SlideShare a Scribd company logo

Computer Security

•
•
Frederik Questier
Frederik Questier

F. Questier, Computer security, workshop for Lib@web international training program 'Management of Electronic Information and Digital Libraries', university of Antwerp, October 2015

TechnologyEducation
1 of 90
Download to read offline
Computer security Prof. dr. Frederik Questier - Vrije Universiteit Brussel Workshop for Lib@web 2015 - International Training Program @ University of Antwerp Management of Electronic Information and Digital Libraries
This presentation can be found at http://questier.com http://www.slideshare.net/Frederik_Questier
Main objectives of computer security ➢ Confidentiality ➢ of data (secrecy) ➢ of persons (privacy) ➢ access only by authorized parties ➢ Integrity ➢ data only correctly modified or deleted by authorized parties ➢ Availability ➢ correctly accessible in a timely manner ➢ the failure to meet this goal is called a denial of service
Assignment 1 personal computer security ➢ Throughout this workshop: write down all possible ways how your personal computer system could be compromised. What are the possible attack vectors?
Assignment 2: institutional data security Congratulations! You are elected member of the newly established computer and data security team in your institution. 1) Make a list of all possible risks that can have an impact on the security and stability of your data and internal and external Information & Technology services. 2) Make a list of recommendations to lower the risks.
What can go wrong? Nature ➢ lightning strike ➢ fire ➢ flood ➢ heat wave – cold wave ➢ storm weather, hurricane ➢ earthquake ➢ tsunami ➢ volcano eruption ➢ electro magnetic pulse from the sun ➢ disease of key employees
What can go wrong? Evil actions by people ➢ break in (hackers - crackers) ➢ social engineering ➢ phishing ➢ (identity) theft ➢ vandalism ➢ unhappy employees ➢ sabotage (time bomb) ➢ cyber attack, e.g. (Distributed) Denial of Service ➢ terrorism ➢ war ➢ nuclear bomb
What can go wrong? Malware (malicious software) ➢ virus ➢ worm ➢ trojan horse ➢ rootkit ➢ spyware ➢ ransomware ➢ keylogger ➢ network sniffer ➢ back door ➢ dialer
What can go wrong? Infrastructure or services problems ➢ Failure of ➢ software (bugs) ➢ hardware ➢ electricity ➢ power outage or power surge ➢ network (cable cut – saturation) ➢ airconditioning ➢ water pipes –> leak ➢ system upgrades ➢ service providers (e.g. cloud) ➢ Overload of CPU, memory, storage, network (spam)
What can go wrong? Human errors ➢ Weak security ➢ Loss of laptops, smartphones, USB-sticks, … ➢ No encryption ➢ Passwords leaks or cracks ➢ Computer console left unlocked ➢ Misunderstanding computer interface or other mistakes ➢ Deleting data ➢ Corrupting data ➢ Confiscation of machines
Tools for computer security
Tools for confidentiality Overview ➢ Authorization - Access policies - access control ➢ Authentication – identification ➢ Passwords ➢ … ➢ Encryption ➢ Virtual private networking ➢ Auditing – logging ➢ ...
Tools for integrity Overview ➢ Backups ➢ Checksums ➢ Antivirus ➢ ...
Tools for availability Overview ➢ Disaster recovery planning ➢ Physical protections ➢ Anti-theft ➢ Uninterruptible Power Supply ➢ Redundancies ➢ Intrusion-detection systems ➢ Antivirus software ➢ Firewall ➢ ...
TOOLS FOR CONFIDENTIALITY
Passwords ➢ Don't share them ➢ Not even with computer administrators ➢ Don't write them down ➢ Don't reuse them among different sites ➢ Change them often ➢ Select wise: ➢ Easy to remember ➢ Hard to guess (resistant to dictionary attacks) ➢ Password length ➢ Large set of characters (caps, lower case, numbers, symbols)
Some notorious password leaks ➢ 2014: 5M Gmail passwords ➢ 2013: 38M Adobe passwords (and source code) ➢ 2013: 250K Twitter passwords ➢ 2012: 12M Apple User IDs stolen by FBI, 1M leaked ➢ 2012: 6M LinkedIn passwords ➢ 2012: 450K plaintext Yahoo passwords ➢ 2012: 1.5M plaintext Youporn passwords ➢ 2009: 10K MS Hotmail, MSN and Live passwords
Johannes Weber, http://blog.webernetz.net/2013/07/30/password-strengthentropy-characters-vs-words/
Biometric identification ➢ Finger print ➢ Voice print ➢ Iris scan ➢ Retinal scan ➢ Convenient ➢ Relative safe ➢ But...
Danger of biometric identification?
Danger of biometric identification? ➢ You can't change your biometric password once it got leaked ➢ You can't legally refuse to give it, unlike a password (US fifth amendment)
Lock your screen when you leave
Security issues in communication PrivacyPrivacy IntegrityIntegrity AuthenticationAuthentication Non-repudiationNon-repudiation Interception Spoofing Modification Proof of parties involved
Cryptography = secret writing
Cipher algorithm for performing encryption or decryption ➢ Example: Caesar cipher
Great if we can exchange our messages encrypted! But how can we safely exchange our keys?
Symmetric encryption Sender and receiver must both know the same secret key How to exchange that key over distance??? Asymmetric encryption Sender only needs to know the public key of receiver!
Public key encryption The private key can unlock (decrypt) what is locked (encrypted) with the public key
Public key encryption Creation of keys
