Why Your IT Department Doesn't Trust You: Agenda

Transcription

19 June, 2013
Why Your IT Department
Doesn't Trust You:
And How to Solve the Problem
James Stanger, Ph.D.
President and Certification Architect
CERTIFICATION PARTNERS, LLC
Agenda
Today, we're going to discuss:
• Our online rights – and responsibilities
• Why you aren't trustworthy: The importance of
computing responsibly
• The rise of the executive order: The IT department
BOFH
• The cloud and security: How safe is your information?
• What you can do
• Instructors and the Internet: What teachers can do with
the Internet in the classroom, based on executive order
from the IT department
Copyright © 2013 Certification Partners, LLC ‐‐ All Rights Res
About us
1
We're CIW —
Your Web and Internet certification
Skills-based education standard
• A holistic approach to certification
• Courses and certification exams for career and college prep
• Internet skills, Video SEO, social media, Web design and development
• We put people on a life-long learning path, not a vendor's product treadmill
Vendor-neutral
• The best vendor applications as judged by industry
• Open source
• Competency and job role-based approach to education
Globally accepted
• Almost a million courses and exams delivered worldwide
• Over 65,000 certified individuals – ready for today's IT environment
CIW: Preparing for your career
CIW puts people on a lifelong learning path,
not a vendor's product treadmill
Your host
• James Stanger
– President and Chief Certification Architect
– Technologist, consultant and author
• Linux Magazine and Ubuntu User
• Eselvier
• O'Reilly
– Security, Web and social media consultant
– Educator and instructor
• Just taught Security+ in a virtual
environment
• Web technologies
• Social media
• Bring Your Own Device (BYOD)
2
Our online rights – and
responsibilities
Your rights
You have the right to:
• Get online
– To communicate freely
– To learn how to:
• Learn
• Compute securely
• Make connections
• Make money . . .
• Compute privately(?) Well, maybe not so
much
– Possibly
• People also have the right to use your data
• Government: Metadata and the NSA
• Private sector: Google & WiFi sniffing
Your rights (continued)
• Quite a few people talk about “the right to
be forgotten”
• Started in the European Union
• Do Not Track / Do Not Call Policy
• Can these things work?
• What records do governments have in regards
to Internet security?
• What records do governments and
corporations have in regards to privacy?
• What about the idea of not getting tracked in the
first place?
• Consider the right to:
• Learn
• Learn how to work online
• Conduct unfettered exchange of ideas
3
Your responsibilities
We're all citizens . . .


Sure, it's a cliché – but there's a
reason why it's a cliché
To know the systems you're
using
The Internet
Devices
Protocols
•
•
•

To know the motivations of
people – and entities – you will
encounter
Take a test: How does a smart
phone connect to the
Internet?
Your responsibilities (cont'd)
• Behavior
– Ethics
– Consider “Safe at work” behavior
• Security:
– Configuration
– Updating your computing devices
• Traditional systems (e.g., desktops and notebooks)
• Mobile phone firmware
• Antivirus software
– Avoiding – and reporting – issues:
• Attacks
• Harassment / bullying
• Suspicious business behaviors
Why you aren't trustworthy: The
importance of computing
responsibly
4
The decisions you make
Sometimes, we kind of turn
off our minds when we
compute




Our logic gets fuzzy
Details go into the background
Case in point:
–
FBI ransomware scam
–
Older attack, but still
effective
Why is this the case?
Training
Or the lack thereof




Lack of security awareness training
alone is estimated to cost us $100
billion
–
Phishing
–
Software-based attacks
556 million victims a year
18 victims per second
Training is the primary solution
–
Hardware. Okay.
–
Software? Sure.
–
It's all about the wetware
Source URLs:
http://www.go-gulf.com/blog/cyber-crime/
http://www.v3.co.uk/v3-uk/the-frontline-blog/2253010/the-weak-link-in-the-cyber-security-battle-is-the-end-user
Communication (or the lack thereof)
How well do you communicate
with your IT department?

