Security Basics
- 1. SECURITY IT Essentials 5.0
- 2. Objectives • Understand why security is important • Describe security threats • Identify security procedures • Identify common preventive maintenance techniques for security
- 3. The Importance of Security • Private information, company secrets, financial data, computer equipment, and items of national security are placed at risk if proper security procedures are not followed. • A technician’s primary responsibilities include data and network security
- 4. Security Threats Internal threats • Employees can cause a malicious threat or an accidental threat. External Threats • Outside users can attack in an unstructured or structured way.
- 5. Types of attacks to computer security Physical • Theft, damage, or destruction to computer equipment. Data • Removal, corruption, denial of access, unauthorized access, or theft of information.
- 6. Adware, Spyware and Phishing • Adware - software program that displays advertising on your computer, often displayed in a pop-up window. • Spyware - distributed without user intervention or knowledge, monitors activity on the computer. • Phishing - attacker pretends to represent a legitimate organization and asks for verification of victims information such as password or username
- 7. Viruses, Worms • A virus is a software code that is deliberately created by an attacker. Viruses may collect sensitive information or may alter or destroy information. • A worm is a self-replicating program that uses the network to duplicate its code to the hosts on the network. At a minimum, worms consume bandwidth in a network.
- 8. Trojans & Rootkits • A Trojan is malicious software that is disguised as a legitimate program. It is named for its method of getting past computer defenses by pretending to be something useful. • A Rootkit is a malicious program that gains full access to a computer system. Often, a direct attack on a system using a known vulnerability or password.
- 9. Spam & Pop-ups • Spam is unsolicited email that can be used to send harmful links or deceptive content. • Popups are windows that automatically open and are designed to capture your attention and lead you to advertising sites.
- 10. Social Engineering A social engineer is a person who is able to gain access to equipment or a network by tricking people into providing the necessary access information. To protect against social engineering: • Never give out a password. • Never post your password. • Lock your computer when you leave your desk. • Do not let anyone follow you through a door that requires an access card
- 11. Security Policy A security policy should describe how a company addresses security issues. Questions to answer in writing local security policy: • What assets require protection? • What are the possible threats? • What should be done in the event of a security breach? • What training will be in place to educate the end users?
- 12. Usernames and Passwords • Change the default username for accounts such as administrator or guest. • Network admin defines a naming convention for usernames. • Three levels of password protection are recommended: • BIOS • Login • Network
- 13. Guidelines for creating strong passwords • Length - Use at least eight characters. • Complexity - Include letters, numbers, symbols, and punctuation, not just common letters and characters. • Variation - Change passwords often. Set a reminder to change the passwords every three to four months. • Variety - Use a different password for each site or computer that you use.