Man-in-the-middle attack ➢ How can Bob know that Alice's key is really Alice's key (and not Mallory's)?
Digital certificates Version # Serial # Signature Algorithm Issuer Name Validity Period Subject Name Subject Public Key Issuer Unique ID Subject Unique ID Extensions Digital Signature
HTTPS SSL exchange
➢ CAcert.org is a community-driven certificate authority that issues free public key certificates to the public (unlike other certificate authorities which are commercial and sell certificates). ➢ CAcert has over 200,000 verified users. ➢ These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the Internet.
Web of trust Keysigning parties
Avoid non-encrypted protocols! ➢ Encrypted protocols ➢ HTTPS ➢ SFTP ➢ SSH ➢ TOR ➢ VPN ➢ WEP (Wired Equivalent Protocol. Weak!) ➢ WPA - WPA2 Wi-Fi Protected Access ➢ Non-encrypted protocols ➢ HTTP ➢ FTP ➢ TELNET ➢ BitTorrent
Full disk encryption
Full disk encryption
Android encryption
Virtual drive in file container Encrypted file container.txt Mountable as virtual drive /media/encrypted-disk /Volumes/encrypted-disk E:
Virtual Private Networks extends a private (hospital) network across a public (internet) network encrypted to protect against network sniffing
Internet use through a VPN provider Sarah A. Downey, http://www.abine.com/blog/2012/petraeuss-emails-werent-private-and-neither-are-yours/
Firewall Private versus Demilitarized zone
Private browsing
Task: check http://donttrack.us/
= The Onion Router Free Open Source software for anonymity network
➢ Bitcoin = distributed peer-to-peer crypto-currency ➢ Log of chain of digitally-signed transactions to prevent double spending
Edward Snowden: “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.”
You can't trust software if its source code is hidden ➢ From the European Parliament investigation into the Echelon system (05/18/2001): “If security is to be taken seriously, only those operating systems should be used whose source code has been published and checked, since only then can it be determined with certainty what happens to the data.” ➢ Cryptographer, computer security expert Bruce Schneier: “Secrecy and security aren't the same, even though it may seem that way. Only bad security relies on secrecy; good security works even if all the details of it are public." “If researchers don’t go public, things don’t get fixed. Companies don't see it as a security problem; they see it as a PR problem.” “Demand open source code for anything related to security”
The Borland Interbase example ➢ 1992-1994: Borland inserted intentional back door into Interbase (closed source database server) allowing local or remote users root access to the machine ➢ 07/2000: Borland releases source code (→ Firebird) ➢ 12/2000: Back door is discovered
Be aware of phishing attacks!
TOOLS FOR INTEGRITY
Make backups! Example: centralized over network
Backups ➢ Use off-site data protection = vaulting ● e.g. remote backup (compression, encryption!) ➢ First time and sometimes: full backup ➢ Most often: only incremental backup ➢ Use a good data retention scheme ➢ e.g. 7 daily, 4 weekly, 12 monthly, all yearly backups ➢ Reflect about your time for full restore ➢ Test the restore procedure! ➢ “80% of backups fail to restore”
Error detection - Checksum - cryptographic hash e.g. CRC32 (cyclic redundancy check) MD5 (message digest) SHA-3 (Secure Hash Algorithm)
Scan for malware!
Install software from trusted sources! (avoid if possible P2P or web downloads)
Apply software updates and upgrades!
For import documents save daily new versions as: Thesis20131030.odt Thesis20131031.odt Thesis20131101.odt ...
TOOLS FOR AVAILABILITY
Prepare for disasters! Business continuity planning = how to stay in business in the event of disaster? ➢ Disaster recovery ● Preventive measures ● Detective measures ● Corrective measures
Uninterruptible Power Supply UPS 1)Flywheel 2)Diesel generators 3)Batteries (UPS)
fault tolerance high availability redundancy fail over
RAID: Redundant Array of Independent Disks
DDoS Distributed Denial of Service
Questions? Thanks! Questier.com Frederik AT Questier.com www.linkedin.com/in/fquestie www.diigo.com/user/frederikquestier www.slideshare.net/Frederik_Questier
Credits ➢ Hacker - Hacking – Symbol.jpg, CC BY-SA, www.elbpresse.de ➢ Internet Archive, Copyright Bibliotheca Alexandrina, International School of Information Science (ISIS), http://www.bibalex.org/isis/large/000.jpg ➢ Password Strength, Creative Commons BY-NC http://xkcd.com/936/ ➢ Security, Creative Commons BY-NC http://xkcd.com/538/ ➢ Zimmermann Telegram, 1917, no known copyright restrictions ➢ Assymetric and symmetric encryption by Jeremy Stretch, http://packetlife.net/blog/2010/nov/23/symmetric-asymmetric-encryption-hashing/ ➢ Orange blue public key cryptography, Creative Commons CC0 by Bananenfalter ➢ HTTPS SSL Exchange by Robb Perry, http://coding.smashingmagazine.com/2012/05/17/backpack-algorithms-and-public-key-cryptography-made-easy/ ➢ Bitcoin logo, Public Domain by bitboy ➢ Bitcoin Transaction Visual, Creative Commons CC0 by Graingert ➢ Social Icons by Iconshock http://www.iconshock.com/social-icons/
This presentation was made with 100% Free Software No animals were harmed

