Cybersecurity

The Education sector had experienced 118 breaches (13% of all

breaches) that impacted a total of 32 million records.

2017 CYBERSECURITY REVIEW

North

America

had the

highest

number of

attacks.

43% of breaches in higher education were

caused by hacking or malware in 2017. Of these, 41% were due to

Phishing.

Ransomwareattacks continued

their rise (up by

50%) in the first

half of 2017.

It is estimated that for each

record compromised, for a

university, it would cost

approximately $270.

breachlevelindex.com/assets/Breach-Level-Index-Report-H1-2017Gemalto.pdf

beazley.com/news/2017/beazley_breach_insights_july_2017.html

cisco.com/c/en/us/products/security/security-images-mcr2017.html

www.ibm.com/security/data-breach/

www.getcybersafe.gc.ca/cnt/rsrcs/nfgrphcs/nfgrphcs-cybersafebusiness-en.aspx

https://i1.wp.com/ncmedia.azureedge.net/ncmedia/2016/02/SID-Flyer.jpg

www.lastpass.com/business

What is Cybersecurity?

Cybersecurity is the body of technologies, processes and practices

designed to protect networks, computers, programs and data from

attack, damage or unauthorized access.

3

What is Cybersecurity?

Cybersecurity is as much about social practices as it is about physical

technology.

Your daily practices and routine are more of a factor in the risk to your

computer / institutions security than the software / hardware you are

using to protect it.

4

Why it matters for you?

Your actions have the potential to have a major financial impact on your

institution, or could cause significant reputational damage.

As a University we are only as strong as our weakest link!

This sounds like hyperbole but: one open door is often enough to enter a

house.

5

University of Calgary - May 2016

University of Calgary sustained total data access loss in 2016 for a short

time.

This was due to a breach in security by a program classified as

“Ransomware”.

This breach was likely due to a single vulnerability and taken advantage of

by an outside source.

The University of Calgary was forced to pay $20,000 to the hacker so that

the files could be unlocked.

This is not the only example of public and massive security breaches in past

12 months….

6

Yahoo 2016 ‘Cookie Breach’

In late 2016 Yahoo revealed that ‘some’ of its users data had been

compromised for an unknown length of time.

In the end it was determined that upwards of 200 MILLION user accounts

had been compromised, all without requiring a password.

It has been determined this data breach was the fault of one individual who

fell victim to a phishing attack.

This was enough to cause a devaluation of Yahoo as a company in the

hundreds of millions of dollars.

Lesson learned : The practices of a single user can have an enormous

impact on an organization.

7

Types of Cybersecurity Threats

1. Phishing

2. Spear Phishing

3. Ransomware

4. Social Engineering

5. Trojan Horses

6. Viruses

7. Bad Habits

8

Phishing…what is it?

Phishing is an attempt to trick users into sharing personal details or login

credentials.

Attackers may do this by encouraging the user to respond to the email, or by

asking them to access a fraudulent website that prompts them to share

information.

While most phishing attempts are quite obvious, some are quite convincing

and contain details that would seem very difficult to know.

No…A Nigerian Prince is not going to give you $1,000,000.

9

TIMS Ordeal

https://www.youtube.com/watch?v=H0I7jQb37bo

Phishing…what is it?11

Phishing…what is it?12

_________________________________

Look at email address it is coming from.

Look at who it is addressed to.

We will not ask you to follow hidden links.

We will not deactivate your account without contacting you in person.

How can I be sure?

If the email states that it is coming from ‘Mount Allison’ or our ‘Helpdesk’:

We will never ask you to confirm your password.

Your webmail will not be shut down or ‘expire’.

Emails from the helpdesk are addressed “Robin and Isobel”.

Look for improper Grammar…it is the easiest way to identify a

phishing attempt.

13

Phishing - What to look for?

Who sent the email? Did it come from a Mount Allison Account or somebody

you know?

Note: Even if it comes from a Mount Allison account it can still be spam. When

one account is compromised, the hacker / phisher can send emails from the

users account.

Does the email ask for personal information?

