Cyber Awareness Training Employee Training for Cyber Awareness
Cyber Awareness Training Employee Training for Cyber Awareness Feb 9, 2018 Norfolk County Registry of Deeds IT Department Dan Caparrotta
Quotes from IT news articles 2 Cyber attacks are now ‘business as usual’ for hackers around the world. “The Internet is a bad neighborhood. ” “The Internet is riddled with traps. ”
Cyber Awareness is crucial 3 Cyber awareness learning and training is central to minimizing the risks to information security. The methods used by cyber criminals to breach organizational systems and networks prey on human vulnerability. Our network infrastructure is strong, but the ‘human factor’ of the network also has to be strong. The users have to act as human firewalls (the bouncers at the door)
Comic analogy 4
Agenda 5 Types of risks in glossary form Malware sites and malware programs Malware examples Bad email examples Characteristics of scam emails – things to look for in content and attachments What to do General principles
Terms 6 Phishing/Spear phishing Social Engineering Ransomware Adware Malvertising Scareware Malware Drive-by Download Spoofed web page Trojan horse Search Engine Poisoning
Definition of Terms 7 Phishing - email masquerading as a legitimate organization usually combined with request for information such as passwords or credit card information. Social Engineering - the art of manipulating people into performing actions or divulging confidential information. A gain confidence trick for the purpose of information gathering and fraud. Search Engine Poisoning - deliberate manipulation of search engine indexes. A trap web page will pretend to have information about any popularly searched subject. Ransomware - software that holds the data of a computer user for ransom. Usually asks for currency in the form of Bitcoin to release data.
Definition of Terms (continued) 8 Scareware - displaying false warnings of virus infection to cause shock and anxiety. Some of the time these are just pop-up windows with no actual payload or virus. Drive-by Download – A web application that has been injected with HTML to initiate a background download. Spoofed web page – a web page created as a hoax with the intention of misleading readers that the website has been created by a different person or organization. Trojan horse - A program that is disguised as something benign, such as a screensaver or a video game but contains a virus within.
Definition of Terms (continued) 9 Adware – Software that installs on your computer in order to steer your browser towards affiliate advertisers and marketers without your permission. Malvertising – Malicious online advertising, typically performed by masking malicious computer code with seemingly harmless online advertisements. Malware - Malware is a general term used to refer to any of these variety forms of hostile or malicious software.
What do they want? 10 They want your password. They want your access to your accounts. They want access to your computer. They want to gather personal information. They want to use your computer as a money maker for themselves by: - turning your PC into a bot member of their own network. - sending out malicious content from your computer to other computers. - locking you out of your own files and asking you for ransom money to regain entry - use your computer’s CPU as a bitcoin miner
Example Scareware screen 11 This screen may not be anything except a web page. But can scare you into proceeding with a next step where after you might click a malicious link or call a phone number.
Example Ransomware screen 12
Example Ransomware infection
How do these screens appear? The advertisements shown on your favorite web pages are being bought or hacked into. Link to a bad website. Website code can attempt to launch many exploits A malicious email attachment was opened Search engines tricked to present bogus result near the top of your search results (Search Engine Poisoning). Drive-by Download (exploit where don’t even have to click a link) Shady websites that give download access to illegal movies, illegal music & pirated software. 14
What to do if a hack screen appears? 15 Dan and Jim say, PULL THE PLUG. Unplug the Network cord and Power Cord (If the computer is not running, neither is the virus) Power cord at outlet or Power cord from behind PC and Network wire behind PC
Example Phishing email 1 16
Example Phishing email 2 17
Spoofed web page 18 A phishing email linked externally to an exact replica of Kansas State University’s sign-on web page. The page will steal your ID and password if you enter it and “Sign in”. Note the URL highlighted in red – “flushandfloose. nl” which is not the real domain of k-state. edu
19 Fake web page hosted in the Netherlands (. nl) Real web page – Shows actual real domain name
How to identify a phishing scam 20 Characteristics of scam email It asks for private information like a password or account number Will convey the emotion of urgency, fear tactic, greed or curiosity. Uses unfamiliar or inappropriate terms like “send your account information to the MAIL CONTROL UNIT” “Webmail Administrator” The message contains a link where the displayed address differs from the actual web address. (see Spoofed Web page) Scam emails are usually generic or impersonal, such as Dear user, Dear account holder. (This is changing now with hacked data collection, they can custom tailor the messages).
