WEBVTT 00:00.780 --> 00:06.480 This course takes you on a journey that starts with the basics and theory of security and then builds 00:06.480 --> 00:13.700 upon it with practical exercises and on to more advanced topics in the later sections and other volumes. 00:13.770 --> 00:19.350 You have to know the basics so that you can make your own informed choices about security. 00:19.530 --> 00:21.660 I don't want to give you just a to do list. 00:21.690 --> 00:25.130 I want you to understand both the why and the how. 00:25.140 --> 00:31.590 So we start with the theory and basics of security and then build on that later with practical exercises 00:31.920 --> 00:34.090 and onto more advanced topics. 00:34.110 --> 00:40.140 But before we start in the theory basics I want to give you a super easy quick security win that you 00:40.140 --> 00:43.770 can set up right now a small practical exercise. 00:43.770 --> 00:45.410 Before we dig into the theory. 00:45.510 --> 00:51.060 So you have an immediate security capability to detect malware and hackers that you can set up in about 00:51.060 --> 00:54.050 10 minutes and you don't even have to install anything. 00:54.210 --> 00:59.370 This way if you forget to do the rest of the course at least you have got some security capability out 00:59.370 --> 00:59.820 of it. 01:00.000 --> 01:01.140 So here goes. 01:01.140 --> 01:09.030 Wouldn't it be cool if we could set up security trip wires to tell is if someone or something was poking 01:09.030 --> 01:16.270 around in our files on a laptop on a phone tablet you know e-mail and or online accounts basically everywhere. 01:16.290 --> 01:21.270 Will it be good if we could have some trip wires alerted is when somebody was doing things that we don't 01:21.270 --> 01:22.180 want them to do. 01:22.320 --> 01:24.070 Well we can set those things up. 01:24.070 --> 01:30.010 So let me show you how to set the security tripwires using a service call canary tokens. 01:30.010 --> 01:35.760 They are made available just for you guys on this course so you can have some quick and easy security 01:35.760 --> 01:37.210 wins. 01:37.260 --> 01:44.070 So if you get your way to w w w Don't Station X don't net slash canary tokens slash you can follow along 01:44.070 --> 01:47.690 with what I'm doing and create your own tokens at the same time. 01:47.700 --> 01:53.550 So here we have our little canary friendly token we see a rather obvious red boat in here and this is 01:53.550 --> 01:58.960 what we need to click on to take us to the domain that will provide us with the tokens. 01:58.980 --> 02:01.740 So here we are this is a domain here that will rotate. 02:01.740 --> 02:04.840 So don't worry about what that is at the moment. 02:04.920 --> 02:08.100 So here we are this is the main thing that you need to interact with. 02:08.190 --> 02:13.890 And I'm going to show you five different ways of setting up traps these traps that are also called tokens 02:13.890 --> 02:15.660 or canary tokens. 02:15.660 --> 02:17.280 We're going to keep it simple. 02:17.310 --> 02:19.440 The early stages of this course. 02:19.470 --> 02:21.900 So first thing we do is really to put in an e-mail address. 02:21.900 --> 02:26.620 Now this is the e-mail address which you want to get send alerts to. 02:26.850 --> 02:29.210 So this needs to be an e-mail address that you monitor. 02:29.370 --> 02:34.530 I like the e-mail address that you have on your phone or something so that you get notified immediately 02:34.530 --> 02:38.130 when there's a security problem you don't want to set up a secondary e-mail address that you never look 02:38.130 --> 02:41.170 at as pointless as be an e-mail address that you monitor. 02:41.220 --> 02:44.720 Even if you set up a new e-mail address as long as it's one that you monitor. 02:44.730 --> 02:46.140 So let me put one in here. 02:48.410 --> 02:53.340 So that's the e-mail address I want to get sent alerts to and then I need to put in here some sort of 02:53.340 --> 02:58.370 comment that lets me know which token which trap has been triggered. 02:58.470 --> 03:03.380 So I'm going to put Word document in a password folder on the laptop. 03:03.450 --> 03:05.990 That's going to make more sense in a second. 03:06.000 --> 03:08.700 Ignore all this for now just have a DNS and hates it. 03:08.710 --> 03:12.120 Yes and generate token. 03:12.220 --> 03:20.280 And if we go down here the first one that I want you to look at is the M-S word token or trap. 03:20.290 --> 03:26.250 So what this has done is this has generated a unique word document for you that we can download. 03:26.260 --> 03:27.670 I'll give you a demo of it. 03:27.750 --> 03:29.310 It will download that now. 03:30.190 --> 03:34.910 And if you see this here this is the Word document that we've just downloaded. 03:34.930 --> 03:42.270 Now if I click on that and that's just opened up there you see what little time is going on there in 03:42.270 --> 03:43.210 the background. 03:44.270 --> 03:46.970 And you see there we've been alerted. 03:47.160 --> 03:54.060 Now any time anyone opens this document you're going to get alerted is a little trap and this little 03:54.060 --> 03:56.340 trap should work on most operating systems. 