I will be giving this presentation on IT Security, for healthcare professionals, at the Health Sciences Learning Center, University of Wisconsin-Madison, School of Medicine and Public Health, tomorrow morning, at 11:00 CST. It will be held in room #1325 and is open to the public. I hope to see you there.

1. The Wild, Wild Web
-
Social Engineering,
Malware and Security
Awareness
-
Nicholas Davis
MBA, CISA, CISSP
DoIT Security
November 13, 2012
Free Powerpoint Templates
Page 1

2. Introduction
• Background
• Thank you for the invitation
• Today’s Topic, Malware, Social
Engineering and overall Security
Awareness
• Importance to the healthcare field
• Pretexting
• Phishing
• QR Code Danger
• Social Networks
• Passwords
• Malware
• Baiting
• Identity Theft: How, Avoiding,
Responding
• Physical Security
• Sharing of information with the public
Free Powerpoint Templates
Page 2

3. Technology Is Not
The Answer
Strong computer security has two
components:
The Technology: passwords,
encryption, endpoint protection
such as anti-virus.
The People: You, your customers,
your business partners
Today, we will talk about both
components
Free Powerpoint Templates
Page 3

4. Social Engineering
The art of manipulating
people into performing actions
or divulging confidential
information
It is typically trickery or
deception for the purpose of
information gathering, fraud,
or computer system access
Free Powerpoint Templates
Page 4

5. Most Popular Type of
Social Engineering
Pretexting: An individual lies to obtain
privileged data. A pretext is a false motive.
Pretexting is a fancy term for impersonation
A big problem for computer Help Desks, in all
organizations
Example:
Some steps the UW-Madison Help Desk takes
to avoid pretexting
Free Powerpoint Templates
Page 5

6. Let’s Think of HSLC
Pretexting Example
Dear Windows User,
It has come to our attention that your Microsoft windows
Installation records are out of date. Every Windows
installation has to be tied to an email account for daily
update.
This requires you to verify the Email Account. Failure to
verify your records will result in account suspension.
Click on the Verify button below and enter your login
information on the following page to Confirm your records.
Thank you,
Microsoft Windows Team.
Free Powerpoint Templates
Page 6

7. Phishing
• Deception, but not just in
person
• Email
• Websites
• Facebook status updates
• Tweets
• Phishing, in the context of
the healthcare working
environment is extremely
dangerous
Free Powerpoint Templates
Page 7

8. Phishing History
• Phreaking, term for making
phone calls for free back in
1970s
• Fishing is the use bait to
lure a target
• Phreaking + Fishing =
Phishing
Free Powerpoint Templates
Page 8

9. Phishing 1995
• Target AOL users
• Account passwords = free
online time
• Threat level: low
• Techniques: Similar names,
such as www.ao1.com for
www.aol.com
Free Powerpoint Templates
Page 9

10. Phishling 2001
Target: Ebay and major banks
Credit card numbers and
account numbers = money
Threat level: medium
Techniques: Same in 1995, as
well as keylogger
Free Powerpoint Templates
Page 10

11. Keyloggers
• Tracking (or logging) the keys
struck on a keyboard, typically in
a covert manner so that the
person using the keyboard is
unaware that their actions are
being monitored
• Software or hardware based
Free Powerpoint Templates
Page 11

12. Phishing 2007
Targets are Paypal, banks,
ebay
Purpose to steal bank
accounts
Threat level is high
Techniques: browser
vulnerabilities, link
obfuscation
Free Powerpoint Templates
Page 12

13. Don’t Touch That QR Code
• Just as bad as clicking on an
unknown link
• Looks fancy and official, but
is easy to create
Free Powerpoint Templates
Page 13

14. Phishing in 2013
• Trends for the coming year
• Identity Information
• Personal Harm
• Blackmail
Free Powerpoint Templates
Page 14

15. Looking In the Mirror
• Which types of sensitive
information do you have access
to?
• What about others who share the
computer network with you?
• Think about the implications
associated that data being stolen
and exploited!
Free Powerpoint Templates
Page 15

16. What Phishing Looks Like
• As scam artists become more
sophisticated, so do their phishing
e-mail messages and pop-up
windows.
• They often include official-looking
logos from real organizations and
other identifying information
taken directly from legitimate
Web sites.
Free Powerpoint Templates
Page 16

