>> Hi everybody. I always like
beginning security discussions with the risk.
Because information security is risk-management.
Start by looking at your assets
>> and what they are worth.
>> Look at the threats and
vulnerabilities and figure out what the
potential for loss is based on probability and impact.
Then make a good decision
based on the potential value for
loss and what a good countermeasure would be,
and of course, continue to monitor for risk after that.
If we look at this a little bit more specifically,
in the realm of information security,
we have to start with the very beginning.
Here we look at the CIA triad,
confidentiality, integrity, and availability.
Those are the three tenants of security.
When we talk about securing an organization,
those are the three services we're focused on.
Now the problem is that security
>> always costs something.
>> There's always a trade-offs or security.
Usually that trade-off is performance.
Security usually slows things down.
Sometimes it costs money.
Sometimes you have to upgrade
components or pay for security devices.
But performance is the key trade-off.
What have to find out is what is the right amount of
security based on the needs for performance.
We also take into consideration
>> cost and user acceptance.
>> But we're mainly looking for that balance
between security and performance.
Let's look at confidentiality
and some of the threats against it.
The greatest threat is social engineering.
Social engineering is all about impersonation.
Impersonating someone to get
>> access to certain knowledge,
>> system ability in a room and so-forth.
Phishing is a very specific type of
social engineering that is
>> commonly done through e-mail.
>> The PH in phishing is a throwback to
the fact that it used to be
very common on the phone system.
We used to get these calls soliciting
donations or other fraudulent activities.
Now e-mail is the main market for this.
Phishing is based on the idea that it's indiscriminate.
An attacker sends a massive e-mail going back.
An attacker sends a massive alien and
casts a large enough net that he catches something.
A spammer purchases a mailing list
and sends the message out to everyone.
One type of phishing is called spear phishing.
This means it's targeted.
The attacker's targeting a demographic group or
a specific organization and
hopes that he is more likely to be successful.
A specific type of spear phishing is called whaling.
This is when the spear phishing is focused
on in snoring senior leaders.
Now, senior leaders sometimes
>> insist on having access to
>> everything but sometimes they don't have
time to get the security training
that everyone else gets,
and you'd think they would be the most
focused on avoiding risk.
But that's not always the case.
This might be why whaling to tax are successful.
Now going back to the idea of phishing,
we also have vishing.
The idea here is that the attacker
exploits voice over IP systems.
With caller ID, you would think that
you could detect this type of attack.
But phone numbers are as
>> easy to spoof as anything else.
>> That is not always a perfect way to
detect these types of attacks.
Another threat to confidentiality is media reuse.
This is where we stored information on removable drive,
like a thumb drive or a removable hard drive.
Or maybe people are sharing
a laptop or some other device.
If that hardware or a media is not properly sanitized,
we might be inadvertently passing
information from one individual to another.
Sanitizing media is really critical.
One of the ways we could do this is zeroisation,
where we override the drive with zeros.
It's fine and loose security environments.
But one thing about zeroisation is that it's
not good enough for really sensitive information.
For that, the best thing is physical destruction.
That's the only way to make
sure that the data remnants are gone.
Because if an attacker has the right equipment,
he can still retrieve data
from a disk that's been zeroised.
Another point to make is that if you're
storing sensitive information in the Cloud,
you can't do any physical sanitization.
For that there is something called crypto shutting.
This involves encrypting the entire disk with
a really strong publicly known algorithm.
One of the things you'll find
that people in security propor
is open as opposed to close architecture.
Ideally, the algorithm is one that's
tried and true and has been around for a long time.
When we use this algorithm we destroy the key.
We would never keep the key on
the same volume that we keep the encrypted information.
That's how we destroy remnants in a Cloud environment.
Eavesdropping is the next right to confidentiality.
Here we don't mean people
listening on phone conversations.
We mean technical eavesdropping.
This means sniffers like Wireshark.
Another name for sniffer is a protocol analyzer.
May hear it called a network or a packet analyzer.
But the idea is that an attacker
has a device on the network that
captures traffic in a software that
allows the attacker to view the traffic.
The easy way to defend against
eavesdropping is encrypting your data.
Also, you can keep a really sensitive stuff
from traversing the network at all.
We want to make sure that we're aware of these threats,
and we also want to have a good idea of
how to mitigate against them.
With social engineering,
your best method is through training.
Another way is to use separation of duties because
a person can't give an attacker
information if they don't have it.
For media reuse, we make sure we sanitize
the media and for eavesdropping, we encrypt our data.