Contenu connexe


Securing & Safeguarding Your Library Setup.pptx

  1. Securing & Safeguarding Your Library Setup Brian Pichman Twitter: @Bpichman
  2. Agenda • Understanding Anonymity, Privacy, and Everything in Between • Protecting Yourself • Getting Hacked • Best Security Tool: A Policy That Is Followed • Tools for Protecting Your Network
  3. Cloak of Invisibility Anonymous Browsing tools like the Tor Project
  4. Cloak of Invisibility Top reasons why people want to hide their IP address: 1. Hide their geographical location 2. Prevent Web tracking 3. Avoid leaving a digital footprint 4. Bypass any bans or blacklisting of their IP address 5. Perform illegal acts without being detected
  5. Onion Routing, Tor Browsing • Technique for anonymous communication to take place over a network. The encryption takes place at three different times: • Entry Node • Relay Node • Exit Node • Tor is made up of volunteers running relay servers. No single router knows the entire network (only its to and from). • Tor can bypass internet content filtering, restricted government networks (like China) or allow people to be anonymous whistle blowers. • Tor allows you to gain access to “.onion” websites that are not accessible via a normal web browser. • Communication on the Dark Web happens, via Web, Telnet, IRC, and other means of communication being developed daily.
  6. Cloak of Invisibility How do you Hide an 800lb Gorilla? • Use Free Wifi (To Hide your location) • Use a Secure Web Browser • Use a Private VPN • Go back to Dial-up • Setup RF Data Transfer over CB Radio Waves • Use Kali linux to hack someone else’s Wifi Encryption. • Setup long-range Wireless Antennas
  7. Cloak of Invisibility • How to hide yourself? • Private VPN • You want a TOTALLY anonymous service. • Look for one that keeps no log history (Verify via reviews) • Look at Bandwidth & Available Servers • Recommendations: • Private Internet Access (PIA) • TorGuard VPN • Pure VPN • Opera Web Browser • Avast AntiVirus (SecureLine) • Worst Case: Free WIFI
  8. Cloak of Invisibility • How Tor anonymizes – “You”. • How VPN keeps ”You” protected.
  9. Dial Up? • Use an ISPs like NetZero that can be registered with fictitious personal information, and to which you can connect with caller ID disabled • Makes it a bit more difficult to identity “you”
  10. Free WiFi • Sometimes a good alternative if you need to do something anonymously • Nothing is ever 100% anonymous • Some public wifi does track websites you access, what you do, etc. • Make sure your computer name you are using doesn’t include your actual name
  11. Hacked WiFi – Cain and Abel
  12. Best Tips and Practices Do • Use a device that you’ve never signed into anything ”personal on”. • Pro Tip: buy a computer from a Pawn Shop or Garage Sale Don’t • While on a VPN or any other anonymous tool; don’t sign into personal accounts (banks, social media, etc). • If posting, don’t use anything that could be associated to you
  13. Easy Wins for Privacy • 10 Minute Email • • Temporarily get an email box that’s anonymous and disappears after 10 minutes • Dr Cleaner (Mac) or Eraser (Win) can overwrite files on your computer with “blank” data to make file recovery near impossible. • Tools like Recuva is free softwares to allow you to restore deleted files.
  14. What People Pay For Your Data • data.html • Credit Card Numbers: 50 cents to 2.50 per card. • Bank Account Information (logins/information): $1.00 to $70 • Medical Records: $10-$20
  15. Protecting Yourself
  16. Google Isn’t Always Your Friend
  17. Tools For Use • Sites to protect yourself all the time (not free) • • • Sites to monitor when breached data gets related (this is free) • • Password Management Sites (like • Don’t have the same password for all your sites. • Don’t write your passwords down on a post-it-note and leave it at your desk
  18. Dual Factor Authentication • After logging in; verify login via Email, SMS, or an app with a code.
  19. Credit Card Tools for Online Shopping • Check out Privacy.Com • shameless plug
  20. Basic Tips • Accept only people you know to personal and professional accounts • Never click on links from people you don’t know. • Especially if they are using a url shortner:,, etc • - test the website to see if its safe • gets a screenshot of what will load on the site • get a screenshot of what will load on site • If there are people claiming to be you on social media, it’s best to get your account “verified” on those social media platforms • This lets users distinguish that you’re the actual official account • Dual factor authenticate all of your social media logins
  21. Checking Your Accounts / Name Online • Use this site to check your usernames: • The next is a tool searches through your email with things you may have signed up for (I've paid for their premium service as well, not really worth it, the free does just fine) • This tool: searches public searches to see what links. Its similar to
  22. Myths • I’m/my library not worth being attacked. • Hackers won’t guess my password. • I/we have anti-virus software. • I’ll/we know if I/we been compromised.