03:56.340 --> 03:57.640 Most versions of Word. 03:57.720 --> 04:02.600 There's no 100 percent guarantee that it's going to work on every system and with every version of Word. 04:02.670 --> 04:06.860 So if it doesn't work for you then try one of the other tokens that I'm going to show you in a second. 04:06.870 --> 04:09.970 Let me close that and create another example here. 04:10.110 --> 04:12.460 You can change the filename of this document by the way. 04:12.480 --> 04:16.420 Anything that you like make in time step is on to click on. 04:16.560 --> 04:17.900 I opened this one a second 04:20.550 --> 04:26.210 just opened this fully now and this one I put valuable and juicy information in it. 04:26.240 --> 04:34.050 The hacker or other type of threat would be interested in finding Pay-Pal usernames and passwords stock 04:34.110 --> 04:41.220 trading information social media accounts etc. etc. those are the sort of things the threat is going 04:41.220 --> 04:42.570 to be searching for. 04:42.630 --> 04:48.720 If he's on your laptop your device your phone with your e-mail is going to be searching for key words. 04:49.060 --> 04:54.210 And if you want an idea of the sort of things that you want to put in these traps and I put some examples 04:54.210 --> 04:59.260 here we can say personal information financial information file hosting accounts. 04:59.340 --> 05:03.910 And if we go further down here I provide an example file and we just copy this. 05:03.930 --> 05:09.300 We can use it as just an example the sort of information you can see social security numbers credit 05:09.300 --> 05:12.430 card details have put them in the right sorts of formats. 05:12.630 --> 05:14.460 Bitcoin wallet IDs. 05:14.610 --> 05:15.670 You get the idea. 05:16.890 --> 05:23.250 So we can imagine now a hacker was snooping around in an area that we specifically put aside just for 05:23.250 --> 05:26.650 the hackers to find and we've put in that word document. 05:26.850 --> 05:32.490 And he has now clicked on it and this is the alert we get so we know he's snooping around and we know 05:32.490 --> 05:37.860 he's sniffing around we know what he's doing because we set up that comment there and if we click here 05:38.700 --> 05:41.040 we can look to see where he's come from. 05:41.040 --> 05:47.930 We can track him down and it provides further information on how he triggered the alert. 05:47.940 --> 05:50.970 But what is important is that you react to the alert. 05:51.170 --> 05:56.330 And later during the course we're going to talk more about response and recovery strategies as you get 05:56.330 --> 05:58.450 through to the more advanced sections. 05:58.730 --> 06:05.000 And if you look at the second type of token that we can create or trap a PTF so we can download this 06:05.000 --> 06:09.220 PTF version and it works pretty much exactly the same as the Word document. 06:09.380 --> 06:19.740 We opened this PTF document and we will get alerted that someone has opened it and boom there we go. 06:19.940 --> 06:22.160 I know there are PTF trap. 06:22.340 --> 06:28.220 So I think you get any idea and so you want to sprinkle as many of these tokens these traps throughout 06:28.250 --> 06:34.010 your laptop your phone or tablet in your e-mail on your online accounts. 06:34.010 --> 06:39.320 So for example you could put it in your Dropbox and maybe the staff at Dropbox are looking through your 06:39.350 --> 06:40.340 documents. 06:40.340 --> 06:42.010 They open the Word document boom. 06:42.050 --> 06:43.860 You know someone snooping in there. 06:44.030 --> 06:49.640 And as I say they need to be interesting enticing and valuable and he can get that sort of information 06:49.640 --> 06:50.870 from here. 06:50.870 --> 06:56.460 Now let me show you another sneaky way of setting up a trap fake e-mail of passwords. 06:56.480 --> 07:03.650 Number one oh by the way if you put it on that one you'll get more information in the alert about who 07:03.650 --> 07:04.640 the hacker was. 07:04.730 --> 07:09.040 With this type of traveling about set up now so choose that one. 07:09.050 --> 07:15.950 So generate if you pop down here we're going to go to Web books and we're going to use two Web books 07:15.950 --> 07:16.710 here. 07:16.980 --> 07:19.650 Let's just grab that you are real. 07:19.730 --> 07:21.400 So there is a clickable link. 07:21.460 --> 07:24.440 If the hacker clicks on you're going to be alerted. 07:25.450 --> 07:27.840 Let's open up our e-mail here. 07:27.960 --> 07:28.940 Right. 07:28.960 --> 07:31.150 Let's just pop that in there for now. 07:31.320 --> 07:34.380 Then we're going to send this to our self. 07:34.540 --> 07:39.730 We could send it from a different account but all that matters is that the two e-mail addresses the 07:39.730 --> 07:44.590 account that you're wanting to be monitored you wanting to know if a hacker is in there we need to create 07:44.590 --> 07:46.810 an enticing subject so 07:49.580 --> 07:51.230 and then just as an example. 