Chapter 21. Security

This chapter covers the following subjects:

Common Security Threats and Vulnerabilities—Discover the wide variety of electronic, physical, and human vulnerabilities that can be targeted by data thieves, both human and virtual.

Common Prevention Methods—Discover how to implement protection at a physical and digital level as well as safeguarding the human element.

Windows Basic Security Settings—Learn the basic security features built into Windows and how they work.

Best Security Practices for Workstations—From data encryption to password best practices, discover the policies that help keep workstations on a network safe.

Securing Mobile Devices—Smartphones and tablets can be exploited by malware and human data thieves. This section discusses how to stop them.

Data Destruction and Disposal Methods—In this section, you learn how to destroy data and, when necessary, the devices that store the data to prevent it from being exploited when storage devices and media are retired.

SOHO Network Security—A small office/home office network could be the pathway to a large-scale attack if it isn’t secured. Discover the methods needed to help lock down both wired and wireless networks.

Server rooms, networks, desktops, laptops, and mobile devices provide access to financial data and personal information for businesses, governments, organizations, and individuals all over the world. And, thanks to the interconnected nature of the Internet, a security breach of a single device or network can lead to identity theft, electronic embezzlement, and other threats to the financial and personal lives of millions.

In this chapter, you learn about the multi-faceted threats to security in the modern computing environment and how to deal with them.

220-902: Objective 3.1 Identify common security threats and vulnerabilities.

220-902: Objective 3.2 Compare and contrast common prevention methods.

220-902: Objective 3.3 Compare and contrast differences of basic Windows OS security settings.

220-902: Objective 3.4 Given a scenario, deploy and enforce security best practices to secure a workstation.

220-902: Objective 3.5 Compare and contrast various methods for securing mobile devices.

220-902: Objective 3.6 Given a scenario, use appropriate data destruction and disposal methods.

220-902: Objective 3.7 Given a scenario, secure SOHO wireless and wired networks.

Figure 21-2 illustrates a typical phishing e-mail.

Not updated with the latest security patches for the operating system and apps

No password or have weak, easily guessed passwords

Outdated or no antivirus or anti-malware app

No use of encryption to protect data storage or file transfers

No use of digital certificates to sign websites

No limitations on removable media such as USB or rewriteable optical drives

No use of SSL or other security measures on websites

No e-mail spam filters

No network-based security

No wireless security or weak WEP encryption

No user training in how to implement security best practices

For more details on many of the items in this list, see www.zdnet.com/article/10-security-best-practice-guidelines-for-businesses/.

Bluejacking—The sending of unauthorized messages over a Bluetooth connection to a device.

Bluesnarfing—Provides unauthorized access from a wireless device through a Bluetooth connection.

Bluebugging—Creates unauthorized backdoor access to connect a Bluetooth device back to the attacker.

Physical security

Digital security

User education/acceptable use policy (AUP)

Principle of least privilege

The following sections explain these concepts in greater detail.

Physical door locks might seem low-tech, but they can’t be hacked or taken over by hackers. Other precautions to take include: documenting who has keys to server rooms and wiring closets, and periodically changing locks and keys. Cipher locks that use punch codes also enhance security. Combine these methods with electronic security for greater protection.

Confidential documents should never be left sitting out in the open. They should either be properly filed in a locking cabinet or shredded and disposed of if they are no longer needed.

Passwords should not be written down and definitely not left on a desk or taped to a monitor where they can be seen. Many organizations implement a clean desk policy that states users must remove all papers from their desk before leaving for lunch, breaks, or at the end of the day.

Also, the user should lock the computer whenever he leaves the workstation. Desktop and mobile operating systems can also be automatically set to lock after a certain amount of time, even if the user forgets to do so manually.

Photos—If the bearer of the card doesn’t look like the person on the card, the bearer might be using someone else’s card and should be detained.

Barcodes—A barcode enables the card to carry a range of information about the bearer, including levels of access, and can be read quickly by a barcode scanner.

RFID technology—Cards with RFID chips can be used to open only doors that are matched to the RFID chip.

To prevent undetected tampering, ID badges should be coated with a tamper-evident outer layer.

Phase 1. The user logs into the key fob with a PIN.

Phase 2. The user logs into the system or restricted area using a randomly generated access code displayed on the key fob’s LCD display. The code changes every 30 to 60 seconds.

A key fob used in this way is often referred to as a token.

A smart card–based security system includes smart cards, card readers that are designed to work with smart cards, and a back-end system that contains a database that stores a list of approved smart cards for each secured location. Smart card–based security systems can also be used to secure individual personal computers.