Are you afraid to ask questions?
–
–


Of the IT / help desk department
Of other knowledgeable
employees
Do you think you know more than
they do?
Does communication:
–
–
Slow you down?
Cause you too much frustration?
5
New technologies
Appearing daily:




Sometimes they're hype
Sometimes they're real
Technology moves from novelty
to commodity
It's hard to keep track of:
–
–
–
How to use them
How to secure them
And think of Bring Your
Own Device (BYOD) –
what are the implications?
Source URL: http://www.electroiq.com/articles/sst/2012/08/gartner-identifies-fast-movingCopyright © 2013 Certification Partners, LLC ‐‐ All Rights Res
technologies-with-hype-cycle-report.html
Bad guys
Consider:

Number of botnets
– Honeymap
(http://map.honeynet.org)
– http://botnettracker.blogspot.com


Varied attack types
Motivations
–
–
–
–
“Hacktivism”
General crime
Espionage
War and terrorism
Bad guys (cont'd)
Motivations abound, but notice the increase in hacktivism

What does this mean?
• “Bad guys” are targeting specific people and organizations
• The result is that
people can't learn
by the school of
hard knocks
anymore

Who will teach them?
6
Analyzing techniques
Notice the increase in targeted attacks


Why have targeted attacks increased?
Because individuals haven't been taught
– How to secure systems
– It's more
than a
digital
literacy issue;
it's all about
learning how
to think
proactively
You don't know security
Few people do, actually – at least at
first

Back in the day
–
–
–
–
–

You learned by doing – or doing it
wrong
Someone taught you
The school of “hard knocks”
Computer viruses and worms were
rampant
Botnets, now
Can we afford to continue this model
in 2013 and beyond?
People now online
Internet World Stats:
Source URL:
http://www.internetworldstats.com/stats.htm
7
People now online (cont'd)
CIA World Factbook:
Source URL:
https://www.cia.gov/library/publications/the-worldfactbook/rankorder/2153rank.html
The answer: No
We can't afford the school of hard
knocks

Positive solutions:
–
–
–

Education
Better technologies
Easier to learn technologies
But there are also negative solutions . . .
The rise of the executive order:
The IT department BOFH
and BYOD
8
What is the BOFH?
The grumpy IT/support/security person
–
–
–
–


Character created by Simon
Travaglia
Smart, geeky, knowledgeable
Gruff, angry, world weary
Power hungry
Employs the PFY, works with “lusers”
Rogue system administrator
Alternative definitions:
– A person who gets tired of being
• rousted out of bed at 3am because of
end users
• ignored by end users
• interrupted
What motivates this behavior?
So, why does the IT guy get so
bent out of shape?


It's not because end users need to be
geeks
People who aren't responsible
– They do before they think
– They ignore basic principles:
• Have a sense of curiosity
• A bit of healthy skepticism
about certain claims found in
e-mails or other messages
• Ask questions
The cloud and security: How safe
is your information?
9
Well, not particularly . . .
We've all heard about the NSA
metadata controversy,
right?

Take a look at the picture to
the right -->>>>>
•
•

Nice rig, eh?
What does it tell you?
Well, it tells more than the
fact I like to get outdoors
• It has metadata
information
• It can be quite useful
Analyzing metadata
There's more . . .
How did my phone know about the
date and the weather of this
picture?

From captured GPS data
•
•

It is embedded in the image
Most smart phones do this
This means others can discover this
information, too, as you:
•
•
•
•
Update Pinterest
SMS your pictures
Use Flickr and Facebook
Generally do most anything
10
Well . . . pretty safe
How so?


