Information Security: Current Threats

1
Information SecurityCurrent Threats

• Marc Scarborough
• Information Security Officer
• marcs_at_rice.edu

2
Changing Nature of Attacks

• Before Prank/Defacement
• Word Macro viruses that inject words into
  documents when printed
• Web site defacements
• Recently Resource Theft
• Coordinated DDOS (Distributed Denial of Service)
  Attacks by remote controlling hacked computers
• Hacking systems for their disk space and network
  speed, creating distributed repositories of
  stolen content

3
Changing Nature of Attacks

• Now Targeted Attacks - Political and Financial
  Gain
• Credit Card / Personal Information / ID Theft
• Worldwide crime organizations coordinating
  specific attacks for specific purposes
• Government Entities defining Cyberwar

4
Recent Headlines
5
IRS Phishing - Number One Scam

• IRS currently defines phishing (an information
  gathering scam through email or phone) as their
  primary threat.
• Higher Education, including Rice University, has
  also seen a sharp increase in the number and
  complexity of phishing attacks on campus.
• The attacks are looking for Rice NetIDs and
  passwords which are used to log into our Webmail
  servers to send other types of scams to Internet
  users around the world.
• The scams sent from hacked Rice NetIDs include
  Nigerian 419 scams and Death Threat emails.
• Information Technology has worked diligently to
  slow these messages and inform the community as
  they arrive

6
Hannaford Credit Card Breach

• Hannaford reported a significant credit card
  breach
• As many as 4.2 million credit card numbers were
  exposed.
• At least 1,800 were subject to fraud (so far).
• The breach began December 7, 2007 and was not
  contained until March 10, 2008.
• Rice University is and has been taking steps to
  secure our credit card transactions. More
  information on these steps is coming.

7
Ohio University The Response

• Highlights from the (Ohio) blueprint include
• Implementing a perimeter firewall that will
  filter Internet traffic to protect computers
  outside of the central cluster from hacker
  attacks.
• Classifying data by the level of security
  required.
• Rice is also working towards similar goals
• Enhanced firewall protection for our Students and
  Staff
• Enhanced auditing of critical systems and services

8
More Informationhttp//www.rice.edu/it/security/
index.shtml
Yes! We are available for IT security
presentations to departments and other Rice
community groups. Marc Scarborough IT Security
Officer marcs_at_rice.edu 713.348.5735