To further enhance security, smart card security systems can also require the user to input a PIN or security password as well as provide the smart card at secured checkpoints, such as the entrance to a computer room.

These programs can use some or all of the following techniques to protect users and systems:

Real-time protection to block infection

Periodic scans for known and suspected threats

Automatic updating on a frequent (usually daily) basis

Renewable subscriptions to obtain updated threat signatures

Links to virus and threat encyclopedias

Inoculation of system files

Permissions-based access to the Internet

Scanning of downloaded files and sent/received e-mails

When attempting to protect against viruses and malware, the most important thing to remember is to keep your anti-malware application up to date. The second most important item is to watch out for unknown data, whether it comes via e-mail, USB flash drive, mobile device, or elsewhere.

As initially configured, the standard firewall in Windows is a one-way firewall. However, it can be configured to work as a two-way firewall. For more information about how it works, see “Firewall Settings,” p.862, Chapter 16. Most third-party firewall programs, such as ZoneAlarm, are two-way firewalls.

OS X 10.5 includes an application firewall. In OS X 10.6 and newer, the application firewall offers additional customization options. For details, see https://support.apple.com/en-us/HT201642.

Linux, starting with distros based on kernel 2.4.x and above, includes iptables to configure its packet-filtering framework, netfilter. To learn more, see www.netfilter.org. Many distros and third-party Linux apps are available to help make iptables and netfilter easier to configure.

A software firewall can be configured to permit traffic between specified IP addresses and to block traffic to and from the Internet except when permitted on a per-program basis.

Corporate networks sometimes use a proxy server with a firewall as the sole direct connection between the Internet and the corporate network and use the firewall in the proxy server to protect the corporate network against threats.

Strong passwords have the following characteristics:

At least 8 characters long—and the longer, the better

A variety of uppercase and lowercase letters, numbers, and symbols

Avoid real names and words

In Linux and OS X, directory permissions include:

Read (opens file)

Write (changes file)

Execute (runs executable file or opens directory)

The chmod command is used in Linux to change directory permissions. In OS X, the Get Info menu’s Sharing & Permissions submenu is used to change directory permissions.

In Windows, file and folder permissions on an NTFS drive include:

Full control

Modify

Read & Execute

List folder contents (applies to folders only)

Read

Write

These settings are configured through the Security tab of the file or folder’s properties sheet.

The most common types of VPNs include PPTP and L2TP/IPsec. PPTP uses 128-bit encryption, while L2TP combined with IPsec (L2TP/IPsec) uses 256-bit encryption.

E-mail filtering can be performed at the point of entry to a network with a specialized e-mail filtering server or appliance as well as by enabling spam and threat detection features built into e-mail clients or added by security software.

Spam or suspicious e-mails can be discarded or quarantined by the user, and false positives that are actually legitimate messages can be retrieved from the spam folder and placed back into the normal Inbox.

However, not all software for an operating system comes from an app store. Digital certificates included in software are used to identify the publisher, and most operating systems display warning messages when an app without a digital certificate is being installed. Some block the installation of apps that do not have a digital certificate.

Ask for an ID when approached in person by somebody claiming to be from the help desk, the phone company, or the service company.

Ask for a name and supervisor name when contacted by phone by someone claiming to be from the help desk, the phone company, or the service company.

Provide contact information for the help desk, phone company, or authorized service companies and ask users to call the authorized contact person to verify that the service call or phone request for information is legitimate.

Log in to systems themselves and then provide the tech the computer, rather than giving the tech login information.

Change passwords immediately after service calls.

Report any potential social engineering calls or in-person contacts, even if no information was exchanged. Social engineering experts can gather innocuous-sounding information from several users and use it to create a convincing story to gain access to restricted systems.

Users should be educated in how to do the following:

Keep antivirus, antispyware, and anti-malware programs updated.

Scan systems for viruses, spyware, and malware.

Understand major malware types and techniques.

Scan removable-media drives (optical disks, USB drives) for viruses and malware.

Disable autorun (the steps for this are shown later).

Configure scanning programs for scheduled operation.

Respond to notifications when viruses, spyware, or malware have been detected.

Quarantine suspect files.

Report suspect files to the help desk and to the software vendor.

Remove malware.

Disable antivirus when needed (such as during software installations) and to know when to reenable antivirus.

Don’t open attachments from unknown senders

Use antiphishing features in web browsers and e-mail clients.