Recommended

Basic concepts in computer security
Basic concepts in computer securityBasic concepts in computer security
Basic concepts in computer securityArzath Areeff
 
Computer security
Computer securityComputer security
Computer securityfiza1975
 
Information Security- Threats and Attacks presentation by DHEERAJ KATARIA
Information Security- Threats and Attacks presentation by DHEERAJ KATARIAInformation Security- Threats and Attacks presentation by DHEERAJ KATARIA
Information Security- Threats and Attacks presentation by DHEERAJ KATARIADheeraj Kataria
 
Computer security and
Computer security andComputer security and
Computer security andRana Usman Sattar
 
Network Security Fundamentals
Network Security FundamentalsNetwork Security Fundamentals
Network Security FundamentalsRahmat Suhatman
 
What is Network Security?
What is Network Security?What is Network Security?
What is Network Security?Faith Zeller
 
Information security
Information securityInformation security
Information securityavinashbalakrishnan2
 
Introduction to Network Security
Introduction to Network SecurityIntroduction to Network Security
Introduction to Network SecurityJohn Ely Masculino
 

Recommended

Basic concepts in computer security
Basic concepts in computer securityBasic concepts in computer security
Basic concepts in computer securityArzath Areeff
 
Computer security
Computer securityComputer security
Computer securityfiza1975
 
Information Security- Threats and Attacks presentation by DHEERAJ KATARIA
Information Security- Threats and Attacks presentation by DHEERAJ KATARIAInformation Security- Threats and Attacks presentation by DHEERAJ KATARIA
Information Security- Threats and Attacks presentation by DHEERAJ KATARIADheeraj Kataria
 
Computer security and
Computer security andComputer security and
Computer security andRana Usman Sattar
 
Network Security Fundamentals
Network Security FundamentalsNetwork Security Fundamentals
Network Security FundamentalsRahmat Suhatman
 
What is Network Security?
What is Network Security?What is Network Security?
What is Network Security?Faith Zeller
 
Information security
Information securityInformation security
Information securityavinashbalakrishnan2
 
Introduction to Network Security
Introduction to Network SecurityIntroduction to Network Security
Introduction to Network SecurityJohn Ely Masculino
 
Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Network security (vulnerabilities, threats, and attacks)
Network security (vulnerabilities, threats, and attacks)Network security (vulnerabilities, threats, and attacks)
Network security (vulnerabilities, threats, and attacks)Fabiha Shahzad
 
Network Security Presentation
Network Security PresentationNetwork Security Presentation
Network Security PresentationAllan Pratt MBA
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
Basics of Information System Security
Basics of Information System SecurityBasics of Information System Security
Basics of Information System Securitychauhankapil
 
Malicious
MaliciousMalicious
MaliciousKhyati Rajput
 
Cybersecurity Attack Vectors: How to Protect Your Organization
Cybersecurity Attack Vectors: How to Protect Your OrganizationCybersecurity Attack Vectors: How to Protect Your Organization
Cybersecurity Attack Vectors: How to Protect Your OrganizationTriCorps Technologies
 
Network security
Network securityNetwork security
Network securityEstiak Khan
 
Network security
Network securityNetwork security
Network securityNkosinathi Lungu
 
Computer Security Threats
Computer Security ThreatsComputer Security Threats
Computer Security ThreatsQuick Heal Technologies Ltd.
 
Basic Security Training for End Users
Basic Security Training for End UsersBasic Security Training for End Users
Basic Security Training for End UsersCommunity IT Innovators
 
Network Security
Network SecurityNetwork Security
Network SecurityManoj Singh
 
Computer Security Presentation
Computer Security PresentationComputer Security Presentation
Computer Security PresentationPraphullaShrestha1
 
Malware
MalwareMalware
MalwareAnoushka Srivastava
 
Computer & internet Security
Computer & internet SecurityComputer & internet Security
Computer & internet SecurityGerard Lamusse
 
Network security
Network securityNetwork security
Network securitySimranpreet Singh
 
Virus and Malicious Code Chapter 5
Virus and Malicious Code Chapter 5Virus and Malicious Code Chapter 5
Virus and Malicious Code Chapter 5AfiqEfendy Zaen
 
Computer Security
Computer SecurityComputer Security
Computer Securityvishal purkuti
 
Types of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsTypes of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsLearningwithRayYT
 
Application security
Application securityApplication security
Application securityHagar Alaa el-din
 
Computer Security and Risks
Computer Security and RisksComputer Security and Risks
Computer Security and RisksMiguel Rebollo
 
Security
SecuritySecurity
SecurityAyushiGupta3123
 

More Related Content

What's hot

Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on itWSO2
 
Network security (vulnerabilities, threats, and attacks)
Network security (vulnerabilities, threats, and attacks)Network security (vulnerabilities, threats, and attacks)
Network security (vulnerabilities, threats, and attacks)Fabiha Shahzad
 
Network Security Presentation
Network Security PresentationNetwork Security Presentation
Network Security PresentationAllan Pratt MBA
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Edureka!
 
Basics of Information System Security
Basics of Information System SecurityBasics of Information System Security
Basics of Information System Securitychauhankapil
 
Cybersecurity Attack Vectors: How to Protect Your Organization
Cybersecurity Attack Vectors: How to Protect Your OrganizationCybersecurity Attack Vectors: How to Protect Your Organization
Cybersecurity Attack Vectors: How to Protect Your OrganizationTriCorps Technologies
 
Network security
Network securityNetwork security
Network securityEstiak Khan
 
Network Security
Network SecurityNetwork Security
Network SecurityManoj Singh
 
Computer Security Presentation
Computer Security PresentationComputer Security Presentation
Computer Security PresentationPraphullaShrestha1
 
Computer & internet Security
Computer & internet SecurityComputer & internet Security
Computer & internet SecurityGerard Lamusse
 
Virus and Malicious Code Chapter 5
Virus and Malicious Code Chapter 5Virus and Malicious Code Chapter 5
Virus and Malicious Code Chapter 5AfiqEfendy Zaen
 
Types of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsTypes of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsLearningwithRayYT
 

What's hot (20)

Application Security - Your Success Depends on it
Application Security - Your Success Depends on itApplication Security - Your Success Depends on it
Application Security - Your Success Depends on it
 
Network security (vulnerabilities, threats, and attacks)
Network security (vulnerabilities, threats, and attacks)Network security (vulnerabilities, threats, and attacks)
Network security (vulnerabilities, threats, and attacks)
 
Network Security Presentation
Network Security PresentationNetwork Security Presentation
Network Security Presentation
 
Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...Application Security | Application Security Tutorial | Cyber Security Certifi...
Application Security | Application Security Tutorial | Cyber Security Certifi...
 
