Section 2.7-2.10: Mobile Security and Browser Security

- restrict access to the device: you're going to leave it somewhere
- facial recognition: unlock with your face
- PIN: choose a personal identification number
- fingerprint: built-in fingerprint reader
- swip: choose a pattern
- failed attempts: iOS - erase everything after 10 failed attempts, Android - lock the device and require a Google login or wipe the device

- built-in GPS and location "helpers"
- find your phone on a map
- control from afar: make a sound or display a message
- wipe everything: at least your data is safe

- all devices need updates, even mobile devices
- device patches: security updates
- OS updates: new features, bug fixes

- encrypt all device data: phone keeps the key
- iOS 8 and later: personal data is encrypted with your passcode
- Android: version 5.0 and later is probably already encrypted

- difficult to backup something that's always moving: backup to the cloud
- constant backup: no manual process
- backup without wires: use the existing network
- restore with one click: restores everything, authenticate and wait

- Apple iOS: closed environment and tightly regulated, malware has to find a vulnerability
- Android: more open and apps can be installed from anywhere, easier for malware to find its way in
- apps run in a "sandbox": you control what data an app can view
- 3rd party virus and malware protection: available from the usual providers

- mobile phones don't include a firewall: most activity initiates outbound, not inbound
- some mobile firewall apps are available: most for Android, none seem to be widely used
- enterprise environments can control mobile apps: firewalls can allow or disallow access

- manage company-owned and user-owned mobile devices: BYOD
- centralized management of the mobile devices: specialized functionality/MDM
- set policies on apps, data, camera, etc: control the remote device, the entire device or a "partition"
- manage access control: force screen locks and PINs on these single user devices

- Internet of Things: sensors for heating and cooling or lighting
- smart devices: home automation, video doorbells
- wearable technology: watches and heart monitors
- facility automation: temperature, air quality, lighting
- weak defaults: IoT manufacturers are not security professionals, consider isolating IoT devices on their own network

- shredder: heavy machinery, complete destruction
- drill/hammer: quick and easy, drill platters or all the way through
- electromagnetic(degaussing): use of degausser, remote the magnetic field, destroys the drive data and electronics
- incineration: burn it

- destruction is often done by a 3rd party: how many drills and degaussers do you have?
- need confirmation that your data is destroyed: service should include a certificate
- a paper trail of broken data: know exactly what happened

- low-level formatting: provided at the factory, not recommended for the user
- quick format: sets up the file system and installs a boot sector, clears the master file table but not the data, can be recovered with the right software
- regular format: overwrites every sector with zeros, default for Windows Vista and later, can't recover the data

- file level overwriting: Sdelete - Windows Sysinternals, remaining files are still available
- whole drive wipe secure data removal: DBAN - Darik's Boot and Nuke, removes all data on the drive multiple times
- physical drive destruction: one-off or industrial removal and destroy, drive is no longer usable

- 2019 study from Blancco and Ontrack 159 storage drives from eBay: 42% of the used drives contain sensitive data
- different data types: 66 drives had data, 25 drives with PII
- varied data sources: travel company email archive, freight company shipping details, university student papers, audio, video, and other personal files

- SOHO(small office/home office) appliances: appliance are usually a closed architecture, updates are provided by the manufacturer
- updates may address different requirements: bug fixes, new features, security patches
- install the latest software: update and upgrade the firmware for firewalls, routers, switches, etc

- content filtering, IP address ranges, or a combination
- allow list: nothing pass through the firewall unless it's approved, very restrictive
- deny list: nothing on the "bad list" is allowed, specific URLs, Domains, IP addresses

- control traffic based on data within the content: URL filtering, website category filtering
- corporate control of outbound and inbound data: sensitive materials
- control of inappropriate content: NSFW, parental controls
- protection against AV and anti-malware

- often a single device: router, switch, access point, firewall, etc
- location may be restricted to a secure room: prevent access to servers and network devices
- for wireless, location becomes more important: above ceiling tiles or another high point, this may cause problems for power cycling
- plan before the installation: may require additional setup time

- DHCP(automatic) IP addressing vs. manual IP addressing
- IP addresses are easy to see in an unencrypted network
- if the encryption is broken, the IP addresses will be obvious
- configuring a static IP address is not a security technique: security through obscurity

