Practical Online Security

Learn how to secure your online life through practical, everyday measures.

Transcript

1. PRACTICAL ONLINE SECURITY MYTHS AND DEFENSES
2. PRACTICAL ONLINE SECURITY MYTHS AND DEFENSES
3. WHO AM I? Ky-Cuong L. Huynh 3rd year Computer Science, UCLA Daily Bruin Web Contributor Pan-Asian Queers Bruinrunner Team Vim + Sublime Text
4. MY BACKGROUND CS 136 — Computer Security IT Staff at the UCLA Lab School Web of Trust (WOT) volunteer PhishTank volunteer
5. ASK ME ANYTHING, ANYTIME.
6. OUT OF SCOPE } { Hosts file HTTPS Everywhere PGP email Signal app Router configuration Tails FileVault Tor uBlock Spokeo ProtonMail OTR chat BitLocker Little Snitch Windows Firewall
7. THE MYTHS “I’LL SHOW YOU THE DARK SIDE.” — KYLO REN
8. COMMON MYTHS
9. COMMON MYTHS ▸ “No one cares about my computer.”
10. COMMON MYTHS ▸ “No one cares about my computer.” ▸ “I have nothing worth stealing.”
11. COMMON MYTHS ▸ “No one cares about my computer.” ▸ “I have nothing worth stealing.” ▸ “Who would go through the effort of targeting me?”
12. COMMON MYTHS ▸ “No one cares about my computer.” ▸ “I have nothing worth stealing.” ▸ “Who would go through the effort of targeting me?” ▸ “It would be obvious if my computer were compromised.”
13. THE REALITY
14. THE REALITY ▸ Attacks are easily automated
15. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more
16. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers
17. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers ▸ Stolen money, but also: identities, corporate data, etc.
18. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers ▸ Stolen money, but also: identities, corporate data, etc. ▸ Many of you will become valuable targets
19. THE REALITY ▸ Attacks are easily automated ▸ Spam, phishing, botnets, malvertising—and much more ▸ There are billions to be made off of insecure computers ▸ Stolen money, but also: identities, corporate data, etc. ▸ Many of you will become valuable targets ▸ Executives, engineers, sysadmins, and more
20. VIDEO: SOCIAL ENGINEERING
21. THREAT LANDSCAPE “KNOW YOUR ENEMY.” — SUN TZU
24. SCAREWARE, SPYWARE, RANSOMWARE
29. SCAREWARE, SPYWARE, RANSOMWARE
30. SCAREWARE, SPYWARE, RANSOMWARE
31. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE
34. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE
35. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE
36. ADVANCED PERSISTENT THREAT (APT) SCAREWARE, SPYWARE, RANSOMWARE HUMAN ATTACKER
38. THE THREATS
39. THE THREATS ▸ Strong defense against:
40. THE THREATS ▸ Strong defense against: ▸ Automated attacks
41. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering
42. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking
43. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking ▸ Weak defense against:
44. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking ▸ Weak defense against: ▸ NSA/FBI/CIA/…
45. THE THREATS ▸ Strong defense against: ▸ Automated attacks ▸ Social engineering ▸ Password cracking ▸ Weak defense against: ▸ NSA/FBI/CIA/… ▸ Industrial espionage
46. THE ASSETS
47. THE ASSETS ▸ Online accounts
48. THE ASSETS ▸ Online accounts ▸ Identity & personal safety
49. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources
50. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime
51. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime ▸ Personal data
52. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime ▸ Personal data ▸ Hands off!
53. THE ASSETS ▸ Online accounts ▸ Identity & personal safety ▸ Computing resources ▸ No aid to cybercrime ▸ Personal data ▸ Hands off! ▸ Always available to us
54. THE DEFENSES “SOMEBODY HAS TO SAVE OUR SKINS!” — PRINCESS LEIA ORGANA
55. DEFENSE #1 KNOWLEDGE IS POWER
56. VIDEO: TOYDARIAN
57. DEMO: WEB PHISHING
59. CERTIFICATE MISMATCH
61. HXXP://SALTLAKECITYCHIROPRACTOR.NET/WELLSFARGO.COM/WELLSFARGO- ONLINE.SERVER/VERIFY_INFORMATION/INDEX.HTML
62. BASE URL MISMATCH
65. REAL CITIBANK SITE
67. INCORRECT FORMATTING
69. URLEX.ORG
71. DEFENSE #2 UPDATE, UPDATE, UPDATE, UPDATE!
72. “…AN UNPROTECTED PC CAN GET HIJACKED WITHIN [20] MINUTES OF ACCESSING THE INTERNET.” — USA Today
73. VIDEO: REY
74. “SAFETY ENGINEERING [IS]…PROGRAMMING MURPHY’S COMPUTER…SECURITY ENGINEERING INVOLVES PROGRAMMING SATAN'S COMPUTER.” Bruce Schneier
75. SET-UP: AUTOMATIC UPDATES
76. DEFENSE #3 MULTI-FACTOR AUTHENTICATION
77. VIDEO: “STORMTROOPERS”
78. AUTHENTICATION FACTORS
79. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW
80. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy”
81. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE
82. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password
83. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password ▸ Yubikey
84. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password ▸ Yubikey ▸ SOMETHING YOU ARE
85. AUTHENTICATION FACTORS ▸ SOMETHING YOU KNOW ▸ Passphrase/PIN: “horrible toady neckline piggy” ▸ SOMETHING YOU HAVE ▸ One-time password ▸ Yubikey ▸ SOMETHING YOU ARE ▸ Fingerprint, iris scan, voice
86. DEMO: AUTHY & YUBIKEY
87. SET-UP: AUTHY FOR GOOGLE
88. DEFENSE #4 BACK-UP EVERYTHING
89. “THERE ARE TWO KINDS OF COMPUTER USERS: THOSE WHO HAVE SUFFERED A CATASTROPHIC DISK FAILURE—AND THOSE WHO WILL.” Computing proverb
90. “THIS WEAPON IS YOUR LIFE!”— OBI-WAN KENOBI
92. DEFENSE #5 USE A PASSWORD MANAGER
94. X
95. VIDEO: LASTPASS
96. DEMO: LASTPASS
97. SUMMARY 1. Street smarts 2. Up-to-date software 3. MFA authentication 4. Back-up everything 5. Password manager HANDOUT: KYCODE.ME/BLOG