Data at rest
– You can encrypt it
– You don't have to store in the
cloud, you know . . .
Data in transit
– Authentication
– Encryption
• VPN
• SSL

To gain trust, organizations can't be
too cynical – word always gets out
What you can do
Store data locally
And you can do it securely


Data at rest
–
Stored on your SD card
–
In native mobile device memory
–
The good old USB thumb drive
You can secure data at rest through:
–
Whole disk encryption
–
Password protection
• Screen savers
• Entire devices
11
Know the policies
It's all about the
Acceptable Use Policy (AUP)



A public document
–
Meant to show what is
allowed
–
And . . . what is not
Is there an AUP in your
organization?
Do you create one for your
students, if you're an instructor?
Secure your devices
• Here's what you can do:
• Encryption
• SD card
• Native memory
• Disable “features”
• Use a pass code
• Remote data wiping
• And don't forget traditional devices
• Notebooks
It's all about the
steps you take
...
• Desktop
Secure yourselves
Become literate in the tools that you
use
• Are we asking you to become a geek?
• Yes and no
• Yes:
– Do you know your phone settings?
– Have you spent time “peeking
underneath the hood?”
• No
– Become a smart consumer
– Consider becoming familiar with the
technologies you use
12
Steps you can take
Options include:



Configuring your phones to stop collecting data
Tracking Protection
Lists
•
Abine Standard
•
EasyPrivacy
Apps and add-ons
•
TrackerBlock
for Chrome
•
Ghostery
• Chrome
• Firefox
• Safari
• IE
Steps you can take (cont'd)
Additional steps:

Configure your mobile device to
stop tracking you
– GPS
– Photos


Opting out – if the option exists
Secure your device
– Password protection
– Firmware updates
– Application updates
Instructors and the Internet:
What teachers can do with the Internet in
the classroom based on executive order
from the IT department
13
Survey results


Anne Arundel Schools
–
A board
–
Approves – or denies –
requests
–
Takes about a week to
find out
Maryland Schools
–
County Media Center
–
Fewer online restrictions
than the standard
classroom
–
More observation,
however
Survey results (cont'd)



Try a national proxy service
You will need to gather support
–
Edline
–
A Learning Community
Management System (LCMS)
–
URL: www.edline.net
–
$4k a year for schools,
according to the schools
surveyed
How do you work to get support?
–
Document the need
–
Show overwhelming need
Recommendations
Considerations include:


Use a different Web browser
–
Requests generated from one
browser can make a difference
with the proxy server
–
Consider rendering engine:
Chrome versus IE
Conduct an instructor-assisted lab
–
Instructors may be able to use
different logins than students
–
Use an overhead
14
Recommendations (cont'd)
You can always try:


Using your mobile phone as a hot spot
–
Then conduct an instructor-led lab
–
Don't allow students to connect
directly!
Anonymous proxy (anonymizers)
–
Can bypass limitations
–
Liabilities – beware of them
–
Overview:
http://navigators.com/anonymizer.html
Recommendations (cont'd)
Empower the students:


Open access, then create an Acceptable Use
Policy (AUP)
–
Students enroll in a program
–
They are then taught how to behave
responsibly
–
Terminate students from the program
for irresponsible use
One-to-one technology access
–
Implement a BYOD policy
–
Again, exercise strict control and
reinforce training
Caveats
Considerations include:





Does your department have enough talented techs
to implement?
Some instructors feel BYOD will lead to the fall of
civilization as we know it
Others feel it empowers students
What if the resources go offline?
–
Store locally
–
Make alternative labs available
Keeping students on task
–
Kinesthetic labs
–
Have them use devices for only a few minutes,
then conduct interpretive labs
15
Resources
Resources
Some of the better places we found include:
• “Fact Sheet 18: Online privacy”
URL:
https://www.privacyrights.org/fs/fs18-cyb.htm
• “Cybersmart: Learn More about your Online Rights and Responsibilities”
URL:
http://www.cybersmart.gov.au/About%20Cybersmart/Newsroom/Annual%
20Events/Safer%20Internet%20Day%202013/SID2013%20%20Connect%20with%20respect.aspx
Resources (cont'd)

