Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to 7 Cybersecurity Sins When Working From Home
Similar to 7 Cybersecurity Sins When Working From Home (20)
Recently uploaded
Recently uploaded (20)
7 Cybersecurity Sins When Working From Home
- 1. 7 cybersecurity Sins when Working From Home DALLAS HASELHORST Founder & Principal Consultant, TreeTop Security www.treetopsecurity.com From the makers of Peak, the only affordable and comprehensive small business cybersecurity solution
- 2. 2info@treetopsecurity.com | @oneoffdallas # whoami ● 20+ years of IT & cybersecurity experience ● Consulted for companies all over the US ● Multiple computer-related degrees from FHSU ● Master’s degree in Information Security Engineering from the SANS Technology Institute ● Alphabet soup of security-related certifications ○ CISSP, GSEC, GCIH, GCCC, GCPM, GPEN, GMON, GCIA, GWAPT, GDSA, GSE #231 ● Co-organizer of BSidesKC conference ● Founded an IT company in 2003, acquired in 2016 ● Lead design of the Peak platform > 3 years
- 3. 3info@treetopsecurity.com | @oneoffdallas WFH Fails (non-cybersecurity)
- 4. 4info@treetopsecurity.com | @oneoffdallas #1 I am too small to to be hacked Pride
- 5. 5info@treetopsecurity.com | @oneoffdallas 43% of all cyber attacks target small businesses “No one wants OUR data” Unprepared Small Businesses Large Businesses and Government “Prepared” Small Businesses Verizon 2019 DBIR - https://enterprise.verizon.com/resources/2019-data-breach-investigations-report.pdf https://www.cnbc.com/2019/10/13/cyberattacks-cost-small-companies-200k-putting-many-out-of-business.html
- 6. 6info@treetopsecurity.com | @oneoffdallas Targeted or untargeted? •Works equally well on 1 or 1,000 •Ransomware • Locks you out of your data • Monetary ransom gets it back •Cryptominers/botnets • Uses your system resources • To “mine” cryptocurrency • To hack or harass others •Nation-states •Organized crime
- 7. 7info@treetopsecurity.com | @oneoffdallas #2 Overindulgence of devices Gluttony
- 8. 8info@treetopsecurity.com | @oneoffdallas Home network •One compromised device on the same network can compromise your device too •Who has access? • Kids • Neighbor kids • Everyone? •What devices have access? • Gaming computers • “Knock-off” products • Internet of things (IoT) - Alexa, Google Home, doorbells, Xbox, refrigerators, camera systems, etc.
- 9. 9info@treetopsecurity.com | @oneoffdallas Fing app •Free, easy to use •Available for Apple/Android •Scan your network •Find other devices •Staying at a B&B??? •Restaurant guest wifi • Printers • Speakers • Servers <---- • POS <-------- PCI compliance? Access to credit card info!
- 10. 10info@treetopsecurity.com | @oneoffdallas Wireless/firewall •Default username/password? •Use WPA2 (AES) encryption setting •Disable WPS <- “button to connect” •Wireless key/password • When was it last changed? • Using your phone number? • Hacked in under 10 mins • More than 20 characters • Use passphrases!!! • Stayoffmywifi@homeplease (24) https://linuxincluded.com/why-phone-numbers-make-horrible-wifi-passwords/
- 11. 11info@treetopsecurity.com | @oneoffdallas Next steps: 1) A properly configured company VPN helps 2) Segment network? Likely requires new equipment
- 12. 12info@treetopsecurity.com | @oneoffdallas #3 Uncontrolled device security Wrath
- 13. 13info@treetopsecurity.com | @oneoffdallas Prying eyes •Password on computer • Passphrases! • >16 characters • Length is better than complexity • Lock when away • Auto-lock after inactivity • Windows = Windows key + L • Mac = Control-Shift-Power • Alternative - biometrics •PIN/biometrics on portable devices •Keep kids away • “Grandkids were here this weekend”
- 14. 14info@treetopsecurity.com | @oneoffdallas WFH setups •Don’t overshare! •High resolution images •Accidental disclosure • Zoom meeting IDs • What you are working on • Client names / file names • Applications you use (open or closed) • Passwords on sticky notes <- NOOO! •Hide all icons •Don’t show toolbars/taskbars •Resize pictures? What could an attacker or competitor gain?