How to identify a bad email 21 Scam emails are usually generic or impersonal, such as Dear user, Dear account holder Bad email will have vague or brief content They take advantage of current news events Often pose as popular entity that people have account with – Amazon, Bank of America, Facebook. Legitimate emails will prove they are real by listing your less known identifiers such as last 4 numbers of account. Mouse-over the links to show the destination If unsure of legitimacy, call the company to see if they sent it Go directly to the site manually in your browser instead of getting there through email link.
Mouse-Over to check 22 Not fidelity. com
Phishing example 23 Using official logo of HSBC -Message is brief and vague. -Greeting is impersonal. -mousing over the blue text would wrong show destination not HSBC
Phishing example 2 24 The sender; Donald is a known acquaintance but his email account has been compromised. Now his account is sending phishing messages to his personal contacts. -Message is brief and vague. -Greeting is impersonal. -The mouse-over technique would show the link does not go to Dropbox. com
Legitimate email example 25 Providing proof they know you personally/profe ssionally by showing your full name, last 4 digits of real account number and Member Since: info Microsoft has verified sender legitimacy by showing green Trusted Shield (available in hotmail)
Legitimate attachment example 26 Legitimate attachment how? personally identified me professionally. I was expecting this.
Evaluating attachments 27 Do not open email attachments you were not expecting If the content of the email message is brief, vague, and/or unusual From someone you do not know From someone you know, but weren’t expecting them to send you a file (already compromised accounts can send malicious emails from the owner of the computer to contacts in their email address book)
Malicious Attachment example 28 Avoid this attachment
Malicious Attachment attempt (Microsoft Word file) new example March 2016 When you do open an attachment, keep file in view only mode (default setting) and DO NOT enable macros.
Example of malicious email subjects and attachments 30 Some subjects of emails with bad intent: Shipping update for your Amazon. com order 254 -78546325 Your Broken message was found and restored Update your account Your friend has sent you an invite! _____________________ 4 different malicious attachments: Shipping documents. zip Your order. ps Your invoice. doc Invitation card. zip
Evaluating attachments 31 Ignore or delete it if it’s not expected nor important; not worth the risk of opening it and infecting your computer Beware of embedded in. zip attachments – it is a common way for hackers to send. exe files that would normally be deleted by email systems If there’s any reason to doubt it might be legitimate, validate the attachment before opening it Contact the sender and ask if it is legit and that they sent it. Ask the IT Department to analyze it.
General Principles 32 Neither IT staff nor any legitimate business will EVER ask for your password in an email. Any IT related notifications will come from Dan Caparrotta or Jim Limbey. No other vendor should send alerts. Think before you click – do not be a victim due to a hasty action. Be skeptical / be paranoid Ask I. T. - Don’t be timid about asking the IT Dept to help verify an email is legitimate or not. Do not use the same password for all accounts. Diversify your passwords so that “ 1 key does not open all doors”.
Useful sources of information 33 The Department of Homeland Security’s own safe internet advice page: https: //www. onguardonline. gov Anti-Phishing Working Group http: //apwg. org Teach yourself with Sonicwall’s “Phishing and Spam IQ Quiz” – www. sonicwall. com/phishing Symantec Internet Security Threat Report - A compiled report of the most current examples of the latest malware, phishing and social engineering on the internet http: //www. symantec. com/en/au/productssolutions/training/theme. jsp? themeid=ssap
- Slides: 33
