How do i industry sign banking new jersey ppt secure
[Music] and today is uh aDNA is that how you pronounce his name today who's speaking today today yeah yeah just want to make sure that I pronounce his name right Wow there is hello Lou alright how are you I'm good thank you good let me I'm gonna make you a co-host okay alright do you have like a PowerPoint presentation you want to display let me just put it on okay beautiful all right so just so you know usually a lot of people end up jumping on like right at 12 o'clock so we give them until about 1202 1203 trickle in once it hits like 1203 I'm gonna make some brief announcements I'm just gonna let people know hey I'm gonna mute you you won't be able to unmute yourselves please direct any and all questions to the chat I will again say please direct questions chat and a hard cutoff time of 12:45 to respect everyone's time after your presentation I'll make some more brief announcements for what's going on at the chamber and uh then I'll hand the floor to you perfect pretty or just without recording it is already recording okay it's gonna be recorded I'll send you a link to view and download the recording and you can use that and after being after doing some editing like trimming out this little beginning part basically we post it to our YouTube and to our web sites of video library let me know is this the way to crown a madman yeah yeah okay I just wanted to make sure I got that right thank you all right we're at 12 o'clock for those of you that are here already thank you so much for joining us we're gonna give people two or three more minutes to trickle in and then we'll get started all right we're at 12:03 so I'm just gonna get started with some announcements so just so you know I am going to mute all it looks like everyone's already pretty good about that so I appreciate that just so there are no interruptions during the presentation and you will not be able to unmute yourselves um please direct any and all comments or questions into the chat feature we have a hard cutoff time of 12:45 to respect everyone's time after the presentation is over I'll make some brief announcements for the chamber so I'm gonna mute all I think everyone's already mostly muted which is great but one moment there we go and the floor is yours thank you so much I'm a good to start you are good to go all right awesome hey yeah kind of afternoon everyone my name is Adnan and thanks for this opportunity from ng commerce you know since you're all locked down so I think it's a good opportunity to make the most use of it and trying to educate people around cybersecurity or security so I won't go into the DA I'll just keep it very high level and the thing I want to make sure when you go from here you have those basic steps and basics knowledge which you can apply in your regular life or business depending so I may be asking some question the chat box but just for to understand you know what kind of business or what kind of tools and technology you are using it so that would help me I hope if you know I'll be able to go and check in a chat so that's how when I start this and kind of make it a little bit interactive and maybe there any question we can take in the end of this slide deck or you can ask in the chat so again going back you know since we are all locked down and there's a lot of push um and and the reason is we all working from home and company who would have never thought about out working from home now they are being forced whether it's a five employee company or 50,000 100,000 you look in the news this has never nobody ever thought about it we know that people talk about workforce remote workforce digital workplace but all of a sudden it within this short period of time nobody imagined that and that leasts you are so many connecting dots not about a cultural shift but also challenges with the technology so that's we'll look into that house being happening and why attacker or actor or the bad guys who want to take the opportunity and cause damage and what you can do to protect yourself your data your employer your company you know even if your individual if even it's your personal data so there are a lot of awareness needs to be needed what a lot of actions you can take and these are not super tech that'll be sick stuff you really can apply and at least get to the next level where you can protect your privacy in the data so little about myself like I said before I started this I meant for cloud there is a cloud this type of mistake but that's more training and also project based consulting I've been an IT for 20-plus years been working for large financials design a lot of architecture engineering but on the business side of it always see a value where I can educate and have the business to you know fill those gaps and missing in the technology so let's move on so this is something I was able to pull this report a couple of days ago that before coffee 19 it says based on the report if you go on the Google or folks and one of us from another side that 29% of the Americans were able to work from home that's according to force and that one means that's how the company is putting their employees to work from home and this is how you design your network your technology and all that stuff I think I do have go back there is question something I just commented that I'm amazed at that 99% of workers right right would refuse to work remotely I was I commented that that's kind of incredible yep so yeah I mean the people were given the twice right so and then if it will help us to build the conversation to the next level because because if you look at a big bigger picture all the companies you know it's a it's a jump 29% and then everyone is now forced right even it is I mean if they would know there is no check this is no choice but still people are working from home regardless so so as when I go a little bit on technology side there's no infrastructure has been designed and challenges and I'll go into that what are the challenges and what can be done of course that's not gonna