Home Computing Security Awareness

Transcription

1 Hme Cmputing Security Awareness Hme cmputing carries the same srt f risks t yur persnal infrmatin and persnal financial infrmatin that industry cmputing des t sensitive Cmpany infrmatin. The purpse f bad actrs in the hme cmputing envirnment is the same as bad actrs in the business envirnment, namely t steal yur sensitive infrmatin, gain the ability t infect yur hme cmputer with malware and spyware, and derive sme financial r persnal satisfactin rewards ut f disrupting the life f the hme cmputing victim. Eternal vigilance by the peple is the price f liberty! This is just as true tday fr the safety and security f the hme cmputing envirnment as it was in 1837 fr President Andrew Jacksn, as he made his farewell address n leaving ffice. The purpse f this shrt Hme Cmputing Security Awareness Mdule is t help the hme cmputing user identify cmmn threats, and t defend themselves, and their data against bad actrs wrking hard t deny them the liberty t pursue their infrmatin freedm f use, withut ging t the extent f turning ff their cmputer access t the wrld utside. There are multiple layers f prtectin in yur radial tires t prtect yu frm rad hazards, and yu need the same srt multi layered apprach t prtecting yur cmputer. Up tp date OS, Up t date Firewalls, Up t date AV prtectin. The starting pint f safe and prductive usage f yur hme cmputer is t defend it against the bad actrs f the wrld with multiple layers f defenses. Defensive Cmputing Define Apprpriate User Access Level Starting at the initial user definitin level and creating a Restricted Windws User fr rdinary access use and a Windws Admin User fr cmputer maintenance and sftware installatin. The Restricted Windws User is walled ff frm the cre f the perating system. Windws 7 calls this a standard user. They cannt insert/update/delete anything in the C\Windws flder. The perating system is helping yu defend itself against manipulatin by malware if yu are lgged in as a Restricted User. Only lg in as the Admin User when yu need t actually tweak yur system. It is nt fl prf against malware infectin, but it is a defensive layer. Develp a Strng On-Line Passwrd Mdel Begin yur prtectin layer effrts n line with a strng Passwrd mdel. Dn't use bvius base-wrds r clues like a name, birthday r date, these are easier t crack than whle phrases. Take advantage f length. An 8 character passwrd is many times mre difficult t crack than a fur digit passwrd. Fr even mre security, try t use "nnsense wrds." Cmbine these with numbers, upper case and lwer case characters, and symbls as well t make memrable, secure

2 passwrds. Fr example, start with a wrd like catdgs, and substitute upper case, symbls, and numbers, such as Ca1d0&5. Having a base wrd helps yu remember yur substitutins. Sme passwrd sites restrict length and symbls, s knw what the site requires befre yu create yur passwrd. The example catdgs culd have been Ca1d095 fr a n symbl, 8 character site. Anther alternate scheme is t use a memrable phrase t create a passwrd using the first r last r sme ther sequence frm the sequential letters t make a passwrd mdel yu can remember. Example: Give me liberty r give me death culd becme Gml0gMd Yu can write dwn yur passwrds, but keep them secure. A wallet card is much mre secure, and mre mbile, than a sheet f paper kept clse t yur cmputer. D nt write yur passwrd anywhere where it might be seen r fund. If yu stre a passwrd file n yur cmputer, encrypt the file, and be sure t remember that passwrd r write it dwn! If yu have truble remembering all the passwrds yu need, try using a passwrd manager r passwrd vault applicatin, which can reside n yur mbile phne fr cnvenience and security. They can stre all yur passwrds securely using a single master passwrd, and yur phne s encrypted strage will keep it secure. Cnsider having multiple levels f passwrds. A simple easy t remember level fr sites which yu access t read fr news r entertainment. Newsblgs, recipe sites, hbby sites, newspaper sites, all fit this definitin. This is a thrwaway level f passwrd. N great harm cmes t yu if smene cracked it. D nt use the same passwrd generatin lgic fr these as fr yur mre prtected level f passwrds! Use a higher level f mre prtective passwrds with alpha, numeric, and symbls, if pssible, fr sites where yu expse financial r persnal infrmatin, such as credit card infrmatin fr transactins. These passwrds shuld never be reused n mre than ne sites. Higher value sites (yur bank r credit card sites fr instance) shuld never have duplicate passwrds r base passwrds with a sequential number embedded that yu change t generate a new passwrd. Bbcash 10 and Bbcash11 are nt really different passwrds t use fr tw ATM accunts! Persnal Accunts f high value shuld have the passwrd changed every 90 days. Never tell anybdy yur passwrd. Smebdy culd verhear yu, r the persn yu tld culd let it slip. Knwing ne r mre f yur passwrds may help a bad actr guess mre f them. Be watchful f shulder surfers as yu enter yur passwrds, particularly in public lcatins. Change yur passwrds peridically r whenever it may have becme cmprmised. Frequent passwrd changing is required by cmpany plicy r federal law in sme businesses, but may encurage users t chse weaker passwrds r write dwn their passwrd near their cmputers. Dn't re-use an expired passwrd.

