Identity Theft: Protection and Prevention © 2017

Computer Security: Data and Identity Management Data Security - Identity Theft: Protection and Prevention www.RobertSiciliano.com © 2017 9/18/2017 www.IDTheftSecurity.com 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 1 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 2 Awareness . A lack of security appreciation contributes directly to poor security awareness, most notably at the personnel level. – This is one of the leading contributors to the human error factor with most security breaches. – Security needs to be everyone’s business. – Corporations and government agencies are directly responsible for protecting personal information entrusted to them by their consumers, so measures must be taken to increase awareness in the everyday IT environment. – The most critical step to changing user behavior is to build a secure-minded culture from the ground up. – To create this culture, all employees need to be educated and tested on security threats and how their day-to-day computer use behavior can affect their organization’s security posture. 9/18/2017 www.IDTheftSecurity.com CIO Magazine Social Engineering . Social engineering is a collection of techniques used to manipulate people into performing actions or divulging confidential information. While similar to a confidence trick or simple fraud, the term typically applies to trickery for information gathering or computer system access and in most cases the attacker never comes face-to-face with the victim. THERE IS NO PATCH FOR HUMAN GULLIBILITY . Lose something . Thieves pose as You . Gain something . Spouse . Fear/greed . Bill collector . “Principles of Influence and Persuasion . Bank . email . Utility . telephone . Merchant / Organization . in person . Fellow employee . Trojan horse/Watering holes . Government agency 9/18/2017 www.IDTheftSecurity.comID Theft Security 3 9/18/2017 www.IDTheftSecurity.com 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 4 9/18/2017 www.IDTheftSecurity.com 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 5 9/18/2017 Hack a Company w/… . Scour all of the social networking sites for employees of target company like LinkedIn, Twitter , and Facebook.com . Find numerous people who openly discussed what they did for a living . Create a Facebook group site identified as “Employees of” the company. Using a fictitious identity proceed to “friend,” or invite, employees to our “company” Facebook site. Membership grows exponentially each day. By creating a group, you access to employees profiles. The “group” is a place where those who you know, like and trust are your “Friends” and in this case fellow employees who you have no reason to distrust. Chose to use the identity of one of our Facebook-friended employees to gain access to the building. Relative to as companies size you may be able to recreate the identity of an employee that’s not known to the branch office to breach. But the name needs to be in the system. A little creativity, a fake business card and enough information gleaned off of Facebook, you’re in. www.IDTheftSecurity.comID Theft Security 6 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 7 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 8 9/18/2017 www.IDTheftSecurity.com Malicious insider Attacks A malicious insider is; a current or former employee, contractor, or business partner who has or had authorized access to an organization’s network system or data and intentionally exceeded or misused that access in a manner that negatively affected the confidentiality, integrity, or availability of the organization’s information. CERT. Methods/tactics: Recruiting: • System admins • New hires • Disgruntled; sabotage • Friends/relations • Opportunists: fraud • Unknowingly contribute • Theft of intellectual property • Money/incentives • Social engineering • Threats/violence “Our whole system is based on personal trust,” James Clapper, director of national intelligence said adding that there were no “mousetraps” in place to guarantee there wouldn’t be another Edward Snowden. 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 9 Data Breaches . Irresponsible/malicious insiders . 3rd party fault . Laptop theft . Physical security vulnerabilities . Loss st .9/18/2017Hacking : 21 century burglarywww.IDTheftSecurity.com 9/18/2017 www.IDTheftSecurity.comID Theft Security 10 Criminal Hackers • Albert Gonzalez 170 million records • Buried $1 Million • Doing 20 years 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 11 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 12 9/18/2017 www.IDTheftSecurity.com Password Manager . Dictionary attacks: These rely on software that automatically plugs common words into password fields. Password cracking becomes almost effortless with a tool like John the Ripper or similar programs. Cracking security questions: When you click the “forgot password” link within a webmail service or other