be a ideal state we can just go and turn the switch off or on to get to that state that's not gonna happen but again you can get to the next level and every business can apply and at least to improve and work on that process and this is gonna be happen for the next few months that's what we've seen then you it's not going to change X equal two weeks we know that that's what going in the news let me just put the chat on the side so so that's I want to bring up I mean you can always go back look it up these breaches just want to give you some education on that there are so many there is a list of top 10 threats of this century or something so I pull the ones which was bigger in numbers or maybe less aside you know eBay Equifax Capital One's this is where you're in my data you know I'm concerned about it so you are because my credit card information and when you open those credit card you have your socials and all that stuff so that's not good and last I heard I read one report um month ago that's not there in the list 143 millions user data hack because if somebody did not encrypt the data on Amazon storage so you know those thing happens because of some ignorance somebody's not paying enough attention not applying those security policies and guess what end-user is the victim all the time and then I get sold on dark web and all those site people do a business you know and then end of the day end user is affected whether it's your personal data your health data you know your medical records and all that so that's not good and now why it is the problem because I would not be surprised couple of weeks later or if you just that that's I see it coming in few weeks there will be more breaches happening and why we look into that so so that's the traditional model and this is where I want to ask you about the people who are attending what what kind of a network you had do you host or put everything in the cloud or do you have more or less the same setup in your office in your home office or at your workplace just type yes or no it there's no right and wrong answer because if you work for 50 user company you may have I've seen those environment if you go to a large bank or financials it's totally different SuperDuper secure physical access but they're also get the breach and those breaches are very intense like 100 million user data get stolen so that kind of breaches happen but in this kind of office it won't happen so yeah so I'm getting all your chat we use cloud and everything right so so I want to give you you know a little bit graphical environment here and that and that's what it typically works in your small data center or small office and then we go how does it things changes in the cloud so basically the one in the blue you say it's a cloud and then you have a firewall and then you have this file folder I put it is that is like your file server your windows server your backup and everything but what happens in in a in a typical a physical environment where you do not have cloud so of course today pretty much everyone has cloud but if you go back five ten years ago when these breaches were not happening because everyone there was on premises a small server room what'd you call it small data center so you breach was the physical layer not the logical or not internet layer somebody was wanted to hack or wanted to break the door physically you know or turn off your CCTV cut the wire you know those kind of physical access was important that was the main thing and then somebody can go in there and steal the data and if you're if you're not in the e-commerce business if you're not that kind of a business if you're like a regular business retail manufacturing whatever if your business to not run 24 operation 7 operations whichever so that kind of business you basically what you do is turn off the server and then you leave it but still you leave your turn Internet turn on because your firewall so you have that kind of okay now I have a firewall I have some security in place guess what if something happens when machine does shutdown and all that and you're doing the backup and all that and I can go and on on the pros and cons or the backups and everything but again let's stick to this then this what I'm trying to say is the physical physically somebody has to access and then from there somebody can steal the data and that's a typical thing and only traffic which is allowed in this kind of setup and it also kind of resemble the data center where the companies have cloud and on-premises which is called a hybrid but when you have the data in some banks their server do not even talk at all to the intranet so that's kind of thing in this example one user is accessing it could be me anybody else on the small businesses they have full access to the Internet but at the same time they are blocking with their policies and not allowing anything from these servers uploading through the internet so that's it's a very basic model now if you look at in the next slide it's on cloud now we all use cloud every one of us and we've been using it pretty much I would say last 20 years in terms of an email like Gmail Yahoo so that was this is how it got started 20 years ago in from the email stuff then now we use it for everything you're storing under files you're storing over the pictures you name it everything even over Android phones and contacts and everything is in the cloud because so easy if I replace my phone I just put my ear google-eyed you in the next other phone and all contacts are there some fully synched but that's the thing will changes when it comes to the business and the common thing if I were to say in the cloud is we only need one thing and that one thing is what our identity so identity is very important because in internet model your identity just like your password because with this password you can travel anywhere in the world same applies here with your identity you can go to Google Facebook Instagram you name it you have one identity pretty much you don't keep multiple email addresses every platform allows