SlideShare uma empresa Scribd logo
1 de 5
Baixar para ler offline
PREPARING FOR DEF CON
Security Guide and Checklist to Not Get PWND
Reed Loden, Information Security
SECURITY GUIDE
DEF CON is home to the most hostile network in the world. As such, precautions
need to be taken to ensure that both your and your company’s data and equipment
are kept safe. Taking some time now to prepare for Vegas will make your days
much happier.
Laptops
⋅ If at all possible, don't bring your laptop at all.
⋅ If you absolutely need to bring it, do not bring it to the Rio at all (leave it at your hotel).
Keep it completely turned off (not just sleeping) and locked up (in the room safe).
⋅ If you do want a laptop at the Rio, bring a burner laptop (nothing company-specific on
it).
⋅ For all Internet traffic, use full-tunnel (“redirect gateway”) back to your company’s VPN.
Phones
⋅ Minimize phone call usage and prefer short SMS messaging or some other data-based
messaging.
⋅ Watch out for weird behavior from your phone (e.g., full signal strength, yet can't make
a call; consistently downgraded to 2G / EDGE / GPRS). If your phone starts acting
weird, stop using it and power it completely off. Weirdness means it is possible
somebody is actively trying to intercept calls.
⋅ If possible, back up your phone, wipe it completely for the con, and restore when back
home.
Wallets / Bags
⋅ Leave any badges, NFC/RFID cards, and passports at home. If you need to bring
something with you, store it in a copper-lined envelope or wrap in tinfoil (srsly).
⋅ Leave any non-essential USB / portable drives at home.
General Tips
⋅ Be at least a little bit paranoid. Healthy dose of suspicion will go far. Social engineering
tactics will be in full swing by some attendees.
⋅ Do not use any data connection other than your phone's non-WiFi capabilities.
⋅ Do not scan QR codes.
⋅ Do not use any kind of CDs, floppies, USB drives, or other device you may acquire that
connects to your phone or computer.
⋅ Do not use any unknown dongles. Bring any VGA/Thunderbolt adapters/converters
you may need.
⋅ Do not use any type of public / free charging station. Bring your charger with you if
needed.
⋅ Do not disclose any private / confidential company information, even something minor.
⋅ Do not install or update any software on your devices.
General Tips, Cont.
⋅ Expect any phone calls / text messages sent within 500-1000 feet of the Rio to be
monitored or recorded, so do not say or send anything confidential
⋅ Be careful around ATMs anywhere at or near the Rio. If you need to use one, use the
ones on the casino floor or those at your hotel.
⋅ Store any equipment you are not actively using in your hotel room safe. Burglaries can
and do occur.
⋅ This is Vegas, so watch out for prostitutes, muggings, and druggings. Do not accept
handouts.
A few simple things to do as your plane lands in Vegas...
⋅ Disable WiFi, Bluetooth, NFC, etc. on all phones and tablets.
⋅ Clear lists of saved WiFi networks and SSIDs.
⋅ Disable USB debugging or side-loading on your phone.
⋅ Disable data on phone if you only want to use it for calls or texting.
DEF CON SECURITY CHECKLIST
Phones / Tablets
o Ensure strong passcode set
o Enable auto-lock (<= 5 minutes of inactivity)
o iPhone/iPad: Disable "Simple passcode" (Settings > General > Passcode Lock)
o iPhone: Disable voice dial (Settings > General > Passcode Lock)
o iPhone/iPad: Enable erase data (Settings > General > Passcode Lock)
o iPhone/iPad: Disable SMS preview (Settings > Notifications > Messages)
o iPhone/iPad: Set up Find My Phone
o iPhone/iPad: Enable Safari security settings & clear databases (Settings > Safari)
o iPhone/iPad: Clear location settings database (toggle) (Settings > Location Services)
o iPad: Disable smart cover unlock
o Android: Disable debugging (Settings > Applications > Development > USB
Debugging)
o Android: Turn off side loading (Settings > Security > Unknown sources)
o Android: Set screen lock to pattern or password (Settings > Lock screen)
o Android: Disable NFC, S Beam, & related (Settings > More... > NFC)
o Android: Enable encryption (Settings > Security > Encryption)
o Android: Disable sending location data to Google (Settings > Location services)
o Disable Bluetooth
o Remove any saved WiFi networks/SSIDs
o Ensure e-mail settings set to use SSL (and accept all SSL certs is unchecked)
Phones / Tablets Checklist, Cont.
o Ensure Lookout Mobile Security app is installed
o Ensure phone OS up to date
o Take backup
o Set temporary passwords (both on corporate and personal accounts)
Laptops
o Remove any saved WiFi networks/SSIDs
o Remove any company source code / confidential documents / intellectual property
o Disable Bluetooth
o Disable auto-login (Mac: System Preferences > Users & Groups > Login Options)
o Ensure encryption active (Mac: FileVault)
o Ensure firewall active (also, enable stealth mode on Mac / ICMP-Echo on Linux)
o Ensure OS up-to-date (Microsoft Update or Apple Software Update)
o Ensure browsers up-to-date (Firefox, Chrome, Safari, IE)
o Ensure e-mail settings set to use SSL (and accept all SSL certs is unchecked)
o Mac: Disable location services and sharing of data with Apple
o Disable sharing
o Update antivirus (and ensure some form of antivirus is installed)
o Update Java
o Update Flash
o Update other Adobe products
o Update Office
o Disable guest user
o Set screensaver (<= 5 minutes of inactivity) – use hot corners to lock!
o Require password to unlock screensaver
o Set up VPN (full tunnel)
o Take backup