07:51.340 --> 07:57.290 But this one I'm going to go here and I'm going to copy all of this stuff here into this e-mail 08:02.440 --> 08:07.880 obviously you're going to put your own sort of information in here and things related to you know I've 08:07.930 --> 08:10.620 just taken that link there. 08:11.450 --> 08:14.240 Now putting that link here. 08:17.020 --> 08:18.990 I can actually change this to anything I want. 08:18.990 --> 08:27.370 After this here can change this to whatever I want so I can put log in if I want to him now and see 08:27.370 --> 08:33.570 what I'm doing is I'm creating an enticement here by private files or back I put everything username 08:33.580 --> 08:34.900 and password. 08:34.900 --> 08:39.520 So if the person opens his email and then clicks on this link it will trigger the alert. 08:39.670 --> 08:42.800 Will get you something even more tricky here. 08:42.910 --> 08:47.030 We want to definitely catch this hacker within Thunderbird. 08:47.110 --> 08:52.030 There is a feature by which you can insert a link to an image. 08:52.030 --> 08:56.190 Now we don't want to attack an image we want to insert a link to an image. 08:56.220 --> 09:01.700 So if you're going to insert an image and we own click this. 09:01.760 --> 09:03.720 We don't want to attach. 09:03.720 --> 09:11.970 We go on there and then we can put image gif and see we're already alerted. 09:12.070 --> 09:20.140 That's our quick services and we do not want to use any alternative text out there and you'll see you 09:20.140 --> 09:25.000 can't see the image because that is a one by one pixel invisible gif. 09:25.000 --> 09:28.570 Now let me show you how this works so when can send that to ourselves. 09:32.420 --> 09:33.370 So there we go. 09:33.370 --> 09:36.370 That's our little trap there that we can choose to open it. 09:36.370 --> 09:42.640 Leave it as an open e-mail or we can leave it as an open e-mail but no matter what if someone's in e-mail 09:42.670 --> 09:46.560 and they're searching for whatever it is that they want to be searching for maybe they're interested 09:46.560 --> 09:48.110 in PayPal accounts. 09:48.340 --> 09:48.960 Well there we go. 09:48.960 --> 09:54.730 That comes up searching for bank information credit card information that's going to come up and all 09:54.730 --> 09:57.440 they need to do is just open it. 09:57.530 --> 10:01.310 They want me to click on a link to them. 10:01.330 --> 10:03.200 No they're poking around in there. 10:03.260 --> 10:08.710 So let's say that doesn't work for whatever reason it should then there's still things like that to 10:08.710 --> 10:12.630 entice them like on that boom caught him again. 10:12.640 --> 10:17.370 Now in order for us to have inserted that image I went on this insert image. 10:17.410 --> 10:22.150 Now you may not have this functionality available in the e-mail client that you use. 10:22.210 --> 10:25.720 It may not even be available to do this but it doesn't matter. 10:25.720 --> 10:28.750 You can still download Thunderbird if you like. 10:28.780 --> 10:29.650 It's FREE. 10:29.710 --> 10:36.190 And just send an e-mail or e-mails using Thunderbird just for this one task if you can't work out how 10:36.190 --> 10:40.010 to embed that invisible web book into your email. 10:40.510 --> 10:45.490 So as I said you want to sprinkle these tokens throughout your laptop on your laptop phone tablet in 10:45.490 --> 10:49.210 your e-mail in your accounts make them enticing make them valuable. 10:49.210 --> 10:55.250 And then when you get an alert respond to that and respond in the ways I recommend throughout this course. 10:55.390 --> 11:00.110 Changing your password and all this sort of thing is disconnecting from the network. 11:00.400 --> 11:03.090 So there you go that's your security quick win. 11:03.130 --> 11:05.260 Go ahead and set those up right now. 11:05.440 --> 11:07.690 You will have after you set this up. 11:07.750 --> 11:11.610 Better security detection capabilities than most companies do. 11:11.620 --> 11:16.960 You might not believe that if you're not in the security industry but that is a sad and true analysis 11:16.990 --> 11:20.510 of the state of most organizations detection capabilities. 11:20.510 --> 11:21.720 Just think of Edward Snowden. 11:21.760 --> 11:27.050 He was poking around in the NSA for months as an insider threat and nothing like this. 11:27.130 --> 11:28.500 Alerted the NSA. 11:28.600 --> 11:29.550 Pretty crazy. 11:29.740 --> 11:34.020 Later on in the course we will discuss canary tokens a more advanced level. 11:34.060 --> 11:38.920 When you get there you'll understand more about how they work and will understand about the importance 11:38.920 --> 11:45.250 of detection controls which these are versus preventative controls which are used to stop a hacker getting 11:45.250 --> 11:46.420 in in the first place. 11:46.450 --> 11:48.520 The preventative controls are very important. 11:48.520 --> 11:50.260 We use a defense in depth approach. 11:50.260 --> 11:51.580 All of which we're going to go into. 11:51.610 --> 11:53.640 So that was form. 11:53.740 --> 11:59.130 Now let's dig into the theory and the basics and start our journey into cybersecurity.