October is Security Awareness Month. This presentation is intended to educate people about Facebook security. I will be giving this presentation at Union South, on the UW-Madison campus, several times, throughout October. Contents of the presentation include: Basic rules of Facebook security Unique situation on UW-Madison campus (academic research poses a unique Facebook chalenge) Why unauthenticated identity means “be careful” The dangers of Facebook photos Application settings and security preferences Facebook passwords Time and place concerns Roaming security Account cleanup and maintenance Tips and tricks Q&A session

1. Securing Your
Facebook Identity
Nicholas A. Davis, CISA, CISSP
UW-Madison
Division of Information Technology
10/9/2013 UNIVERSITY OF WISCONSIN 1

2. !!Advisory!!
The content of today’s presentation is designed
to help people protect themselves on Facebook.
This is NOT a session on Facebook hacking. If
hacking Facebook is your motivation for
attending today’s session, please leave now
10/9/2013 UNIVERSITY OF WISCONSIN 2

3. Overview
Basic rules of Facebook security
Unique situation on UW-Madison campus
(academic research poses a unique Facebook
chalenge)
Why unauthenticated identity means “be careful”
The dangers of Facebook photos
Application settings and security preferences
Facebook passwords
Time and place concerns
Roaming security
Account cleanup and maintenance
Tips and tricks
Q&A session
10/9/2013 UNIVERSITY OF WISCONSIN 3

4. Basic Rules of Security
1. Think before you post
2. Customize your privacy settings
3. Don’t accept friend requests from people
you do not know
4. Keep sensitive information private
5. Remember, being on Facebook means that
you are living like a rock star! (kind of)
10/9/2013 UNIVERSITY OF WISCONSIN 4

5. Research Lab Example
10/9/2013 UNIVERSITY OF WISCONSIN 5

6. Meet Flat Cow
We will be using Flat Cow, known to his
friends as FC, in a few slides
10/9/2013 UNIVERSITY OF WISCONSIN 6

7. Wait, Cows Can’t Be On FB!
Unauthenticated Identity
10/9/2013 UNIVERSITY OF WISCONSIN 7

8. Organize Friends In Lists
10/9/2013 UNIVERSITY OF WISCONSIN 8

9. Photos Tell Stories
(Not Always Safe Ones)
10/9/2013 UNIVERSITY OF WISCONSIN 9

10. Photos Tell Stories
(Not Always Flattering Ones)
10/9/2013 UNIVERSITY OF WISCONSIN 10

11. Keep In Mind
Don’t get yourself into a situation in
which such pictures can be taken
You have little to no control over who
takes your picture in public
Think about the stories your photos tell
about you
Exercise control over pictures of you
tagged by others
10/9/2013 UNIVERSITY OF WISCONSIN 11

12. Automatic Updates
Take Control!
10/9/2013 UNIVERSITY OF WISCONSIN 12

13. Don’t Advertise Yourself
10/9/2013 UNIVERSITY OF WISCONSIN 13

14. You Can’t Control Your Friends
But You Can Control Their
Applications
10/9/2013 UNIVERSITY OF WISCONSIN 14

15. Don’t Let Your App Excitement
Obscure Your Judgement
10/9/2013 UNIVERSITY OF WISCONSIN 15

16. Keep The Stalkers At Bay
Change Search Visibility
10/9/2013 UNIVERSITY OF WISCONSIN 16

17. Get Your Facebook Profile
Out of Google
10/9/2013 UNIVERSITY OF WISCONSIN 17

18. Tips To Keep You Safe On
Facebook
Change your Facebook password often
10/9/2013 UNIVERSITY OF WISCONSIN 18

19. Facebook Is a Prime Target For
Password Hackers
Never use the same password for
Facebook as you use for your bank
access
10/9/2013 UNIVERSITY OF WISCONSIN 19

20. Examine Photos Before You Post
Avoid posting photos with identifying
information, such as addresses, license
plates, etc.
10/9/2013 UNIVERSITY OF WISCONSIN 20

21. Don’t Advertise Your Absence
Post vacation pictures AFTER you get
home
10/9/2013 UNIVERSITY OF WISCONSIN 21

22. Browse Facebook Securely When
at Starbucks (HTTPS)
10/9/2013 UNIVERSITY OF WISCONSIN 22

23. Remove Facebook Apps Which
You Do Not Use
10/9/2013 UNIVERSITY OF WISCONSIN 23

24. Use Privacy Settings To Block
People
10/9/2013 UNIVERSITY OF WISCONSIN 24

25. Check the Facebook URL Often
10/9/2013 UNIVERSITY OF WISCONSIN 25

26. Know The Difference Between
Deactivating and Deleting Your
Facebook Account
Deactivating your account leaves all posts
and pictures intact
Deletion is supposed to remove everything
Don’t login after you request deletion
10/9/2013 UNIVERSITY OF WISCONSIN 26

27. The Facebook
Doppelganger Spy
“But Flat Cow is already my friend”
10/9/2013 UNIVERSITY OF WISCONSIN 27

28. Three Strikes and You’re Out!
Don’t Be a Friend Pig
10/9/2013 UNIVERSITY OF WISCONSIN 28

29. How Liking Things Could
Take Advantage of You
10/9/2013 UNIVERSITY OF WISCONSIN 29

30. Facebook Security
Best Practices
http://www.sophos.com/en-us/security-
news-trends/best-practices/facebook.aspx
10/9/2013 UNIVERSITY OF WISCONSIN 30

31. Carnival Cruise Scam
Just One Example
Message purporting to be from "Carnival Cruise" claims that
Facebook users can win an all-expenses-paid vacation package
by liking and sharing a promotional image and clicking a link
to apply for the free tickets.
http://www.hoax-slayer.com/facebook-related.html
10/9/2013 UNIVERSITY OF WISCONSIN 31

32. Enable Login Notifications
Login notifications are an extra security
feature. When you turn on login
notifications, we'll send you an alert each
time someone logs into your account from a
new place.
10/9/2013 UNIVERSITY OF WISCONSIN 32

33. A Note About UW NetID
Your NetID is like your toothbrush, only you
should use it
UW-Madison will NEVER ask for your NetID
and/or password via email
Report any such requests to abuse@wisc.edu
10/9/2013 UNIVERSITY OF WISCONSIN 33

34. Q&A Session
Nicholas Davis
ndavis1@wisc.edu
facebook.com/nicholas.a.davis
10/9/2013 UNIVERSITY OF WISCONSIN 34