Transcript UF Information Security Training

INTERNET AND COMPUTER SECURITY
Cheryl Granto | Information Security Manager, UFIT Information Security
Scott Schreiner | Information Security Analyst, UFIT Information Security
Introduction
• Who we are
• Information Security Office
• What we do
• Risk Assessments and Security Evaluations
• Intrusion Detection
• Penetration Testing
• Vulnerability Management
• Incident Response and Digital Forensics
• Why we do what we do
Agenda
•
•
•
•
•
•
•
Mobile Device Security
Laptop/Desktop Security
Passwords
Web Surfing Safety
Email Security
Physical Security
How to report an incident
Mobile Device Security Tips
•
•
•
•
Install updates
Use a strong passcode
Lock your device and set a quick timeout
Install remote location tracking (find my
iPhone)
• Only download trusted apps
• Disable geotagging
Mobile Device Security Tips
•
•
•
•
Be cautious on unsecured networks
Back up your data
Turn off Bluetooth
Enable encryption of device and memory
card
• Maintain physical control of your device
Laptop/Desktop Security
• Firewalls
• Virus Protection
• Windows:
• Microsoft Security Essentials
• Mac Users:
• Avast, ClamXAV, Sophos AV
https://security.ufl.edu/learn-information-security/protect-yourself/virus-spyware/firewalls/personal-firewalls/
https://security.ufl.edu/learn-information-security/protect-yourself/virus-spyware/virus-protection/
Laptop/Desktop Security
• Spyware Protection
• Full Disk Encryption
• Windows BitLocker
• Encrypt USB drives
https://security.ufl.edu/learn-information-security/protect-yourself/virus-spyware/free-anti-spyware-tools/
https://security.ufl.edu/learn-information-security/mobile-device-security/microsoft-windows/bitlocker-encryption/
Updates and Alerts
• System updates
• Turn on Automatic updates
• Update Applications:
• Adobe Flash
• Java
• Internet browsers
• Subscribe to alerts:
• https://www.us-cert.gov/ncas
Sample Alert
Password Management
Tips for creating passwords
• All new passwords created must be at least eight
characters long
• New passwords may not exceed 48 characters in length
• Passwords cannot be the same as your GatorLink user
name
• Passwords less than 18 characters long:
• Cannot contain any word or string found in UF’s
dictionary
• Must contain at least three of the four elements:
Uppercase letters, Lowercase letters, Numbers,
Punctuation/special characters
Password Development
Let’ s Practice Together
1st – Make a choice
• Pass-phrase
• Regular
Let’ s Practice Together
Pass-phrase Rules:
1. 18-48 characters
2. No Spaces or backslash ‘\’
Let’ s Practice Together
Regular Rules:
1. No Dictionary Words
2. No Spaces
3. Must contain at least 3 special
characters
Practice makes perfect
passwords….
Pass-Phrase
Regular
IgotmyMastersdegreein97!
IgmMdi1997!
IenteredDropafterIsawthenewpasswordstandard.
IeDaIstnps.
ITSecurityisoursharedresponsibility!
ITSiosr!
Password Tips
• Regular passwords
• No names, pets, or easily guessed
information
• Avoid complete words
• Never give your password to anyone
• Never store your password in plain text
Password Tips
• Use unique password for each login
• Password managers can help
• LastPass - https://lastpass.com
• 1Password - https://agilebits.com/onepassword
• KeePass - http://keepass.info
https://security.ufl.edu/learn-information-security/protect-yourself/data/passwords/
Web Surfing Safety
• Ensure site encryption:
• Ensure that characters are masked:
Web Surfing Safety
•
•
•
•
Watch out for shoulder surfing
Avoid questionable sites
Only download from sites you trust
Type or google URLs rather than using
email links
• Secure your social media what control
what you share
Email Security
•
•
•
•
Be wary of Phishing
Check for fake links or web addresses
Don’t click links in email
Never give out account or personal
information
• Don’t open files from unknown sources
• UF Computing Helpdesk at (352)392-HELP
and [email protected]
https://security.ufl.edu/learn-information-security/protect-yourself/email/id-theft-scams/phishing-email/
Phishing example
Phishing example
Physical Security
• Maintain possession of your device
• Label your device (stickers or contact info)
• Lock devices in trunk of car obscured from
view
• If lost, use remote tracking (find my
iPhone)
How to report an incident
• Reporting an Incident to the UF Security Team
• Email: [email protected]
• Phone: 352-273-1344
• Phishing scams or email abuse targeting
University of Florida faculty, staff, or students
should be reported to [email protected]
https://security.ufl.edu/about-us/report-an-incident/
Summary
•
•
•
•
•
•
•
Mobile Device Security
Laptop/Desktop Security
Passwords
Web Surfing Safety
Email Security
Physical Security
How to report an incident
Contact information
Web Site:
https://security.ufl.edu/
Email:
[email protected]
Cheryl Lyn Granto, CISSP
Information Security Manager
Office (352) 273-3359
[email protected]
Scott Schreiner
Information Security Analyst
Office (352) 273-8497
[email protected]