  23. Understanding Breaches and Hacks • A hack involves a person or group to gain authorized access to a protected computer or network • A breach typically indicates a release of confidential data (including those done by accident) • Both of these require different responses if breaches/hacks occur.
  24. The Costs Of Breaches • This year’s study found the average consolidated total cost of a data breach is 3.9 million dollars and in the US the average is actually higher at 8.19 million. [IBM 2019] • Data Breached Companies Experience… • People loose faith in your brand • Loss in patrons • Financial Costs • Government Requirements, Penalties, Fees, etc. • Sending of Notifications • Payment of Identity Protection or repercussions.
  25. Top Hacker Tools • #1 Metasploit. • #2 Nmap. • #3 Acunetix WVS. • #4 Wireshark. • #5 oclHashcat. ... • #6 Nessus Vulnerability Scanner. ... • #7 Maltego. ... • #8 Social-Engineer Toolkit.
  26. BackTrack can get you ALOT • BackTrack was a Linux distribution that focused on security based on the Knoppix Linux distribution aimed at digital forensics and penetration testing use. In March 2013, the Offensive Security team rebuilt BackTrack around the Debian distribution and released it under the name Kali Linux.
  27. Why have a policy? Staring Will Ferrell ….
  28. Increases Efficiency • Having a security policy allows you to be consistent in your approach to issues and how processes should work. • It should outline how and what to do, and repeatable across your organization. • Everyone is doing XYZ the same way and on the same page.
  29. Accountability, Discipline, and Penalties • Think of it as a contract – for legal purposes – that you have taken the steps needed to secure your organization. • Need to define penalties when violations occur. People need to know the consequences are for failure to comply – both from a legal and HR standpoint or even access permissions. • Policies and procedures provide what the expectation is and how to achieve that expectation. It should define what the consequence are for failure to adhere.
  30. Education For Employees • By reading these policies (and signing them), it helps educate your employees (and users) the sense of ownership for assets and data. • Everything from advice on choosing the proper passwords, to providing guidelines for file transfers and data storage, internet access and rules, will help to increase employees’ overall awareness of security and how it can be strengthened
  31. Addresses Threats and Risks • A good policy should address all threats, strategies to decrease the vulnerabilities of those threats, and how to recover if those threats became actionable. • This makes the “what do we do if someone hacks our network” a defined process already and who to call and what to do to mitigate further damage.
  32. Access Definitions and Permissions • A good policy would outline who accesses what and why. This makes reporting a security violation easier and streamlined. • Policies are like bouncers at a night club • It states who has access to the VIP section of the club, why, and any reasons to allow entry. • Without these rules, VIP wouldn’t be really VIP.
  33. Protecting Your Library you threats Delicious Library Data
  34. Why do People Attack? • Financial Gain • Stocks • Getting Paid • Selling of information • Data Theft • For a single person • For a bundle of people • Just Because • Malicious
  35. How to navigate and prevent wrong turns • Who are the people we’re trying to avoid? Hacker Groups • Lizard Squad. ... • Anonymous. ... • LulzSec. ... • Syrian Electronic Army. ... • Chaos Computer Club (CCC) ... • Iran's Tarh Andishan. ... • The Level Seven Crew. ... • globalHell.