Administrator

Power user

Guest

Standard user

There are three standard account levels in Windows:

Standard user—Standard accounts have permission to perform routine tasks. However, these accounts are blocked from performing tasks that involve system-wide changes, such as installing hardware or software unless they can provide an administrator password when prompted by User Account Control (UAC).

Administrator—Users with an administrator account can perform any and all tasks.

Guest—The guest account level is the most limited. A guest account cannot install software or hardware or run already-existing applications and cannot access files in shared document folders or the Guest profile. The Guest account is disabled by default. If it is enabled for a user to gain access to the computer, that access should be temporary and the account should be disabled again when the user no longer requires access.

When a user is created using the Users applet in Windows, the user must be assigned a Standard or Administrator account. Guest accounts are used for visitors.

The Power users account was a specific account type in earlier versions of Windows, having more permissions than standard users, but fewer than administrators. In Windows Vista and later versions, power users have the same rights and permissions as standard users. A custom security template can be created if the Power Users group needs specific permissions, such as for the operation of legacy programs.

When you copy a folder or file on the same, or to a different volume, the folder or file inherits the permissions of the parent folder it was copied to (target directory).

When you move a folder or file to a different location on the same volume, the folder or file retains its original permissions.

To view file attributes in Windows, right-click a file in File Explorer or Windows Explorer and select Properties. To view file attributes from the Windows command line, use the Attrib command.

Full control—Complete access to contents of file or folder. When Full Control is selected, all of the following are selected automatically.

Modify—Change file or folder contents.

Read & Execute—Access file or folder contents and run programs.

List Folder Contents—Display folder contents.

Read—Access a file or folder.

Write—Add a new file or folder.

To connect to the administrative share, the user must provide a user name and password for an account on that system.

If you create a folder, the default action it takes is to inherit permissions from the parent folder. So any permissions that you set in the parent will be inherited by the subfolder. To view an example of this, locate any folder within an NTFS volume (besides the root folder), right-click it and select Properties, access the Security tab, and then click the Advanced button.

In Windows 7, a checkbox named Inherit from Parent the Permission Entries that apply to Child Objects is visible toward the bottom of the window. This means that any permissions added or removed in the parent folder will also be added or removed in the current folder. In addition, those permissions that are being inherited cannot be modified in the current folder. The box is already checked and it is grayed out, so it cannot be cleared. If you want to make modifications to the permissions, you must click the Change Permissions button, clear the Include inheritable permissions from this object’s parents checkbox, and select Add (converts and adds inherited parent permissions as explicit permissions on this object), Remove (removes inherited permissions), or Cancel.

In Windows 8/8.1/10, the Advanced Security Settings dialog offers these buttons: Add, Remove, View, and Disable Inheritance.

You can also propagate permission changes to subfolders that are not inheriting from the current folder. To do so, select Replace all child object permissions with inheritable permissions from this object. Remember that folders automatically inherit from the parent unless you turn inheriting off—and you can propagate permission entries to subfolders at any time by selecting the Replace option.

To make these files and folders visible:

Step 1. Click or tap Tools.

Step 2. Click or tap Folder options.

Step 3. Click or tap the View tab.

Step 4. Click the Show hidden files, folders, and drives radio button.

Step 5. Clear the Hide protected operating system files checkbox.

A Trusted Platform Module (TPM), which is a chip residing on the motherboard that actually stores the encrypted keys.

or

An external USB key to store the encrypted keys. Using BitLocker without a TPM requires changes to Group Policy settings.

and

A hard drive with two volumes, preferably created during the installation of Windows. One volume is for the operating system (most likely C:), which will be encrypted; the other is the active volume that remains unencrypted so that the computer can boot. If a second volume needs to be created, the BitLocker Drive Preparation Tool can be of assistance and can be downloaded from the Microsoft Download Center at:

http://www.microsoft.com/en-us/download/details.aspx?id=7806

BitLocker software is based on the Advanced Encryption Standard (AES) and uses a 128-bit encryption key.

Starting with Windows Vista SP1, BitLocker can be used to encrypt internal hard disk volumes other than the system drive. For example, if a hard disk is partitioned as C: and D: drives, BitLocker could encrypt both drives.

In Windows 7 and later versions, BitLocker functionality is extended to external USB drives (including flash drives) with BitLocker To Go. Windows 7 also simplifies BitLocker and BitLocker To Go configuration: Simply right-click a drive and select Enable BitLocker to start the encryption process. During the process, you are prompted to specify a password or a smart card for credentials to access the drive’s contents.

To enable access to the contents of BitLocker To Go USB drives on Windows Vista and Windows XP, Microsoft now offers the BitLocker To Go Reader. Download it from the Microsoft website.

