1. Cybersecurity @ NKU James Walden Director of the CIS http://cis.nku.edu/

2. We all have Assets http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/

3. Who are the threats? Hacktivists VandalsCriminals Spies

4. Components of Security Integrity ConfidentialityAvailability

5. States of Information 1.Storage: information in permanent storage (disk or tape) that is not currently being accessed. 2.Processing: information in memory (RAM or cache) that is currently being used by a program. 3.Transmission: information in transit between one node and another on a network.

6. Attack Surface System surface The attack surface of a system consists of the ways in which a threat can enter the system. 1. Methods 2. Channels 3. Data Attacks Entry/Exit Points Methods are code components that receive input. Channels are avenues of communication (sockets, environment, keyboard, files, etc.) Data are the actual input strings.

7. Automotive Attack Surface

8. Firewalls reduce Attack Surface Firewall Port 80 HTTP Traffic Web Client Web Server Application Database Server telnet ftp

9. Vulnerabilities

10. SQL Injection – Illustrated Firewall Hardened OS Web Server App Server Firewall Databases Legacy Systems Web Services Directories Human Resrcs Billing Custom Code APPLICATION ATTACK Network Layer Application Layer Accounts Finance Administration Transactions Communication Knowledge Mgmt E-Commerce Bus. Functions HTTP request  SQL query  DB Table   HTTP response   "SELECT * FROM accounts WHERE acct=‘’ OR 1=1-- ’" 1. Application presents a form to the attacker 2. Attacker sends an attack in the form data 3. Application forwards attack to the database in a SQL query Account Summary Acct:5424-6066-2134-4334 Acct:4128-7574-3921-0192 Acct:5424-9383-2039-4029 Acct:4128-0004-1234-0293 4. Database runs query containing attack and sends encrypted results back to application 5. Application decrypts data as normal and sends results to the user Account: SKU: Account: SKU

11. Malware

12. Malware is a Growing Threat

13. Botnets

14. CAE in IA/CD Center of Academic Excellence in – Information Assurance and – Cyber Defense Only CAE in Kentucky; only IA/CD in region. Benefits – Scholarship for Service program eligibility. – Employers look for CAE graduates. – Cybersecurity certificate.

15. Cybersecurity Certificate INF 282: Introduction to Databases BIS 382: Principles of Information Security CIT 247: Networking Fundamentals CIT 371: UNIX Systems CIT 480: Securing Computer Systems CIT 481: Cybersecurity Capstone

16. Ugrad Cybersecurity Classes CSC 482: Computer Security CSC 483: Cryptology CIT 430: Computer Forensics CIT 480: Securing Computer Systems CIT 481: Cybersecurity Capstone CIT 484: Network Security BIS 382: Principles of Information Security