- address reservation: administratively configured
- table of MAC addresses: each MAC address has a matching IP address
- other names: static DHCP assignment, static DHCP, static assignment, IP reservation

- Wide Area Network/internet link: external IP address
- many ISPs dynamically allocate WAN addresses: the default for most ISPs
- it's easier to manage if the IP address is static: the IT team always knows the IP address, a SOHO might provide a service
- this may be an additional cost: contact the ISP for options

- Universal Plug and Play: allows network devices to automatically configure and find other network devices, zero configuration
- applications on the internal network can open inbound ports using UPnP: no approval needed, used for many P2P(peer-to-peer) applications
- best practice would be to disable UPnP: only enable if the app requires it and maybe not even then

- previously known as the DMZ(demilitarized zone)
- an additional layer of security between the internet and you
- public access to public resources

- Service Set Identifier: name of the wireless network, usually LINKSYS, DEFAULT, NETGEAR
- change the SSID to something not-so obvious
- disable SSID broadcasting option: SSID is easily determined through wireless network analysis

- open system: no authentication password is required
- WPA/2/3-Personal or WPA/2/3-PSK: WPA2 or WPA3 with a PSK, everyone uses the same 256-bit key
- WPA/2/3-Enterprise or WPA/2/3-802.1X: authenticates users individually with an authentication server(i.e., RADIUS, LDAP, etc)
- use an open frequency: some access points will automatically find good frequencies

- limit access to outsiders: guest networks are often enabled by default
- some guest networks can be used for other connections: IoT, lab networks
- don't enable without security: WPA2 or WPA3

- enabled physical ports: conference rooms and break rooms
- administratively disable unused ports: more to maintain, but more secure
- NAC(Network Access Control): 802.1X controls, you can't communicate unless you are authenticated

- 24x7 access to a service hosted internally: web server, gaming server, security system, etc
- external IP/port number maps to an internal IP/port: does not have to be the same port number
- also called Destination NAT or Static NAT: destination address is translated from a public IP to a private IP, does not expire or timeout

- always use trusted sources: attackers want you to install the malware for them, no fancy exploit required
- avoid untrusted 3rd party sites: don't click links to emails, don't follow links from other websites, always visit a browser site directly
- uses hashes to verify the download: confirm the downloaded file matches the version on the server

- install a hash checking application: available for command line and GUI, options available in the Microsoft Store
- hash values may be available on the download site: usually includes a digital signature for verification
- verify the downloaded file: compare the downloaded file hash with the posted hash value

- trusted sources: official browser extension library - Chrome Web Store and Microsoft Store, known-good websites
- untrusted sources: random or unfamiliar websites, installed by malware
- this is a significant attack vector: almost everything we do is in our browser

- March 2021: more than 24 malicious Google Chrome extensions identified, includes 40 malicious domains, not identified by security technologies
- malicious activity identified: credential theft, screenshots and keylogging, data exfiltration
- don't trust any software: always have backups

- password vaults: all passwords in one location, a database of credentials
- secure storage: all credentials are encrypted, cloud-based syncrhonization options
- create unique passwords: passwords are not the same across sites
- personal and enterprise options: corporate access

- security alerts and invalid certificates: signals something isn't right and should raise your interest
- look at the certificate details: may be expired or the wrong domain name, the certificate may not be properly signed(untrusted certificate authority), check for correct time and date

- pop-up blocker: prevented unwanted notification windows
- enable or disable: should usually be enabled, disable temporarily when troubleshooting
- block and allow: control pop-up blocking on certain websites

- clear browsing data: history, saved passwords, list of downloaded files
- clear cache: parts of a website are stored locally, remove all local data

- don't store information from a browsing session: good for privacy, useful when testing or troubleshooting
- removes the info when the browser is closed: no history tracking, no download file list, cached info is deleted

- share browsing data across multiple systems: sign in to the browser
- use with other computers, tablets, and mobile devices: browsing history, favorites, installed extensions, and other settings

- some browsers can block advertising: this isn't always an option
- many sites will track visits and recognize a return visit
- difficult to always recognize an ad: you can control the security level