Basics of Information System Security
Basics of Information System SecurityBasics of Information System Security
Basics of Information System Security
 
Malicious
MaliciousMalicious
Malicious
 
Cybersecurity Attack Vectors: How to Protect Your Organization
Cybersecurity Attack Vectors: How to Protect Your OrganizationCybersecurity Attack Vectors: How to Protect Your Organization
Cybersecurity Attack Vectors: How to Protect Your Organization
 
Network security
Network securityNetwork security
Network security
 
Network security
Network securityNetwork security
Network security
 
Computer Security Threats
Computer Security ThreatsComputer Security Threats
Computer Security Threats
 
Basic Security Training for End Users
Basic Security Training for End UsersBasic Security Training for End Users
Basic Security Training for End Users
 
Network Security
Network SecurityNetwork Security
Network Security
 
Computer Security Presentation
Computer Security PresentationComputer Security Presentation
Computer Security Presentation
 
Malware
MalwareMalware
Malware
 
Computer & internet Security
Computer & internet SecurityComputer & internet Security
Computer & internet Security
 
Network security
Network securityNetwork security
Network security
 
Virus and Malicious Code Chapter 5
Virus and Malicious Code Chapter 5Virus and Malicious Code Chapter 5
Virus and Malicious Code Chapter 5
 
Computer Security
Computer SecurityComputer Security
Computer Security
 
Types of Threat Actors and Attack Vectors
Types of Threat Actors and Attack VectorsTypes of Threat Actors and Attack Vectors
Types of Threat Actors and Attack Vectors
 
Application security
Application securityApplication security
Application security
 

Viewers also liked

Computer Security and Risks
Computer Security and RisksComputer Security and Risks
Computer Security and RisksMiguel Rebollo
 
Database management system presentation
Database management system presentationDatabase management system presentation
Database management system presentationsameerraaj
 
02 introduction to network security
02 introduction to network security02 introduction to network security
02 introduction to network securityJoe McCarthy
 
Chapter 3: Block Ciphers and the Data Encryption Standard
Chapter 3: Block Ciphers and the Data Encryption StandardChapter 3: Block Ciphers and the Data Encryption Standard
Chapter 3: Block Ciphers and the Data Encryption StandardShafaan Khaliq Bhatti
 
Network Security 1st Lecture
Network Security 1st LectureNetwork Security 1st Lecture
Network Security 1st Lecturebabak danyal
 
Types of attacks and threads
Types of attacks and threadsTypes of attacks and threads
Types of attacks and threadssrivijaymanickam
 
Classical Encryption Techniques in Network Security
Classical Encryption Techniques in Network SecurityClassical Encryption Techniques in Network Security
Classical Encryption Techniques in Network Securitybabak danyal
 
block ciphers
block ciphersblock ciphers
block ciphersAsad Ali
 
Computer security threats & prevention
Computer security threats & preventionComputer security threats & prevention
Computer security threats & preventionPriSim
 
Network Security & Attacks
Network Security & AttacksNetwork Security & Attacks
Network Security & AttacksNetwax Lab
 
Different types of attacks in internet
Different types of attacks in internetDifferent types of attacks in internet
Different types of attacks in internetRohan Bharadwaj
 
Search Engine Powerpoint
Search Engine PowerpointSearch Engine Powerpoint
Search Engine Powerpoint201014161
 
Introduction to Microsoft Office
Introduction to Microsoft OfficeIntroduction to Microsoft Office
Introduction to Microsoft OfficeCik Na Shohaili
 

Viewers also liked (20)

Computer Security and Risks
Computer Security and RisksComputer Security and Risks
Computer Security and Risks
 
Security
SecuritySecurity
Security
 
Search Engines
Search EnginesSearch Engines
Search Engines
 
Introduction to database
Introduction to databaseIntroduction to database
Introduction to database
 
Database management system presentation
Database management system presentationDatabase management system presentation
Database management system presentation
 
02 introduction to network security
02 introduction to network security02 introduction to network security
02 introduction to network security
 
Chapter 3: Block Ciphers and the Data Encryption Standard
Chapter 3: Block Ciphers and the Data Encryption StandardChapter 3: Block Ciphers and the Data Encryption Standard
Chapter 3: Block Ciphers and the Data Encryption Standard
 
Network Security 1st Lecture
Network Security 1st LectureNetwork Security 1st Lecture
Network Security 1st Lecture
 
Types of attacks and threads
Types of attacks and threadsTypes of attacks and threads
Types of attacks and threads
 
Classical Encryption Techniques
Classical Encryption TechniquesClassical Encryption Techniques
Classical Encryption Techniques
 
OSI Security Architecture
OSI Security ArchitectureOSI Security Architecture
OSI Security Architecture
 
Classical Encryption Techniques in Network Security
Classical Encryption Techniques in Network SecurityClassical Encryption Techniques in Network Security
Classical Encryption Techniques in Network Security
 
block ciphers
block ciphersblock ciphers
block ciphers
 
Computer security threats & prevention
Computer security threats & preventionComputer security threats & prevention
Computer security threats & prevention
 
Network Security & Attacks
Network Security & AttacksNetwork Security & Attacks
Network Security & Attacks
 