you hey you want to use an email address you want to use a Google ID your Facebook whichever and we use just one identity for ease of use for single sign-on and we get access to whatever we want link then Google as I said Facebook whatever it is so that's what we have but if I if I go back here that does not apply so that's the significant that's the huge change from this model to the cloud because here my identity does not work at all I have to be there physically or I have to be P into my office and then I get access to my servers and file but again the nature or the world we live in we need everyday 24/7 the business has changed so that's what is driving and then now we are into this type of model where even my Chromebook I have to sign into the cloud and use it even kids at the school they resided in with the Chromebook like and the video conferencing Nordic confessing we are using today it's all cloud-based of course there are so many benefits so the point is that how do I go to the next level I wanna I know that I want to use it I'll keep using it is good for my business it makes me more there I don't have to worry about backing up and restore and you know those kind of nobody wants to go back to that because you know you you lose your focus you lose your concentration you want to focus on a business so how do I go to the next level so I'm gonna give you a couple more for example that's the Google is an example here where you have this identity and same thing here you have all these software as a service service like sense it's like gee sweet box office 365 Salesforce so you have these multiple platform which is either for your online cloud storage which is either for your sales or maybe your change management ticketing banking you name it some of the systems system out there but that's the car model again you just need one identity to access all of them right so that's another example and I want to share one more example along the same lines so yep so basically that was example and then what identities that's what I'm talking about right so in in this how do we do and what am I gonna do to make sure you know I stay protected so I want to go a little bit but again I'm gonna describe me in the chat have you heard the word encryption before yes and no yes okay so you heard it okay so and do you know about have you heard data at rest encryption in transit okay so so I'll be honest I'll be very high level because these I don't want to go into the beads because it gets very technical but again the idea here is that whenever you're putting your data in the cloud I'm not sure about a box but again wherever there are free services usually they do not have encryption in that cloud for example I can because I pretty much use office 365 most of the time and outlook maybe Google but Google have two offering one is free like live.com and office 365 is paid Google is free Google Drive but they do have Google suite on a G suite which is for businesses it could be a one person or five thousand or 50 or whatever so this is where things changes if we go and read they tells you because this is what you are paying for what data encryption because there are different level of encryption one is let's say if I send you message and I phone this is an iMessage so if I'm sending your message through I messages it's blue and if I'm sending to you at the recipient so that message going over the wireless through the Verizon network whichever but end-to-end it's encrypted nobody can read my message because even in the air it is encrypted and that's what Apple is known for but if the recipient does not have iMessage another mobile platform Android base it may not be encrypted it is clear type same thing applies on the War SEP you might have heard encryptions and you might have seen those things so this is end-to-end encryption same thing if I'm putting my data drag and drop for Picasa or something in the cloud probably they are not secure so that data you're putting in the cloud you gotta make sure whether super personal later depending is it your yearly text file and you say hey I don't know don't want to back it up at home because what i
the hard drive crashes I'm going to lose that you dragon I put in the Google Drive so question is is that Google Drive is secured in the cloud mean it is providing the encryption because those data centers they keep changing the hard drive like we do shredding of our bills every day because hydrolyzes go corrupt then they have a thousands of millions of hard drives so if it's not encrypted go read it because business subscription they provide all encryption so your sensitive data I got to be put in the cloud where they have encryption at rest means your encryption address is you're a hard drive is encrypted basically if I have macbook it comes by default if I have a Windows I want to make sure because if I'm carrying one notebook and if it gets stolen and somebody gets access to it they won't be able to even they take out the hard drive they won't able to access my data so that same concept applies in the cloud so that's one part of it second all I want to explain is encryption I explain different at rest but encryption in the transit so for example if I am sending you an email and let's say Gmail - Gmail or Yahoo whatever so so let me put this we pretty much we yeah if you don't have a mortgage around but if you've been through credit card processing a bank loan and mortgage I'm sure the email you get from the bank they wants you to click on a link and when you go to that link and you put your password and it's a different interface you get access to it it means the bank wants you to log on through their portal and then upload your financial statement mortgage documents and everything on to their server you would have never seen a bank sending you these document as an attachment even they want you to do the digital signature they wants you to log on to their portal it means they are reliable they're liable for this too fighting the security that's why they wants you to go through