tina yeung, technologist - stay safe online...2018/04/04 · issues and threats – vps...
TRANSCRIPT
![Page 1: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/1.jpg)
Moderated by Daniel Eliot, Director
Small Business ProgramsNational Cyber Security
Alliance
Tina Yeung, Technologist Office of Technology
Federal Trade Commission
Bill Fanelli, Chief Security Officer
Council of Better Business Bureaus
Morgan Bradley, Cyber Security Analyst
Global Threat CommunicationsFedEx E-Commerce/Application
Security
![Page 2: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/2.jpg)
Tina Yeung, Technologist Office of Technology
Federal Trade Commission
![Page 3: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/3.jpg)
WHAT SHOULD A SMALL BUSINESS LOOK FOR WHEN SEEKING A WEB HOST?Christina Yeung
Federal Trade Commission
![Page 4: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/4.jpg)
6
![Page 5: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/5.jpg)
Web hosts
7
![Page 6: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/6.jpg)
FINDING WEB HOSTS
Google Best web host for small businesses
All News Videos Images Shopping More Settings Tools
About 10,900,000 results (0.48 seconds)
The Best Small Business Web Hosting Service Of All Timehttps://thebestsmallbusinesswebhostingserviceofalltimeranking.example.comFeb 13, 2018 – Are you a small business? Do you need a web host? We rank all web hosts to see if they fit your needs. Web hosts web hosts web hosts.
Best 10 Web Hosting Companies for Small Businesseshttps://weranked10webhostssothatyoudonthaveto.example.comJune 2, 2017 – Get the best web hosting for your small business needs. Your web site is only as good as your web host. We found ten hosts that will help you expand your business.
Web Hosts for Small Businesses Ranked Top 20https://webhostsforsmallbusinessesrankedtop20.example.comMay 13, 2018 – Sometimes looking for a web host can be an intimidating experience. Trust our guidance to lead you to the right match! Finding the right host isn’t always easy. What features do you care about – affordability, uptime, performance. All these things can be important depending on what you need for your small business. We do the research so you don’t have to.
8
![Page 7: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/7.jpg)
BUT WAIT…
….Not all web hosts are equal
9
![Page 8: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/8.jpg)
OUR STUDY
Studied 11 web hostsWebsite security and anti-phishing technology
for small businesses
10
![Page 9: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/9.jpg)
Encrypts data between browser and website
SSL/TLS
The Lemonade Store
https://www.thelemonadestore.example.com
The Lemonade S
The Lemonade Store
www.thelemonadestore.example.com
The Lemonade S
11
![Page 10: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/10.jpg)
SSL/TLS AVAILABILITY
12
Available27% Included
36.5%
Additional fee36.5%
Documentation provided
Integratedinto setup (73%)
![Page 11: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/11.jpg)
13
![Page 12: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/12.jpg)
14
![Page 13: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/13.jpg)
15
![Page 14: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/14.jpg)
16
![Page 15: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/15.jpg)
17
![Page 16: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/16.jpg)
18
?
![Page 17: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/17.jpg)
19
?
Warning
![Page 18: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/18.jpg)
EMAIL AUTHENTICATION AVAILABILITY
20
![Page 19: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/19.jpg)
FTC ADVICE
• Small businesses● Pay attention to security features offered in plans● Plans with SSL/TLS and email authentication can protect your business and
your customers
• Web hosts• Sites that rank web hosts
21
![Page 20: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/20.jpg)
THANK YOU VERY MUCH!
![Page 21: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/21.jpg)
Bill Fanelli, Chief Security OfficerCouncil of Better Business Bureaus
![Page 22: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/22.jpg)
24 Confidential
5 STEPS TO BETTER WEBSITE CYBERSECURITY
Confidential
![Page 23: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/23.jpg)
25 Confidential
** Start with Your Domain
• Check reputation of the Web Host– Run IPs and domains through VirusTotal.com– Reputation of shared sites will affect you
• Set up your domain– Fully populate your WhoIs record– Set up Security@<YourDomain.com> – Consider using Secure DNS
![Page 24: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/24.jpg)
26 Confidential
Scan your Site• Before you add content
– Look for open ports and known vulnerabilities
• After adding content– Search for data leaks– Rescan
• Quarterly• After any content change
• Track changes– Get notification on changes– Back out unauthorized
![Page 25: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/25.jpg)
27 Confidential
HTTPS Everywhere• Use HTTPS always
– Used to say for input pages only• SEO – Google requirement by
July 2018– Security of data– Validity of the site
Business is responsible to customers for security
![Page 26: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/26.jpg)
28 Confidential
** Use these Resources
• National Conference of State Legislatures
www.ncsl.org• NCSA website:
www.stopthinkconnect.org• BBB Cybersecurity website:
www.bbb.org/cybersecurity
![Page 27: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/27.jpg)
Morgan Bradley, Cyber Security Analyst
Global Threat CommunicationsFedEx E-Commerce/Application Security
![Page 28: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/28.jpg)
RISK AND THREATS
• Risk is the name of the game
• Vulnerabilities alone aren’t bad
• Risk changes based on factors involved in making a choice
• In this case, choice being how to deliver a digital experience to the customer
![Page 29: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/29.jpg)
![Page 30: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/30.jpg)
IDENTIFYING NEEDS TO DRIVE RISK ASSESSMENT
• What is the purpose of the site?