- 15. 15info@treetopsecurity.com | @oneoffdallas Staying up-to-date •New security issues found every day •Operating system updates • Windows, Apple, Linux • Still using Windows 7 - end of life •3rd party updates • Microsoft Office • Browser - Chrome, Safari, Firefox • Adobe Reader • Zoom - new version 2 days ago • Click profile -> check for updates •Anti-virus - definition updates •Mobile devices
- 16. 16info@treetopsecurity.com | @oneoffdallas Next steps: 1) Separate work devices 2) Centralized, managed updates & anti-virus
- 17. 17info@treetopsecurity.com | @oneoffdallas Lust #4 Not treating data like it’s your data #5 Longing to communicate (insecurely) Envy
- 18. 18info@treetopsecurity.com | @oneoffdallas Scattershot storage & technology •Unprepared for WFH? •Then prepare for shadow IT • Find alternatives to get things done •Data/info coming from new sources • No server or centralized storage • Dropbox, OneDrive, Google Drive • Email, Slack, Microsoft Teams •Regulated industries - PII, PHI, etc. • Many regulations laxed... For now • “Left over data” • After 6 months? • After 2 years? Maintain order now, Thank me later
- 19. 19info@treetopsecurity.com | @oneoffdallas Data protection •Alexa, Google Home -> always listening •Backups - even more important • Hardware failure • Accidental deletion • Ransomware - no protection is perfect! •Full-disk encryption (FDE) • Lost or stolen? Only out cost of device • Recommended for PII/PHI everything • Windows - Bitlocker • Apple MacOS - FileVault • Mobile devices - tablets & phones • PIN/passcode on boot • Decryption often tied to PIN/passcode
- 20. 20info@treetopsecurity.com | @oneoffdallas Secure communications Example: Healthcare Industry/regulatory approved? Business Associate Agreement (BAA) Video conferencing Zoom or Zoom Business? No Zoom for Healthcare? Yes Free vs minimum of $200/month Document storage/sharing Google Drive? No G Suite by Google? Yes Free vs $6/month per user -------------------(additional services)
- 21. 21info@treetopsecurity.com | @oneoffdallas Next steps: 1) Disk encryption start now if you’re not already 2) Solutions must be company/regulatory approved 3) See “separate work devices”
- 22. 22info@treetopsecurity.com | @oneoffdallas #6 Lacking vigilance Sloth
- 23. 23info@treetopsecurity.com | @oneoffdallas Criminal activity - domain registrations https://www.markmonitor.com/mmblog/covid-19-domains-whats-going-on/ New domains registered related to corona, COVID, vaccine, etc. Example: id-covid19[dot]com DON’T GO THERE
- 24. 24info@treetopsecurity.com | @oneoffdallas Criminal activity - focus & increased attacks
- 25. 25info@treetopsecurity.com | @oneoffdallas Change matters We let our guard down •Different work schedules •Shared spaces •Using different software •Communicating differently •Consuming news differently •Receiving money • SBA loans • Wire & ACH transfers • Stimulus checks • Unemployment? PRIME opportunity for cybercriminals
- 26. 26info@treetopsecurity.com | @oneoffdallas Next steps: 1) Increase awareness now 2) Ongoing - company culture
- 27. 27info@treetopsecurity.com | @oneoffdallas #7 Education is expensive Greed
- 28. 28info@treetopsecurity.com | @oneoffdallas Is it really?!?!?
- 29. 29info@treetopsecurity.com | @oneoffdallas Shared and recommended at the RSA conference Feb 2020 Downloaded in over 150 countries in < 1 year Sept 2019 - March 2020 Slides available at https://www.treetopsecurity.com/CAT Awareness slide deck
- 30. 30info@treetopsecurity.com | @oneoffdallas Also available at https://www.treetopsecurity.com/CAT Free video + other goodies •New slide deck • Version 1.1 • Released March 2020 •Video presentation • Released March 2020 •Awareness quiz •Certificate of completion •Sign-up for our newsletter
- 31. 31info@treetopsecurity.com | @oneoffdallas Questions? https://www.treetopsecurity.com 785-370-3444 info@treetopsecurity.com Think actual cybersecurity is expensive? Think again! Ask us about Peak! It’s cybersecurity piece of mind for small businesses