their portal sign-in and they make sure encryption in the challenge whenever you're doing this processing and everything is there so that's the encryption one of the example you can in the transit because still you're working with the webpage so that's in the transit that's on the wire so basically that's the idea encryption they do it so if they don't you can swim and that's they take their responsibility being that regulatory compliant to give you those options as an end-user because that's not your sponsor it's a bank so so that's one of the example I know it's complicated but the best example or easiest example is an email if I send you an email not necessarily my email going to you is secured what it means end-to-end encryption and there are many ways to do it as I said before if you go to Google and check it out they do offer in the business like an office 365 they do have encryption what it does end to end encryption so if somebody get access to it they won't be able to read that so this is where really make a difference now how things are going to be changing and more opportunity for attackers will come to that because if you look at this picture and the previous one or this one now people are being tool and you know of course that's the nature of the situation we have we all have remote work so what it means when you're working remotely one of the thing is that and it also depends on the size of the business so as I said before if I'm a small medium size and I'll tell you size in terms sometimes size really doesn't matter too so let's say if you have a 50 user company for example and you do not give devices to your user and they have their own devices again but that is not accept acceptable for somebody who works for a law firm who works for a mortgage who works for a bank take an example if you go to a bank the people on the retail banking if they are true to work from home and if they do not have a company assign laptop that's a problem because these devices are unmanaged devices and they use their home devices who knows what kind of viruses they have they are not patched because the way it works in any company where they have the IT and all that they have a standard procedure like if the Tesla is making the car Tesla have standards for their car their engine the consumption the body the shape the color whatever right they follow the whole pipeline to assembly line and everything same thing applies in any industry so they follow those procedures because they control it same thing if the company provides these devices to the employee to work from home they still monitoring because employees log on to the VPN or both will internet they have secured certificate so they have the full inventory and they know each and every device if it's not passed if it's not up-to-date if the software is missing or not abraded they will quarantine the device automatically and bring it back to the same level well it means the IT health interest standards for the device but as I said 29% to 99% remote work has changed these verticals these businesses never thought of so now this is the gap right and how are they gonna do it of course it's not going to happen and there will be more breaches and attacks and this thing will see but there are like they are working on and some best practices but this is the huge gap so whether you're small business or large business a small form of 50 law firm require the same stuff and they have to be compliant because the industry they're working right if there is a big company with 200 user and they do not need to be compliant or manufacturing they were not care but again the data is there on the user's devices so that's that's challenging how to deal with that of course there is not gonna be as I said before switch to change it but again there are some actions some items can be which I'll walk you to share what are those so that's the challenge because an unmanaged device is if I can go on like it can be mobile devices it can be your laptops and everything and then when your ex SX I give an example if I have my company's email I can easily copy paste for regulatory environment you're not even allowed to that you are not even if some time a belief or word those emails so you lose all those control that's those are the thing and also let's let's lead that large from let's talk about small businesses or whichever you might have heard ransomware this was very common six month eight months ago there they were asking some ransom money and then they were like okay I got all your data there was some manufacturing company whichever company had been paying ten thousand two hundred thousand to those bad actors or an attackers because they benefited in the system how did they do it is because of social engineering dates have been sending phishing email I'm sure you must have heard of fish in here if not this let me know in the chair I can explain but that's email it's your fish and then they watch your activity literally for a week for a month even two and then they learn your environment they just need one user and from there they keep monitoring and watching and they find who the user environment may have admin level access and once they do it they start collecting the data slowly slowly and two months three months later guess what you get an email you ignore it you get another email you ignore it and they say hey okay let me delete some file and then yeah or something happen and then IT and security can involve and then it's too late so and still so still I mean there is no I can say you have to be very vigilant you have to variety people but still it's not something you can just go or like like over 19 there's no vaccinations for that because social engineering people will be phished so milord of awareness is required to the end-user how to figure it out not to click every email so that's where the ransomware is and then they encrypt the data even you do not have access to data and they say okay be deleted it so it's been happening so that's why it's a risk whenever you have unmanaged