CTI12318 - Infosec Notes

Intro to Infosec Notes o User awareness o Policies  Privacy Badger – extension for blocking tracking, etc.  Ghostery  uBlock Origin Phishing Awareness  The most dangerous threat  All email cannot be blocked.  Well crafted phishing attempts are nearly impossible to detect.  Things to look out for: o Sense of urgency o Behavior outside the norm o Issue requiring “secrecy.” o Links or procedures outside SOP 1.8 – In the News – IoT  IoT Botnet causes internet outage. o In October 2016 Dyn was targeted by a botnet that disrupted numerous top Internet destinations.  How does this impact security?  What should be done?  How could you protect your system? 1.9 – Controls and Techniques  You will never know everything that needs to be secured.  The best way to understand controls is to start with a baseline.  Many organizations have reliable resources that can guide you to create security baselines: o OWASP Top 10 – Top 10 most found vulnerabilities in a web-based application. o DISA STIGS – Guides on how to harden operating systems made by the Department of Defense. o SANS Checklists – SANS is a large educational institute. o Common Criteria 1.10 – Data Security Security Concepts  OS Hardening o Why harden? o What is hardening?  Concept of making yourself harder to attack.  For example – removing or uninstalling features that come preinstalled that are not actually needed.  Lockout, Wipe, Tracking, Encryption o The device was stolen, now what? o Remote lockout, remote wipe, if encryption is available then use it.