THINK BEFORE YOU CLICK!

1. THINK BEFORE YOU CLICK! Cyber Security is everybody’s responsibility Don Winaker Network Security Manager dwinake1@jhu.edu

2. We know what those thieves are after. But Johns Hopkins isn’t a store or a bank. What would people want to steal from us?

5. 84.2% of all incoming email messages are dropped due to SPAM, viruses, phishing, etc. Inbound network connections blockeddue to malware* Per Day: 4,000,068 Per Hour: 166,669 Per Second: 46 Per Day: 88,405 Per Hour: 3,684 Per Second: 1 • Unauthorized attemptsto access our internal networks blocked Outboundnetwork connections blockeddue to malware* Per Day: 75,545,460 Per Hour: 3,147,727 • Per Second: 874 Per Day: 882,310 Per Hour: 36,763 • Per Second: 10 Johns Hopkins has technology in place that deflects many attacks

6. Technology can provide prevention and detection Technical Tools • Can’t reason or exercise judgment • Can only detect broad trends • Must quickly sort through more than 2 billion daily events • Have to be configured, monitored, and maintained by … people! Technology is great and has made our lives and jobs easier, but …

7. What is Johns Hopkins Network Security doing today ? • Extensive Deployment of Cisco Firewalls • Automated Blacklisting • Nessus Vulnerability scanning • Sourcefire Intrusion Detection and Prevention systems installed • JWatch – Intel Security incident and Event Management • LanCope – network traffic flow monitoring Is this enough ?

8. Technology can’t do it all Humans • Can make connections between different pieces of information that don’t seem related but indicate a trend • Can recognize when seemingly normal behavior just doesn’t look or sound quite right • Can adapt quickly to new information and emerging attacks and threats • Provide a principal preventive control People are the first and most important line of cyber defense

9. If you know where to look and have the right level of access, vast amounts of information are available with just one click People hold the keys to the kingdom What are the most common types of attack? Social Engineering Phishing Malware

10. SOCIAL ENGINEERING • Type of confidence trick or con job • Uses psychological manipulation to trick people to bypass normal security procedures • Often relies on natural helpfulness of people • One step in a more complex fraud scheme • From 2009-2011, 48% of large businesses suffered attacks costing between $25,000-$100,000 per incident How do cyber criminals try to get information from us?

11. PHISHING SPEAR PHISHING • Often sent in an email • Pretends to be from an official source • Directs users to enter credentials into a fake web site • Warn or threaten of consequences for failure to act • Targeted phishing attack • Attacker has specific target in mind • Uses details about the target to sound more legitimate • May present a problem and try to elicit sympathy and get a helpful response How do cyber criminals try to get our login credentials?

12. How can you tell if it’s phishing? • Asks you to reply to an email or go to a web site and enter in personally identifiable information • Asks you to click a link to install software (malware) • Directs you to a URL that is not a Johns Hopkins address (but might look like one) or starts with an IP address • Creates a sense of urgency by warning or threatening that something bad will happen if you don’t comply • Is badly written, including misspelled words or poor grammar Be skeptical when you read email

13. Phishing email examples

14. MALiciousSoftWARE • Gets installed on your system and performs unwanted tasks • Designed to disrupt, damage, stealinformation, take control, create bots • Many different types: • Virus and worm (infectious) • Rootkit, Trojan Horse, Backdoor (RAT – remote access tool) • Keylogger, Spyware (steal information) • Ransomeware (extortion) • Dialer, Adware (generate funds) • Hybrids and variations If you never fall for a phishing attack then you are safe, right?

15. You could usually avoid malware if you were careful with your email

17. 90% of malware comes from web browsing today – only 6% comes from email • The biggest threat to corporate networks is employees clicking on infected web pages A 'drive-by-download' attack is a malware delivery technique that is triggered just because you visited a website. You don’t need to click or accept any software, and the malicious code can download in the background to your device. But not anymore

18. Drive-by download attack • One of the top 600 most popular web sites on the Internet – Law of Large Numbers • Used the RedKit exploit kitto look for vulnerable versions of Adobe Reader, Acrobat, Java • Vulnerable computers were infected with malware: • Citadel (spyware) targets financial account details • ZeroAccess (adware) generates fake pay-per-view revenues for botnet controllers or their clients • This version of Citadel was at the time only recognized by 3 out of the 46 antivirus programs on virustotal.com Anatomy of the NBC.com Infection

19. McAfee Labs catalogs 100,000 new malware samples every day - 69 new pieces of malware a minute!

20. Number of unsafe websites detected by Google Google blocks 10,000 per day, and 42,000 new malware sites are detected each week But I’m safe since I only visitlegitimate web sites!

21. Top 10 Infected Web Site Types 80% are legitimate sites Mainstream Websites More Likely to Harbor Malware 1.   Blogs 19.8% 2.   Web hosting 15.6% 3.   Business and economy 10% 4.   Shopping 7.7% 5.   Education and reference 6.9% 6.   Technology, computer, Internet 6.9% 7.   Entertainment and music 3.8% 8.   Automotive 3.8% 9.   Health and medicine 2.7% 10.  Porn 2.4% 2013 Cisco Annual Security Report

22. Keep application and operating system patches up-to-date • Don’t click on unknown links or attachments • Don’t trust sites that ask for your cell phone number or require you to create a login account • Keep anti-virus/anti-spyware up to date Malware Bottom Line

23. The internet is overwhelmingly a power for good It provides cheap and easy access every moment of every day to vast amounts of information and entertainment, and it is transforming the nature of government and commerce. However …

24. You hold the keys to the kingdomTHINK BEFORE YOU CLICK! Cyber Security is everybody’s responsibility

25. Questions? Don Winaker Network Security Manager dwinake1@jhu.edu