devices even your personal computer at home it's not a company home if we are finished and you are compromised your text document your personal files your family pictures whatever you name it so that you can also be compromised so this is where you might think okay what controls do I need you know how do I do that what are the best practices so I'll share in a moment so any questions so far just go ahead and type in the chat box if you have so people say they've heard about the phishing email okay so do you use anything on top of the password just I so whenever let's say you access your email on Gmail or whichever platform do you just use your email ID and password or do you Newton use any kind of extra layer of security do you know anything that there is something more than a password just password okay okay so that's definitely gonna help you okay so what happened before I go to that what happens is is because I come from a different background in IT I've been in applications and infrastructure and for the last few years pretty much heavily focus on security like governance compliance and you know thought process around that what are the controls can be implemented and how the businesses you know I'm a very technical at one side but also I want to make sure it brings an add value even when I'm doing a business thing but even those control when I'm not doing business and personal user who I am myself my family you know those kind of things everyone has that so how do we do that and implement those control when you are by yourself or you are into a business and how do you make it some of the controls you can you wanna make it as your lifestyle because there is no room for that then you wanna ignore it because if that something happens they give you an example and somewhere damage is very significant whether it's your company already this is yourself because you end up losing all your personal data for the last 10 years imagine if you have a hard drive and you using your MacBook or whatever or you Windows computer and you have your tax documents and all these things at your home office whatever so you don't want to lose that that's and that's those are smart or bad guys they know about it and that's why they demand for this you know for the money depending how valuable that it is so that's this is very important so something I'm gonna go to the next slide and then I will share what are some controls available so I put it all together the list so there are some symptoms and there are some production so symptom is that slowing down off the computer we know that it's always gonna be a virus somebody did something in my computer shared computer and all that but again guess what you gotta be you know careful about it because that's today when we say going on your computer not necessarily dust it could be more than that so you gotta be on top of that very very you know take it seriously just don't ignore it because it's your work related computer it's not for your kids do you think it's a sensitive data even your kids computer getting infected and can affect whole network so they put a firewall basically at home and make sure you know oh just google it you know some of the basic steps but again I'll go back through the identity piece here again but these are symptoms showing down off your computer you have a strange pop-up which you have never never seen so that's another thing make sure do not do not put all those browser add-ons in Chrome's and Firefox do not because until you do not trust or function unless you do not know that add-on or you know they're like we get get it getting Chrome for Facebook or whatever if as long as trusted publisher because their Facebook but what if the publisher is not Facebook is somebody else so your password when you're typing it is it might be somebody is watching your key logs and this is how you get Hank so those are the things you gotta be not put everything on your computer make sure it comes from the right and trusted resource and you are using a go Google it figured out what are the best or good antivirus available use that and then sometimes you notice any suspicious thing that on your screen the cursor is moving and you are just so those are thing you have to be basic you know awareness why I'm you know this cursor is having some motion while I'm watching a Netflix or whatever so those kind of thing you have to be vigilant and careful about that always look for some unknown programs there are even antivirus will tell you when they do the scanning so so these are the vulnerabilities basically unknown programs add-ons these are always those things and you go to a website and any other browser opens automatically and say you're dis dis dis compromise pay as this money and we'll fix your computer it means you're already being breached so shut down the computer unplug the network cables and then boot it up because and make sure Wi-Fi is disabled at that point so make sure the best this is the best way just to disconnect from the network ASAP right away and then you can always put it up run antivirus take you to the computer show or whatever call somebody for IT support whatever it is you gotta make sure you're disconnected because that's the that's the thing that's the stop line because whatever has gone whatever have happened now you stop and put the barrier for somebody not to you know look in the system or there may be some file or some programs or anything may not be able to send the data to the bad actor through the cloud and all the so that's the best approach or the very first of course you wanna do with it same suspicion phishing email I do get a la everyone does from the bank hey your you know bank password we have changes policy look and feel exactly the same like dick I would not be surprised people start saying phishing and I've seen I've read an article I just don't know the details but the headline was there is an increase of 660 person okay so I'll answer this question so 660 percent increase in the attack already 666 6-0 unbelievable unbelievabl and