--Originally published at Allow Yourself to fail and learn… and hack

--Originally published at Allow Yourself to fail and learn… and hack

--Originally published at Allow Yourself to fail and learn… and hack

--Originally published at Allow Yourself to fail and learn… and hack

Collaboration post made with Diego

 

Same as previous post (link to previous post). Network security refers to all the measures and efforts made to protect a network and its data. The components we care about are the same components from computer security (usability, reliability, integrity).

 

Having a secure network not only assures a healthy and constant connectivity on the network, but most important it helps to protect personal information from a hacler attack.

 

To provide protection to a network we need to combine multiple layers for a solution. Each layer containing its own policies and controls. Some popular types of network security are the following:

 

• Access control
• Antivirus and antimalware software
• Behavioral analytics – it analizes activites that deviate from the norm
• Email security – this is the channel where many infections occur. An email secuiry application blocks incoming attacks
• Firewalls – set a barrier between your network and outside networks
• Network segmentation – it is intelligent to classify and restric a network to limit the privilegies and content each segment has.
• Web security
• Wireless security

 

For more security recommendations visit the following link:

http://www.cisco.com/c/en/us/products/security/what-is-network-security.html

--Originally published at Allow Yourself to fail and learn… and hack

Collaboration made with edy

Through all the semester we have discussed about the risk we can found on web. The certifications, and methodologies developers can use to provide a more secure ecosystem for their users. And about the different type of hackers we can found out there. There are still so many things to learn and practice related to security on the web.

Since many of the blog posts we have participated on were focused or at least required of slight knowledge on computer security, we want to make this post a friendlier one, a post we can share with anyone, and hopefully prevent people from bad practices online.

Let’s start with the basics:

• Be aware that anything shared online is prompted to be shared with anyone. So avoid personal and important information to filtrate just by not sharing it. (no passwords, no personal documents, no card numbers should ever be shared if not really necessary).

• Be careful and extremely suspicious about sites asking for personal information, there are many people illegally acquiring personal information by disguising as other services companies and asking users to submit their personal data. A real example that happened to us:I received an email invoice from a transaction for 100 dollars made on PayPal, attached was a link in case I wanted to cancel the transaction. I have a PayPal account, but I never used it on this year. Checking on the official site I realized there wasn’t such payment. Curious about the received mail I accessed to the link and there was a supposed PayPal login. By providing a mail that I’ve never used on PayPal and a random password the system granted me access, and ask me to submit all my personal information. The site looks exactly like a PayPal site, but it
  
  
  
  Continue reading "Safe browsing 101" →

--Originally published at Allow Yourself to fail and learn… and hack

What if I tell you that the most common method you use to access web is also really insecure? Well actually almost everything web related is prompt to insecurities (not because it’s bad designed, but because there are people who will always try whatever they can to obtain access where they shouldn’t); however wireless technology is a great target for hackers.

via GIPHY

Let’s talk about wireless security:

This is the prevention of unauthorized access or damage to computers using wireless networks. Anyone on the range of an unencrypted open wireless network can gain unauthorized access to private resource, and use information to perform illegal acts.

Some tools to provide protection by cyphering a wireless network are WEP, WAP, and WAP2. WEP is an early technology therefore nowadays hackers can break WEP’s key in a matter of minutes. More recommended standards for security are WAP and WAP2, due to its more complicate protection which warrantees more safety than others.

Some advice:

For god’s sake, always configure your wireless network with a password.

Make a hard to guess key, to avoid curious intruder breaking in.

If you’re using a router without WPA2 support, seriously consider an upgrade (this technology is outdated since 2003).

The longer your key length the better.

On a business consider a proper setting to provide wireless network for costumers (It’s ok to be generous with people, but don’t let them access to the same wireless network where the organization communicates).

Change your password constantly, there’s no perfect key.

The information shared through your wireless network is important and personal, you shouldn’t underestimate the importance of browsing on an open network.

 

Extra: A short introductory video about the importance of wireless security.

