Introduction to Systems Security January 11 2016 Abdou

Introduction to Systems Security (January 11, 2016) © Abdou Illia – Spring 2016

Learning Objectives n Discuss state of security threats in the U. S. n Discuss how to manage info security n Plan-Protect-Respond cycle n People-Technology-Policy approach 2

Preventing Security Threats n. What can you do, as a user of a computer connected to the Internet or as a business having a network that is connected to the Internet, to prevent security threats/attacks from occurring? 3

Preventing Security Threats n Use anti-virus software n Use software firewall n Use hardware/appliance firewall n Use Intrusion Defense Systems n Use Intrusion Prevention Systems n Install OS updates n Install applications’ updates n Not open file attachments from unknown sources n Not click URL in emails from unknown sources n Social engineering tests/Mock phishing schemes n Awareness training n Acceptable computer use policy n Password policy n Etc. 4

Countermeasures n Tools used to thwart attacks n Also called safeguards, protections, and controls n Types of countermeasures n Preventative n Detective n Corrective n Question: Match each of the countermeasures from the previous slide with its type. 5

The Plan-Protect-Respond cycle Figure 2 -6 Dominates security management thinking 6 6

How is the book organized? 7

2012/2013 CSI Security Report Survey Summary online n Survey conducted by the Computer Security Institute (http: //www. gocsi. com). n Copy of Survey report on course web site 8

9

Types of attacks: by % of respondents 10

2013 CSI Report (cont. ) 11

CSI Survey (cont. ) 12

13

Satisfaction with Security Technology (cont. ) 14

15

Types of Technology Used (cont. ) 16

2014 Sophos Security Threat Report n Malware* hosted on websites * Malicious software 17

2014 Sophos Security Threat Report n Malware hosting countries 18

2014 Sophos Security Threat Report n Web server’s software affected Web server software Apache IIS Sun. ONE Operating System Computer hardware RAM chip HD Processor Web server computer n As of March 2014 Apache served 58% of all web servers n Apache available for Microsoft Windows, Novell Net. Ware and Unix-like OS 19

Summary Questions 1. What is Plan-Protect-Respond? How important is it for information security? 2. What is PTP? 3. What does malware refer to? 4. Systems running Microsoft operating systems are more likely to be attacked than others. T F 5. With Windows OS, you can use IIS or another web server software like Apache. T F 6. What web server software is most affected by web threats today? 20