EFS files can be opened only by the user who encrypted them, by an administrator, or by EFS keyholders (users who have been provided with the EFS certificate key for another user’s account). Thus, they are protected against access by hackers.

Files encrypted with EFS are listed with green filenames when viewed in Windows Explorer or File Explorer. Only files stored on a drive that uses the NTFS file system can be encrypted.

To encrypt a file, follow this process:

Step 1. Right-click the file in Windows Explorer or File Explorer or Computer and select Properties.

Step 2. Click the Advanced button on the General tab.

Step 3. Click the empty Encrypt Contents to Secure Data checkbox.

Step 4. Click OK.

Step 5. Click Apply. When prompted, select the option to encrypt the file and parent folder or only the file as desired and click OK.

Step 6. Click OK to close the properties sheet.

To decrypt the file, follow the same procedure, but clear the Encrypt Contents to Secure Data checkbox in Step 3.

In Windows, the screensaver required password settings (On Resume, Display Logon Screen checkbox) is located in the Screen Saver Settings window, which can be accessed from Control Panel, Personalization. In OS X, use the Desktop & Screen Saver menu to choose a screen saver, and Security & Privacy to require a password to unlock your system. Linux distributions that use the X11 Window System use the XScreenSaver (https://www.jwz.org/xscreensaver/).

Change passwords periodically (Local Policies > Security Options)

Be informed in advance that passwords are about to expire (Account Policies > Password Policy)

Enforce a minimum password length (Account Policies > Password Policy)

Require complex passwords (Account Policies > Password Policy)

Prevent old passwords from being reused continually (Account Policies > Password Policy)

Wait a certain number of minutes after a specified number of unsuccessful logins has taken place before they can log in again (Account Policies > Account Lockout Policy)

To make these settings in Local Security Settings, open the Security Settings node and navigate to the appropriate subnodes (shown in parentheses in the preceding list). In Group Policy (gpedit.msc), navigate to

Computer Configuration > Windows Settings > Security Settings > Account Policies > Password Policy

Computer Configuration > Windows Settings > Security Settings > Account Policies > Account Lockout Policy

Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options as appropriate

In Windows, users can lock their screens manually by pressing Windows key+L on the keyboard or pressing Ctrl+Alt+Del and select Lock Computer. In Linux, the keys to use vary by desktop environment. In OS X, use Control+Shift+Eject or Control+Shift+Power (for keyboards without the Eject key).

The easiest way to turn off AutoRun and AutoPlay in Windows Vista/7/8/8.1/10 is to open the AutoPlay applet in Control Panel, clear the Use AutoPlay for all media and devices, and then click Save. From Windows 8/8.1’s Start screen, search for “AutoPlay settings” and click or tap it. In the PC and Devices menu, move the Use AutoPlay for all media and devices slider to Off.

To disable autorun in Windows using Local Group Policy, complete the following steps:

Step 1. Click Start and in the search field type gpedit.msc. This opens the Local Group Policy Editor.

Step 2. Navigate to Computer Configuration > Administrative Templates > Windows Components > AutoPlay Policies.

Step 3. Double-click the Turn Off Autoplay setting. This displays the Turn Off AutoPlay configuration window.

Step 4. Click the Enabled radio button and then click OK. You are actually enabling the policy named Turn off Autoplay.

Use this sparingly on laptops that do presentations, as these computers might require AutoPlay.

OS X does not support autorun/autoplay features.

In Linux, autoplay/autorun can be disabled on systems that use the nautilus file manager by changing the properties on the Media tab to enable Never prompt or start programs on media insertion and disable Browse media when inserted. See https://scottlinux.com/2011/02/09/ubuntu-linux-disable-autorun/ for details.

This can be accessed on an Android device by going to Settings > Security.

You can also select how long the phone waits after inactivity to lock. Generally this is set to 3 or 5 minutes or so, but in a confidential environment you might set this to “immediate.” Swipe lock apps immediately lock the device when the user swipes the display to one side.

The next option on the Security screen is Visible Passwords. If check marked, this shows the current letter of the password being typed by the user. This type of setting is vulnerable to shoulder surfers (people looking over your shoulder to find out your password) and should be deselected. When deselected, only asterisks (*) are shown when the user types a password.

There is also a Credential Storage option. By default, secure credentials are dropped after a session is over. (an exception to this rule is a Gmail or other similar login). But, if Use Secure Credentials is check marked, and a user accesses a website or application that requires a secure certificate, the credentials are stored on the device. A user can set a password here so that only he or she can view or clear credentials, or install credentials from a memory card. The use of secure credentials is usually only configured if a user needs access to confidential company information on the Internet.

