<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Consolas",serif;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:427510401;
mso-list-template-ids:-357950794;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>It’s very thorough. I won’t be able to use it all in the presentation because of time limitations.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>But it gives me ideas for further work. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks Everyone.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>WR<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Ipg-smz <ipg-smz-bounces@netpress.org> <b>On Behalf Of </b>Carol Pinchefsky via Ipg-smz<br><b>Sent:</b> Tuesday, August 6, 2019 4:38 PM<br><b>To:</b> ipg-smz@netpress.org<br><b>Cc:</b> Carol Pinchefsky <will_edit_for_food@mac.com><br><b>Subject:</b> Re: [Ipg-smz] Security training for hams<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Wow. This is hella thorough, guys.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Carol<o:p></o:p></p></div><div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>4. Understanding basic multi-factor authentication and why a wider ID footprint is good<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> a. OS vs browser vs site vs non-browser app authentication-- who's guarding what<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> b. What passwordless really means<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> c. Why unique passwords are important, since your identity and at least a few of your passwords are ALREADY OWNED & NOW published no matter who you think you are.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> d. Password keepers and how they work<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> e. Why syncrhonization can kill your work across all of your platforms.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>5. Packet Radio and why there's no encryption<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> a. Basic APRS, state of the art X.25 networking and it still works, but can be impersonated so simply <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> b. Digital modes from RTTY to FT4 and they DON'T USE authentication and why (Part 95)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> c. Spectrum theft by organizations that aren't hams, yet use opaque protocols that can't be identified (see eHam's treatments of the topic)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> d. Bruce Perens' work on non-proprietery digital protocols and why<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>6. Infection vectors and how<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> a. Your firewall/router, smartphones, computers, digital appliances, IoT devices<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> b. Email phishing (as below)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> c. Portable media<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> d. browsing maladies<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>7. Backup, backup, then backup your friends and civilians, based on the 3-2-1 plan<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> a. Three backups, two local, one offsite<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> b. Backup all devices (after updating them) and send one to a trusted place, regularly<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> c. Never put network storage devices directly on the open internet, ever, for any reason, at any time (they're bot lunch)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> d. In the event of theft/fire/destruction, the offsite backup saves your bacon (or beans, if you're vegetarian)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>73 W9YW<o:p></o:p></p><div><p class=MsoNormal>On 8/5/19 5:57 PM, Wayne Rash via Ipg-smz wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I’m putting together a presentation on computer security for ham radio operators. The club has a high proportion of very smart engineers and a bunch of nuclear physicists, but as you’d expect, they know little about security. <o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>So I’m putting together a list of topics.<o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div><ol start=1 type=1><li class=MsoListParagraph style='mso-list:l0 level1 lfo1'>Why hams are at risk (they use free software from unverified sites and they believe that Macs are invulnerable)<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level1 lfo1'>What the risks are:<o:p></o:p></li></ol><ol start=2 type=1><ol start=1 type=a><li class=MsoListParagraph style='mso-list:l0 level2 lfo1'>Phishing<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level2 lfo1'>Credential theft through social engineering<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level2 lfo1'>Ransomware and how to limit the damage<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level2 lfo1'>Failure to patch<o:p></o:p></li></ol></ol><ol start=3 type=1><li class=MsoListParagraph style='mso-list:l0 level1 lfo1'>How to limit the risks<o:p></o:p></li></ol><ol start=3 type=1><ol start=1 type=a><li class=MsoListParagraph style='mso-list:l0 level2 lfo2'>Know how to identify a phishing email (I have examples of actual emails)<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level2 lfo2'>How to identify social engineering<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level2 lfo2'>How to patch<o:p></o:p></li><li class=MsoListParagraph style='mso-list:l0 level2 lfo2'>How and why to back up your data and why a network share isn’t secure, and neither is an air gap.<o:p></o:p></li></ol></ol><div><p class=MsoNormal> <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Any thoughts on what else I should include?<o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Wayne Rash<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>703-425-9231<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>703-200-4915 cell<o:p></o:p></p><div><p class=MsoNormal> <o:p></o:p></p></div></div><p class=MsoNormal><br><br><o:p></o:p></p></blockquote><pre>-- <o:p></o:p></pre><pre>Tom Henderson<o:p></o:p></pre><pre>ExtremeLabs, Inc.<o:p></o:p></pre><pre>+1 317 250 4646<o:p></o:p></pre><pre>Twitter: @extremelabs<o:p></o:p></pre><pre>Skype: extremelabsinc<o:p></o:p></pre></div><p class=MsoNormal>-- <br>Ipg-smz mailing list<br><a href="mailto:Ipg-smz@netpress.org">Ipg-smz@netpress.org</a><br><a href="http://netpress.org/mailman/listinfo/ipg-smz_netpress.org">http://netpress.org/mailman/listinfo/ipg-smz_netpress.org</a><o:p></o:p></p></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>