site, you’re asked to answer a question or series of questions. The answers can often be found on your social media profile. This is how Sarah Palin’s Yahoo account was hacked. Simple passwords: When 32 million passwords were exposed in a breach last year, almost 1% of victims were using “123456.” The next most popular password was “12345.” Other common choices are “111111,” “1234567,” “12345678,” “123456789,” “princess,” “qwerty,” and “abc123.” Many people use first names as passwords, usually the names of spouses, kids, other relatives, or pets, all of which can be deduced with a little research. Reuse of passwords across multiple sites: Reusing passwords for email, banking, and social media accounts can lead to identity theft. Two recent breaches revealed a password reuse rate of 31% among victims. Social engineering: Social engineering is an elaborate type of lying. An alternative to traditional hacking, it is the act of manipulating others into performing certain actions or divulging confidential information. There are a number of ways to create more secure passwords. One option is to create passwords based on a formula, using a familiar name or word, plus a familiar number, plus the first four words of the website where that password will be used. Mix in a combination of upper and lowercase letters, and you have a secure password. Using this formula, your Bank of America password could be “Dog7Bank,” for example. (Add one capital letter and an asterisk to your password, and it can add a couple of centuries to the time it would take for a password cracking program to come up with it.) 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 13 9/18/2017 www.IDTheftSecurity.com Hacking for Money . Social engineering . Phishing . Weak credentials . Insecure passwords . Unpatched OS . Vera . NO PASSWORDs 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 14 9/18/2017 www.IDTheftSecurity.com www.IDTheftSecurity.comID Theft Security 15 Identity Theft Identity Theft Definition; Identity theft and identity fraud are terms used to refer to all types of crime in which someone wrongfully obtains and uses another person's personal data in some way that involves fraud or deception, typically for9/18/2017 economic gain. www.IDTheftSecurity.com Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 16 Perpetrators 9/18/2017 Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 17 PerpetratorsPerpetrators 9/18/2017 PerpetratorsPerpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 18 Perpetrators 9/18/2017 Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 19 Perpetrators 9/18/2017 Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 20 Perpetrators 9/18/2017 Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 21 Perpetrators 9/18/2017 Perpetrators Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 22 Perpetrators 9/18/2017 Perpetrators 9/18/2017 www.IDTheftSecurity.comID Theft Security 23 Victims Story • I have been a victim of Identity Theft. Without making this E-mail 10 pages long, this all started in 1983, with a warrant for my arrest, it escalated to my drivers license being suspended in the state of Minnesota in 1986, and an arrest warrant in the State Of Kansas. I had a criminal history report run by the Minnesota Bureau of Criminal Apprehension, which came back with a 10 page report linked to my name, with various felonies including Criminal Sexual Conduct and Grand Theft. The person who has been using my name and date of birth is someone that I was “friends” with as a child. Over the course of the past 20 odd years, I have had my drivers license flagged with the DMV, so that picture ID must be provided if someone gives my name, as well as carrying a file folder with me, in the off chance that I get stopped by the police. I also have my driving record checked once a year to make sure that everything on it is accurate. Paul G. January 20 9/18/2017 Flawed System SSN + Credit + Fake ID www.IDTheftSecurity.comID Theft Security 24 Identity Theft Types . New Account Fraud Using another's personal identifying information (SSN) to obtain products and services using that person’s good credit standing . Account Takeover Fraud Using another persons account numbers such as a credit card number to obtain products and services using that person’s existing accounts or extracting funds from a persons bank account. • Tax Identity Theft Tax-related scams have increased by over 700% since 2008. Two million fraudulent tax returns were filed in 2011 alone, at a cost of two billion dollars. Child Identity Theft Studies show child identity theft is affecting over 500,000 kids every year. Identity Theft Types . Medical Identity Theft The deadliest form of identity theft. 1.5 Million victims every year. The motivation of the thief is medical procedures or any form of attention regarding healthcare . Criminal Identity Theft Someone commits a crime and uses the assumed name another person.

Load more