# IT Fundamentals/2014/Security

Security is the degree of resistance to, or protection from, harm applied to any vulnerable and valuable asset. This lesson covers IT security threats and best practices.

## Preparation

Learners should already be familiar with IC$^3$ - Computer Use and Safety.

## Objectives and Skills

Objectives and skills for the security portion of IT Fundamentals certification include:
* Define basic security threats
** Malware
*** Virus
*** Trojan
*** Spyware
*** Ransomware
** Phishing
** Social engineering
** Spam
** Password cracking
** Physical security
*** Hardware theft
*** Software/license theft
*** Shoulder surfing
*** Dumpster diving
* Given a scenario, use security best practices
** Password management
*** Password complexity
*** Change default passwords
*** Password confidentiality
*** Password expiration
*** Password reuse
*** Awareness of Single Sign On
** Device hardening
*** Disable unused features
**** Disable Bluetooth
**** Disable NFC
*** Timeout / lock options
*** Enable security software/features
**** Software firewall
**** Anti-malware
*** Encryption options
** Open WiFi vs. secure WiFi
** Multifactor authentication
** Suspicious emails
*** Attachments
*** Hyperlinks
** Act on security software alerts
** Admin vs. user vs. guest account

## Readings

* Wikipedia: Internet security
* Wikipedia: Password manager
* Wikipedia: Hardening (computing)
* Wikipedia: Multi-factor authentication

## Multimedia

* YouTube: IT Fundamentals - Risk Analysis and Security Policy
* YouTube: IT Fundamentals - Threats
* YouTube: IT Fundamentals - Wireless and Mobile Network Security
* YouTube: Protecting Your Computer from Malware
* YouTube: Using Safe Practices
* YouTube: Antivirus Software

## Activities

* Use anti-malware software to scan your system and test malware detection.
** All: Review Wikipedia: Comparison of antivirus software. Download a free, well-known anti-malware application and scan your system.
** All: Review Wikipedia: EICAR test file. Download and save the EICAR test file to test your anti-malware application and follow the process for removing malware.
* Configure password management.
** All: Research password managers. Consider installing and using a password manager on your system.
** Windows: Review Microsoft: How to Configure Security Policy Settings. Consider modifying Password Policy and Account Lockout Policy settings.
** OS X: Review CNet: How to set up password policies in OS X. Consider modifying password restrictions.
** Linux: Review Xmodulo: How to set password policy on Linux. Consider modifying password policy settings.
* Research multi-factor authentication. Consider setting up multi-factor authentication on your Apple, Facebook, Google, and/or Microsoft accounts, as well as your password manager and your financial institutions.
* Test your firewall using a testing service such as Gibson Research: ShieldsUP!
* Consider encrypting your system storage:
** Windows: Review Microsoft: BitLocker Drive Encryption Overview
** OS X: Review Apple: OS X: About FileVault 2
** Linux: Review ArchLinux: Disk Encryption
** Android: Review GreenBot: Why and How to Encrypt Your Android Device.
** iOS: Review Apple:Understanding Data Protection.

## Lesson Summary

* Security threats include malware, phishing, social engineering, spam, password cracking, and physical security risks.
* Malware is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. This includes viruses, Trojans, spyware, and ransomware.
* Physical security threats include hardware theft, software/license theft, shoulder surfing, and dumpster diving.
* Effective password management includes password complexity, password confidentiality, password expiration, limited password reuse, changing default passwords, understanding single sign-on, and using multi-factor authentication.
* Device hardening includes disabling unused features such as Bluetooth and Near Field Communication, using screen timeout and lock options, enabling security software features, using a software firewall, using anti-malware software, and encrypting data storage.
* Security best practices include being alert for suspicious emails, attachments, and hyperlinks, responding to security software alerts, renaming administrator accounts, and disabling guest accounts.

## Key Terms
### authentication

    The process of confirming identity.

### authorization

    The function of specifying access rights to resources.

### BitLocker

    A full disk encryption feature included with the Ultimate and Enterprise editions of Windows Vista and later Windows operating systems.

### brute-force attack

    A cryptanalytic attack that consists of systematically checking all possible keys or passwords until the correct one is found.