Different types of attacks in internet
Different types of attacks in internetDifferent types of attacks in internet
Different types of attacks in internet
 
Network Attacks
Network AttacksNetwork Attacks
Network Attacks
 
Data Base Management System
Data Base Management SystemData Base Management System
Data Base Management System
 
Search Engine Powerpoint
Search Engine PowerpointSearch Engine Powerpoint
Search Engine Powerpoint
 
Introduction to Microsoft Office
Introduction to Microsoft OfficeIntroduction to Microsoft Office
Introduction to Microsoft Office
 

Similar to Computer Security

2.5 safety and security of data in ict systems 13 12-11
2.5 safety and security of data in ict systems 13 12-112.5 safety and security of data in ict systems 13 12-11
2.5 safety and security of data in ict systems 13 12-11mrmwood
 
Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...
Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...
Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...Cengage Learning
 
IS L07 - Security, Ethics and Privacy
IS L07 - Security, Ethics and PrivacyIS L07 - Security, Ethics and Privacy
IS L07 - Security, Ethics and PrivacyJan Wong
 
Information Systems.pptx
Information Systems.pptxInformation Systems.pptx
Information Systems.pptxKnownId
 
Topic #17 IT Security ITSecurityIncidentsA.docx
Topic #17 IT Security ITSecurityIncidentsA.docxTopic #17 IT Security ITSecurityIncidentsA.docx
Topic #17 IT Security ITSecurityIncidentsA.docxjuliennehar
 
Free Guide-to-cybersecurity-fundamentals.pdf
Free Guide-to-cybersecurity-fundamentals.pdfFree Guide-to-cybersecurity-fundamentals.pdf
Free Guide-to-cybersecurity-fundamentals.pdfVarinder K
 
Basic_computerHygiene
Basic_computerHygieneBasic_computerHygiene
Basic_computerHygieneEricK Gasana
 
2014CyberSecurityProject
2014CyberSecurityProject2014CyberSecurityProject
2014CyberSecurityProjectKaley Hair
 
How to survive in the work from home era
How to survive in the work from home eraHow to survive in the work from home era
How to survive in the work from home eraMarian Marinov
 
Complete notes security
Complete notes securityComplete notes security
Complete notes securityKitkat Emoo
 

Similar to Computer Security (20)

Computer & Data Security
Computer & Data SecurityComputer & Data Security
Computer & Data Security
 
Computer security
Computer securityComputer security
Computer security
 
2.5 safety and security of data in ict systems 13 12-11
2.5 safety and security of data in ict systems 13 12-112.5 safety and security of data in ict systems 13 12-11
2.5 safety and security of data in ict systems 13 12-11
 
Notacd02
Notacd02Notacd02
Notacd02
 
Notacd02
Notacd02Notacd02
Notacd02
 
Security Measures
Security MeasuresSecurity Measures
Security Measures
 
Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...
Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...
Compusecuraphobia – The Fear of HOPING Your Computer is Secure - Course Techn...
 
IS L07 - Security, Ethics and Privacy
IS L07 - Security, Ethics and PrivacyIS L07 - Security, Ethics and Privacy
IS L07 - Security, Ethics and Privacy
 
Data security
Data securityData security
Data security
 
Information Systems.pptx
Information Systems.pptxInformation Systems.pptx
Information Systems.pptx
 
Computer-Security.pptx
Computer-Security.pptxComputer-Security.pptx
Computer-Security.pptx
 
Internet Security
Internet SecurityInternet Security
Internet Security
 
Topic #17 IT Security ITSecurityIncidentsA.docx
Topic #17 IT Security ITSecurityIncidentsA.docxTopic #17 IT Security ITSecurityIncidentsA.docx
Topic #17 IT Security ITSecurityIncidentsA.docx
 
Free Guide-to-cybersecurity-fundamentals.pdf
Free Guide-to-cybersecurity-fundamentals.pdfFree Guide-to-cybersecurity-fundamentals.pdf
Free Guide-to-cybersecurity-fundamentals.pdf
 
Basic_computerHygiene
Basic_computerHygieneBasic_computerHygiene
Basic_computerHygiene
 
NewIinternet security
NewIinternet securityNewIinternet security
NewIinternet security
 
New internet security
New internet securityNew internet security
New internet security
 
2014CyberSecurityProject
2014CyberSecurityProject2014CyberSecurityProject
2014CyberSecurityProject
 
How to survive in the work from home era
How to survive in the work from home eraHow to survive in the work from home era
How to survive in the work from home era
 
Complete notes security
Complete notes securityComplete notes security
Complete notes security
 

More from Frederik Questier

Free Libre Open Source Software Development
Free Libre Open Source Software DevelopmentFree Libre Open Source Software Development
Free Libre Open Source Software DevelopmentFrederik Questier
 
Plagiarism prevention and detection
Plagiarism prevention and detectionPlagiarism prevention and detection
Plagiarism prevention and detectionFrederik Questier
 
Open e-learning - MarMOOC experiences - Cuba
Open e-learning - MarMOOC experiences - CubaOpen e-learning - MarMOOC experiences - Cuba
Open e-learning - MarMOOC experiences - CubaFrederik Questier
 
Open learning experiences from the MarMOOC project presented at BDU
Open learning experiences from the MarMOOC project presented at BDUOpen learning experiences from the MarMOOC project presented at BDU
Open learning experiences from the MarMOOC project presented at BDUFrederik Questier
 
Open learning Experiences from the MarMOOC project (presented at UHo)
Open learning Experiences from the MarMOOC project (presented at UHo)Open learning Experiences from the MarMOOC project (presented at UHo)
Open learning Experiences from the MarMOOC project (presented at UHo)Frederik Questier
 