Passcode locking can be accessed on iPad and iPhone devices by going to Settings > Passcode> and tapping Passcode Lock. This displays the Passcode Lock screen. Tap Turn Passcode On to set a passcode.

To enable Auto-Lock, go to Settings > General > Auto-Lock and select an amount of minutes. If it is set to “never” then the device will never sleep, negating the security of the passcode, and using valuable battery power. The default setting is two minutes.

Aside from the default timeout, devices can also be locked by pressing the power button quickly. If configured, the passcode must be supplied whenever a mobile device comes out of a sleep or lock state and whenever it is first booted.

Some devices support other types of screen locking, including fingerprint lock (the user’s fingerprint is matched against a list of authorized users) and face lock (the user’s face is matched against a list of authorized users). Windows Hello, a Windows 10 feature supported on some devices, is an example of a face lock.

Some devices (such as the iPhone) have a setting where the device will be erased after a certain amount of incorrect password attempts (10 in the case of the iPhone). There are also third-party apps available for download for most mobile devices that will wipe the data after x amount of attempts. Some apps configure the device to automatically take a picture after three failed attempts and e-mail the picture to the owner.

Examples of software that can accomplish this include Google Sync, Google Apps Device Policy, Apple’s Data Protection, and third-party apps such as Mobile Defense. In some cases, such as Apple’s Data Protection, the command that starts the remote wipe must be issued from an Exchange server or Mobile Device Management server. Of course, you should have a backup plan in place as well so that data on the mobile device is backed up to a secure location at regular intervals. This way, if the data needs to be wiped, you are secure in the fact that most of the data can be recovered. The type of remote wipe program, backup program, and policies regarding how these are implemented vary from one organization to the next. Be sure to read up on your organization’s policies to see exactly what is allowed from a mobile security standpoint.

Apple’s iCloud offers free cloud backup service for a limited amount of data (currently 5GB), with more space available by subscription. iTunes can be used for USB-based backup, which enables the entire device to be backed up at no additional cost.

Android users have free backup for e-mail, contacts, and other information via Google Cloud. However, backing up photos, music, contents, and other documents must either be performed manually via USB or file sync to the cloud using a service such as Dropbox or with a third-party app.

Both iOS and Android users can use popular third-party cloud-based backups also supported for OS X and Windows such as Mozy (mozy.com), iDrive (www.idrive.com), and others.

iOS works a bit differently. iOS is a tightly controlled operating system. One of the benefits of being a closed-source OS is that it can be more difficult to write viruses for it, making it somewhat more difficult to compromise. But there is no OS that can’t be compromised. For the longest time there was no antivirus software for iOS. However, starting in 2011, jailbreaking software began to make iOS devices more vulnerable. As a result, Apple allowed antivirus and anti-malware vendors onto its App Store.

Updates for iOS can be located at Settings > General > Software Update.

When it comes to large organizations that have many mobile devices, a Mobile Device Management (MDM) suite should be used. McAfee (and many other companies from AirWatch to LANDESK Mobility Manager to Sybase) have Mobile Device Management software suites that can take care of pushing updates and configuring many mobile devices from a central location. Decent quality MDM software will secure, monitor, manage, and support multiple different mobile devices across the enterprise.

Recent and current iOS devices have built-in support for fingerprint reading with the Touch ID feature for iPhone 5s or later, iPad Pro, iPad Air 2, or iPad mini 3 or later. Learn more at https://support.apple.com/en-us/HT201371.

With Android devices running version 5.x or earlier, you must assign a passcode first before you can encrypt the device. Then, go to Settings > Lock screen and security > Other security settings > Encrypt device. You must have at least an 80% charge in your device and plug the device into AC power during the process. Encryption can take an hour or longer. You must also assign a new passcode of six characters or longer including at least one letter and one number. Once you encrypt your Android device, you must enter the passcode every time you turn on or awaken your device from sleep.

With full device encryption, your data is not accessible to would-be thieves unless they know the passkey.

The Google Authenticator from the Google Play app store enables the user to receive or generate multifactor codes with Android, iOS, and BlackBerry devices. It supports options to add or remove trusted computers and devices and works with the Security Key USB device.

Other authenticator apps for mobile devices include LastPass Authenticator, Authy, FreeOTP, and Toopher.

Before selecting an authenticator app, be sure to determine which websites and services it supports.

Apple does not include a firewall because the design of iOS uses a feature called “sandboxing” that runs apps in separate protected space.

