Secure Use of IT

Secure Use of IT
1
European Computer Driving Licence
9/26/2017

2
 Please check the spelling of your name (in accordance with
NRIC or Passport)
 Please set mobiles to silent
 No food and drinks (except bottle drinks with CAP)
 Training materials
 Washroom and emergency exits location
 AM Tea break: 10 – 10:15 am (15 minutes)
 Lunch break: 12-1pm (1 hour)
 PM Tea break: 3 – 3.15pm (15 minutes)
 Please scan your thumb drives for viruses
Points to Note
9/26/2017

3
 WSQ is a national credentials system developed and
managed by Singapore Workforce Development Agency (WDA)
 Aim to train, develop, assess and recognise adult workers for
competencies that companies need of their employees
What is ES WSQ
9/26/2017

4
 At end of lesson, you are required to take a summative
assessment using the online tools of International Computer
Driving Test (ICDL)
 To be assessed as competent you must attain:
 Minimum 75% attendance
 Minimum 75% pass for ICDL Test
Assessment
9/26/2017

5
 Secure Use of IT
 Security Concepts
 Malware
 Network Security
 Access Controls
 Secure Web Use
 Communications
 Secure Data Management
Course Outline
9/26/2017

Security Concepts
 1.1 Data Threats
 Common Terms
o What is Data?
o What is Information?
o Cybercrime
o Hacking
 Cloud Computing
o What is Cloud Computing?
o Vulnerabilities
• Session Hijacking
• Service Reliability
• Reliance on the Internet
o Threats
• Data Control
• Denial of Service
• Potential Loss of Privacy
• Malicious Insiders
• Loss of Data
69/26/2017

Security Concepts
 1.2 Value of Information
 Basic Characteristics
o Confidentiality
o Integrity
o Availability
 Protecting Personal Information
o Personal Privacy, Data theft
 Protecting Commercial Information
o Financial Statements, Customers Records
o Trade Secrets, New Products & Patents
 Data Privacy or Protection
o Data Protection Legislation
 Data Subjects and Data Controllers
 ICT Policies
79/26/2017

Security Concepts
 1.3 Personal Security
 Social Engineering
o Information Gathering (Illegally obtain sensitive data)
o Fraud (Faking identity to obtain confidential information)
o Computer System Access (Infiltrate 3rd Party Computer Systems)
 Methods of Social Engineering
o Phone Calls (Impersonating Person)
o Phishing (Fraud Email to Fraud Website)
o Shoulder Surfing (Looking Over Shoulder)
 Identity Thefts and Its Implications
 Methods of Identity Theft
o Information Driving (Look in Trash Bins for
Credit Card Statements)
o Skimming (Device attached to ATM to capture Victim's Cards)
o Pretexting (Inventing Scenario to engage Victim)
89/26/2017

Security Concepts
 1.4 File Security
 Enabling/Disabling Macro Security Settings
 Setting File Passwords
 Encrypt a Folder or Drive
 Advantages of Encryption
o Ensure Confidentiality of Data
o Prevents Unauthorised Person From Opening
and Reading Data
o Ensure Data Integrity and Prevent Unauthorised
Alteration of Data
o Verify Author of Document
99/26/2017

Security Concepts
 1.4 File Security
 Limitation of Encryption
o Cannot recover data if you forget your password
o Easy to crack password for older version of Words Document and Zip
archive
o Attract attention for encrypted files
o Cannot prevent deletion of data
109/26/2017

Security Concepts
 1.5 Review Exercise
1. The process of intentionally accessing a computer without
authorisation or exceeding authorised access is known as:
c. Hacking
2. Which of the following is not a basic characteristic of
information security?
b. Locality
3. Which of the following is an advantage of encryption?
b. Ensures data integrity
4. Which one of the following terms describe the
process of someone monitoring you keying in
your ATM pin with malicious intent?
a. Shoulder surfing
119/26/2017

MALWARE
 2.1 Types of Malware
 Definition of Malware
o Malware is malicious software designed to install and harm your computer
 Types of Infectious Malware
o Viruses
o Worms (WannaCry Ransomware)
o Trojan horses (pretends as harmless program that
collect you login info and password
o Rootkits
o Backdoor
 Types of Data Thefts
o Adware
o Spyware
o Botnet
o Keylogger
o Dialler
129/26/2017