Open learning Experiences from the MarMOOC project
Open learning Experiences from the MarMOOC projectOpen learning Experiences from the MarMOOC project
Open learning Experiences from the MarMOOC projectFrederik Questier
 
Authentication options for Open edX: focus on OAuth and OpenID
Authentication options for Open edX: focus on OAuth and OpenIDAuthentication options for Open edX: focus on OAuth and OpenID
Authentication options for Open edX: focus on OAuth and OpenIDFrederik Questier
 
E-learning design models - Primer for (educational) technologists
E-learning design models - Primer for (educational) technologistsE-learning design models - Primer for (educational) technologists
E-learning design models - Primer for (educational) technologistsFrederik Questier
 
New learning paradigms and learning technologies
New learning paradigms and learning technologiesNew learning paradigms and learning technologies
New learning paradigms and learning technologiesFrederik Questier
 
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...Frederik Questier
 
Students' Experiential Knowledge Production in the Teaching-Learning Process ...
Students' Experiential Knowledge Production in the Teaching-Learning Process ...Students' Experiential Knowledge Production in the Teaching-Learning Process ...
Students' Experiential Knowledge Production in the Teaching-Learning Process ...Frederik Questier
 
Institutional strategies for educational innovation and e-learning
Institutional strategies for educational innovation and e-learningInstitutional strategies for educational innovation and e-learning
Institutional strategies for educational innovation and e-learningFrederik Questier
 
New learning paradigms and technologies
New learning paradigms and technologiesNew learning paradigms and technologies
New learning paradigms and technologiesFrederik Questier
 
Free & Open Source Software (2017 update)
Free & Open Source Software (2017 update)Free & Open Source Software (2017 update)
Free & Open Source Software (2017 update)Frederik Questier
 
Challenges for 21st century education and blended learning
Challenges for 21st century education and blended learningChallenges for 21st century education and blended learning
Challenges for 21st century education and blended learningFrederik Questier
 

More from Frederik Questier (20)

Free Libre Open Source Software Development
Free Libre Open Source Software DevelopmentFree Libre Open Source Software Development
Free Libre Open Source Software Development
 
OER & Copyrights
OER & CopyrightsOER & Copyrights
OER & Copyrights
 
Plagiarism prevention and detection
Plagiarism prevention and detectionPlagiarism prevention and detection
Plagiarism prevention and detection
 
FLOSS strategies & policies
FLOSS strategies & policiesFLOSS strategies & policies
FLOSS strategies & policies
 
Open e-learning - MarMOOC experiences - Cuba
Open e-learning - MarMOOC experiences - CubaOpen e-learning - MarMOOC experiences - Cuba
Open e-learning - MarMOOC experiences - Cuba
 
Open learning experiences from the MarMOOC project presented at BDU
Open learning experiences from the MarMOOC project presented at BDUOpen learning experiences from the MarMOOC project presented at BDU
Open learning experiences from the MarMOOC project presented at BDU
 
Open learning Experiences from the MarMOOC project (presented at UHo)
Open learning Experiences from the MarMOOC project (presented at UHo)Open learning Experiences from the MarMOOC project (presented at UHo)
Open learning Experiences from the MarMOOC project (presented at UHo)
 
Open learning Experiences from the MarMOOC project
Open learning Experiences from the MarMOOC projectOpen learning Experiences from the MarMOOC project
Open learning Experiences from the MarMOOC project
 
FLOSS development
FLOSS developmentFLOSS development
FLOSS development
 
Authentication options for Open edX: focus on OAuth and OpenID
Authentication options for Open edX: focus on OAuth and OpenIDAuthentication options for Open edX: focus on OAuth and OpenID
Authentication options for Open edX: focus on OAuth and OpenID
 
E-learning design models - Primer for (educational) technologists
E-learning design models - Primer for (educational) technologistsE-learning design models - Primer for (educational) technologists
E-learning design models - Primer for (educational) technologists
 
MOOCs & Openness
MOOCs & OpennessMOOCs & Openness
MOOCs & Openness
 
New learning paradigms and learning technologies
New learning paradigms and learning technologiesNew learning paradigms and learning technologies
New learning paradigms and learning technologies
 
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
 
Students' Experiential Knowledge Production in the Teaching-Learning Process ...
Students' Experiential Knowledge Production in the Teaching-Learning Process ...Students' Experiential Knowledge Production in the Teaching-Learning Process ...
Students' Experiential Knowledge Production in the Teaching-Learning Process ...
 
Institutional strategies for educational innovation and e-learning
Institutional strategies for educational innovation and e-learningInstitutional strategies for educational innovation and e-learning
Institutional strategies for educational innovation and e-learning
 
New learning paradigms and technologies
New learning paradigms and technologiesNew learning paradigms and technologies
New learning paradigms and technologies
 
Free & Open Source Software (2017 update)
Free & Open Source Software (2017 update)Free & Open Source Software (2017 update)
Free & Open Source Software (2017 update)
 
Challenges for 21st century education and blended learning
Challenges for 21st century education and blended learningChallenges for 21st century education and blended learning
Challenges for 21st century education and blended learning
 
FLOSS & OER
FLOSS & OERFLOSS & OER
FLOSS & OER
 

Recently uploaded

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Victor Rentea
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistandanishmna97
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfOrbitshub
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MIND CTI
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...apidays
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Angeliki Cooney
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAndrey Devyatkin
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024The Digital Insurer
 
Cyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfCyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfOverkill Security
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businesspanagenda
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...apidays
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDropbox
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 

Recently uploaded (20)

Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
Modular Monolith - a Practical Alternative to Microservices @ Devoxx UK 2024
 
CNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In PakistanCNIC Information System with Pakdata Cf In Pakistan
CNIC Information System with Pakdata Cf In Pakistan
 
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdfRising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
Rising Above_ Dubai Floods and the Fortitude of Dubai International Airport.pdf
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
Apidays New York 2024 - Passkeys: Developing APIs to enable passwordless auth...
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
Biography Of Angeliki Cooney | Senior Vice President Life Sciences | Albany, ...
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
Cyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdfCyberprint. Dark Pink Apt Group [EN].pdf
Cyberprint. Dark Pink Apt Group [EN].pdf
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Why Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire businessWhy Teams call analytics are critical to your entire business
Why Teams call analytics are critical to your entire business
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
Apidays New York 2024 - The Good, the Bad and the Governed by David O'Neill, ...
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 

Computer Security

  • 1. Computer security Prof. dr. Frederik Questier - Vrije Universiteit Brussel Workshop for Lib@web 2015 - International Training Program @ University of Antwerp Management of Electronic Information and Digital Libraries
  • 2. This presentation can be found at http://questier.com http://www.slideshare.net/Frederik_Questier
  • 3. Main objectives of computer security ➢ Confidentiality ➢ of data (secrecy) ➢ of persons (privacy) ➢ access only by authorized parties ➢ Integrity ➢ data only correctly modified or deleted by authorized parties ➢ Availability ➢ correctly accessible in a timely manner ➢ the failure to meet this goal is called a denial of service
  • 4. Assignment 1 personal computer security ➢ Throughout this workshop: write down all possible ways how your personal computer system could be compromised. What are the possible attack vectors?
  • 5. Assignment 2: institutional data security Congratulations! You are elected member of the newly established computer and data security team in your institution. 1) Make a list of all possible risks that can have an impact on the security and stability of your data and internal and external Information & Technology services. 2) Make a list of recommendations to lower the risks.
  • 6. What can go wrong? Nature ➢ lightning strike ➢ fire ➢ flood ➢ heat wave – cold wave ➢ storm weather, hurricane ➢ earthquake ➢ tsunami ➢ volcano eruption ➢ electro magnetic pulse from the sun ➢ disease of key employees
  • 7. What can go wrong? Evil actions by people ➢ break in (hackers - crackers) ➢ social engineering ➢ phishing ➢ (identity) theft ➢ vandalism ➢ unhappy employees ➢ sabotage (time bomb) ➢ cyber attack, e.g. (Distributed) Denial of Service ➢ terrorism ➢ war ➢ nuclear bomb
  • 8. What can go wrong? Malware (malicious software) ➢ virus ➢ worm ➢ trojan horse ➢ rootkit ➢ spyware ➢ ransomware ➢ keylogger ➢ network sniffer ➢ back door ➢ dialer
  • 9. What can go wrong? Infrastructure or services problems ➢ Failure of ➢ software (bugs) ➢ hardware ➢ electricity ➢ power outage or power surge ➢ network (cable cut – saturation) ➢ airconditioning ➢ water pipes –> leak ➢ system upgrades ➢ service providers (e.g. cloud) ➢ Overload of CPU, memory, storage, network (spam)
  • 10. What can go wrong? Human errors ➢ Weak security ➢ Loss of laptops, smartphones, USB-sticks, … ➢ No encryption ➢ Passwords leaks or cracks ➢ Computer console left unlocked ➢ Misunderstanding computer interface or other mistakes ➢ Deleting data ➢ Corrupting data ➢ Confiscation of machines
  • 11. Tools for computer security
  • 12. Tools for confidentiality Overview ➢ Authorization - Access policies - access control ➢ Authentication – identification ➢ Passwords ➢ … ➢ Encryption ➢ Virtual private networking ➢ Auditing – logging ➢ ...
  • 13. Tools for integrity Overview ➢ Backups ➢ Checksums ➢ Antivirus ➢ ...
  • 14. Tools for availability Overview ➢ Disaster recovery planning ➢ Physical protections ➢ Anti-theft ➢ Uninterruptible Power Supply ➢ Redundancies ➢ Intrusion-detection systems ➢ Antivirus software ➢ Firewall ➢ ...
  • 16. Passwords ➢ Don't share them ➢ Not even with computer administrators ➢ Don't write them down ➢ Don't reuse them among different sites ➢ Change them often ➢ Select wise: ➢ Easy to remember ➢ Hard to guess (resistant to dictionary attacks) ➢ Password length ➢ Large set of characters (caps, lower case, numbers, symbols)
  • 17. Some notorious password leaks ➢ 2014: 5M Gmail passwords ➢ 2013: 38M Adobe passwords (and source code) ➢ 2013: 250K Twitter passwords ➢ 2012: 12M Apple User IDs stolen by FBI, 1M leaked ➢ 2012: 6M LinkedIn passwords ➢ 2012: 450K plaintext Yahoo passwords ➢ 2012: 1.5M plaintext Youporn passwords ➢ 2009: 10K MS Hotmail, MSN and Live passwords
  • 18.
  • 20.
  • 21. Biometric identification ➢ Finger print ➢ Voice print ➢ Iris scan ➢ Retinal scan ➢ Convenient ➢ Relative safe ➢ But...
  • 23. Danger of biometric identification? ➢ You can't change your biometric password once it got leaked ➢ You can't legally refuse to give it, unlike a password (US fifth amendment)
  • 24. Lock your screen when you leave
  • 25. Security issues in communication PrivacyPrivacy IntegrityIntegrity AuthenticationAuthentication Non-repudiationNon-repudiation Interception Spoofing Modification Proof of parties involved
