
Passwords
####################################################################################################
root@localhost:~$ clear
root@localhost:~$
[+] Cracking is usually based on word lists, not random brute force
[-] Programs can easily substitute @ for A, etc. and append numbers/symbols
cat Why.txt
[-] Patterns are easily guessable
[!] Length is much more important than getting every character class
[!] This does not mean don’t mix it up, just don’t mix it up predictably
© Brent Harrell, 2020

13. root@localhost:~$ show Stats
root@localhost:~$ pwd
Passwords
####################################################################################################
https://www.hivesystems.io/blog/are-your-passwords-in-the-green
Big Asterisk 
[+] remember from the
prior slide: this does not
tell the whole story.
[+] “Password123!!”
should take 2M years
according to this, but it
will be instant
© Brent Harrell, 2020

14. root@localhost:~$
If you are receiving a service online for no
monetary cost, you are not the customer
You are the product
cat WARNING.txt
root@localhost:~$ clear
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
© Brent Harrell, 2020

15. root@localhost:~$
[!] Know that you’re the product
[-] If it’s still worth it, then enjoy
cat Social-Media_Advice.txt
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
[!] Limit sharing and lock down who sees your stuff
[-] Don’t fill in the fields they want you to
[-] Wherever possible, limit access to only friends/connections
[!] Lie on security questions
[-] Stay consistent so you don’t confuse yourself
[-] Be careful: some people have had the lies show up on credit-related
questions. Limit to things like ‘first pet’ or ‘high school mascot’
root@localhost:~$ clear
[-] Social media is a great way to get answers to security questions
[-] If given the option, always write your own security question
© Brent Harrell, 2020

16. root@localhost:~$
[!] Be careful when using smaller/off-brand sites
cat General_Advice.txt
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
[!] Close out of sensitive sessions (tabs) when done
[-] Test: If you can return to the page and are logged in after closing the
tab, you need to log out manually
[!] Use security-related browser extensions
[-] Firefox/Chrome: NoScript, uBlock Origin/Adblock Plus
root@localhost:~$ clear
[!] Resist the urge to find out which Disney princess you are (quizzes)
[!] Use a VPN on public WiFi
[!] Pay attention to warnings – don’t just click through them
© Brent Harrell, 2020

17. root@localhost:~$
[+] What are they?
[-] Delicious baked goods. Also, small files that contain information
[-] Can store almost anything: a session ID, settings, how you got to the page
cat Cookies.txt
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
[+] Good and Bad
[-] Good: Helps manage sessions so that you don’t need to log in every time you
change pages on the website (e.g. going from the home page to your profile)
[-] Good: Remembers settings and other configurations to make experiences
smoother
[-] Bad: Can be used to track your activity across sites (think custom ads)
[-] Bad: Can end up taking up a lot of storage
root@localhost:~$ clear
© Brent Harrell, 2020

18. root@localhost:~$ show Cookie
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
root@localhost:~$ clear
© Brent Harrell, 2020

19. root@localhost:~$
[+] Cross-Site Scripting (XSS)
[-] When a site does not ‘sanitize’ the contents of user-controlled input,
malicious users can insert scripts that users’ browsers will execute
cat XSS.txt
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
root@localhost:~$ show Stored_Example
root@localhost:~$ clear
BeEF
© Brent Harrell, 2020

20. root@localhost:~$
[+] Cross Site Request Forgery (CSRF)
[-] Scripts on a page only have access to the contents of cookies for that page
[-] CSRF takes advantage of the browser storing other cookies to try to execute
authenticated actions. NOTE: Requires security lapse on both sides
cat CSRF.txt
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
[+] Example:
[-] You use Bank of Money for your banking. You log in to the site and it sets
a session cookie so that you can navigate the website while logged in
[-] You then open a new tab and navigate to http://iloveallthefurrypuppies.com
which has a comment section
[-] While great at loving puppies, they don’t filter the comments. A malicious
user inserts a script that causes all visitors to try to execute a financial
transaction at BoM. Because you’re still logged in, BoM sees the session cookie
from your browser, thinks it’s a valid request, and executes it
root@localhost:~$ clear © Brent Harrell, 2020

