1. Protecting your digital identity Nik Talati, Stan Patterson

2. Overview While at work, your computer is protected using several techniques including antivirus software, central updates, authentication, filters and firewalls. At home, we must be aware of ways to protect our identity and information. There are additional factors that affect home computing: Shared computer often with kids Responsible for updates and antivirus software Lack of passwords or strong passwords Online banking and purchasing

3. Be aware of… Sharing your personal information Sharing your personal information Phishing Phishing Hacking Hacking Social networking web sites Social networking web sites P2P file sharing P2P file sharing Secure web sites (https) Secure web sites (https) Anti-virus and anti-spyware software Anti-virus and anti-spyware software Operating system and browser updates Operating system and browser updates Wireless networks Wireless networks

4. Sharing your personal information SSN, Credit card #, username/password, birthday, challenge question & answer, etc SSN, Credit card #, username/password, birthday, challenge question & answer, etc No legitimate and reputable organization will ask for personal information via email No legitimate and reputable organization will ask for personal information via email Be wary of people asking for such information: why they need it? Be wary of people asking for such information: why they need it? Never email sensitive information. Call. Never email sensitive information. Call. Verify identity of online merchant Verify identity of online merchant

5. Phishing (Goucher example) From: "helpdesk@goucher.edu" Date: May 13, 2009 11:32:06 AM EDT To:..@... Subject: [spam]Important Notice Reply-To: <> helpdesk@goucher.edurobert.maguire@eircom.nethelpdesk@goucher.edurobert.maguire@eircom.net Dear goucher.edu User Your email account has been used to send numerous Spam mails recently from a foreign IP. As a result, the goucher.edu has received advice to suspend your account. However, you might not be the one promoting this Spam, as your email account might have been compromised. To protect your account from sending spam mails, you are to confirm your true ownership of this account by providing your original Username (*******) and Password (*******) as a reply to this message. On receipt of the requested information, the "goucher.edu" web email support shall block your account from Spam. Failure to do this will violate the goucher.edu email terms & conditions. This will render your account inactive. NOTE: You will be send a password reset message in next seven (7) working days after undergoing this process for security reasons. Thanks for using goucher.edu Goucher College Education Without Boundaries, Webmail Access (Powered By Eircom). (c) 2009 Goucher College Education Without Boundaries, All rights reserved

6. Phishing (example) Dear USAA Member, During our regular update and verification of the accounts, we could not verify your current information. Either your information has changed or it is incomplete. As a result, your access to online banking on USAA has been restricted. To start using fully your online account, please update and verify your information by clicking the link below : http://www.ptcnets.com Thank you for your prompt attention to this matter. Regards, USAA Inc.

7. Phishing (example) Dear Navy Federal Credit Union customer, We at Navy Federal Credit Union, would like to remind you that your Navy Federal Credit Union Account has not been updated to the latest Online Access Agreement for Navy Federal Credit Union Online Services. In order for us, at Navy Federal Credit Union to guarantee your online security, you need to update your account information. We urge you to partner with us to prevent consumer fraud, by going through the 2 steps Wells Fargo Account Confirmation process. This operation involves logging in and confirming your identity over a secure connection at: https://online.navyfcu.org/signon?SIGNON_XCP=1010 https://online.navyfcu.org/signon?SIGNON_XCP=1010 After completing this process, you will be informed that your account has been updated and you will be redirected to the actual Online Access Agreement, for you to review. https://online.navyfcu.org/signon?SIGNON_XCP=1010 Thank you for choosing Navy Federal Credit Union as your Financial Institution. When you use Navy Federal Credit Union Online ® or Navy Federal Credit Union Business Online ® Banking, we guarantee that you will be covered 100% for any funds improperly removed from your Navy Federal Credit Union accounts, while we are handling your transactions, subject to your responsibility, described below. © 1999 - 2005 Navy Federal Credit Union Bank. All rights reserved.

