Information SecurityA Matter of BalanceWhat is Security?Threat CategoriesOne of the Company’s Most Valuable AssetsProfiles: Who’s Breaking In?What Makes Us Vulnerable?PasswordProblems with PasswordsPassword SecurityDon’t Choose a Weak Password:Do Choose a Strong Password:Weak Passwords (examples):Strong Passwords (examples):Mnemonics Made EasyProtect the Security of the Company’s Information As If Your Job Depends on It, Because…©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Information SecurityDon’t Be the Weakest Linkor“But, I use a password!!”©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. A Matter of BalanceThere is an inverse relationship between convenience (ease-of-use) and security.As you increase security, you lose convenience.ConvenienceSecurity©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. What is Security?Webster’s Dictionary: Measures taken to guard against espionage or sabotage, crime, attack, or escapeH. Stanley Judd: The ultimate security is your understanding of reality.©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Threat CategoriesNatural Disasters – Fire, flood, tornado, etc.Nonhuman – Product failures, bugs, etc.Human ☹ Malicious: Insiders – Disgruntled employees Outsiders – Hackers, crackers, etc. ☹ Nonmalicious: Untrained or uninformed employees©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. One of the Company’s Most Valuable AssetsThe information stored in computer files on our desktop computers and on the local area network©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Profiles: Who’s Breaking In?Corporate spiesGovernmentsTerroristsCareer criminalsInsidersFinancial, competitive gainNational interestsReligious, political idealsFinancial, control/powerFinancial, revenge©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. What Makes Us Vulnerable?Easily guessed passwords – Too short; too simple; common wordsNot keeping secrets – Writing passwords down; sending confidential data in e-mailsTrusting things we get from others – Opening e-mail attachments that have a virus or other malicious code©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. PasswordA string of characters, entered to verify that you are authorized to access computer resources, consisting of:Alphabetic – A to Z and a to zNumeric – 0 to 9Special Characters – ~; !: @; #; $; %; ^; &; *; (; ); +; =; [; ]; {; }; /; ?; <; >; ,; ;; :; \; |; `; ’; ”; .©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Problems with PasswordsThere is a direct relationship between the ease with which a password can be remembered and the ease with which it can be guessed.Without a gimmick, a password that is difficult for an unauthorized person to guess is usually difficult for a user to remember (more about gimmicks later).If a password is easy to remember, it is probably easy for someone else to guess.©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Password Security Don’t tell anyone your password.Don’t write your password down anywhere.Make sure your password cannot be easily guessed.If you think there is even a slight chance someone knows your password, change it.Don’t let someone see what you are entering as your password.©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Don’tDon’t Choose a WeakWeak Password:With fewer than eight characters.That could be found in a dictionary.That uses public information about you or your family or friends (Soc Sec #; birthdate; credit card number; telephone number, etc.).That you have used before.That is a variation of your user ID.That is something significant about you.©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. DoDo Choose a StrongStrong Password:That is at least eight characters long.That contains uppercase and lowercase letters.That contains at least one number or special character.That is not a dictionary word in any language, slang, or jargon.That cannot be easily guessed and is easy to remember.Remember to change your password every 90 days.©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. WeakWeak Passwords (examples):cat dog diego querty hart heat heart mary 1dennis2 hartelephone lintelco hartwelleednyw ydnew kayak palindromeseptember superman mickeymouse r2d2aaaabbbccd 12345678 a1b2c3d4 zxcvbnmbonvoyage mercibeaucoup volkswagenmircrosoft colorprinter windows98nowisthetimeforallgoodmentocometotheaid©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. StrongStrong Passwords (examples):Wwe&nadtd 2BoN2bTist?IsfgaWDo6 3bmstfw1491Mdi#1imh 52eobbowtffcdtmb1W2rpw mkrG8b$I know what you are thinking: “Wait one minute, you geek – you said it must be easy to remember!”Let me explain mnemonics.mnemonics.©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Mnemonics Mnemonics Made EasyTake a phrase that is easy for you to remember and convert it into characters.It could be the first line of a poem or a song lyric.“Water, water everywhere and not a drop to drink” (Rhyme of the Ancient Mariner) converts to Wwe&nadtd.“We Three Kings from Orient Are” converts to w3KfOr3691. (3691 is the year 1963 spelled backward to extend beyond six characters.)©2002 TechRepublic, Inc. www.techrepublic.com. All rights reserved. Protect the Security of the Company’s Information As If Your Job Depends on It, Because…IT