1. Cyber Awareness Training
Employee Training for Cyber Awareness
Feb 9, 2018
Norfolk County Registry of Deeds IT Department Dan Caparrotta

2. Quotes from IT news articles
Cyber attacks are now ‘business as usual’ for hackers around the world. “The Internet is a bad neighborhood.” “The Internet is riddled with traps.”

3. Cyber Awareness is crucial
Cyber awareness learning and training is central to minimizing the risks to information security.
The methods used by cyber criminals to breach organizational systems and networks prey on human vulnerability.
Our network infrastructure is strong, but the ‘human factor’ of the network also has to be strong.
The users have to act as human firewalls (the bouncers at the door)

4. Comic analogy

5. Agenda Types of risks in glossary form
Malware sites and malware programs
Malware examples
Bad examples
Characteristics of scam s – things to look for in content and attachments
What to do
General principles

6. Terms Phishing/Spear phishing Social Engineering Ransomware Adware
Malvertising
Scareware
Malware
Drive-by Download
Spoofed web page
Trojan horse
Search Engine Poisoning

7. Definition of Terms
Phishing - masquerading as a legitimate organization usually combined with request for information such as passwords or credit card information. Social Engineering - the art of manipulating people into performing actions or divulging confidential information. A gain confidence trick for the purpose of information gathering and fraud. Search Engine Poisoning - deliberate manipulation of search engine indexes. A trap web page will pretend to have information about any popularly searched subject. Ransomware - software that holds the data of a computer user for ransom. Usually asks for currency in the form of Bitcoin to release data.

8. Definition of Terms (continued)
Scareware - displaying false warnings of virus infection to cause shock and anxiety. Some of the time these are just pop-up windows with no actual payload or virus. Drive-by Download – A web application that has been injected with HTML to initiate a background download. Spoofed web page – a web page created as a hoax with the intention of misleading readers that the website has been created by a different person or organization. Trojan horse - A program that is disguised as something benign, such as a screensaver or a video game but contains a virus within.

9. Definition of Terms (continued)
Adware – Software that installs on your computer in order to steer your browser towards affiliate advertisers and marketers without your permission. Malvertising – Malicious online advertising, typically performed by masking malicious computer code with seemingly harmless online advertisements. Malware - Malware is a general term used to refer to any of these variety forms of hostile or malicious software.

10. What do they want? They want your password.
They want your access to your accounts.
They want access to your computer.
They want to gather personal information.
They want to use your computer as a money maker for themselves by:
- turning your PC into a bot member of their own network.
- sending out malicious content from your computer to other computers.
- locking you out of your own files and asking you for ransom money to regain entry
- use your computer’s CPU as a bitcoin miner

11. Example Scareware screen
This screen may not be anything except a web page. But can scare you into proceeding with a next step where after you might click a malicious link or call a phone number.

12. Example Ransomware screen

13. Example Ransomware infection

14. How do these screens appear?
The advertisements shown on your favorite web pages are being bought or hacked into.
Link to a bad website. Website code can attempt to launch many exploits
A malicious attachment was opened
Search engines tricked to present bogus result near the top of your search results (Search Engine Poisoning).
Drive-by Download (exploit where don’t even have to click a link)
Shady websites that give download access to illegal movies, illegal music & pirated software.

15. What to do if a hack screen appears?
Dan and Jim say, PULL THE PLUG Unplug the Network cord and Power Cord
(If the computer is not running, neither is the virus)
Power cord at outlet or
Power cord from behind PC
and
Network wire behind PC

16. Example Phishing email 1

17. Example Phishing email 2

18. Spoofed web page
A phishing linked externally to an exact replica of Kansas State University’s sign-on web page. The page will steal your ID and password if you enter it and “Sign in”. Note the URL highlighted in red – “flushandfloose.nl” which is not the real domain of k-state.edu

19. Shows actual real domain name
Fake web page
hosted in the
Netherlands
(.nl)
Real web page –
Shows actual real domain name

20. How to identify a phishing scam
Characteristics of scam
It asks for private information like a password or account number
Will convey the emotion of urgency, fear tactic, greed or curiosity.
Uses unfamiliar or inappropriate terms like “send your account information to the MAIL CONTROL UNIT” “Webmail Administrator”
The message contains a link where the displayed address differs from the actual web address. (see Spoofed Web page)
Scam s are usually generic or impersonal, such as Dear user, Dear account holder. (This is changing now with hacked data collection, they can custom tailor the messages).

21. How to identify a bad email
Scam s are usually generic or impersonal, such as Dear user, Dear account holder
Bad will have vague or brief content
They take advantage of current news events
Often pose as popular entity that people have account with – Amazon, Bank of America, Facebook. Legitimate s will prove they are real by listing your less known identifiers such as last 4 numbers of account.
Mouse-over the links to show the destination
If unsure of legitimacy, call the company to see if they sent it
Go directly to the site manually in your browser instead of getting there through link.

22. Mouse-Over to check
Not fidelity.com

23. Phishing example Using official logo of HSBC
-Message is brief and vague.
-Greeting is impersonal.
-mousing over the blue text would wrong show destination not HSBC

24. Phishing example 2
The sender; Donald is a known acquaintance but his account has been compromised. Now his account is sending phishing messages to his personal contacts.
-Message is brief and vague. -Greeting is impersonal.
-The mouse-over technique would show the link does not go to Dropbox.com

25. Legitimate email example
Microsoft has verified sender legitimacy by showing green Trusted Shield (available in hotmail)
Providing proof they know you personally/professionally by showing your full name, last 4 digits of real account number and Member Since: info

26. Legitimate attachment example
Legitimate attachment how?
personally identified me.
 identified me professionally.
 I was expecting this.

27. Evaluating attachments
Do not open attachments you were not expecting
If the content of the message is brief, vague, and/or unusual
From someone you do not know
From someone you know, but weren’t expecting them to send you a file (already compromised accounts can send malicious s from the owner of the computer to contacts in their address book)

28. Malicious Attachment example
Avoid this attachment

29. Malicious Attachment attempt (Microsoft Word file) new example March 2016
When you do open an attachment, keep file in view only mode (default setting) and DO NOT enable macros.

30. Example of malicious email subjects and attachments
Some subjects of s with bad intent:
Shipping update for your Amazon.com order
Your Broken message was found and restored ‏
Update your account
Your friend has sent you an invite!
_________________________________________
4 different malicious attachments:
Shipping documents.zip
Your order.ps
Your invoice.doc
Invitation card.zip

31. Evaluating attachments
Ignore or delete it if it’s not expected nor important; not worth the risk of opening it and infecting your computer
Beware of embedded in .zip attachments – it is a common way for hackers to send .exe files that would normally be deleted by systems
If there’s any reason to doubt it might be legitimate, validate the attachment before opening it
Contact the sender and ask if it is legit and that they sent it.
Ask the IT Department to analyze it.

32. General Principles
Neither IT staff nor any legitimate business will EVER ask for your password in an .
Any IT related notifications will come from Dan Caparrotta or Jim Limbey. No other vendor should send alerts.
Think before you click – do not be a victim due to a hasty action.
Be skeptical / be paranoid
Ask I.T. - Don’t be timid about asking the IT Dept to help verify an is legitimate or not.
Do not use the same password for all accounts. Diversify your passwords so that “1 key does not open all doors”.

33. Useful sources of information
The Department of Homeland Security’s own safe internet advice page:
Anti-Phishing Working Group
Teach yourself with Sonicwall’s “Phishing and Spam IQ Quiz” –
Symantec Internet Security Threat Report - A compiled report of the most current examples of the latest malware, phishing and social engineering on the internet