This lecture presents information about cybercrime, which has become the most ubiquitous crime world-wide and affects individuals, companies and government. The lecture indicates that 95% of all cybercrime is preventable and describes a myriad of cyber security techniques that are available to prevent hacking. Legislation to combat cybercrime is presented as well as the places where cybercrime should be reported

Ramson, Amy J

English

City University of New York

City University of New York (CUNY) CUNY Academic Works Open Educational Resources Hostos Community College 2020 Cybercrime and Cyber security Techniques Amy J. Ramson CUNY Hostos Community College How does access to this work benefit you? Let us know! More information about this work at: https://academicworks.cuny.edu/ho_oers/4 Discover additional works at: https://academicworks.cuny.edu This work is made publicly available by the City University of New York (CUNY). Contact: AcademicWorks@cuny.edu An Introduction to CybersecurityCreated By:Cyber Smart YourselfCyber Security & Managed IT Services CONFIDENTIALeztechassist.comPresented By:Shalom CohenCreated For:This OER material was produced as a result of the CUNY Public InterestTechnology initiative.Creative Commons LicenseThis work is licensed under a Creative CommonsAttribution-Noncommercial-Share Alike 4.0Created By:Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comPresented By:Shalom CohenSCohen@eztechassist.comCyber Crime can be avoidedCyber Security & Managed IT Services CONFIDENTIALeztechassist.comOnline Trust Alliance (OTA)Cybersecurity RiskCyber Security & Managed IT Services CONFIDENTIALeztechassist.com66%14%51%93%43%81%MALWAREMISTAKEORGANIZED CRIMESOCIAL ENGINEERINGSOCIAL MEDIAWEAK/STOLEN PASSWORDSHow are Cyber Criminals Exploiting you?Cybersecurity MythsUnderstanding Exploits and ScamsLaws & RegulationCyber Security & Managed IT Services CONFIDENTIALeztechassist.comCybersecurity & MeBest PracticesPersonal Identifiable InformationCybersecurity MythsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comWhy should I bother doing anything?Hackers are not interested in me?Are the apps in the Apple store and Google Play store safe?Do I really need to keep so many passwords?Are websites with the lock symbol safe to use?Is a public WiFi secure if it requires a password?Are email providers (Google & Yahoo) making money from my emails?Cybersecurity MythsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comAre my backups safe?Do I need a separate email if I have a strong bank account password?Will credit monitoring & Fraud alerts protect me?Do I need to shred sensitive documents?Can I be denied critically needed medicine at the hospital?Understanding The ExploitsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comHow do criminals get my money?What do criminals do with my money?How do criminals get my credentials?What do criminals do with my credentials?How do criminals access my computing resources?What do criminals do with my computing resources?Forms of ExploitsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comSocial EngineeringPhishing AttacksEmail PhishingSpear PhishingWhalingEmail accountVoice Phishing a.k.a. VishingSMS PhishingForms of ExploitsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comMalwareCrypto mining & CryptojackingRansomwareSpywareScarewareAdwareTrojansForms of ScamsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comFake Technical SupportGovernment Agency ImpersonationGrandparent ScamVirtual KidnappingUnpaid Utility Bill ScamsOnline Dating ScamsJob ScamsCharity ScamsRobocalling ScamsVictim of a Phishing AttackCyber Security & Managed IT Services CONFIDENTIALeztechassist.comDisconnect from the InternetRestart in Safe ModeBackup your filesChange your account informationFraud Alert & Freeze your creditVictim of a Phishing AttackCyber Security & Managed IT Services CONFIDENTIALeztechassist.comReport the attack to authoritiesFBI – www.ic3.govUS-CERT – www.us-cert.govFTC – www.ftccomplaintassistant.govISP – reportphishing@apwg.orgLocal Law EnforcementIdentity Theft – www.identitytheft.govVictim of a Ransomware AttackCyber Security & Managed IT Services CONFIDENTIALeztechassist.comGather the evidenceDisconnect from the InternetScreenshot of ransom noteDecide to pay (negotiate) or not payRestart in safe modeIdentify the ransomwarewww.nomoreransom.org/crypto-sherrif.php?lang=enReinstall the operating systemReport to AuthoritiesProtecting Your MoneyCyber Security & Managed IT Services CONFIDENTIALeztechassist.comEnable two-factor authenticationCreate unique and complex passwordsCreate a PINMaintain a separate email accountDedicate a secure deviceBookmark your banking websiteUse verified mobile appsEnable security alertsUse the “Chip” when availableProtecting Your Mobile DeviceCyber Security & Managed IT Services CONFIDENTIALeztechassist.comUse securely designed devicesDon’t use jailbroken devicesEnable lock screen codeBiometric risksEncrypt your