No hardware cost to organization

Higher usage due to employee satisfaction with their selected device

Greater productivity

Potential drawbacks include:

Hidden costs of management and security

Possibility that some employees will not want to buy their own devices

These can include specifying approved devices and operating system versions, requiring passwords and lock screens, device encryption, support issues, and when and how to remove company information when an employee leaves the organization.

A long format rewrites the disk surface. However, data recovery programs available from many third-party firms can recover data from a formatted drive. A low-level format is performed by the drive manufacturer before the drive is shipped and cannot be performed in the field.

External hard disks should also be handled in one of these ways when being disposed of. USB flash drives that contain sensitive information can be physically destroyed or can be bulk-erased to prevent information from being recovered. To protect information on optical media, shredding is recommended.

To help “hide” the details of your network and location, a replacement SSID for a secure wireless network should not include any of the following:

Your name

Your company name

Your location

Any other easily identifiable information

An SSID that includes a sports team popular in the area or obscure information (such as the name of your first pet) would be a suitable replacement.

Wireless equivalent privacy (WEP) was the original encryption standard for wireless Ethernet (Wi-Fi) networks. It is the only encryption standard supported by most IEEE 802.11b-compliant hardware. Unfortunately, WEP encryption is not strong enough to resist attacks from a determined hacker. There are several reasons this is true, including key length (64-bit WEP uses a 10-character hex key, and 128-bit WEP uses a 26-character hex key) and the use of unencrypted transmissions for some parts of the handshaking process. Because WEP encryption is not secure, it should not be used to “secure” a wireless network.

As a replacement to WEP, Wi-Fi Protected Access (WPA) was developed a few years ago. It is available in two strengths: WPA (which uses TKIP encryption) and the newer, stronger WPA2 (which uses AES encryption). WPA and WPA2’s encryption is much stronger than WEP, supports a key length from 8 up to 63 alphanumeric characters (enabling the use of punctuation marks and other characters not permitted with WEP) or 64 hex characters, and supports the use of a RADIUS authentication server in corporate environments.

Because all clients and WAPs or wireless routers on a wireless network must use the same encryption standard, use the strongest standard supported by all hardware.

Ideally, all wireless networks should be secured with WPA2 (WPA has been cracked, although cracking WPA is much harder than cracking WEP). However, the use of WPA2 encryption might require upgraded drivers for older network adapters and upgraded firmware for older WAPs or wireless routers. All currently manufactured Wi-Fi Certified adapters and WAPs or wireless routers must support WPA2.

Figure 21-3 illustrates a Linksys router configuration dialog in which several of these security recommendations have been implemented.

PIN—A PIN marked on the router is entered into each new device added to the network. This is the only mandatory WPS method and is the default method.

Push button—The router or WAP has a push button, and each new device has a physical push button or (more often) a software push button in the setup program. Both buttons must be pushed within a short period of time to make the connection.

A security flaw with the PIN method was discovered in late 2011, so the push-button method is recommended if WPS is to be used.

Most routers use the Administration or Management dialog for the password and other security settings.

With most wireless routers and WAPs, you can specify the MAC addresses of devices on your network. Only these devices can access your network; some routers can also be configured to block a list of specified MAC addresses from accessing the network.

MAC filtering can be a useful way to block casual hackers from gaining access to a wireless (or wired) network. However, keep in mind that it is possible to use software to change the MAC address of a network device (a feature sometimes referred to as MAC address cloning), and that MAC addresses are not encrypted and can be detected by software used to hack networks. Thus, MAC address filtering alone should not be relied on to stop serious attacks.

Access logs

Filtering of specific types of traffic

Enhanced support for VPNs

See the router documentation for more information about advanced security features.

Parental controls are built into recent versions of OS X. Enable this feature through the Parental Controls menu. To learn more, see https://support.apple.com/kb/PH18571?locale=en_US.

Although Linux distros do not include parental controls, many third-party apps are available. To learn more, see https://help.ubuntu.com/community/ParentalControls for details.

Some wireless routers made for SOHO use also include content filtering and parental controls.

Step 1. View the device’s configuration dialogs to see the current firmware version.

Step 2. Visit the device vendor’s website to see whether a newer version of the firmware is available. Note that you must know the model number and revision of the device. To find this information, look on the rear or bottom of the device.

Step 3. Download the firmware update to a PC that can be connected to the device with an Ethernet cable.

Step 4. Connect the PC to the device with an Ethernet cable.

Step 5. Navigate to the device’s firmware update dialog.

