IT Fundamentals/2014/Security



Security is the degree of resistance to, or protection from, harm applied to any vulnerable and valuable asset. This lesson covers IT security threats and best practices.

Preparation
Learners should already be familiar with IC3 - Computer Use and Safety.

Objectives and Skills
Objectives and skills for the security portion of IT Fundamentals certification include:


 * Define basic security threats
 * Malware
 * Virus
 * Trojan
 * Spyware
 * Ransomware
 * Phishing
 * Social engineering
 * Spam
 * Password cracking
 * Physical security
 * Hardware theft
 * Software/license theft
 * Shoulder surfing
 * Dumpster diving
 * Given a scenario, use security best practices
 * Password management
 * Password complexity
 * Change default passwords
 * Password confidentiality
 * Password expiration
 * Password reuse
 * Awareness of Single Sign On
 * Device hardening
 * Disable unused features
 * Disable Bluetooth
 * Disable NFC
 * Timeout / lock options
 * Enable security software/features
 * Software firewall
 * Anti-malware
 * Encryption options
 * Open WiFi vs. secure WiFi
 * Multifactor authentication
 * Suspicious emails
 * Attachments
 * Hyperlinks
 * Act on security software alerts
 * Admin vs. user vs. guest account

Readings

 * 1)  Internet security
 * 2)  Password manager
 * 3)  Hardening (computing)
 * 4)  Multi-factor authentication

Multimedia

 * 1) YouTube: IT Fundamentals - Risk Analysis and Security Policy
 * 2) YouTube: IT Fundamentals - Threats
 * 3) YouTube: IT Fundamentals - Wireless and Mobile Network Security
 * 4) YouTube: Protecting Your Computer from Malware
 * 5) YouTube: Using Safe Practices
 * 6) YouTube: Antivirus Software

Activities

 * 1) Use anti-malware software to scan your system and test malware detection.
 * 2) * All: Review Comparison of antivirus software.  Download a free, well-known anti-malware application and scan your system.
 * 3) * All: Review EICAR test file.  Download and save the EICAR test file to test your anti-malware application and follow the process for removing malware.
 * 4) Configure password management.
 * 5) * All: Research password managers. Consider installing and using a password manager on your system.
 * 6) * Windows: Review Microsoft: How to Configure Security Policy Settings. Consider modifying Password Policy and Account Lockout Policy settings.
 * 7) * OS X: Review CNet: How to set up password policies in OS X. Consider modifying password restrictions.
 * 8) * Linux: Review Xmodulo: How to set password policy on Linux. Consider modifying password policy settings.
 * 9) Research multi-factor authentication.  Consider setting up multi-factor authentication on your Apple, Facebook, Google, and/or Microsoft accounts, as well as your password manager and your financial institutions.
 * 10) Test your firewall using a testing service such as Gibson Research: ShieldsUP!
 * 11) Consider encrypting your system storage:
 * 12) * Windows: Review Microsoft: BitLocker Drive Encryption Overview
 * 13) * OS X: Review Apple: OS X: About FileVault 2
 * 14) * Linux: Review ArchLinux: Disk Encryption
 * 15) * Android: Review GreenBot: Why and How to Encrypt Your Android Device.
 * 16) * iOS: Review Apple:Understanding Data Protection.

Lesson Summary

 * Security threats include malware, phishing, social engineering, spam, password cracking, and physical security risks.
 * Malware is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. This includes viruses, Trojans, spyware, and ransomware.
 * Physical security threats include hardware theft, software/license theft, shoulder surfing, and dumpster diving.
 * Effective password management includes password complexity, password confidentiality, password expiration, limited password reuse, changing default passwords, understanding single sign-on, and using multi-factor authentication.
 * Device hardening includes disabling unused features such as Bluetooth and Near Field Communication, using screen timeout and lock options, enabling security software features, using a software firewall, using anti-malware software, and encrypting data storage.
 * Security best practices include being alert for suspicious emails, attachments, and hyperlinks, responding to security software alerts, renaming administrator accounts, and disabling guest accounts.

Key Terms

 * authentication
 * The process of confirming identity.


 * authorization
 * The function of specifying access rights to resources.


 * BitLocker
 * A full disk encryption feature included with the Ultimate and Enterprise editions of Windows Vista and later Windows operating systems.


 * brute-force attack
 * A cryptanalytic attack that consists of systematically checking all possible keys or passwords until the correct one is found.


 * device hardening
 * The process of securing a system by reducing its surface of vulnerability through the removal of unnecessary software, unnecessary usernames or logins and the disabling or removal of unnecessary services.


 * dictionary attack
 * A technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities from a list.


 * dumpster diving
 * The practice of sifting through commercial or residential waste to find items that have been discarded by their owners, but that may prove useful to the collector.


 * ethical hacker
 * A computer security expert, who specializes in penetration testing and in other testing methodologies to ensure the security of an organization's information systems.


 * impersonation
 * The act of assuming the identity of another, in order to commit fraud, such as accessing confidential information, or to gain property not belonging to them.


 * malware
 * Any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.


 * multi-factor authentication
 * A method of computer access control which a user can pass by successfully presenting authentication factors from at least two of the three categories of knowledge, possession, and inherence.


 * packet sniffer
 * A computer program that can intercept and log traffic passing over a digital network.


 * password complexity
 * The length and character set combinations used to create a password, such as upper case and lower case letters, numbers, and punctuation.


 * password confidentiality
 * A set of rules or a promise that limits access or places restrictions on password sharing.


 * password cracking
 * The process of recovering passwords from data that have been stored in or transmitted by a computer system, most often through brute-force or dictionary attacks.


 * password expiration
 * A policy that requires users to change passwords periodically.


 * password reuse
 * A policy that prevents users from repeating recently used passwords.


 * permissions
 * Access rights assigned to specific users and groups of users to control the ability of the users to view or make changes to system objects.


 * phishing
 * The attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.


 * physical security
 * Measures designed to deny unauthorized access to facilities, equipment and resources, and to protect personnel and property from damage or harm.


 * ransomware
 * A type of malware which restricts access to the computer system that it infects, and demands a fee be paid to the operators of the malware in order for the restriction to be removed.


 * shoulder surfing
 * Using direct observation techniques to obtain information such as passwords, PINs, security codes, and similar data.


 * single sign-on
 * A property of access control systems that allows a user to log in once and gain access to all interrelated systems without being prompted to log in again.


 * social engineering
 * Psychological manipulation of people to cause them to perform actions or divulge confidential information.


 * spam
 * Unsolicited electronic messages, especially advertising.


 * spim
 * Unsolicited electronic messages targeting users of instant messaging (IM) services.


 * spoofing
 * Concealing the identity of the sender by impersonating another computing system.


 * spyware
 * Software that aims to gather information about a person or organization without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge.


 * trojan
 * A non-self-replicating type of malware program containing malicious code that, when executed typically causes loss or theft of data, and possible system harm.


 * virus
 * A malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or firmware.

Assessments

 * Flashcards: Quizlet: IT Fundamentals - Security
 * Quiz: Quizlet: IT Fundamentals - Security