### device hardening

    The process of securing a system by reducing its surface of vulnerability through the removal of unnecessary software, unnecessary usernames or logins and the disabling or removal of unnecessary services.

### dictionary attack

    A technique for defeating a cipher or authentication mechanism by trying to determine its decryption key or passphrase by trying hundreds or sometimes millions of likely possibilities from a list.

### dumpster diving

    The practice of sifting through commercial or residential waste to find items that have been discarded by their owners, but that may prove useful to the collector.

### ethical hacker

    A computer security expert, who specializes in penetration testing and in other testing methodologies to ensure the security of an organization's information systems.

### impersonation

    The act of assuming the identity of another, in order to commit fraud, such as accessing confidential information, or to gain property not belonging to them.

### malware

    Any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

### multi-factor authentication

    A method of computer access control which a user can pass by successfully presenting authentication factors from at least two of the three categories of knowledge, possession, and inherence.

### packet sniffer

    A computer program that can intercept and log traffic passing over a digital network.

### password complexity

    The length and character set combinations used to create a password, such as upper case and lower case letters, numbers, and punctuation.

### password confidentiality

    A set of rules or a promise that limits access or places restrictions on password sharing.

### password cracking

    The process of recovering passwords from data that have been stored in or transmitted by a computer system, most often through brute-force or dictionary attacks.

### password expiration

    A policy that requires users to change passwords periodically.

### password reuse

    A policy that prevents users from repeating recently used passwords.

### permissions

    Access rights assigned to specific users and groups of users to control the ability of the users to view or make changes to system objects.

### phishing

    The attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.

### physical security

    Measures designed to deny unauthorized access to facilities, equipment and resources, and to protect personnel and property from damage or harm.

### ransomware

    A type of malware which restricts access to the computer system that it infects, and demands a fee be paid to the operators of the malware in order for the restriction to be removed.

### shoulder surfing

    Using direct observation techniques to obtain information such as passwords, PINs, security codes, and similar data.

### single sign-on

    A property of access control systems that allows a user to log in once and gain access to all interrelated systems without being prompted to log in again.

### social engineering

    Psychological manipulation of people to cause them to perform actions or divulge confidential information.

### spam

    Unsolicited electronic messages, especially advertising.

### spim

    Unsolicited electronic messages targeting users of instant messaging (IM) services.

### spoofing

    Concealing the identity of the sender by impersonating another computing system.

### spyware

    Software that aims to gather information about a person or organization without their knowledge and that may send such information to another entity without the consumer's consent, or that asserts control over a computer without the consumer's knowledge.

### trojan

    A non-self-replicating type of malware program containing malicious code that, when executed typically causes loss or theft of data, and possible system harm.

### virus

    A malware program that, when executed, replicates by inserting copies of itself (possibly modified) into other computer programs, data files, or firmware.

## Review Questions

* Security threats include _____, _____, _____, _____, _____, and _____. Security threats include malware, phishing, social engineering, spam, password cracking, and physical security risks.
* Malware is _____. This includes _____, _____, _____, and _____. Malware is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems. This includes viruses, Trojans, spyware, and ransomware.
* Physical security threats include _____, _____, _____, and _____. Physical security threats include hardware theft, software/license theft, shoulder surfing, and dumpster diving.
* Effective password management includes _____, _____, _____, _____, _____, _____, and _____. Effective password management includes password complexity, password confidentiality, password expiration, limited password reuse, changing default passwords, understanding single sign-on, and using multi-factor authentication.
* Device hardening includes disabling _____, using _____, enabling _____, using _____, using _____, and encrypting _____. Device hardening includes disabling unused features such as Bluetooth and Near Field Communication, using screen timeout and lock options, enabling security software features, using a software firewall, using anti-malware software, and encrypting data storage.
* Security best practices include being alert for _____, responding to _____, renaming _____, and disabling _____. Security best practices include being alert for suspicious emails, attachments, and hyperlinks, responding to security software alerts, renaming administrator accounts, and disabling guest accounts.

## Assessments

* Flashcards: Quizlet: IT Fundamentals - Security
* Quiz: Quizlet: IT Fundamentals - Security

## See Also

* IC$^3$ - Computer Use and Safety