MALWARE
 2.2 Protection
 Understanding Anti-Virus Software
o Identify and eliminate malware by scanning files in your computer
 Limitations
o Anti-virus software features
o Zero-day exploits
o Vulnerabilities
 Using an Anti-Virus Software
o Scanning
o Scanning Specific Drives
o Scheduling Scans
 Quarantine Files
 Updating Anti-Virus Software
139/26/2017

MALWARE
1. __________ is created and distributed for malicious purposes:
a. Malware
2. Which of the following is not a characteristic of spyware?
d. Call numbers without consent
3. A network of infected computers used to distribute malware is
known as:
b. Botnet
4. Which one of the following options is not a common option
when anti-virus software detects an infected file?
c. Open
5. Match the malware type on the left with the
description on the right?
149/26/2017

Network Security
 3.1 Networks And Connections
 Common Network Types
o LAN (Local Area Network)
o WAN (Wide Area Network)
o WLAN (Wireless Local Area Network)
o VPN (Virtual Private Network)
 Security Implications of Connecting to a Network
o Malware
o Unauthorised Data Access, Privacy
 Roles of the Network Administrator
 Functions of Firewall
 Limitation of Firewall
o Viruses
o Attacks
o Monitoring
159/26/2017

Network Security
 3.2 Wireless Security
 Potential Risks of Using Unprotected Wireless Network
o Eavesdroppers
o Network Hijacking
o Man in the Middle
 Types of Wireless Security
o Wired Equivalent Privacy (WEP)
o Wi-Fi Protected Access (WPA)
o Media Access Control (MAC) Address Filtering)
o Service Set Identifier (SSID) Hiding
 Using Personal Hotspots
 Enabling/Disabling a Personal Hotspot (Smartphone)
169/26/2017

Network Security
1. Which of the following is not a type of network?
b. WAP
2. Which of the following is not a feature of a firewall?
a. Encrypts information
3. List 2 security implications of connecting to a network.
Malware
Unauthorised data access
Privacy
4. In wireless security, WPA is:
d. Wi-Fi Protected Access
179/26/2017

Access Controls
 4.1 Methods
 Preventing Unauthorised Data Access
 Passwords
 PIN (Personal Identification Number)
 Encryption
 Multi-factor authentication
 One-Time Password
 Network Accounts
 Biometric Security Techniques
o Fingerprint Scanning
o Hand Geometry
o Facial Recognition
o Voice
189/26/2017

Access Controls
 4.2 Password Management
 Good Password Policies:
o Complex Password at least 8-12 Characters, include Upper & Lowercase,
Numbers and Special Characters
o Avoids Words Found in Dictionary
o Change Passwords Regularly
o Avoid Passwords that include your Name, Birthdate and Spouse Name
o Never Use Password such as “admin”, “root” or “password”
o Avoid Writing Your Password on Sticky Notes
o Do Not Use Same Password for Different Services
o Do Not Share Your Password with Anyone
 Password Management Software:
o Dashlane
o LastPass
o KeePass
199/26/2017

Access Controls
1. Which of the following is not a type of authentication?
d. Something I believe
2. When data has been encrypted, what does the recipient need
to read the data?
b. A key.
3. Which of the following is not a biometric security method?
c. One time password
4. Go to the following web page to test how secure your
password is:
http://howsecureismypassword.net/
209/26/2017

Secure Web Use
 5.1 Browser Settings
 Setting AutoComplete Options
 Clearing Private Data from Browser:
o Temporary Internet Files
o Cookies
o A History of the Websites You’ve Visited
o Information that You have Entered into
Websites or The Address Bar
o Saved Web Passwords
219/26/2017

Secure Web Use
 5.2 Secure Browsing
 Measures to Review a Website’s Safety:
o Content Quality and Currency
o Valid URL
o Company or Owner Information
o Check for Security Certificate and Validate Domain Owner
 Pharming
o Attacker targets DNS Service and changes IP Address of a Website.
o User Types the Website Address in Web Browser.
o User’s Computer Queries DNS Server for IP Address of Website.
o Because DNS Server has been ‘poisoned’ by the Attacker,
it returns the IP Address of the Fake Website to User’s
Computer.
o User has now been tricked into Visiting the Fake Website.
 Content-Control Software
o Client-side filters, Browser-based filters, Content-limited
(or filtered) ISPs
o Search-engines filters
229/26/2017