• What functionality is needed?
• What do you want to eventually do in the future?
• What services and features are important?
![Page 31: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/31.jpg)
ISSUES AND THREATS – SHARED WEB HOSTING
![Page 32: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/32.jpg)
ISSUES AND THREATS – SHARED WEB HOSTINGGODADDY, DREAMHOST, ETC.• No management of the server itself
• Shared resource (you have a “container” inside a machine)
• Limited control over patching of services (PHP, CMS, etc.)
• No visibility into the network or hardware
• Often no visibility into the practices and management (this is changing)
• Web hosts are targets (more exposure)
![Page 33: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/33.jpg)
ISSUES AND THREATS – VPSDIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC.
![Page 34: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/34.jpg)
ISSUES AND THREATS – VPSDIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC.
• VPS = “Virtual Private Server”
• Better management of the web server and services by the client
• Not completely “shared” resource
• Requires more knowledge and management by the client
• Maintenance relies on the client
• Still reliant on the provider for network security and good policies
![Page 35: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/35.jpg)
ISSUES AND THREATS – CONTENT MANAGEMENTWORDPRESS, DRUPAL, JOOMLA, ETC.
![Page 36: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/36.jpg)
ISSUES AND THREATS – CONTENT MANAGEMENTWORDPRESS, DRUPAL, JOOMLA, ETC.• Built in to many hosting services and easy to setup/edit
• Good for static content (blogging, company website, etc.)
• Allow for use of modules, themes, etc.
• Security gets complicated
• Reliance on module authors, CMS developers, etc. for updates
• Ton of vulnerable versions, modules, etc. already in the wild
• Low hanging fruit
![Page 37: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/37.jpg)
Moderated by Daniel Eliot, Director
Small Business ProgramsNational Cyber Security
Alliance
Tina Yeung, Technologist Office of Technology
Federal Trade Commission
Bill Fanelli, Chief Security Officer
Council of Better Business Bureaus
Morgan Bradley, Cyber Security Analyst
Global Threat CommunicationsFedEx E-Commerce/Application
Security
![Page 38: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/38.jpg)
Small Business Owners and the NIST Cybersecurity Framework
• If you are a small business owner who has worked with the NIST Cybersecurity Framework and/or attended a “CyberSecure My Business” webinar or training, NIST would like to interview you.
• The NIST Cybersecurity Framework is a flexible, voluntary methodology to address cybersecurity risk in any organization, small or large.
• For more information, please email Marian Merritt, lead for industry engagement with NICE/NIST at [email protected]
![Page 39: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/39.jpg)
Webinar SeriesSecond Tuesdays
2:00 p.m. EDT
To Register: www.staysafeonline.org
Up-Coming Webinar Topics:• May 8th Protect Your Business Email• June 12th How to Assess Vendor Security
• July 10th Do you need Cybersecurity Insurance?
![Page 40: Tina Yeung, Technologist - Stay Safe Online...2018/04/04 · ISSUES AND THREATS – VPS DIGITALOCEAN, MICROSFT AZURE, AMAZON AWS, ETC. •VPS = “Virtual Private Server” •Better](https://reader035.vdocuments.us/reader035/viewer/2022070801/5f02a9407e708231d40560ef/html5/thumbnails/40.jpg)
National Cyber Security Alliancewww.staysafeonline.org/cybersecure-business
NATIONAL CYBER SECURITY ALLIANCETitle:
Federal Trade Commissionwww.FTC.gov/smallbusiness
BBB www.bbb.org/council/for-businesses/cybersecurity
FedExhttps://smallbusiness.fedex.com/home