3 High value accunts, such as yur electrnic banking, may ffer the ptin f a One Time Passwrd system (OTP), using yur mbile phne t deliver yur single use passwrd. This is very secure since yu never use the same passwrd twice n that accunt. It is als pssible t btain yur wn OTP phne applicatin, and link it t yur persnal site accunts in sme cases. This again prvides a very secure passwrd if the ptin is available. Prtect Yurself Against Malware Attacks Always have up t date Anti-Virus sftware, OS, and third party sftware updates n yur hme cmputer, and update it as new patches cme ut fr the AV sftware. Prtect yurself and yur hme cmputer with an Internet firewall. Never turn it ff as it is the first line defense against dwnlading malware frm the Net. Remember that all prtective sftware is lking back at what is knwn t be bad, and avid questinable sites and activities where yu might be mre likely t discver the latest and greatest malware! Never dwnlad anything because f a pp up warning, as it is prbably a malware scam. Update all f yur sftware regularly, nt just yur Anti-Virus package. Cyber criminals wrk t explit vulnerability and the sftware vendrs wrk t prevent them frm ding it. Use the latest versins t help keep yur cmputer safe. Cnsider un-installing sftware that yu d nt use and keep updated, t minimize ptential vulnerability. Be careful with USB key sharing. Use yur anti-virus scan feature t scan any key that has been in smene else s cmputer. The USB drive may share mre than the pictures yu think are n it with yur cmputer! An infected USB stick is a cmmn carrier f malware. Prtect yurself frm a lst USB key by using encrypted keys fr yur prtable data strage. If yu lse it, yu may be incnvenienced but yu will be prtected against identity theft r theft f financial data that yu might have n yur key. Dn t be tricked int dwnlading malware. Be suspicius f any link r attachment in unknwn , instant messages r scial netwrk pst. D nt click Agree, OK, r I Accept in banner ads r ppups windws that ffer t inspect fr r remve malware r spyware. It is ften actually malware ffering t install itself! Be careful f dwnlading free games, music, r sftware ffered n websites yu are surfing. They are cmmn means f malware infectin. Always Be Skeptical When yu are n-line and an update windw pps up saying yu need t update this r that plugin, such as Flash, be skeptical. It is ften a scam t get yu t expse infrmatin t a bad actr site. G t the actual sftware site t check fr upgrades. Only dwnlad upgrades frm the riginal sftware site!

4 Keep a healthy skepticism regarding unslicited t yur accunt ffering anything ptentially attractive t yu fr just a buttn click n an attached link, as it may be Phishing! Phishing, the act f ffering a lure t see if yu will bite, is mre and mre prevalent as an based attack. Offering sme great deal r special infrmatin link just fr yu, frm smene r sme business yu d nt knw may be an attempt t lure yu t a site and acquire yur persnal infrmatin as yu register fr the deal r special ffer. Anther cmmn Phishing scam is t send yu an warning abut a large accunt charge r a cancelatin f yur accunt frm a business yu suppsedly knw. Examine thse links and addresses carefully! Lk fr scam links that shw a different address than expected when yu hver ver them. Als lk fr misspellings r slight changes in site names which yu think yu might knw. It is trivial fr a scammer t frge a Frm address t make yu think yu are dealing with a knwn business. If yu get a request fr any persnal r financial infrmatin update, r t cnfirm yur accunt infrmatin, never click a supplied link in a nte. G t the actual site f yur bank r stre accunt directly, and see if they are messaging yu t make sme accunt update r change. Dn t get caught by the Phisher! Think Befre Yu Share Persnal Infrmatin On-Line Yur persnal and family privacy depends n yur ability t cntrl the amunt f persnal infrmatin that yu prvide n-line and wh has access t that infrmatin. Identity theft is a majr cncentratin f bad actrs, and can be embarrassing persnally and financially injurius t yur family members. Read the privacy plicy f websites befre yu cntribute persnal r financial infrmatin. Privacy plicies shuld clearly explain what data the website gathers abut yu, hw it is used, shared, and secured, and hw yu can edit r delete it. Understand that sme scial media sites repeatedly change their sites, in the name f adding functinality and features, which break dwn the previusly applied privacy barriers f the users, requiring them t be reset ver and ver. Mnitr and knw when yur scial media site has brken yur privacy barricades and knw hw t reestablish them! D nt share mre than yu need t. D nt pst anything nline that yu wuld nt want made public. Minimize details that identify yu r yur whereabuts. Dn t pst yur plans fr trips and travel fr the wrld t see n yur scial media sites. Burglars use Scial Media t! Cnsider disabling yur ge lcating functinality fr yur camera if yu pst pictures. Knwing the lcatin tag f a picture gives a lt f infrmatin t a scammer trying t establish a cnnectin t yu, and may tell him where yu r yur children hang ut, wrk, r live, r g t schl. Keep yur accunt numbers, user names, and passwrds secret.

