Computer Network Security

1. Computer-Network Security Bryley Systems Inc. Bryley Communications Inc.

2. Synopsis Are you worried about the security of your computer network? Learn the latest on protecting your system from spyware, spam, and unauthorized access. Discover what you need to do to ensure the integrity of your company’s valuable data. Copyright 2005 2

4. About Bryley • Business Technology Solutions • Established and incorporated 1987 • Full-service, end-to-end provider: - Computer networks Network security Telephone systems Voice and data cabling Copyright 2005 4

7. I. Common Threats • • • • • • • I. II. III. Viruses Spyware Spam Phishing Objectionable Content External Threats The Threat Within Common Threats Preventative measures Questions and answers Copyright 2005 7

9. Spyware • • • • Gathers information about computer use patterns Slows system response, may cause errors and instability Compromises user privacy Often installed with the user’s permission Copyright 2005 9

10. Spam • • • • • Unsolicited advertising e-mail Also includes messages trying to spread viruses and spyware Wastes employees’ time distinguishing legitimate e-mail from SPAM Legitimate e-mail may be inadvertently deleted. Not unusual for a majority of e-mail to be SPAM Copyright 2005 10

11. Phishing • • E-mail that insists that an account must be updated or verified, usually for “security reasons” E-mail contains links to a web site that is similar in design and name to the legitimate web site Copyright 2005 11

14. The Threat Within • • • • • • Unnecessary access allows careless or malevolent employees to move or delete data Passwords which are easily guessed or written down allow access to other employees’ accounts Stolen or lost portable devices contain data and may allow for unauthorized remote access rnet connected systems are often scanned for know vulnerabilities Compromised systems are used to send SPAM or store illegal content Targeted attacks Copyright 2005 14

16. Computer & Internet Use Policy • • • • • Defines how employees use while reducing organization’s liability As formal as other policy documents Use company-approved software only Do not share accounts and passwords Do not write down passwords Copyright 2005 16

17. Computer & Internet Use Policy (continued) • • • • PC and Internet access provided for businessuse only Reduce or eliminate unproductive use (personal shopping, entertainment) Prohibit illegal use (downloading copyrighted materials, gambling) Limit legal liability (sexual harassment, illegal activities) Copyright 2005 17

18. Security Policy • • • • Complements the Computer & Internet Use policy Defines from a technology standpoint what is allowed and not allowed on the network Defines the process for making changes, including who authorizes changes Needed when a firewall, anti-spam, or Internet filtering solution is installed Copyright 2005 18

19. User Education • Avoid virus infection and spyware installation – – – – Do not open unexpected e-mail attachments Do not install “free” or “ad-supported” software Do not click on pop-up ads Be careful when responding to requests to install something from a web site. These requests might be worded in a deceptive or misleading manner. Copyright 2005 19

20. User Education (continued) • Avoid using “remember password”, especially on portable devices that may be lost or stolen. To avoid phishing and other scams: • – – – – Be skeptical of requests for personal info Do not respond to suspicious e-mail If concerned, contact the company through a previously established channel Review credit-card and bank statements carefully Copyright 2005 20

21. Security Technologies • • • • • • • • Operating System Security Firewall VPN Virus and Spyware Protection SPAM Filtering Internet-Site Blocking Intrusion Detection & Prevention Layering Copyright 2005 21

22. Security Technologies – Operating System Security • • • • • • • • • • • • All users should have their own username and password Require minimum password length and periodic password changes Use file and directory security to limit user access Enable auditing and/or encryption on sensitive files and directories Operating System Security Firewall VPN Virus and Spyware Protection SPAM Filtering Internet-Site Blocking Intrusion Detection & Prevention Layering Copyright 2005 22

23. Security Technologies – Operating System Security (continued) • • • Administrative access should be limited If at all possible, administrators should use a non-privileged account for day to day work Install vendor-supplied security patches Layering Copyright 2005 23

24. Security Technologies – • • • Firewall Controls network traffic between its interfaces (typically LAN and Internet) Default rules block inbound traffic, allow outbound traffic Stateful packet inspection Copyright 2005 24

27. Security Technologies – • • • • Virus and Spyware Protection Spyware detection is often available as an add-on to an antivirus package Compares files or e-mail messages against known signatures Subscription for updates is a necessity Multiple protection points Copyright 2005 27

28. Security Technologies – SPAM Filtering • • • • • ISP mail filtering Single user Subscription service Onsite mail filtering Some anti-spam options: – – – McAfee Anti-Spam Postini SurfControl Copyright 2005 28

29. Security Technologies – • • • • Internet-Site Blocking Restrict access to non-productive web-sites on the Internet Log only or log and block PC-based, firewall-based, separate device Site categorization subscription Copyright 2005 29

30. Security Technologies – • • • • • Intrusion Detection & Prevention Examines network traffic against a database of known attacks Rules-based escalation process Dynamically configures routers and firewalls to ignore traffic from attacking sites Available on some firewalls Sensors can be placed on the LAN to detect and block virus activity internally Copyright 2005 30

32. Wireless Security • • • • • Non-secured wireless networks allow unauthorized users to connect Enable the best security compatible with all devices Do not broadcast SSID WPA if possible, otherwise WEP Access points and firewalls that support VPN Copyright 2005 32

33. Backup • • Store all data on servers Data-backup plan: – – – – • Who manages the process What gets backed-up and how often Schedule off-site rotation Review backup logs Ask for our free Server-Backup Guide Copyright 2005 33

34. Disaster Recovery • • • • Create & distribute a contingency plan Backup data often and rotate media Test restoration of backup data Build redundancy into all business-critical systems: Phone, computer-network, networksecurity, etc. Copyright 2005 34