dataApply updatesBackup to the cloudInstall verified appsProtecting Your Mobile DeviceCyber Security & Managed IT Services CONFIDENTIALeztechassist.comConsider mobile A/V for AndroidEnable ”Find My Device”Beware of unsolicited texts & phone callsThink before you clickProtecting Your Home WiFiCyber Security & Managed IT Services CONFIDENTIALeztechassist.comUse a modern WiFi RouterLock down your WiFi router’s consoleUpdate your SSID name & PasswordUpdate the firmware regularlyApply strong encryption (WPA2)Consider VPN servicesSet up guest networks for visitors and IoTConsider turning off your WiFi when not at homeProtecting Your IoT DevicesCyber Security & Managed IT Services CONFIDENTIALeztechassist.comReview IoT Brands before purchasingReview privacy policiesChange default passwordUpdate the firmware regularlyVerify apps before downloadingConfigure security and privacy settingsSet up a separate WiFi network for your IoTDisable features you don’t needBest Practices – Systems Security• Keep antivirus software active and up-to-date• Keep firewall software active and up-to-date• Keep your operating system and programs up-to-date• Regularly back up critical data• Keep backed up data off-site• Only download verified applications (PC & phone)• Verify smart phone’s apps access rights• Don’t click on links in texts from unknown sendersCyber Security & Managed IT Services CONFIDENTIALeztechassist.comBest Practices – Email & Passwords• Never open unknown attachments or links• Use a secure document-sharing platform• Guard login credentials to email and other services• Use complex passwords• combination of letters, numbers, symbols• Avoid using the same password for multiple accounts• Consider using a password manager• Use two-factor authentication whenever it is available• Avoid doing business over unsecured networks• Never mix work and personal informationCyber Security & Managed IT Services CONFIDENTIALeztechassist.comWhat Needs to be Protected?Most typical business, personal data and records are categorized into the following:Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comPersonally Identifiable Information (PII);Protected health information(PHI);Payments card data (PCI)Personally Identifiable Information (PII);• First and last name, a home or other physical address including street name and name of a city or town• A screen or user name that functions as online contact information• A telephone number• A social security number• A persistent identifier that can be used to recognize a user over time and across different websites or online services• A photograph, video, or audio file, where such file contains an image or a voice• Geolocation information sufficient to identify street name and name of a city or town; or• the individual’s past, present or future physical or mental health or condition• the provision of health care to the individual, or• the past, present, or future payment for the provision of health care to the individualCyber Security & Managed IT Services CONFIDENTIALeztechassist.comFair Credit Reporting Act (FCRA)The Fair Credit Reporting Act (FCRA) is the act that regulates the collection of credit information and the access to credit reports. It was passed in 1970 to ensure fairness, accuracy and privacy of the personal information contained in the files of the credit reporting agencies.Under the FCRA, consumers have the right to:Know what's in their file.• Free file disclosure once per year from each of the major credit bureaus.• Verify accuracy of report when required for employment purposes.• Notification if a file has been used against them.• Dispute and correct information that is incomplete or inaccurate.• Remove outdated, negative information (seven years old or 10 years in the case of bankruptcy).Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comChildren's Online Privacy Protection Act (COPPA)The Children's Online Privacy Protection Act (COPPA) is a law created to protect the privacy of children under 13. The Act was passed by the U.S. Congress in 1998 and took effect in April 2000. COPPA is managed by the Federal Trade Commission (FTC).COPPA requires that site operators allow parents to review any information collected from their children. In practice, this means that any relevant site has to provide full access to all user records, profiles and log-in information when a parent requests it. The FTC has stipulated that parents may delete certain information but may not otherwise alter it.Any Web site that collects information from children under the age of 13 has to abide by COPPA. The Act affects many popular sites like MySpace.com, Facebook.com, Friendster.com, Xanga.com and other social networking siteCyber Security & Managed IT Services CONFIDENTIALeztechassist.comSection 5 FTCSection 5 of the FTC Act, dating back to 1914, prohibits “unfair or deceptive business practices in or affecting commerce.” Not surprisingly for a law passed in 1914, the act does not mention cybersecurity. However, the FTC has long maintained that Congress intended for the word “unfair” to be interpreted broadly and flexibly to allow the agency to protect consumers as technology changes. Most early consumer privacy cases brought by the FTC came under the “deception” prong of Section 5. They targeted companies that gave false data security or privacy representations to their customers through websites or other applications.Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comSarbanes-Oxley / SOX 404Financial auditing of public companiesIncludes auditing of security measures that affect financialreportingLegislation has been introduced to apply to cybersecuritysystems and cybersecurity systems officers the samerequirements regarding corporate responsibility for financialreports and managements assessments of internal controlstructures and procedures for financial reporting as apply topublic companies subject to oversight by the Securities andExchange Commission (SEC)Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comCommon Types of Personal Documents• Bank Statements• Paycheck Stubs• Canceled checks• Monthly and quarterly mutual fund and retirement contribution statements• Credit Card Statements• Medical Bills• Utility Records• Expired Insurance Policies• Supporting Documents for Tax Returns• Accident Reports and Claims• Medical Bills• Property Records and Improvement Receipts• Sales Receipts• Wage Garnishments• Other Tax-Related Bills• CPA Audit Reports• Legal Records• Important Correspondence• Income Tax Returns• Income Tax Payment Checks• Investment Trade Confirmations• Retirement and Pension Records• Car Records• Credit Card Receipts• Insurance Policies• Mortgages, Deeds Leases• Pay Stubs• Sales Receipts• Stock and Bond Records• Warranties and Instructions• Other Bills• Depreciation Schedules and Other Capital Asset RecordsCyber Security & Managed IT Services CONFIDENTIALeztechassist.com’;--have I been pwned?Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comhttps://haveIbeenpwned.comSo What’s Next?Cyber Security & Managed IT Services CONFIDENTIALeztechassist.comOpen Source Security ToolsCyber Security & Managed IT Services CONFIDENTIALeztechassist.comNmapCyber Security & Managed IT Services CONFIDENTIALeztechassist.comNmap - map your network and ports with the number one port scanning tool. Nmap now features powerful NSE scripts that can detect vulnerabilities, misconfiguration and security related information around network services.OpenVASCyber Security & Managed IT Services CONFIDENTIALeztechassist.comOpenVAS - open source vulnerability scanning suite that grew from a fork of the Nessus engine when it went commercial. Manage all aspects of a security vulnerability management system from web based dashboards.The primary reason to use this scan type is to perform comprehensive security testing of an IP address. It will initially perform a port scan of an IP address to find open services. Once listening services are discovered they are then tested for known vulnerabilities and mis-configuration using a large database (more than 53000 NVT checks). The results are then compiled into a report with detailed information regarding each vulnerability and notable issues discovered.WireSharkCyber Security & Managed IT Services CONFIDENTIALeztechassist.comWireshark - view traffic in as much detail as you want. Use Wireshark to follow network streams and find problems. Tcpdump and Tshark are command line alternatives. Wireshark runs on Windows, Linux, FreeBSD or OSX based systems.• Detect anomalous behaviour that could indicate malware• Search for unusual domains or IP address endpoints• Use IO graphs to discover regular connections (beacons) to command and control servers• Filter out the "normal" and find the unusual• Extract large DNS responses and other oddness which may indicate malwareWireShark.orgKali LinuxCyber Security & Managed IT Services CONFIDENTIALeztechassist.comKali Linux - was built from the foundation of BackTrack Linux. Kali is a security testing Linux distribution based on Debian. It comes prepackaged with hundreds of powerful security testing tools. From Airodump-ng with wireless injection drivers to Metasploit this bundle saves security testers a great deal of time configuring tools.Kali.orgShodanCyber Security & Managed IT Services CONFIDENTIALeztechassist.comUse Shodan to discover which of your devices are connected to the Internet, where they are located and who is using them.shodan.ioWebsites are just one part of the Internet. There are power plants, Smart TVs, refrigerators and much more that can be found with Shodan!(888) 859-2688support@eztechassist.comCyber Security & Managed IT ServicesCONFIDENTIALeztechassist.com

Cybercrime and Cyber security Techniques

https://academicworks.cuny.edu/cgi/viewcontent.cgi?article=1003&context=ho_oers

Cybercrime and Cyber security Techniques

Abstract

Similar works

Full text

Available Versions

City University of New York