  • 27.
  • 28. Cipher algorithm for performing encryption or decryption ➢ Example: Caesar cipher
  • 29.
  • 30.
  • 31.
  • 32.
  • 33. Great if we can exchange our messages encrypted! But how can we safely exchange our keys?
  • 34. Symmetric encryption Sender and receiver must both know the same secret key How to exchange that key over distance??? Asymmetric encryption Sender only needs to know the public key of receiver!
  • 35. Public key encryption The private key can unlock (decrypt) what is locked (encrypted) with the public key
  • 37.
  • 38.
  • 39.
  • 40.
  • 41. Man-in-the-middle attack ➢ How can Bob know that Alice's key is really Alice's key (and not Mallory's)?
  • 42. Digital certificates Version # Serial # Signature Algorithm Issuer Name Validity Period Subject Name Subject Public Key Issuer Unique ID Subject Unique ID Extensions Digital Signature
  • 44. ➢ CAcert.org is a community-driven certificate authority that issues free public key certificates to the public (unlike other certificate authorities which are commercial and sell certificates). ➢ CAcert has over 200,000 verified users. ➢ These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the Internet.
  • 46. Avoid non-encrypted protocols! ➢ Encrypted protocols ➢ HTTPS ➢ SFTP ➢ SSH ➢ TOR ➢ VPN ➢ WEP (Wired Equivalent Protocol. Weak!) ➢ WPA - WPA2 Wi-Fi Protected Access ➢ Non-encrypted protocols ➢ HTTP ➢ FTP ➢ TELNET ➢ BitTorrent
  • 47.
  • 51.
  • 52.
  • 53. Virtual drive in file container Encrypted file container.txt Mountable as virtual drive /media/encrypted-disk /Volumes/encrypted-disk E:
  • 54.
  • 55.
  • 56. Virtual Private Networks extends a private (hospital) network across a public (internet) network encrypted to protect against network sniffing
  • 57. Internet use through a VPN provider Sarah A. Downey, http://www.abine.com/blog/2012/petraeuss-emails-werent-private-and-neither-are-yours/
  • 59.
  • 62. = The Onion Router Free Open Source software for anonymity network
  • 63. ➢ Bitcoin = distributed peer-to-peer crypto-currency ➢ Log of chain of digitally-signed transactions to prevent double spending
  • 64. Edward Snowden: “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.”
  • 65.
  • 66. You can't trust software if its source code is hidden ➢ From the European Parliament investigation into the Echelon system (05/18/2001): “If security is to be taken seriously, only those operating systems should be used whose source code has been published and checked, since only then can it be determined with certainty what happens to the data.” ➢ Cryptographer, computer security expert Bruce Schneier: “Secrecy and security aren't the same, even though it may seem that way. Only bad security relies on secrecy; good security works even if all the details of it are public." “If researchers don’t go public, things don’t get fixed. Companies don't see it as a security problem; they see it as a PR problem.” “Demand open source code for anything related to security”
  • 67. The Borland Interbase example ➢ 1992-1994: Borland inserted intentional back door into Interbase (closed source database server) allowing local or remote users root access to the machine ➢ 07/2000: Borland releases source code (→ Firebird) ➢ 12/2000: Back door is discovered
  • 68.
  • 69. Be aware of phishing attacks!
  • 72. Backups ➢ Use off-site data protection = vaulting ● e.g. remote backup (compression, encryption!) ➢ First time and sometimes: full backup ➢ Most often: only incremental backup ➢ Use a good data retention scheme ➢ e.g. 7 daily, 4 weekly, 12 monthly, all yearly backups ➢ Reflect about your time for full restore ➢ Test the restore procedure! ➢ “80% of backups fail to restore”
  • 73. Error detection - Checksum - cryptographic hash e.g. CRC32 (cyclic redundancy check) MD5 (message digest) SHA-3 (Secure Hash Algorithm)
  • 74.
  • 75.
  • 77. Install software from trusted sources! (avoid if possible P2P or web downloads)
  • 78. Apply software updates and upgrades!
  • 79.
  • 80. For import documents save daily new versions as: Thesis20131030.odt Thesis20131031.odt Thesis20131101.odt ...
  • 82. Prepare for disasters! Business continuity planning = how to stay in business in the event of disaster? ➢ Disaster recovery ● Preventive measures ● Detective measures ● Corrective measures
  • 85. RAID: Redundant Array of Independent Disks
  • 87.
  • 88. Questions? Thanks! Questier.com Frederik AT Questier.com www.linkedin.com/in/fquestie www.diigo.com/user/frederikquestier www.slideshare.net/Frederik_Questier
  • 89. Credits ➢ Hacker - Hacking – Symbol.jpg, CC BY-SA, www.elbpresse.de ➢ Internet Archive, Copyright Bibliotheca Alexandrina, International School of Information Science (ISIS), http://www.bibalex.org/isis/large/000.jpg ➢ Password Strength, Creative Commons BY-NC http://xkcd.com/936/ ➢ Security, Creative Commons BY-NC http://xkcd.com/538/ ➢ Zimmermann Telegram, 1917, no known copyright restrictions ➢ Assymetric and symmetric encryption by Jeremy Stretch, http://packetlife.net/blog/2010/nov/23/symmetric-asymmetric-encryption-hashing/ ➢ Orange blue public key cryptography, Creative Commons CC0 by Bananenfalter ➢ HTTPS SSL Exchange by Robb Perry, http://coding.smashingmagazine.com/2012/05/17/backpack-algorithms-and-public-key-cryptography-made-easy/ ➢ Bitcoin logo, Public Domain by bitboy ➢ Bitcoin Transaction Visual, Creative Commons CC0 by Graingert ➢ Social Icons by Iconshock http://www.iconshock.com/social-icons/
  • 90. This presentation was made with 100% Free Software No animals were harmed