Secure Web Use
1. How do you identify a secure web site?
https:// and Secured Lock Icon
Check for Valid URL
Check for Company or Owner Information
Check Security Certificate and Validate Domain Owner
2. Open your browser and delete all temporary internet files.
b. In Internet Explorer, Click “Tools” -> “Delete Browsing History”
3. Go to the Web of Trust website at http://www.mywot.com/ and check
the reputation of the following websites:
c. www.amazon.com
d. Goldenpalace.com
e. Whitehouse.com
239/26/2017

Communications
 6.1 E-Mails
 Encrypting and Decrypting E-Mail
 Digital Signature
 Receiving Fraudulent and Unsolicited E-mail
 Phishing Attack:
o Planning
o Setup
o Attack
o Collection
o Identify Theft and Fraud
 E-mail and Malware
249/26/2017

Communications
 6.1 E-Mails
 Encrypting and Decrypting E-Mail
259/26/2017

Communications
 6.1 E-Mails
 Adding Digital Signature in Email
269/26/2017

Communications
 6.1 E-Mails
 Receiving Fraudulent E-mail (Phishing)
279/26/2017

Communications
 6.1 E-Mails
 What is Unsolicited Email (Spam)
289/26/2017

Communications
 6.2 Social Networking
 Potential Dangers:
o Cyber Bullying
o Cyber Grooming
o Misleading or Dangerous Information
o False Identities
o Fraudulent Links or Messages
 Sharing on Social Networks
 Privacy Setting
299/26/2017

Communications
 6.3 VoIP and Instant Messaging
 Security Considerations:
o Malware
o Backdoor Access
o Access to Files
o Eavesdropping
 Strategies to Ensure Confidentiality when
using IM and VoIP:
o Encryption
o Non-disclosure of important details
o Restrict files sharing
309/26/2017

Communications
 6.4 Mobile
 Risks of Using Mobile Apps from Unofficial Source:
o Mobile Malware
o Apps not fully tested and quality not approved.
Slow down you Mobile Device and other apps.
Result in Device Instability.
o Apps may also gain permission to access your
personal data such as Contacts, Images and Location.
 Emergency/Precautionary Measures if
You Mobile Devices is Lost/Stolen:
o Remote Disable
o Remote Wipe
o Locate Device
 Emergency Features (Android)
319/26/2017

Communications
1. An e-mail is sent out to mass recipients asking them to verify
their bank account details. This is an example of:
b. Phishing
2. Which one of the following details is considered unsafe to
share on a social networking site?
d. Home address
3. The process of re-directing users to a different website without
their knowledge is knowing as:
c. Pharming
4. A secure website can be identified by the
web address if it begins with:
b. https
329/26/2017

Communications
5. Consider the following questions:
a. What was your favourite holiday destination?
b. What is the name of your primary school?
c. What is my favourite pet’s name?
What would the potential security threats be by answering the
questions above?
339/26/2017

Secure Data Management
 7.1 Secure and Back Up Data
 Measures to Enhance Physical Security of Devices:
o Do Not Leave Unsecured Computers or Devices Unattended
o Record Details and Location of Items and Equipment
o Use Cable Locks to Secure Computers and Devices
o Works Areas Can Be Secured Using Access Control
Measures such as Swipe Cards or Biometric Scanning
 Backup Procedure:
o Schedule
o Compression
o Location
o Regularity
 Backing Up Data
 Cloud Back Up
349/26/2017

 7.2 Secure Deletion and Destruction
 Common Methods of Permanently Destroying Data:
o Shredding
o Degaussing
o Drive/Media Destruction
 Specific Destruction Techniques:
o Physically Breaking Media Apart, by Grinding, Shredding, etc
o Incineration
o Phase Transition (Liquefaction or Vaporisation of a Solid Disk)
o Application of Corrosive Chemicals, such as Acids, to Recording Surfaces.
 Using Data Destruction Utilities
 FREE Programs That Perform Secure Over-Writes:
o DBAN http://www.dban.org
o Eraser http://eraser.heidi.ie
359/26/2017

 Shredding Hard Drives
369/26/2017

 Shredding Optical Disks
379/26/2017

 Degaussing Hard Drives
389/26/2017

1. Which of the following is not a feature of a backup procedure?
c. Volume
2. Which one of the following is not used as a backup method?
b. Random access memory
3. Residual traces of deleted data that still remains is known as:
b. Data remanence
399/26/2017

Secure Use of IT

More Related Content

Similar to Secure Use of IT (20)

More from Michael Lew (20)

Recently uploaded (20)

Secure Use of IT