Does the email ask you to follow a hidden link/short URL?

Does it demand “URGENT” action?

Does it make you think twice?

14

Phishing Websites15

Phishing Websites16

Spear Phishing

Spear phishing is more targeted. Cyber criminals who use spear-phishing

tactics segment their victims, personalize the emails, impersonate specific

senders and use other techniques to bypass traditional email defenses.

It uses data usually collected off social media or other open sources to use

information that makes it seem believable that the scammer is legitimate.

Spear-phishers study their victims in advance, learning names, organizational

structure, and even workplace culture to try to keep the victim from raising red

flags.

17

Spear Phishing18

APT - Advanced

Persistent Threat

Ransomware

Ransomware is a type of malware that restricts access to your computer or

your files and displays a message that demands payment in order for the

restriction to be removed. The two most common means of infection appear to

be phishing emails that contain malicious attachments and website pop-up

advertisements.

The 2017 Ransomware Report shows that companies and government

agencies are overwhelmed by frequent, severe ransomware attacks, which

have now become the #1 cyber threat to organizations.

Ransomware will display a notification stating that your computer or data has

been locked and demanding a payment be made for you to regain

access. Sometimes the notification states that authorities have detected

illegal activity on your computer, and that the payment is a fine to avoid

prosecution.

19

Ransomware – What should I do?Keep your operating system and software up to date.

Avoid clicking on links or opening attachments or emails from people you don't know or

companies you don't do business with.

Do not visit unknown web sites.

Only install software from official places like the Apple App Store, Google Play and Microsoft

Store.

Back up all your files. The number of people saving files on their computers without backups

is staggering. If such a computer is infected with ransomware, it can be a worst-case-scenario

disaster. Recovery may be impossible. So always maintain file backups.

Test backups regularly, at least once a month, to ensure they can easily restore lost data.

If you get warning on your computer monitor of ransomware, please disconnect computer

from a network, by unplugging the cable or disconnecting from WiFi network and contact

Computing Services Helpdesk right away.

20

Social Engineering

Social engineering, in the context of information security, refers to psychological

manipulation of people into performing actions or divulging confidential

information.

It's the art of gaining access to buildings, systems or information by exploiting

human psychology, rather than breaking in, or using technical hacking techniques.

The attacker will reach out to you under a pretext, which can be very believable

depending on how much effort they put into researching you. This pretext can

then be used as a hook to verify information they already have, or gain new

information. The attackers might also leverage information they previously

acquired to give the impression that since they are authorized to know what they

already know, they are authorized to know more.

For example, knowing about a recent Internet outage at your office, a clever

attacker might call you for a follow-up or even show up in person to gain

valuable insights into how your network is secured—and where it’s vulnerable.

21

Social Engineering – What should I do?

Be mindful of what you are posting on social media.

Be careful, what you post to social media, it never really goes away.

Do not upload anything you wouldn’t want everyone to see.

Do not upload or share sensitive information.

You are never truly anonymous on social media.

22

Trojan Horses

A Trojan horse is a malicious program that is disguised as, or embedded within, legitimate software. It is an executable file that will install itself and run automatically once it's downloaded.

A Trojan horse may not be a term you're familiar with, but there's a good chance you or someone you know has been affected by one.

What it can do:

Delete your files.

Use your computer to hack other computers.

Watch you through your web cam.

Log your keystrokes (such as a credit card number you entered in an online purchase).

Record usernames, passwords and other personal information.

23

Viruses

A Virus is a malicious computer program that are often sent as an email attachment or a download with the intent of infecting your computer, as well as the computers of everyone in your contact list. Just visiting a site can start an automatic download of a virus.

What it can do:

Send spam.

Provide criminals with access to your computer and contact lists.

Scan and find personal information like passwords on your computer.

Hijack your web browser.

Disable your security settings.

Display unwanted ads.

24

Viruses – How will you know if your

computer is infected?

It takes longer than usual for your computer to start up, it restarts on its own or doesn't start up at all.

It takes a long time to launch a program.

Files and data have disappeared.

Your system and programs crash constantly.