Step 6. Follow instructions to update firmware.

Also watch out for visible network wires and unused network jacks. Network cables should be routed in the walls and ceiling out of sight. If they are not visible, it cuts down on the chances of someone tapping into the network. RJ-45 jacks that currently don’t have a computer connected to them should be noted. In the wiring closet, disconnect those network drops at the patch panel by removing the patch cable that leads to the switch. This way, a person can’t just sit down, plug in to a network jack, and attempt to hack the network. On some switches you can also disable ports within the firmware.

malware

spyware

viruses

worms

Trojan horses

rootkits

ransomware

phishing

spear phishing

social engineering

shoulder surfing

zero-day attack

zombie/botnet

brute forcing

dictionary attacks

non-compliant systems

violations of security best practices

tailgating

man-in-the-middle

mantrap

cable locks

biometrics

ID badges

key fob

RFID badge

tokens

privacy filters

entry control roster

digital security

strong password

multifactor authentication

directory permissions

VPN

access control lists

smart card

e-mail filtering

trusted/untrusted software sources

acceptable use policy (AUP)

principle of least privilege

administrator

power user

guest

standard user

NTFS permissions

share permissions

file attributes

administrative shares

local shares

permission propagation

inheritance

system files and folders

user authentication

administrator

standard user

BitLocker

BitLocker-To-Go

EFS

password best practices

account management

guest

lockout

timeout

screen lock

autorun

data encryption

patch/update management

fingerprint lock

face lock

swipe lock

passcode lock

remote wipe

locator applications

remote backup

failed login attempt restrictions

antivirus/anti-malware

patching/OS updates

biometric authentication

full device encryption

multifactor authentication

authenticator applications

firewalls

policies and procedures

BYOD

profile security requirements

shredder

drill/hammer

incineration

certificate of destruction

repurposing

security best practices

low level format

standard format

overwrite

drive wipe

SSID

default SSID

SSID broadcast

WPS

MAC filtering

static IP address

radio power levels

firewall

port forwarding/mapping

content filtering

permission propagation

inheritance

remote backup

antivirus

anti-malware

content filtering

parental controls

WEP

WPA

WPA2

parental controls.

Check your junk or spam e-mail folders for phishing messages. Note patterns such as misspelled words, poor grammar, lack of personalization, and unnecessary attachments.

Look over the laptops, external hard disks, displays, and other equipment for security lock slots. How many of these items are actually locked? Create a sample budget for locking these items to prevent theft or loss.

Evaluate your own passwords. Do they qualify as strong? If not, visit a website such as the Norton Identity Safe Password Generator (https://identitysafe.norton.com/password-generator) to generate replacements.

Use a disk-wiping program to wipe a hard disk that is no longer in use (make sure any useful data is backed up first!). If you don’t have a utility, you can choose one from the list at http://www.techrepublic.com/blog/five-apps/five-hard-disk-cleaning-and-erasing-tools/.

Review the configuration for a SOHO router at your home or place of employment. Implement some of the changes advocated in this chapter. Be sure to record the new settings!

Answer Options:

1. Spyware

2. Virus

3. Worm

4. Rootkit

5. Ransomware

2. Which of the following statements best describes phishing?

A. A hacker pretends to be a co-worker or IT professional to gain network access

B. A bogus website that tricks user into revealing personal or financial information.

C. An attempt to physically view information such as passwords or PINs.

D. A computer that has been taken over for the purpose of distributing malware.

3. A brute-force attack can be thwarted by implementing which security policy?

A. Account lockout at logon

B. Digital passwords

C. Physically locking doors to server room

D. Strong encryption

4. As an IT professional, you should be sure to employ best security practices. Which of the following is not a best practice?

A. Strong passwords for user accounts

B. Antivirus/malware protection

C. SSL for websites

D. WEP encryption

5. Which of the following is generally the most difficult form of security for an intruder to overcome?

A. Firewall

B. Encryption

C. Biometrics

D. Physical lock and key

6. Biometrics includes the use of which of the following? (Choose all that apply.)

A. Fingerprint scan

B. RFID

C. Retinal scan

D. Token

7. Which of the following is not a type of token?

A. Key fob

B. Cable lock

C. RFID card

D. Smart card

8. Which of the following is a program that either blocks or allows data packets to be delivered to network addresses?

A. DHCP server

B. Key fob

C. Firewall

D. Network server

9. Which of the following is a characteristic of a strong password? (Choose all that apply.)

A. No more than six characters

B. Lowercase only

C. Use of symbols

D. Use of numbers

10. In OS X and Linux, which of the following are directory permissions that are available? (Choose three.)

A. Full control

B. Modify

C. Read

D. Read and Execute

E. Write

F. List folder contents

G. Execute

11. Which of the following is a private secure network that is used to communicate over an unsecured public network?

A. Proxy server

B. VPN

C. Firewall

D. ACL

12. When you copy a folder to a different volume, which of the following statements best describes what happens to the folder’s permissions?