“NSA Best Practices for Keeping Your Home Network Secure”
(How ironic!)
URL:
http://www.nsa.gov/ia/_files/factsheets/Best_Practices_Datasheets.pdf
• “MIT Top Ten Safe Computing Tips”
URL:
http://ist.mit.edu/security/tips
• “University of Oregon Safe Computing: Tips and Tricks”
URL:
https://casit.uoregon.edu/faq/security/safe-computing
16
Resources (cont'd)

“How much online privacy do you really have? Less than you think
URL:
http://www.zdnet.com/blog/bott/how-much-online-privacy-do-you-reallyhave-less-than-you-think/4508
• Govloop's “Cyber Security in Focus”
URL:
http://www.govloop.com/profiles/blogs/infographic-cybersecurity-in-focus
• The EasyPrivacy Web site
URL:
https://easylist.adblockplus.org/en/
How CIW teaches you responsible
online behavior – beyond simple
digital literacy
CIW Foundations – Especially IBA and NTA
Most will want to
simply focus on IBA.
But that's not enough
– NTA teaches you
essential security
concepts for the
workplace.
17
CIW Internet Business Associate (IBA)
As a Web developer, you need to know all of the Internet cold – not
just the Web . Skills taught and assessed in this program include:
• Mitigating risk online
• Project management
essentials
• Using Internet and
Web-based tools to
create and
collaborate
• Working as a team
• Understanding IT
job roles
• Using search engines
• Advanced searches (Booleans)
• Configuring a home office
network
• Troubleshooting browser
connectivity
• Using browser plug-ins and
add-ons
• Database essentials
• Working in a cloud computing
environment
• The Domain Name System (DNS)
• Using Internet clients in
business
• Social media
• Protecting your identity
• Open source essentials
For more information, go to:
http://www.ciwcertified.com/certifications/
web_foundations_series/iba.php
CIW Site Development Associate (SDA)
Skills taught and assessed in this program include:
• Identifying steps in the Web
site planning and development
process
• Creating pages with HTML5
• Cascading Style Sheets (CSS)
• XHTML
• Web design as a project
• Using templates
• Creating HTML5 forms
• Validating code
Creating video
Editing for the audience
Ensuring page accessibility
Coordinating with social media
Internet marketing
Search engine optimization
(SEO)
• Using GUI-based HTML editing
software to create Web pages.
• Testing and analyzing Web site
performance issues
•
•
•
•
•
•
• Maintaining a Web site
• Consulting with
customers
• Benefits and
drawbacks of
using cloud
providers
• Write solid copy
• Identify trademark and
copyright issues
• Publish to the cloud
web_foundations_series/sda.php
CIW Network Technology Associate (NTA)
Skills taught and assessed in this program include:
• Working with cloud service
providers
• Virtualization
• Service-based models, including
SaaS, IaaS, and PaaS
• Network troubleshooting
• Maintaining hardware
• Configuring mobile devices
• IP addressing
• Recognizing attacks
• Securing traditional and cloud
networks
• Authentication schemes
• Encryption types
• Firewall configuration
• Intrusion detection
• End user security
• Mobile computing devices
• Content management
systems
• Network
models and types
• IPv4 and IPv6
• Typical Internet
security and
availability issues
• Routing essentials
web_foundations_series/nta.php
18
CIW Certifications
CIW Certifications
How we help people teach and learn:
CIW's turnkey, modular approach
19
We provide it all
No other Web or Internet program provides:
• Pre-assessment
• Courseware, with hands-on labs
• Online, via our CIW campus
• Book-based
• Supplements
• Practice exams
• Videos
• LiveLabs – Ready-made “sandbox” environment that allows students to
learn today's technologies
• Industry-respected assessment and certification
Courseware
To get certified, you have three options:
• Learning resources
• PDF-based
• Available via our electronic campus
• We welcome you to attend a
demonstration
• Book-based, if you wish
• Supplements
• Exercises designed to engage
today's learners
• LiveLabs
Assessment and certification
To get certified, you have three options:
• VUE testing centers
• Available worldwide
• www.pearsonvue.com
• Prometric testing centers
• Available worldwide
• www.prometric.com
• Innovative Exams kiosks nation-wide (US)
• CTC Online (our preferred option)
• We own and operate
• You become a proctor and test students test right in the classroom
20
Faculty training and professional
development
We can help prepare you. Options include:
• In-person training
• Right in your facility – or ours
• Expert, trained instructors
• Online training
• The same instructors
• Taught using all CIW tools
• Hybrid model
• The most effective model
• Helps “trickle feed” instructors over time on a more flexible schedule,
but also with a personal touch
What makes CIW work?
• Individuals want CIW because:
• People want the skills
• Hands-on learning
• We push skills, not software
• We profile the right applications
• Institutions use CIW because it is:
• Easy to teach
• Articulation agreements and relationships that ease funding and put
students in seats
• Books allow students to quickly identify what they're learning
• Online supplements assist knowledge transfer
Why is the CIW standard so relevant?