8. Phishing (example) Dear PayPal® member, It has come to our attention that your PayPal® account information needs to be updated as part of our continuing commitment to protect your account and to reduce the instance of fraud on our website. If you could please take 5-10 minutes out of your online experience and update your personal records you will not run into any future problems with our online service. However, failure to update your records will result in account suspension. Please update your records. Once you have updated your account records, your PayPal® account activity will not be interrupted and will continue as normal. Click here to update your PayPal account information Click here to update your PayPal account information

9. Social networking web sites Facebook, Myspace, Bebo, LinkedIn, Orkut, Zorpia, etc. Facebook, Myspace, Bebo, LinkedIn, Orkut, Zorpia, etc. The content posted on the site stays on the server even after you disable your account and is searchable The content posted on the site stays on the server even after you disable your account and is searchable Unknown person can pretend to be your friend and get access to your posts and virtual wall Unknown person can pretend to be your friend and get access to your posts and virtual wall Can be a source of spam, adware and spyware Can be a source of spam, adware and spyware

10. Hacking Gaining unauthorized access to your computer Gaining unauthorized access to your computer Why interested in a basic home user’s pc? Why interested in a basic home user’s pc? Steal personal information stored on your computer Steal personal information stored on your computer But, more importantly use your network as a launch pad for malicious activities But, more importantly use your network as a launch pad for malicious activities By Brian Krebs | May 26, 2009; The Washington Post

11. An example of malicious code inserted into a MSNBC sports webpage Tools like McAfee site advisor can be handy in determining if the site is safe A hacker had placed a malicious JavaScript file into the website’s Source code Even reputable site might not be safe at times

12. SSL (https) Secure Socket Layer encrypts the data between the user machine and the server Secure Socket Layer encrypts the data between the user machine and the server Always log off and close the browser after your transaction is completed Always log off and close the browser after your transaction is completed Prefer to shop at the web sites that offers google, paypal, safepass, etc. check outs Prefer to shop at the web sites that offers google, paypal, safepass, etc. check outs Browsers are populated with commonly used certificate authorities

13. P2P file sharing Gnutella, KaZaA, Napster, iMesh, LimeWire, Morpheus, SwapNut, WinMX, AudioGalaxy, Blubster, eDonkey and BearShare Gnutella, KaZaA, Napster, iMesh, LimeWire, Morpheus, SwapNut, WinMX, AudioGalaxy, Blubster, eDonkey and BearShare Primarily used to exchange pirated music, video, and software. Primarily used to exchange pirated music, video, and software. Many files shared in the P2P network contain viruses, worms, Trojan horses, & spyware. Many files shared in the P2P network contain viruses, worms, Trojan horses, & spyware. By installing P2P software, the user is required to allow access to their personal computer. This has lead to the unintended access of banking and tax informrtion. By installing P2P software, the user is required to allow access to their personal computer. This has lead to the unintended access of banking and tax informrtion. The Recording Industry Association of America (RIAA) has started lawsuits against individuals and businesses over this "sharing" of copyrighted material. The Recording Industry Association of America (RIAA) has started lawsuits against individuals and businesses over this "sharing" of copyrighted material.

14. Antivirus, Antispyware, & Firewalls  Protect yourself against viruses and Trojan horses that may steal or modify the data on your own computer and leave you vulnerable  Make sure to keep your virus definitions up to date  Make sure to keep your firewall enabled  Run regular virus and spyware scans  McAfee AV and AS free to all Goucher Community  Other free offerings: ◦ AVG-Free Antivirus http://free.grisoft.com/ http://free.grisoft.com/ ◦ SpyBot Search & Destroy http://www.safer-networking.org http://www.safer-networking.org ◦ Ad-Aware http://lavasoft.com/ http://lavasoft.com/ ◦ McAfee SiteAdivsor http://www.siteadvisor.com/ http://www.siteadvisor.com/

15. Update Your Operating System Windows, Mac, and Linux. Windows, Mac, and Linux. Internet Explorer, Firefox, and Safari. Internet Explorer, Firefox, and Safari. Adobe Flash Player, Adobe Shockwave, and Java Adobe Flash Player, Adobe Shockwave, and Java They all need updates!!! Updates address: Updates address: Security by fixing vulnerabilities Security by fixing vulnerabilities Functionality by fixing software bugs Functionality by fixing software bugs

16. Wireless Networks - Home Steps to a secure network Steps to a secure network Use the setup disk and select the secure options Use the setup disk and select the secure options Do not broadcast network name Do not broadcast network name Enable security/encryption Enable security/encryption WPA2 – Best WPA2 – Best WEP – Better WEP – Better None – Bad None – Bad Enable MAC address filtering Enable MAC address filtering More Secure More Secure Hard to maintain Hard to maintain

17. What can happen if I don’t secure my wireless network?