A. The folder retains its original permissions.

B. The folder inherits permissions from the new location’s parent folder.

C. The user selects the permissions option during the file copy process.

D. The user must manually set up permissions after the file copy process.

13. Which of the following statements best describes how to view and change the attributes of a file? (Choose two.)

A. Right-click the file, select Properties, and then click the General tab.

B. Right-click the file and select Sharing.

C. Type attrib at the command line.

D. In Administrative Tools, open the Shares folder and select Attributes.

14. Which of the following statements best describes how to turn on or off file inheritance?

A. Right-click the file, select Properties, and then click the Security tab.

B. Right-click the file, select Properties, and then click the General tab.

C. Right-click the file and select Sharing.

D. In Administrative Tools, open the Shares folder.

15. The computer’s system files are not normally displayed. Which of the following statements best describes how to make them visible?

A. Open Administrative Tools and select Computer Management.

B. Right-click Computer or This PC and select Properties.

C. Open Device Manager and select Disk Drives.

D. Open Control Panel > Folder Options > View > Show hidden files, folders, and drives.

In addition to the patterns mentioned in the lab as telltale signs of phishing e-mails, did you see any other clues? Share these with your supervisor.

How many cable locks would be needed to lock all lockable equipment in your office? Consider proposing a phased method for adding locks, starting with the most vulnerable equipment.

How long did it take the utility to overwrite the drive? Were you able to find any data on the drive? Were you able to use the drive as new (repartition, reformat, etc.)? If you used more than one, consider recommending your favorite to be the standard repurposing program in your organization.

2. B. Phishing is a technique that involves tricking a user into revealing confidential information, such as a Social Security Number or credit card information. The technique might involve a bogus security alert in the form of an e-mail or a telephone warning that includes an offer of assistance. In social engineering, the hacker pretends to be a co-worker or IT professional in order to gain network access. Shoulder surfing is an attempt to physically view confidential information (such as passwords or PINs) by looking over a user’s shoulder. A zombie or botnet is a program that takes over a computer for the purpose of distributing malware, such as a denial of service attack.

3. A. A brute-force attack tries to guess the password by trying combinations of letters, numbers, and symbols until it comes upon the correct combination. This type of attack can be stopped by using an account-lockout policy to lock the computer after a specified number of incorrect attempts to log on.

4. D. WEP encryption is a weak type of encryption. Use WPA (better) or WPA2 (best) instead.

5. D. A physical lock and key might be the most difficult form of security to overcome because it cannot be bypassed electronically and cannot be done remotely. An intruder must be in possession of a physical key and he must be physically present at the site.

6. A, C. Fingerprint scan, retinal or iris scan, facial recognition, and voice recognition are all types of biometric security methods.

7. B. A cable lock is used to secure a laptop to an immovable object, such as a post. A token is any physical object used to gain access to a secure system. Key fobs, RFID cards, and smart cards are all types of tokens.

8. C. A firewall examines data packets being received by a network to determine whether they should be delivered to a network location or whether delivery should be blocked. Data packets can be allowed or blocked depending upon the threat level that is determined by the firewall programming.

9. C, D. A strong password should consist of eight or more characters, a combination of upper- and lowercase letters, symbols, and numbers. In addition, a strong password should not use real names or real words.

10. C, E, G. Read, Write and Execute are the directory permissions for both OS X and Linux. The Windows version of file and folder permissions on an NTFS drive includes Full Control, Modify, Read and Execute, List, Read, and Write.

11. B. The Internet is an insecure communication network. A Virtual Private Network (VPN) is a private network that provides a secure method for sending and receiving data across the Internet.

12. B. When you copy a folder to a different folder on either the same or a different volume, the folder inherits the permissions of the current location’s parent folder.

13. A, C. To change the attributes of a file, right-click the file and select Properties. File attributes can be changed on the General tab. Alternately, use the attrib command on the command line.

14. A. To turn the file inheritance on or off, right-click the file and select Properties. Go to the Security tab, click the Advanced button, and follow the procedures for the version of Windows in use.

15. D. Open Control Panel > Folder Options > View > Show hidden files, folders, and drives.