Mais conteúdo relacionado

Mais de Lookout

5 Ways to Protect your Mobile Security
5 Ways to Protect your Mobile Security5 Ways to Protect your Mobile Security
5 Ways to Protect your Mobile SecurityLookout
 
Feds: You have a BYOD program whether you like it or not
Feds: You have a BYOD program whether you like it or notFeds: You have a BYOD program whether you like it or not
Feds: You have a BYOD program whether you like it or notLookout
 
What Is Spyware?
What Is Spyware?What Is Spyware?
What Is Spyware?Lookout
 
Mobile Security: The 5 Questions Modern Organizations Are Asking
Mobile Security: The 5 Questions Modern Organizations Are AskingMobile Security: The 5 Questions Modern Organizations Are Asking
Mobile Security: The 5 Questions Modern Organizations Are AskingLookout
 
2015 Cybersecurity Predictions
2015 Cybersecurity Predictions2015 Cybersecurity Predictions
2015 Cybersecurity PredictionsLookout
 
The New NotCompatible
The New NotCompatibleThe New NotCompatible
The New NotCompatibleLookout
 
Relentless Mobile Threats to Avoid
Relentless Mobile Threats to AvoidRelentless Mobile Threats to Avoid
Relentless Mobile Threats to AvoidLookout
 
When Android Apps Go Evil
When Android Apps Go EvilWhen Android Apps Go Evil
When Android Apps Go EvilLookout
 
Scaling Mobile Development
Scaling Mobile DevelopmentScaling Mobile Development
Scaling Mobile DevelopmentLookout
 
Visualizing Privacy
Visualizing PrivacyVisualizing Privacy
Visualizing PrivacyLookout
 
Hiring Hackers
Hiring HackersHiring Hackers
Hiring HackersLookout
 
How to (Safely) Cut the Cord With Your Old iPhone
How to (Safely) Cut the Cord With Your Old iPhoneHow to (Safely) Cut the Cord With Your Old iPhone
How to (Safely) Cut the Cord With Your Old iPhoneLookout
 
3 Ways to Protect the Data in Your Google Account
3 Ways to Protect the Data in Your Google Account3 Ways to Protect the Data in Your Google Account
3 Ways to Protect the Data in Your Google AccountLookout
 
