True or False: Passwords = Security? – False

Passwords as a preventative measure are completly irrelevant. There are not if ands or buts about it. The fact that major services such as online banking, corporate email and data storage use simple passwords as the only real security mechanism is a sad commentary on the state of defensive technologies. But, as the continued parade of password leaks of late proves on a daily basis, users who believe these companies are protecting their passwords are sadly mistaken.

The companies that provide these online services, such as email, cloud storage, online banking and others, would really rather not store your passwords, truth be told. As we’ve seen, it’s just one more piece of data that they need to protect and can potentially lose. The business models at banks, retailers and social networks do not include acting as secure storage facilities for user passwords. If there was some way for these services to exist without having to deal with user passwords, they would have found it. But no one has yet, and there doesn’t seem to be a good solution to the problem on the horizon. In the past year alone, Yahoo and Google were both hacked and upwards of a million user names and passwords were compromised and posted on the internet.

That’s not going to change. What could change is the way that people think about their passwords and handle them. At this point, users need to consider that any password they create for a given site is going to be compromised. It may not happen, but if you go into the transaction thinking that somewhere down the line this combination of letters and numbers will be in the hands of someone other than you, then you can start to think about passwords in a different way.

Think of them as disposable tokens that you need to present to the site in question. With that in mind, you should change your passwords as often as you can. Many Web sites will never require you to change a password once it’s set, so this is something that you’ll need to do on your own

Of course, the passwords you choose should be complex and not easily guessable. There are a number of random password generators you can use for this, including random.org. You pick the parameters and it generates the password for you. Also, password managers and secure password generation apps such as LastPass and 1Password can be nice additions and remove some of the burden of remembering passwords.

But, if you need to make sure that you can remember the password, you have a new problem. If you’re dealing with passwords for personal use at home, it’s not a bad idea to write them down. The odds of someone breaking into your house and stealing your passwords and then using them online is minimal. If you’re worried that someone else in your house will steal or use them, you probably have bigger problems.

So, once you’ve done all that, followed all of the guidelines and logged into your favorite sites and gone about your online business, you have ceded all control of the security of your account to the site and its security policies. And you’re right back where you started. You can do everything right, take all of the precautions possible and be diligent about your own personal security and still end up with your password sitting on Pastebin.

And that’s just the nature of the beast right now. Enjoy the Internet

5 Steps To Secure Your Mobile Device

A few years ago laptops surpassed desktops as the primary computing device of choice. The move from laptops as the primary computing device to smartphones and tablets is taking far less time than the transition from desktops to laptops. As a result, a brand new target for attackers is growing at a steady rapid pace. The evolution of such powerful mobile devices raises a range of security concerns, some of which are familiar, while others present entirely new challenges As the consumer, user and primary target for this new class of threats, you should know five simple things that could help keep you and your family’s data safe while computing on mobile devices.

Enable the auto-lock feature and create a strong password

By default, phones and tablets don’t require you to lock them. Turning on the feature to lock your phone is fairly trivial and instructions can usually be found in your instruction manual. If your mobile device was purchased within the last few years, you likely have the option to increase your password size from the traditional 4 characters to something larger which is strongly suggested. Many opt out of this setting due for convenience but this is highly recommended against. Studies have shown that with commercially available software four character passcodes and be cracked in under 6 minutes.

Disable Wi-Fi and Bluetooth automatic connection

Taking advantage of the increased speed and performance of Wi-Fi on a mobile device is perfectly okay. The risk occurs when you do this on public connections and wireless hot spots. Once you connect to a public hotspot, anyone else connected to that hotspot can see any traffic coming from your phone that’s not encrypted. This feature is easily disabled or enabled on Android, Apple IOS and BlackBerry devices.

Install Anti-Virus

Most people outside of the IT/Security community I talk to aren’t even aware that they can receive viruses on their phones. Not only can you get a virus, malware for phones today is built to do one thing, steal your PII and valuable data such as contacts, call history, text messages and emails. Currently the most vulnerable mobile operating systems to viruses is the Android. The most recent release of malicious code for Androids is built to sit quietly on your phone while capturing all your banking credentials and account information. With that said, go to your application store on your mobile device and search for “anti-virus” and install at least one or two of the free ones as soon as you can. If you want to really go all out, McAfee offers a really good solution for about $20.

Enable Automatic Updates

Just like your computer or laptop, your mobile device is subject to security updates. Instead of deferring the update and possibly forgetting to go back any apply it, which many people do, apply the update as soon as your phone notifies you that one is available. Update sometimes are released to upgrade the software but what the vendor doesn’t tell you is that they are also fixing a number of know security flaws as well. The longer you go without those updates, the longer you will be vulnerable.

Apply Common Sense

When it comes down to it common sense is always important when discussing any security approach. Don’t leave your mobile device unattended. Report lost or stolen devices immediately to your service provider. Just like on your computer, be cautious when opening attachments in email, text messages and instant messages. Rule of thumb, if you don’t know the sender or you’re not expecting the attachment don’t open it without confirming the validity of the message with the sender. Know what you’re downloading. Make sure that you only download apps from reputable developers. Restore your device back to factory default prior to exchanging, donating or trashing it.

Common fallacies that end in “…I thought I was secure”

Throughout my career and while growing up, I have been the “go-to-guy” for all computer related issues including every thing security related. As you can imagine, I’ve come across everything from identity theft to spyware and in almost every situation the victim had a false sense of confidence in their security.