5 Only share yur primary address r Instant Message (IM) name with peple wh yu knw r with reputable rganizatins. Cnsider a secnd accunt fr public use which yu can ignre r delete withut any lss. Avid listing yur address r name n Internet directries and jb-psting sites. Be Cautius! Enter nly required infrmatin ften marked with an asterisk (*) n registratin and ther frms. Chse hw private yu want yur scial media prfile r blg t be! Mdify website settings r ptins t manage wh can see yur nline prfile r phts, hw peple can search fr yu, wh can make cmments n what yu pst, and hw t blck unwanted access by thers. Mnitr what thers pst abut yu and yur family members. Search fr yur name n the Internet using at least tw search engines. Search fr text and images. If yu find sensitive infrmatin n a website abut yurself, lk fr cntact infrmatin n the website and send a request t have yur infrmatin remved. Regularly review what thers write abut yu n blgs and scial netwrking websites. Ask friends nt t pst phts f yu r yur family withut yur permissin. If yu feel uncmfrtable with material such as infrmatin r phts that are psted n thers' websites, ask fr it t be remved. Be selective abut Friends. Cnsider adding nly thse yu actually knw r thse that yu have friends in cmmn. Dn t assume that a friend f a friend is yur friend until yu inquire with yur real friend. Scial engineering, the attempt t slicit identity infrmatin frm a user n a scial media site, usually starts with the friends yu d nt knw. They can gain a lt f initial knwledge abut yu by reading what yu pst. They can get a lt mre by careful cmmunicatin thru yur site. Wireless Internet Security Risks Dn t share everything! The wrld des nt need t knw everything abut yu. Hme WI-FI Netwrk Issues Wi-Fi netwrks (generally standard X) allw peple t wirelessly cnnect devices t the Internet, such as smartphnes, gaming cnsles, tablets, and laptps. Because Wi-Fi netwrks are simple t setup, many peple install their wn Wi-Fi netwrks at hme. Many hme Wi-Fi netwrks are cnfigured insecurely, allwing strangers r unauthrized peple t easily access yur hme netwrk r annymusly abuse yur Internet cnnectin. T ensure yu have a safe and secure hme Wi-Fi netwrk, here are a few simple steps yu shuld take. Limit the access t yur Wi-Fi Access Pint by taking time t set up security when yu set it up.