The Back to School Smartphone Guide
The Back to School Smartphone GuideThe Back to School Smartphone Guide
The Back to School Smartphone GuideLookout
 
Mobile Security at the World Cup
Mobile Security at the World CupMobile Security at the World Cup
Mobile Security at the World CupLookout
 
Spring Cleaning for Your Smartphone
Spring Cleaning for Your SmartphoneSpring Cleaning for Your Smartphone
Spring Cleaning for Your SmartphoneLookout
 
Mobile Threats, Made to Measure
Mobile Threats, Made to MeasureMobile Threats, Made to Measure
Mobile Threats, Made to MeasureLookout
 
Security & Privacy at the Olympics
Security & Privacy at the OlympicsSecurity & Privacy at the Olympics
Security & Privacy at the OlympicsLookout
 
5 Types of Shady Apps
5 Types of Shady Apps5 Types of Shady Apps
5 Types of Shady AppsLookout
 
10 Beautiful Enterprise Products
10 Beautiful Enterprise Products10 Beautiful Enterprise Products
10 Beautiful Enterprise ProductsLookout
 

Mais de Lookout (20)

5 Ways to Protect your Mobile Security
5 Ways to Protect your Mobile Security5 Ways to Protect your Mobile Security
5 Ways to Protect your Mobile Security
 
Feds: You have a BYOD program whether you like it or not
Feds: You have a BYOD program whether you like it or notFeds: You have a BYOD program whether you like it or not
Feds: You have a BYOD program whether you like it or not
 
What Is Spyware?
What Is Spyware?What Is Spyware?
What Is Spyware?
 
Mobile Security: The 5 Questions Modern Organizations Are Asking
Mobile Security: The 5 Questions Modern Organizations Are AskingMobile Security: The 5 Questions Modern Organizations Are Asking
Mobile Security: The 5 Questions Modern Organizations Are Asking
 
2015 Cybersecurity Predictions
2015 Cybersecurity Predictions2015 Cybersecurity Predictions
2015 Cybersecurity Predictions
 
The New NotCompatible
The New NotCompatibleThe New NotCompatible
The New NotCompatible
 
Relentless Mobile Threats to Avoid
Relentless Mobile Threats to AvoidRelentless Mobile Threats to Avoid
Relentless Mobile Threats to Avoid
 
When Android Apps Go Evil
When Android Apps Go EvilWhen Android Apps Go Evil
When Android Apps Go Evil
 
Scaling Mobile Development
Scaling Mobile DevelopmentScaling Mobile Development
Scaling Mobile Development
 
Visualizing Privacy
Visualizing PrivacyVisualizing Privacy
Visualizing Privacy
 
Hiring Hackers
Hiring HackersHiring Hackers
Hiring Hackers
 
How to (Safely) Cut the Cord With Your Old iPhone
How to (Safely) Cut the Cord With Your Old iPhoneHow to (Safely) Cut the Cord With Your Old iPhone
How to (Safely) Cut the Cord With Your Old iPhone
 
3 Ways to Protect the Data in Your Google Account
3 Ways to Protect the Data in Your Google Account3 Ways to Protect the Data in Your Google Account
3 Ways to Protect the Data in Your Google Account
 
The Back to School Smartphone Guide
The Back to School Smartphone GuideThe Back to School Smartphone Guide
The Back to School Smartphone Guide
 
Mobile Security at the World Cup
Mobile Security at the World CupMobile Security at the World Cup
Mobile Security at the World Cup
 
Spring Cleaning for Your Smartphone
Spring Cleaning for Your SmartphoneSpring Cleaning for Your Smartphone
Spring Cleaning for Your Smartphone
 
Mobile Threats, Made to Measure
Mobile Threats, Made to MeasureMobile Threats, Made to Measure
Mobile Threats, Made to Measure
 
Security & Privacy at the Olympics
Security & Privacy at the OlympicsSecurity & Privacy at the Olympics
Security & Privacy at the Olympics
 