  36. So what Do You Need to Protect? • Website(s) • ILS • Staff Computers • And what they do on them • Patron Computers • And what they do on them • Network • And what people do on them • Stored Data, Files, etc. • Business Assets • Personal Assets • ….anything and everything that is plugged in…
  37. Outside • Modem Router Firewall Switches • Servers End User • Phones • Computers • Laptops
  38. Outer Defenses (Routers/Firewalls) • Site to Site Protection (Router to Router or Firewall to Firewall) • Encrypted over a VPN Connection • Protection With: • IDS • IPS • Web filtering • Antivirus at Web Level • Protecting INBOUND and OUTBOUND
  39. Unified Threat Management • Single Device Security • All traffic is routed through a unified threat management device.
  40. Areas of Attack On Outer Defense External Facing Applications • Anything with an “External IP” • NAT, ONE to ONE, etc. • Website • EZProxy Connection • Custom Built Web Applications or Services Internal Applications • File Shares • Active Directory (usernames / passwords) • Patron Records • DNS Routing • Outbound Network Traffic • Who is going where
  41. Attacks • Man in the Middle • Sitting between a conversation and either listening or altering the data as its sent across. • DNS Spoofing ( lan-redirect-traffic-your-fake-website-0151620/) set up a fake website and let people login to it. • D/DoS Attack (Distributed/Denial of Service Attack) • Directing a large amount of traffic to disrupt service to a particular box or an entire network. • Could be done via sending bad traffic or data • That device can be brought down to an unrecoverable state to disrupt business operations. • Sniffing Attacks • Monitoring of data and traffic to determine what people are doing.
  42. Inner Defenses (Switches/Server Configs) • Protecting Internal Traffic, Outbound Traffic, and Inbound Traffic • Internal Traffic = device to device • Servers • Printers • Computers • Protected By: • Software Configurations • Group Policy • Password Policy • Hardware Configurations • Routing Rules
  43. Updates, Patches, Firmware • Keeping your system updated is important. • Being on the latest and greatest [software/update/firmware] isn’t always good. • Need to test and vet all updates before implementation • If you can – build a dev environment to test and validate.
  44. Casper Suite / JAMF -
  45. SCCM tools
  46. Protecting End Devices • Protecting Assets • Business Assets • Thefts • Hacking • Personal Devices • Security Risk • Usually pose an INBOUND threat to your network
  47. Passwords • Let’s talk about Passwords • Length of Password • Complexity of password requirements • DO NOT USE POST IT NOTES • A person’s “every day account” should never have admin rights to machines. • That includes your IT Folks!
  48. Your Security is as Strong As the Weakest Link
  49. Tools To Train • Knowbe4
  50. Pulling Everything Together • Do A Risk Assessment • Develop Policies • Training Plans For Staff • Implement tools to help rotect
  51. IT Admin Tricks for Security • Administrative Accounts are easy to figure out if they are something like “administrator” ”root” or “power users”. At the same time, no employee should have their account as a full admin. • Instead, give them their own username for admin access (like brian.admin) • Change the default “login” pages for sites to something that’s not Bots look for this and attack. • My Drupal Site login page is • User Awareness is key to any secure organization. Teach users how to identify potential threats and how to respond quickly. • Avoid shared accounts. One account should only be used by one person.
  52. “Cool” Hardware Be careful when plugging your device in o public USB Outlet… Either read the data on your device OR Record your screen ->
  53. Credit Card Skimmers
  54. Some Recommended Security Tools
  55. ESET Products
  56. Sophos Home
  57. Proactive Scanning • Malwarebytes (Free):
  58. Proactive Cleaning • CCleaner ( ) • CleanMyMac ( )
  59. How About Your Network?
  60. Web Security – No Installs Needed
  61. Parental Controls
  62. Email for Kids • There are service providers that can help manage kid’s emails and help protect them. • Google has an option where you can manage a Google Account for your child:
  63. Apple iOS Parental Controls • •
  64. Microsoft Families •
  65. Google Families • •
  66. App Based Monitoring
  67. • Evolve Project • • Twitter: @bpichman • Email: Brian Pichman Questions?

Notes de l'éditeur

  3. These are also the people that use TorBrowser as well to hide themselves
  4. Infrastructure: Network (Switches, Routers, Firewalls, Modem) WiFi Network VPN Connections Servers (File Storage, Active Directory, Application Servers). Phone System, Security System, Website, etc. End Clients End User PCs and other Peripherals Copiers, Scanners, Printers Software