Hands-on workshop on information security basics: - how to think about security - threat modelling / risk assessment - authentication - device security Handouts: https://drive.google.com/file/d/13FZBhEY2kSsThkq7-5fTXf8eqGaSI5pg/view?usp=sharing

1. information
SECURITY
for publishers

2. Paul Schreiberpaulschreiber@gmail.com
@paulschreiber

9. tradeoffs

10. continuum

11. average people✔

12. under government surveillance
whistleblowers
political campaigners
activists
celebrities
victims of stalking and violence

13. encrypted email (PGP, GPG)
messaging (Signal)
SecureDrop
Physical security
VPNs
Tor

14. Tails
Social media
Airgap
Firmware passwords
On-premises vs cloud

15. corporate espionage
criminal gangs
zero-day exploits
Mossad, CIA, MI6, NSA

16. password reuse✔
password guessing✔
lost and stolen devices✔
phishing✔

18. threat
model

21. how much they want to know
howmuchyoucare
$$$$$$
0 $

22. assets

23. adversaries

24. capabilities

25. consequences

26. defenses

29. memorizing
passwords

30. password
managers

32. Create View Edit Delete Web Sync 2FA Mac Windows Linux iOS Android
Chrome ✔ ✔ ✘ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔ ✔
Firefox ✘ ✔ ✔ ✔ ✘ ✔ ✘ ✔ ✔ ✔ ✔ ✔
Safari ✔ ✔ ✔ ✔ ✘ ✔ ✔ ✔ ✘ ✘ ✔ ✘
browser password management

34. Preferences > Passwords

36. chrome://flags

37. chrome://settings/passwords

39. about:preferences#privacy

40. security
questions

41. “security”
questions

42. password
policies

43. NIST Special
Publication
800-63BDigital Identity Guidelines
Authentication and Lifecycle Management

44. § 5.1.1.2
Verifiers SHALL require subscriber-chosen memorized secrets
to be at least 8 characters in length. Verifiers SHOULD permit
subscriber-chosen memorized secrets at least 64 characters in
length.
length

45. composition
§ 5.1.1.2
All printing ASCII [RFC 20] characters as well as the space
character SHOULD be acceptable in memorized secrets.
Unicode [ISO/ISC 10646] characters SHOULD be accepted as
well.
Verifiers SHOULD NOT impose other composition rules (e.g.,
requiring mixtures of different character types or prohibiting
consecutively repeated characters) for memorized secrets.

46. § 5.1.1.2
Verifiers SHOULD NOT require memorized secrets to be
changed arbitrarily (e.g., periodically).
rotation

47. password
sharing

48. password
resets

51. know

52. are

53. have

69. backup
codes

70. device
migration

72. WordPress
VIP

93. Many graphics from The Noun Project
Bear by Gan Khoon Lay; Computer Fire by Ian Ransley; Computer by Azis; Credit
card Gonzalo Bravo; Fingerprint by Ben Davis; Lock with keyhole by Brennan
Novak; Marker by Jeff Seevers; Nokia 3310 by Stan Fisher; Notification by vijay
sekhar; Shield by Wayne Thayer; Spy by Alen Krummenacher; iPhone by Ross
Sokolovski.