5 Types of Shady Apps
5 Types of Shady Apps5 Types of Shady Apps
5 Types of Shady Apps
 
10 Beautiful Enterprise Products
10 Beautiful Enterprise Products10 Beautiful Enterprise Products
10 Beautiful Enterprise Products
 

Último

ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDELiveplex
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1DianaGray10
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfAijun Zhang
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Adtran
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintMahmoud Rabie
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
Building AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptxBuilding AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptxUdaiappa Ramachandran
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-pyJamie (Taka) Wang
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UbiTrack UK
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024D Cloud Solutions
 
Cybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptxCybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptxGDSC PJATK
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfJamie (Taka) Wang
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.YounusS2
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsSeth Reyes
 
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online CollaborationCOMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online Collaborationbruanjhuli
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAshyamraj55
 

Último (20)

ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
 
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1UiPath Platform: The Backend Engine Powering Your Automation - Session 1
UiPath Platform: The Backend Engine Powering Your Automation - Session 1
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdf
 
Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™Meet the new FSP 3000 M-Flex800™
Meet the new FSP 3000 M-Flex800™
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
Empowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership BlueprintEmpowering Africa's Next Generation: The AI Leadership Blueprint
Empowering Africa's Next Generation: The AI Leadership Blueprint
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
Building AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptxBuilding AI-Driven Apps Using Semantic Kernel.pptx
Building AI-Driven Apps Using Semantic Kernel.pptx
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-py
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024
 
20150722 - AGV
20150722 - AGV20150722 - AGV
20150722 - AGV
 
Cybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptxCybersecurity Workshop #1.pptx
Cybersecurity Workshop #1.pptx
 
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
activity_diagram_combine_v4_20190827.pdfactivity_diagram_combine_v4_20190827.pdf
 
201610817 - edge part1
201610817 - edge part1201610817 - edge part1
201610817 - edge part1
 
Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.Basic Building Blocks of Internet of Things.
Basic Building Blocks of Internet of Things.
 
Computer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and HazardsComputer 10: Lesson 10 - Online Crimes and Hazards
Computer 10: Lesson 10 - Online Crimes and Hazards
 
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online CollaborationCOMPUTER 10: Lesson 7 - File Storage and Online Collaboration
COMPUTER 10: Lesson 7 - File Storage and Online Collaboration
 
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPAAnypoint Code Builder , Google Pub sub connector and MuleSoft RPA
Anypoint Code Builder , Google Pub sub connector and MuleSoft RPA
 