21. root@localhost:~$
[+] Most sites use encryption now, but it isn’t always needed
[-] If you do not plan to enter/receive any sensitive data, not too worrisome
[!] If you DO plan to enter/receive any sensitive data, always ensure it’s on
an encrypted connection (HTTPS) and the certificate is valid
cat Site_Encryption.txt
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
root@localhost:~$ clear
© Brent Harrell, 2020

22. root@localhost:~$
[+] Virtual Private Network
[-] Cryptographic tunnel between two locations – a virtual means of creating a
point to point link
[-] Can allow remote computers access to internal networks (mainly corporate)
What is a VPN
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
[-] Can be used to appear as a different IP and prevent Man-in-the-Middle
attacks
root@localhost:~$ ./Man-in-the-Middle
root@localhost:~$ clear
[+] When someone controls an element of the link, they can view
and/or modify all traffic flowing through it
[-] Examples: Airport or Hotel WiFi
© Brent Harrell, 2020

23. root@localhost:~$ show Tunnel_Simplified
root@localhost:~$ pwd
Internet Browsing
####################################################################################################
Request
to Google
Request to
Google
from MITM
MITM
Intercepts
Client establishes tunnel with VPN provider,
client sends request to Google (red), MITM
only sees encrypted data (blue)
VPN provider forwards original
request to Google (red)
Google establishes HTTPS
tunnel with client (green)
Tunnel
from MITM
Data exposed
to MITM
Tunnel to
Google
from MITM
© Brent Harrell, 2020

24. root@localhost:~$
[!] Keep software and firmware up to date
[-] Particularly: antivirus, browsers, router firmware, operating system
more Tips.txt
[!] Windows Defender has come a long way
[-] Other free options: Avast, AVG, MalwareBytes, BitDefender
[!] Don’t use Kaspersky
[!] Avoid downloading anything cosmetic that you do not need
[-] Themes (mobile or computer), browser add-ons, apps, etc.
[-] Often user-generated and not vetted, perfect access vector for attacks
root@localhost:~$ pwd
Final Tips
####################################################################################################
[?] Example: Windows theme caused the OS to divulge NTLM hashes
- -More- -(33%) [Press space to continue, 'q' to quit.] © Brent Harrell, 2020

25. [!] Verify links in emails before clicking by hovering over them
[!] If you know the URL (e.g. your bank), go directly instead of with the link
root@localhost:~$
Final Tips
####################################################################################################
[!] Use WPA2 (Personal/PSK/AES depending on device) for home wireless
[!] WEP, WPA, and TKIP for WPA2 are deprecated and should not be used
[!] Do not use WPS (WiFi Protected Setup) on devices like printers
[!] Periodically back up your information to an external drive
[!] Disabling SSID is not actually helpful
[!] If you want to go deeper, separate IoT devices into a different VLAN
- -More- -(66%) [Press space to continue, 'q' to quit.] © Brent Harrell, 2020

26. root@localhost:~$
Final Tips
####################################################################################################
- -More- -(100%) [Press space to continue, 'q' to quit.]
[!] Be diligent, but don’t be terrified
[-] Basic ‘cyber hygiene’ is generally enough to keep you protected.
Individuals typically aren’t targets until they make themselves one
[!] Limit trust in external parties – all it takes is one mistake by a company
(who are targets) for your data to go out the door
[!] Question everything, especially things rooted in fear-based tactics
[?] Example: APT31 McAfee phishing attack – ask “Why am I not getting this
straight from McAfee’s site?”
© Brent Harrell, 2020

27. root@localhost:~$ pwd
What Am I About to Get Into
####################################################################################################
Questions?
© Brent Harrell, 2020