We focus on job roles
and skills that set you apart
21
CIW Advisory Council:
Helping us create the standard
A nexus of industry, academia, government, and not-for profit organizations
Academic/Government
Industry/ Not For Profit
Home Learning College
Western Governors University
University of Phoenix
Mesa Community College
Kaplan University
University of the West of Scotland
Pellissippi State College
Tokyo University
State of Florida
Google
CompTIA
Certiport
Western Digital
American Express
HitachiSoft (Japan)
O'Reilly Media
Cypherpath
What does the council do?
Acts as a nexus for industry, government and academia
• Identifies gaps between what academia provides and what the
industry needs
• Industry and academia can share perspectives
Provides feedback
• The latest technologies that CIW should profile
• How CIW can adjust its instructional design to better teach students
CIW: A Proven Way to Fast-Track
Your Development Career
Internet.com names CIW a top developer cert
• Recommends CIW as one of its Top 5 Certifications that put Web Developers on
the Fast Track
• CIW's Web Developer came in at No. 3 with "the distinction of being the
industry standard for Webmasters”
• No. 1 and 2 (MCSD and SCJD) are well-known vendor-based industry staples —
CIW is vendor-neutral and focuses on core technologies and languages
• “When you combine in-demand skill-sets and proven salary impact, specific
certifications become valuable to individual technology professionals”
• Proof positive of CIW's continuing value to designers and developers worldwide
Read the full Internet.com article at:
http://www.computertrainingschools.com/training-spotlights/5-certs-that-putdevelopers-on-the-fast-track.html
22
ISC2 and CIW
ISC2, creators of the CISSP certification, have partnered
with CIW
• ISC2 recognizes CIW's leadership in the Web design and development space
• CIW Web Security Associate now listed as a certification that allows CISSPs
to waive a year of experience
• We continue to partner with ISC2
CIW: Government endorsements
eSkills and City and Guilds (England)
Helps educators in the United Kingdom validate training programs
All CIW programs listed as approved
Department of Defense 8570 Initiative (USA)
Designed to help the DOD and its contractors compute securely
All CIW programs listed:
https://www.cool.navy.mil/ia_documents/ia_iat_flow.htm
Scottish Qualifications Authority
Helps universities and further education colleges determine skill levels
Listed since 2006
CIW: What people are saying
“No other Internet job-role certification can claim the same size, credibility
and acknowledgement as CIW.”
Source URL: http://www.cedsolutions.com/courses/ciw-certification.cfm
“CIW certified are in high demand in small to big enterprise level
organizations.”
Source URL: http://www.theitlibrary.com/ciw_certifications.html
“If your resume [has] a CIW certification on it then it will give you a head
start in the IT industry over and above the other candidates.”
Source URL: http://myhomeschoolnews.com/growing-importance-of-ciwcertification
23
What the industry is saying about Web
Foundations Associate . . .
“As far as I'm concerned everyone at our company could benefit from
CIW Foundations training, especially Network Technology
Associate (NTA).”
"Very interesting stuff, probably things I should already know.”
—Jim Bush, a veteran in security and virtualization, Consonus Corporation
“Foundations would be very valuable from new employees to seasoned
vets."
“These courses would be great to offer in tandem, I found myself answering
client questions directly from the knowledge gained in these courses.”
— Michael Graupner, a new technical consultant for Consonus Corporation
CIW: Its impact on careers
CIW: Skills that set you apart
Compare traditional designers with those who have
the skills CIW teaches:
Salary for a traditional JavaScript developer: $78,000
Source URL: http://www.indeed.com/salary?q1=javascript&l1=durham%2C+nc
Salary for a CIW JavaScript Specialist: $86,000
Source URL: http://www.indeed.com/salary?q1=senior+front+end+developer&l1=durham%2C+nc
Note: Salary figures
may change over time
24
Salary for a traditional Web designer: $69,000
Source URL: http://www.indeed.com/salary?q1=Web+designer&l1=durham%2C+nc
Salary for a CIW Web Design Professional: $80,000
Source URL: http://www.indeed.com/salary?q1=Web+design&l1=durham%2C+nc
Note: Salary figures
may change over time
Salary for a traditional Web designer: $69,000
Source URL: http://www.indeed.com/salary?q1=Web+designer&l1=durham%2C+nc
Salary for a CIW Web Design Professional: $80,000
Source URL: http://www.indeed.com/salary?q1=Web+design&l1=durham%2C+nc
Who uses CIW?
• Learning centers worldwide
– Firebrand (UK)
– YAT (Egypt)
– LaSalle Learning (United States)
• Universities worldwide
–
–
–
–
–
–
–
Home Learning College in (UK)
Kaplan (United States)
University of the West of Scotland
Western Governors University (WGU)
American Public University System (APUS)
New Hebei University (China)
University of Phoenix (UoP)
• Secondary schools (grades 9-12)
worldwide
• 200+ community colleges and growing
25
Questions?
If you have questions, feel
free to:

Use the “chat” window

Raise your hand using
the GoToMeeting feature
Our next Webinar
Our next topic:
Real Life Computing and Teaching
with Virtualization
Wednesday, September 18, 2013
8:00 am – 9:00 am Pacific
Register at the following URL:
http://www.ciwcertified.com/About_CIW/webinars.php
You can also go to the above URL to learn more about future offerings
Summary
• Our online rights – and responsibilities
• Why you aren't trustworthy: The
importance of computing responsibly
• The rise of the executive order: The IT
department BOFH
• The cloud and security: How safe is your
information?
• What you can do
• Instructors and the Internet: What teachers
can do with the Internet in the classroom
based on executive order from the IT
department
26
Follow CIW Today!
www.twitter.com/CIWcertified
www.facebook.com/CIWCertified
http://tinyurl.com/6eznl7z
www.youtube.com/CIWCerts
Contact us today
James Stanger
President and Certification Architect
CERTIFICATION PARTNERS
[email protected]
+1 (888) 303-8694
+1 (360) 970-5357
Mike Shirra
Marketing Manager
CERTIFICATION PARTNERS
[email protected]
+1 (602) 794-4160
To receive the latest info about CIW, follow CIWcertified on Twitter, Facebook and LinkedIn (CIW Group)
27

Why Your IT Department Doesn't Trust You: Agenda

Transcription

Similar documents

4students: Read More about Our Writing Services

4Students LLC is completely

Firehouse hosts Great Big Home Show

oc pepper spray certification course

stockmens insurance agency llc

Keynote speech by Oyvind Vessia, DG Energy, European

be in your new home before the new year!

the eLeaP LMS brochure.

a PDF of this press release

IACCA 2016 Brochure April 2016