Lookout's DEF CON Preparedness Guide and Checklist

  • 1. PREPARING FOR DEF CON Security Guide and Checklist to Not Get PWND Reed Loden, Information Security
  • 2. SECURITY GUIDE DEF CON is home to the most hostile network in the world. As such, precautions need to be taken to ensure that both your and your company’s data and equipment are kept safe. Taking some time now to prepare for Vegas will make your days much happier. Laptops ⋅ If at all possible, don't bring your laptop at all. ⋅ If you absolutely need to bring it, do not bring it to the Rio at all (leave it at your hotel). Keep it completely turned off (not just sleeping) and locked up (in the room safe). ⋅ If you do want a laptop at the Rio, bring a burner laptop (nothing company-specific on it). ⋅ For all Internet traffic, use full-tunnel (“redirect gateway”) back to your company’s VPN. Phones ⋅ Minimize phone call usage and prefer short SMS messaging or some other data-based messaging. ⋅ Watch out for weird behavior from your phone (e.g., full signal strength, yet can't make a call; consistently downgraded to 2G / EDGE / GPRS). If your phone starts acting weird, stop using it and power it completely off. Weirdness means it is possible somebody is actively trying to intercept calls. ⋅ If possible, back up your phone, wipe it completely for the con, and restore when back home. Wallets / Bags ⋅ Leave any badges, NFC/RFID cards, and passports at home. If you need to bring something with you, store it in a copper-lined envelope or wrap in tinfoil (srsly). ⋅ Leave any non-essential USB / portable drives at home. General Tips ⋅ Be at least a little bit paranoid. Healthy dose of suspicion will go far. Social engineering tactics will be in full swing by some attendees. ⋅ Do not use any data connection other than your phone's non-WiFi capabilities. ⋅ Do not scan QR codes. ⋅ Do not use any kind of CDs, floppies, USB drives, or other device you may acquire that connects to your phone or computer. ⋅ Do not use any unknown dongles. Bring any VGA/Thunderbolt adapters/converters you may need. ⋅ Do not use any type of public / free charging station. Bring your charger with you if needed. ⋅ Do not disclose any private / confidential company information, even something minor. ⋅ Do not install or update any software on your devices.
  • 3. General Tips, Cont. ⋅ Expect any phone calls / text messages sent within 500-1000 feet of the Rio to be monitored or recorded, so do not say or send anything confidential ⋅ Be careful around ATMs anywhere at or near the Rio. If you need to use one, use the ones on the casino floor or those at your hotel. ⋅ Store any equipment you are not actively using in your hotel room safe. Burglaries can and do occur. ⋅ This is Vegas, so watch out for prostitutes, muggings, and druggings. Do not accept handouts. A few simple things to do as your plane lands in Vegas... ⋅ Disable WiFi, Bluetooth, NFC, etc. on all phones and tablets. ⋅ Clear lists of saved WiFi networks and SSIDs. ⋅ Disable USB debugging or side-loading on your phone. ⋅ Disable data on phone if you only want to use it for calls or texting.
  • 4. DEF CON SECURITY CHECKLIST Phones / Tablets o Ensure strong passcode set o Enable auto-lock (<= 5 minutes of inactivity) o iPhone/iPad: Disable "Simple passcode" (Settings > General > Passcode Lock) o iPhone: Disable voice dial (Settings > General > Passcode Lock) o iPhone/iPad: Enable erase data (Settings > General > Passcode Lock) o iPhone/iPad: Disable SMS preview (Settings > Notifications > Messages) o iPhone/iPad: Set up Find My Phone o iPhone/iPad: Enable Safari security settings & clear databases (Settings > Safari) o iPhone/iPad: Clear location settings database (toggle) (Settings > Location Services) o iPad: Disable smart cover unlock o Android: Disable debugging (Settings > Applications > Development > USB Debugging) o Android: Turn off side loading (Settings > Security > Unknown sources) o Android: Set screen lock to pattern or password (Settings > Lock screen) o Android: Disable NFC, S Beam, & related (Settings > More... > NFC) o Android: Enable encryption (Settings > Security > Encryption) o Android: Disable sending location data to Google (Settings > Location services) o Disable Bluetooth o Remove any saved WiFi networks/SSIDs o Ensure e-mail settings set to use SSL (and accept all SSL certs is unchecked) Phones / Tablets Checklist, Cont. o Ensure Lookout Mobile Security app is installed o Ensure phone OS up to date o Take backup o Set temporary passwords (both on corporate and personal accounts) Laptops o Remove any saved WiFi networks/SSIDs o Remove any company source code / confidential documents / intellectual property o Disable Bluetooth o Disable auto-login (Mac: System Preferences > Users & Groups > Login Options) o Ensure encryption active (Mac: FileVault) o Ensure firewall active (also, enable stealth mode on Mac / ICMP-Echo on Linux) o Ensure OS up-to-date (Microsoft Update or Apple Software Update) o Ensure browsers up-to-date (Firefox, Chrome, Safari, IE) o Ensure e-mail settings set to use SSL (and accept all SSL certs is unchecked) o Mac: Disable location services and sharing of data with Apple o Disable sharing
  • 5. o Update antivirus (and ensure some form of antivirus is installed) o Update Java o Update Flash o Update other Adobe products o Update Office o Disable guest user o Set screensaver (<= 5 minutes of inactivity) – use hot corners to lock! o Require password to unlock screensaver o Set up VPN (full tunnel) o Take backup