The homepage you set on your web browser is different (note that this could be caused by Adware that has been installed on your computer).

Web pages are slow to load.

Your computer screen looks distorted.

Programs are running without your control.

25

Bad Habits

One of the greatest threats to network security has nothing to do with software and everything to do with people. It’s the users who manage and depend on the network who often put it at the greatest risk.

People threaten security when they make mistakes:

Ignoring email security. At least one person can be tricked into opening a malicious attachment or link…

Using outdated software. People keep using software that has reached end-of-life and is no longer supported by the vendor.

Choosing bad passwords. Malware developers count on people to use the default passwords that are identical across thousands of devices.

Mistakes can be reduced and security can be improved.

26

Password Security

Never share your password with coworkers, family, friends or strangers –

even if it is just for convenience.

Have a good password policy of creating long, unique password for each of

your accounts.

Never use default passwords, and do not use the same password across

multiple systems.

Be extra cautious when connecting to ‘public wifi’ such as at

café’s/restaurants. They may not be secure.

If you have a question about your password/security, DO NOT be afraid to

ask! helpdesk@mta.ca or visit Bennet Building, room 108.

27

Password Requirements Guide28

Less than 8

16 -19

19 +

12 -15

8 – 11

Which and how many characters are required

in my password?

HINT: It depends on password length!

8-11: mixed case letters, numbers, & symbols

12-15: mixed case letters & numbers

16-19: mixed case letters

20+: no restrictions

Aa

1

$

Aa

1Aa

a

Make your password 16 characters or longer!

HOW?

Creating a pass phrase

A pass phrase is basically just a series of words, which can include spaces, that you

employ instead of a single pass "word." Pass phrases should be at least 16 to 25

characters in length (spaces count as characters), but no less.

Here, for example, are a couple pass phrase candidates:

pepper tofu with mushrooms (26 characters)

organic sweet essential oil (27 characters)

16or more

Mobile DevicesRisks to mobile phones, especially smartphones and Bluetooth-enabled phones, but also laptops and tablets, are becoming increasingly common. Aside from the actual physical loss of your mobile device, which could put private and personal information in the wrong hands, there are several ways your mobile device can be compromised.

Viruses or worms can be spread through anything you download from the Internet via your phone, by text attachments and by Bluetooth transfers.

Phishing by phone is another way cyber criminals scam you. They'll send a text or email with a phone number for you to call to verify account information. They may also call you directly and ask you to enter your account number before continuing.

Trojan horses attached to app downloads can delete your files and record personal information you've entered (like a credit card number on an online shopping site). Do not install apps that seem to require an unusual amount of information from you.

An unsecure wireless network can compromise your information, including your contact list, as well as give someone else use of your data plan. Using your 3G connection is a safer option.

Text messages sent to basic phones that contain malware can shut down or completely crash your mobile phone.

29

Mobile Devices

Manage your privacy, iOS or Android.

Enable a Pin or Passcode on your mobile device, iOS or Android.

Keep your mobile device up to date, iOS or Android.

Keep your apps up to date, iOS or Android.

Enable iCloud on your iOS device or Android Device Manager on your Android device, so

you can locate it and wipe it, if needed.

Do not open or respond to unknown or unexpected text messages or email.

Do not leave your mobile device unattended.

Secure your home wireless with a strong password.

30

http://whatis.techtarget.com/definition/cybersecurity

Calyptix Security Corp. - Top Security Threats | 2017 Report

https://www.getcybersafe.gc.ca/cnt/rsks/index-en.aspx

http://nationalpost.com/news/canada/hackers-crippled-the-university-of-calgarys-computer-systems-then-received-a-

20000-ransom-payment

http://securityaffairs.co/wordpress/51536/data-breach/200-million-yahoo-accounts.html

https://www.cybersecurity-insiders.com/portfolio/2017-ransomware-report/

https://heimdalsecurity.com/blog/10-surprising-cyber-security-facts-that-may-affect-your-online-safety/

https://www.getcybersafe.gc.ca/cnt/rsrcs/vds/index-en.aspx

31