17. Techniques For Phishing
• Employ visual elements from target site
• DNS Tricks:
• www.ebay.com.kr
• www.ebay.com@192.168.0.5
• www.gooogle.com
• Unicode attacks
• JavaScript Attacks
• Spoofed SSL lock Certificates
• Phishers can acquire certificates for
domains they own
• Certificate authorities make mistakes
Free Powerpoint Templates
Page 17

18. Social Engineering
Techniques
Often employed in Phishing, lower
your guard
1.Threats – Do this or else!
2.Authority – I have the authority
to ask this
3.Promises – If you do this, you
will get money
4.Praise – You deserve this
Free Powerpoint Templates
Page 18

19. Phishing
Techniques
• Socially aware attacks
• Mine social relationships from public
data
• Phishing email appears to arrive from
someone known to the victim
• Use spoofed identity of trusted
organization to gain trust
• Urge victims to update or validate their
account
• Threaten to terminate the account if the
victims not reply
• Use gift or bonus as a bait
• Security promises
Free Powerpoint Templates
Page 19

20. Let’s Talk About
Facebook
• So important, it gets its own slide!
• Essentially unauthenticated – discussion
• Three friends and you’re out! - discussion
• Privacy settings mean nothing – discussion
• Treasure Trove of identity information
• Games as information harvesters
Free Powerpoint Templates
Page 20

21. Socially Aware
Free Powerpoint Templates
Page 21

22. Context Aware
“Your bid on eBay has won!”
“The books on your Amazon wish
list are on sale!”
Free Powerpoint Templates
Page 22

23. Seems Suspicious
Free Powerpoint Templates
Page 23

24. 419 Nigerian Email Scam
Free Powerpoint Templates
Page 24

25. Too Good to be True,
Even When It Is Signed
Free Powerpoint Templates
Page 25

26. Detecting
Fraudulent Email
Information requested is inappropriate for
the channel of communication:
"Verify your account."nobody should ask
you to send passwords, login names,
Social Security numbers, or other personal
information through e-mail.
Urgency and potential penalty or loss are
implied:
"If you don't respond within 48 hours,
your account will be closed.”
Free Powerpoint Templates
Page 26

27. Detecting Fraudulent
Email
"Dear Valued Customer."Phishing e-mail
messages are usually sent out in bulk and
often do not contain your first or last
name.
Free Powerpoint Templates
Page 27

28. Dectecting Fraudulent
Email
"Click the link below to gain access to
your account.“
This is an example or URL Masking (hiding
the web address)
URL alteration
www.micosoft.com
www.mircosoft.com
www.verify-microsoft.com
Free Powerpoint Templates
Page 28

29. How to Defend Against
Phishing Attacks
•Never respond to an email asking
for personal information
• Always check the site to see if it is
secure (SSL lock)
• Look for misspellings or errors in
grammar
• Never click on the link on the
email. Enter the web address
manually
• Keep your browser updated
• Keep antivirus definitions updated
• Use a firewall
• When in doubt, ask your Network
Administrator for their opinion
Free Powerpoint Templates
Page 29

30. A Note on Spear Phishing
• Designed especially for you
• Includes your name
• May reference an
environment or issue you
are aware of and familiar
with
• Asks for special treatment,
with justification for the
request
Free Powerpoint Templates
Page 30

31. Other Techniques
An ocean of Phishing techniques
•Clone Phishing - Discussion
•Whaling - Discussion
•Filter Evasion - Discussion
•Phone Phishing - Discussion
•Tabnabbing - Discussion
•Evil Twins - Discussion
Free Powerpoint Templates
Page 31

32. Passwords
Your password is your electronic
key to valuable resources, treat it
like your house key!
Sharing – Discussion
Theft – Discussion
Password Rotation - Discussion
Free Powerpoint Templates
Page 32

33. Creating a Strong
Password
Following two rules are bare minimal that
you should follow while creating a
password.
Rule 1 – Password Length: Stick with
passwords that are at least 8 characters in
length. The more character in the
passwords is better, as the time taken to
crack the password by an attacker will be
longer. 10 characters or longer are better.
Rule 2 – Password Complexity: At least 4
characters in your passwords should be
each one of the following:
Free Powerpoint Templates
Page 33

34. Creating a Strong
Password
1.Lower case alphabets
2.Upper case alphabets
3.Numbers
4.Special Characters
Use the “8 4 Rule”
8 = 8 characters minimum length
4 = 1 lower case + 1 upper case + 1
number + 1 special character.
Do not use a password
strength checking website!
Any ideas why this
is a bad idea?
Free Powerpoint Templates
Page 34

