Post on 22-Jan-2018
PUBLIC//NSI//ORNCON//YESFORN
By Ron Williams & Hyun Seo
TAKE BACK CONTROL INA POST-SNOWDEN WORLD
PUBLIC//NSI//ORNCON//YESFORN
The content and tools mentioned in this workshop are for educational purposes only.
We do not endorse or promote any specific products or tools.
Any opinions expressed are our own and are not intended to reflect the views of our employer.
PUBLIC//NSI//ORNCON//YESFORN
Ron WilliamsArchitect, IBM Security
Hyun SeoDesigner, IBM Security
PUBLIC//NSI//ORNCON//YESFORN
Our mission...
PUBLIC//NSI//ORNCON//YESFORN
SecurityBeing free from danger and/or threat.
PUBLIC//NSI//ORNCON//YESFORN
AnonymityWithout any name acknowledged, as that of author, contributor, or the like.
PUBLIC//NSI//ORNCON//YESFORN
PrivacyBeing free from unwanted or undue intrusion or disturbance in one’s life or affairs.
PUBLIC//NSI//ORNCON//YESFORN
We are not deliberately hiding anything when we seek out private places for reflection or conversation. We keep private journals, sing in the privacy of the shower, and write letters to secret lovers and then burn them. Privacy is a basic human need.
“Bruce Schneier, Schneier on Security ”
PUBLIC//NSI//ORNCON//YESFORN
PUBLIC//NSI//ORNCON//YESFORN
Government, Personal,Commercial, Criminal.
PUBLIC//NSI//ORNCON//YESFORN
Anytime you share information, you lose control over it.
PUBLIC//NSI//ORNCON//YESFORN
Legitimate* and illegitimate surveillance.Employer, government (local, state, federal) agencies, criminals.
*Within the bounds of existing law.
PUBLIC//NSI//ORNCON//YESFORN
Automated surveillance techniques are not perfect.Profiles (of employees, citizens) are developed from incomplete data.
PUBLIC//NSI//ORNCON//YESFORN
GovernmentSurveillance
PUBLIC//NSI//ORNCON//YESFORN
If I’m not doing anything wrong, why should I care about government surveillance?
PUBLIC//NSI//ORNCON//YESFORN
December 7th, 1941
PUBLIC//NSI//ORNCON//YESFORN
“NATIONAL SECURITY”
PUBLIC//NSI//ORNCON//YESFORN
PUBLIC//NSI//ORNCON//YESFORN
Lavabit
PUBLIC//NSI//ORNCON//YESFORN
The government is constrained by law.
PUBLIC//NSI//ORNCON//YESFORN
The government is constrained by law. Today.
PUBLIC//NSI//ORNCON//YESFORN
PUBLIC//NSI//ORNCON//YESFORN
CommercialSurveillance
PUBLIC//NSI//ORNCON//YESFORN
If you’re not paying for the product, you’re the product.
PUBLIC//NSI//ORNCON//YESFORN
CommercialSocial Media
Aggregation & Analysis of User Data
Monetization of Analysis
Product Services
User market data
Retail optimization
Who
What
Why
PUBLIC//NSI//ORNCON//YESFORN
Employee
Browser activityInformation access and usage Compliance monitoringSocial Media usagePhone voice monitoring
Employee MonitoringWho
What
Why Business Security
PUBLIC//NSI//ORNCON//YESFORN
Crime as a Service
PUBLIC//NSI//ORNCON//YESFORN
BOT-NETOPERATOR
MALWAREAUTHORS
VULNERABILITYRESEARCHERS
BOT-NET
cCommercesales &
marketingservice catalog
advertisingfinance
counter-surveillance
Servicesddos
spambot-net C&C
malware deliverykey logging
surveillancecredential theft
espionage
CaaS CONSUMER
PUBLIC//NSI//ORNCON//YESFORN
Reducing yourdigital footprint
PUBLIC//NSI//ORNCON//YESFORN
Three can keep a secret, if two are dead.“Benjamin Franklin ”
PUBLIC//NSI//ORNCON//YESFORN
AndroidEmail
Voice & SMS
IM
Mail Services
S/MIME, PGP
Signal
ChatSecure
ProtonMail, Tutanota, GhostMail
PUBLIC//NSI//ORNCON//YESFORN
iOSEmail
Voice & SMS
IM
Mail Services
S/MIME
Facetime, iMessage, Signal
iMessage
ProtonMail, Tutanota, GhostMail
PUBLIC//NSI//ORNCON//YESFORN
Traditional PC’sText & Files
IM
Mail Services
S/MIME, PGP
Off-the-record XMPP Protocol
ProtonMail, Tutanota, GhostMail
PUBLIC//NSI//ORNCON//YESFORN
NetworkRouter
Software
VPN
Passphrase
DNS
Don’t rent your router
Install an open source firmware
OpenVPN
Strong passphrase, disable “WPS”
OpenNIC, FreeDNS
PUBLIC//NSI//ORNCON//YESFORN
Digital Hygiene
PUBLIC//NSI//ORNCON//YESFORN
PUBLIC//NSI//ORNCON//YESFORN
AndroidDevice
Search
Browser
VPN
Other
Disable Backup, Turn off Location, Info Collection, and radios
DuckDuckGo, Disconnect.Me
ORFox & ORBot, Firefox
Anonymous VPN
Try to be “Google Play”-free
PUBLIC//NSI//ORNCON//YESFORN
iOSDevice
Search
Browser
VPN
Disable iCloud Backup, Turn off Location, Info Collection, and radios
DuckDuckGo, Disconnect.Me
Safari, Firefox
Anonymous VPN
PUBLIC//NSI//ORNCON//YESFORN
Traditional PC’sDevice
Search
Browser
VPN
Disable cloud backup, turn off location, Info Collection, and radios
DuckDuckGo, Disconnect.Me
Safari, Firefox, Chromium
Anonymous VPN
PUBLIC//NSI//ORNCON//YESFORN
Citizenfour & No Place To Hide
privacytools.io
PUBLIC//NSI//ORNCON//YESFORN
Thank you!
https://www.linkedin.com/in/rbwilliams https://www.linkedin.com/in/hyunseohi@hyun.ioron.williams@us.ibm.com
PUBLIC//NSI//ORNCON//YESFORN
http://pastebin.com/byUPX6WmAdditional Information