I have compiled a list of the top 5 misconceptions that I am sure many can identify with and hopefully after you are finished reading this post, you will be able to make some minor changes that could have a significant impact on how well you protect your personal data.

The following statements were made after a security compromise and ended in the dreadful “I thought I was secure”

1.I installed anti-virus when I bought the computer so…

2. I’m not using a pc. I bought a MAC so…

3. The password I use on all my accounts is hard to guess and I used numbers and special characters so…

4. I don’t do online banking from my computer at home. I only do it from my cell phone so…

5. I don’t open links from email addresses I don’t know. The email came from my friend so…

In each one of these cases, they had good intentions and good practices were being used. The problem lies in the fact security isn’t black and white. There is a human aspect that is predicated on common sense and quality decision making.

We all know that to protect our homes from intruders we lock our doors and as an extra precaution we have alarm systems and some of us even have cameras and guards protecting the exterior. Is that enough? I would argue no. There are simple day to day measures that will ensure the effectiveness of the safeguards you put in place. You can’t give your key to multiple people can you? You need to turn your alarm on when you leave the house right? You have to pay the monthly bill to the alarm company to ensure your service is active don’t you? You wouldn’t hire convicted thieves as your guard would you? If you wouldn’t make these kinds of decisions when protecting your house; why would you do it when protecting your personal data?

Now lets re-visit the list above and identify where they all went wrong with their decison making

1.I installed anti-virus when I bought the computer so…

Though anti-virus is considered best practice when it comes to protecting your PC from a malware infection, the software is utterly useless if you dont update it. The software comes equipped to detect malware that existed when you purchased the software and if you dont update it , your anti-virus will never have the capability to detect any malware created after your date of purchase. Lesson #1 Antivirus is good but it is ineffective if you dont apply updates regularly.

2. I’m not using a pc. I bought a MAC so…

This is one of my favorites. Unlike the rest of the list, the fallay is rooted in errorneous advertisements moreso than PEBKAC. I am a PC guy so I will try not to let my bias affect my message. Lets clear one thing up. MAC computers are NOT more secure than PCs. Until recently the majority of vulnerabilities and compromises were discovered to be on the Windows platform but that is not because Apple doesnt have any security flaws, its because the lionshare of the computer market is Windows based. Recent surveys revealed that approximately 90% of all internet traffic is from Windows computers and only 5% is generated from Apple computers. If you are an attacker, would you spend time finding flaws in the 90% or the 5%? Conversely, more effort is spent by the security community to address flaws on the Windows platforms as well. Lesson #2 Purchasing a MAC is not a security meaasure.

3. The password I use on all my accounts is hard to guess and I used numbers and special characters so…

Today your bank, the company you work for and most e-commerce websites will force you to create strong passwords. Best practices suggest using a password that has 3 of the following four:Upper case, lower case, number, special characer. This is correct but now you need to take it a step further. With the ammount of compromises taking place today, it is strongly recommended that you have different passwords for different accounts. The last thing you want is for one company you do business with to get hacked and all of your accounts get compromised as collateral damage because you used the same credentials. Lesson #3 Diversify your porfolio of passwords to limit the impact of an account compromise.

4 .I don’t do online banking from my computer at home. I only do it from my cell phone so…

Two years ago this may have been a decent approach but those days are long gone.  More people today would rather browse the internet from a mobile tablet or their phones than the conventional PC or laptop. Because of this, cyber criminals have redirected their attention towards thse new platforms. There is Malware built today specifically to target Android and Apple phones. Mobile phone viruses are usually introduced via text message or through fake apps posted in Application strores. Most people aren’t aware of this threat and as a result proper security measures aren’t applied. Do you have anti-virus installed on your phone? Did you know hackers can take control of your phone and record your calls or redirect your text-messages or turn the recorder on your phone while its in your pocket? This topic is  so ripe and new that I  could dedicate an entire blog to it. Lesson #4 Your mobile phone is probably less secure than your laptop or conventional desktop.

5. I don’t open links from email addresses I don’t know. The email came from my friend so…

After a cyber criminal compromises a computer they begin to search for new targets and one way they do that is by perusing the email boxes of machines they have already hacked. Wjat better way to convince someone to open a file or go to a link than to send it from the email address of someoen they trust. These types of attacks are hard to detect but there are some common idicators that should at least peak your curiosity. If you receive an email from your friend about a topic that you dont typically email about, it should raise a red flag. If the email is sent at 3 AM and you typicaly email during business hours, you should raise an eyebrow. This is  one of those situations where you need to use good judgement. Lesson #5 Be suspicious of any and every email you recieve, regardless of the originator of the email.

Welcome

Welcome to Securitypebkac. PEBKAC is a term that has been used in the IT community as a way to diagnose computer issues as “user error.” The literal translation is “Problem Exists Between Keyboard And Chair” and for years it has been way to attribute technical difficulties to the computer illiterate. This is usually applicable to help desk problems but the sentiment is prevalent in the security community as well. Security experts often say that people are and always will be the weakest link in security. In my humble opinion, simple acknowledgment of our most exploited weakness is not enough. This blog is written by a certified cyber security professional who is dedicated to reinforcing the most critical and portentous link in the chain – the human.