35. Adware, Malware,
Spyware
Adware – unwanted ad software which is
noticed
Malware – unwanted software which is
noticed and potentially causes harm
Spyware – unwanted software which goes
un-noticed and harvests your personal
information
Use endpoint protection!
Free Powerpoint Templates
Page 35

36. CIO.WISC.EDU/SECURITY
Free Powerpoint Templates
Page 36

37. Adware, Malware,
Spyware
How these get on your computer:
Email
Web pages
Downloaded software
CD, USB flash drive
Sometimes, out of the box
Free Powerpoint Templates
Page 37

38. Trojan Malware
Free Powerpoint Templates
Page 38

39. Baiting
Hey, look! A free USB drive!
I wonder what is on this confidential CD
which I found in the bathroom?
These are vectors for malware!
Play on your curiousity or desire to get
something for nothing
Don’t be a piggy!
Free Powerpoint Templates
Page 39

40. Social Engineering
Methods
Using the Out of Office
responder in a responsible
manner
Free Powerpoint Templates
Page 40

41. Medical Identity Theft
Use another person’s name
Sometimes other identifying information
such as a medical bracelet or insurance
information
Obtain medical services
Make false claims
Causes erronious information to be put
into medical records
May lead to inappropriate and life
threatening situaitons
Free Powerpoint Templates
Page 41

42. Synthetic Identity Theft
A variation of identity theft which has
recently become more common is
synthetic identity theft, in which identities
are completely or partially fabricated. The
most common technique involves
combining a real social security number
with a name and birthdate other than the
ones associated with the number.
Free Powerpoint Templates
Page 42

43. How Does Identity
Theft Happen
Let’s talk through the attached paper
handout, entitled:
“Techniques for obtaining and exploiting
personal information for identity theft”
Look through the list and think to yourself
“Could this apply to me?” If so, think
about taking steps to avoid it
Free Powerpoint Templates
Page 43

44. Tips To Avoid
Identity Theft
1. Only Make Purchases On Trusted Sites
2. Order Your Credit Report
3. Know How To Spot Phishing
4. Secure Your Network
5. Can the Spam
6. Don't Store Sensitive Information On Non-
Secure Web Sites
7. Set Banking Alerts
8. Don't Reuse Passwords
9. Use Optional Security Questions
10. Don't Put Private Information On Public
Computers
Free Powerpoint Templates
Page 44

45. If Your Identity Is Stolen
(WORK)
1. Contact your supervisor immediately
2. Report the incident to the Office of
Campus Information Security (OCIS)
http://
www.cio.wisc.edu/security-report.aspx
3. Contact the DoIT Help Desk
4. Contact UW Police, depending on
nature of incident. Consider your
personal safety! “Better safe, than
sorry”
Free Powerpoint Templates
Page 45

46. Physical Security
• The UW is a fairly open and shared
physical environment
• Seeing strangers is normal, we won’t
know if they are here as friend or foe
• Lock your office
• Lock your desk
• Lock your computer
• Criminals are opportunistic
• Even if you are just gone for a moment
• Report suspicious activity to your
administration and UW Police
• If you have an IT related concern,
contact the Office of Campus
Information Security
Free Powerpoint Templates
Page 46

47. Sharing Information With
The Public
• The University of Wisconsin is an open
environment
• However, on occasion, this open nature
can be exploited by people with
nefarious intent
• Don’t volunteer sensitive information
• Only disclose what is necessary
• Follow records retention policies
• When in doubt, ask for proof, honest
people will understand, dishonest
people will become frustrated
Free Powerpoint Templates
Page 47

48. We Have So Much More
To Talk About
• Security Awareness matters not just to
you, but to the University of Wisconsin
as a whole
• Security Awareness is an important
facet of everyone’s work
• My actions impact you
• Your actions impact me
• Security Awareness is an ever changing
and evolving area, which requires
constant attention
• DoIT is here as a resource for you
• Let us know how we can help
• Let me know if I can help
• Don’t be afraid to ask questions
• Better safe than sorry
Free Powerpoint Templates
Page 48

49. A Picture Is Worth
1000 Words
Free Powerpoint Templates
Page 49

50. Questions and
Discussion
Nicholas Davis
ndavis1@wisc.edu
608-262-3837
facebook.com/nicholas.a.davis
Free Powerpoint Templates
Page 50