the covert 19 phishing emails so if you see those come in 1950 have to be very careful do not click all those email make sure you mouse over on the link and when you read that you'll figure out it's coming from New Jersey official covert dot-com let's say governor's and all they're putting those URL if not yes yes if not then you have to be otherwise deleted because if you're not inquired why they're sending it yeah that's another approach do not click you just watch then you and go yourself to the website google it and figure it out why would somebody be sending me an email without you requesting so that's absolutely delete it if you're in your outlook shift deleted it mean it will just not go to delete it for delicious permanent will delete it if you have your Microsoft Outlook Shiv deleted otherwise if you are a cloud Gmail whatever just delete it now so shutting down the computer right but you can shut it down but let's say if you have a little bit basic knowledge so shutting down a computer perfect and at the same time you have your cell phone so you can do some Google search YouTube whatever you know and whenever you want to bring that computer back online make sure disconnected because you want to get that computer fixed or somebody you call at your home fix somebody you want to call at your office to come and fix that computer right so make sure when they turn it on is completely disconnected your desk so either way you can take approach when you're shutting down the computer is not connected to the network so either approach now we have very few minutes so you can still put the questions so multi-factor authentication is the one of the biggest takeaway how much you do take from you know like spin I'll be more focused file encryption I told you location-based access is not that important we'll talk about that that's more of depending on the size of the business you have let's say if I'm in u.s. I would not want people to come to my portal and log in from UK China whichever you know if I know that me and my cell my employees were from us so that's but multi-factor is is one of the most important thing other than those symptoms and everything yes absolutely so it's available you g
google it Google Authenticator and Microsoft Authenticator and there are third-party available but Google Authenticator free - Authenticator free so it's what it means it's the second form of authentication so if you're using today what I want to tell you start using it multi-factor from now onwards so menu accessing I know stuff then whenever you are using your Gmail account and then it will prompt you to put your six digit character but guess what if if it's not that important leave it but if you have your for business if it's compromised guess what so you have to value it to risk is it really worth it taking a risk or not am I gonna lose all my purchase order sales and why is syntax and all that for example and even do not use Gmail free account for your tax and ordered it know all that stuff you gotta be using g-suit or Microsoft paid version it $5.00 a month or $7 a month do not use free version for any of those services for the businesses that's my advice that's even I don't use it I use all the paid subscription so multi-factor you must have so you better have either to configure it to receive a call that's option one or you can do have it to receive a text or you can have an Authenticator app which is the most secure because you get a screen pop-up hey did you sign it approve or deny that kind of thing so if I know that if I'm signing in to my Google I will say yes approve it and I'll then sign in after putting my username and password there will be another form of authentication means who you are and what do you have kind of things so who you are and what do you have so you have this authentication and you prove yourself your identity so it's a it's a one layer of adding a protection an identity identity and identity is your passport so that's how it is you better make sure and then also help you I mean in these all these symptoms I fool you because even let's say your password gets breached and compromise right if you have authentication second form of authentication implemented guess for that user when trying to put your user man password you will get that pop up on your phone and you will surprise I'm not signing it who is that so at that point you just deny it so that's and that's your point in time action go and change your password so this is how you can protect in you know by adopting this multi-factor and then taking all these steps where you can protect your data in the cloud at rest encryption of file so yeah and that's all anyone any questions I think we are pretty much close to the time I'll give you guys two three minutes all right so while we wouldn't see if anyone has any questions I wanted to thank you so much for presenting this I already use two-factor multi-factor authentication on some things but I should definitely start using it on everything considering how much like I said like it's definitely saved me before so I appreciate that so just so everyone knows I'm gonna link our Facebook and LinkedIn pages as well as our YouTube page and our what is our website's video library in the chat I'm gonna paste that just a moment you can always you can always review these webinars in our YouTube and our video library if you'd like to watch them again and on Monday we have two free webinars we have a chi gong for stress management and a mute system support at noon on Monday and then at two o'clock on Monday we have Kovac 19 misunderstandings with the tax laws so two really great topics so I really hope I'll see you guys there let's see any comments in the chat I'm seeing some positive affirmations great class thank you for your very informative presentation great let me drop those links okay all right okay any other questions uh I think we're good so again odd nods thank you so much for presenting and I hope I'll see you all at the next webinar have a great weekend thank you bye bye take care