--Originally published at Allow Yourself to fail and learn… and hack

 

Cryptography is not a new technique at all, encrypting message has been a thing since many many years ago. This because of the need of humans to share message privately. Protecting important and delicate information that could be misused on hands of wrong people. Nowadays the story and the context is different. There still exist cases in which information has to be protected because of the importance it contains, but now that there are millions of people sharing information on the web. The need for protecting this information is more of a concern due to privacy and protection of personal information. It passed from being a technique used by a few, to a tool provided to the masses.

 

To understand encryption there are 3 main things we need to distinguish.

 

Encrypting:

There’s the Encryption part, where the message we need to share has to be protected by a lock, a lock that only sender and receiver know how to open.

Decrypting:

Then when the receiver gets the message he has to open the lock to understand the message, to open it he use the method sender and receiver share.

Cipher

Instead of using physical locks, this is the thing that nowadays we use to lock our messages.

 

Some common Cryptography methods:

 

Symmetric Key cryptography:

AKA shared key cryptography involves 2 people using the same key to encrypt and decrypt the information

 

Public key cryptography:

Makes use of 2 different keys: a public key for encryption, so than anyone can encrypt a message and send it, and then a private key, which able only one person to open the messages encrypted by the public key.

 

At the end, everything is prompt to be hacked and obtained, therefore the best we can do is to

Continue reading "You don’t mess with my key" →

--Originally published at Allow Yourself to fail and learn… and hack

Have you ever wondered what should we expects as users, or as members of a company from the technology we use, or the information we acquire and manipulate? There’s a document for that and is called Security Policies.

When we talk about security policies, we are talking about the document that companies use to declare on paper how they protect their technology and information. Same as technology, this document is always receiving updates, adding or changing what it states.

Policies should define as follows:

• Scope – Who the policy applies to.
• Who does the actions defined by the policy.
• Defines when defined actions are to be done.
• Defines where or on what equipment the policy applies to.
• Defines the organizational level that the policy applies to such as a division or the entire enterprise.
• Who enforces the policy
• What are the consequences of failure to follow the policy.
• Policies may reference procedures that are used but do not define the procedures. E.g. the policy may specify that passwords must be changed every 60 days but not provide a procedure telling how to change them.

So in simple words, it is sort of an agreement that as user we agree to acknowledge. And as members of a company guides to perform security solutions to problems that may be presented. Sort of a constitution, but with step by step guidance on each problematic that could happen.

Extra: the voice acting here is horrible, but it’s a clear example of a security policy on companies, on this case a secure password policy.

Useful reference:

http://www.comptechdoc.org/independent/security/policies/

--Originally published at Allow Yourself to fail and learn… and hack

Nowadays Internet is so important that many companies depend on it. The necessity for protecting all the services we can find online has never been so crucial as today. Employer seeking for top prepared IT security people can rely on the certifications the candidates may have.

Having credentials is not warranty of obtaining the job; however, it’s a way to measure your knowledge and commitment to quality and knowledge update.

 

via GIPHY

There are tons of companies and different certifications offered, today we will  focus only on 4 I consider useful and important:

CISSP:

Developed by the NSA(yeah the one controversial for spying all US Americans) and the ISSEP (Information Systems Security Engineering Professional). This certification is one of the most seek by employers. It focusses on methodologies and best practices on big and small scale.

It requires of an annual fee of $85 dollars to maintain the credentials valid. And a recertification once every 3 years. Obtaining this credential is not easy work, that’s why it is so valued.

CompTIA:

There are 3 different certifications that can be obtained by CompTIA but the one we care about, the one about security is called security+. To obtain it you should consider have at least 2 years of experience, and acquiring a network+ certification. Is a tough certification to get, but a very complete and important  to have.

CEH:

Remember the post about different type of hackers, well white hat hackers are the one who should get this. Cost around $500 dollars to obtain, requires of 2 years work experience.

CISM:

And last but not least we have CISM (Certified Information Security Manager) this is almost a must have among IT experts. It is a lot more demaning than the others, requiring almost 5 years of experience and costib about $700

Continue reading "Show me your credentials" →