6 Always change the default administratr lgin and netwrk passwrd t smething nly yu knw. The default values are available fr almst all brands n the Internet pen t anyne! Never leave the defaults in place. It is recmmended t disable Administratr access t the settings thru the wireless netwrk. Set the cnfiguratin t require wired access thru an Ethernet cable if pssible. If yur access pint des nt have this ptin, disable HTTP and require HTPS, which supprts encryptin. Change the wireless netwrk name (ften called the SSID) t a name knwn nly t yu. Never use the default netwrk name. Set the netwrk name t Nn-bradcast r Hidden. Enable encryptin n yur netwrk by activatin f WPA2. Never run with WEP r an pen Wi-Fi netwrk. An pen netwrk allws anyne t cnnect t yur access pint. Make sure the netwrk passwrd is different frm the Administratr passwrd and nt easily guessed. Recmmended length is generally 20 characters. Yu nly have t enter it nce fr each device using the netwrk and then it is remembered by the device. Write dwn r electrnically stre this netwrk passwrd in sme nn-bvius secure place, nt taped t the access pint! If yu allw guests t use yur netwrk, yu may want t change the netwrk passwrd after they leave. Turn ff r disable WPS. Recent vulnerabilities with WPS have been uncvered which culd give an utsider access t yur wireless netwrk if it is enabled. Use f Public Wi-Fi Netwrks: Security Issues The easiest way t eavesdrp and wiretap internet cnnectins is t d s thrugh public Wi-Fi htspts. Public Wi-Fi security in mst public htspts that yu find in cafes, cffee shps, airprts, schls and htels is weak t nn-existent. Htel Wi-Fi r wired access that yu paid fr is nt autmatically always safe either. Yu are putting a lt f trust in the peratr f the htel netwrk! The FBI has warned travelers there has been an uptick in malicius sftware infecting laptps and ther devices linked t htel Internet cnnectins. The FBI stated: "Recent analysis frm the FBI and ther gvernment agencies demnstrates that malicius actrs are targeting travelers abrad thrugh pp-up windws while they are establishing an Internet cnnectin in their htel rms. Open Wi-Fi htspts run with n security encryptin which makes them very insecure! Cnsider the use f a Virtual Private Netwrk (VPN). The VPN tunnel will nt allw yur cmputer t be cnnected t tw Internet pathways, cutting ff the bad guy s access rute. Yu are transferring data in an encrypted tunnel. VPN services are available fr a mdest mnthly fee if yu need t use a lt f pen Wi-Fi, and bandwidth limited free VPN service is als available fr ccasinal users. Check it ut. Cnsider the use f nly encrypted Wi-Fi htspts utside yur hme. This is nt as secure as VPN r yur wn hme netwrk can be, but it des prvide better prtectin. Starbucks perates an encrypted netwrk at their stres, as d thers. Check befre yu cnnect! Cnsider the use f a USB cellular data card fr yur cmmunicatin access while traveling. A cellular cnnectin is encrypted and much mre secure than Wi-Fi r a htel wired netwrk, althugh yu will have a mnthly fee.

7 If yu have an iphne, r Andrid SmartPhne, yu can install a Persnal Htspt App with a data plan t allw yur iphne t act as yur laptp s cellular cnnectin. This is a very secure encrypted cnnectin t the internet fr a fee f abut $30 t $50 a mnth currently. Speed and perfrmance f SmartPhne Htspts are cmparable t lcal Wi-Fi. If yu are limited t using pen Wi-Fi htspts, yu have the ptential fr interceptin f any data transferred, thru Wi-Fi Spfing (establishment f false netwrks r false sites t steal yur authenticatin and data). Brwsing Web sites with HTTP unsecure access rather than HTTPS secure encryptin expses any data yu send ver the Internet. The Wi-Fi htspt spnsr r anther user in the immediate htspt area can intercept yur lgin infrmatin thru tls such as Firesheep. In a practice knwn as HTTP sessin hijacking (r sidejacking ) the pirating sftware intercepts brwser ckies used by many sites, including Facebk and Twitter, t identify users and allws anyne running the prgram t lg in as the spfed legitimate user, and d anything that user can d n a particular website. Spfing can get everything yu send if it is established between yu and yur intended receiver site, such as a htel r airline reservatin site, where yu wuld typically be exchanging persnal infrmatin, identity infrmatin, and credit card infrmatin. This is a Man-in-the-Middle attack. Yu are sending t the bad guy and he is recrding yur infrmatin and sending it t the intended site but nw he has a cpy f yur identity and authenticatin! Spfing can als include cntrlling the Wi-Fi t dwngrade yur HTTPS t HTTP access, leaving yu vulnerable t data hacking. If using Wi-Fi, be alert t the status f yur cnnectin as a bad actr may change it after yur sessin is established. Never send yur persnal identity infrmatin, r financial infrmatin except thru an HTTPS cnnectin which has secure encryptin! Avid pen Wi-fi if at all pssible when yu are ff f yur hme netwrk! Prtecting Yur Finances Theft f yur credit card infrmatin is a cmmn hacker attack gal. Even if yu are nt liable fr lses abve a certain amunt, the incnvenience f having t cancel accunts, and pen new accunts is majr. Cnsider the use f pay services like PayPal that allw yu t cnceal yur actual credit card infrmatin frm yur transactins. Cnsider the use f a reladable accunt card, especially fr family members playing n line multiplayer games, which ften have fees t cver electrnically. MasterCard, Visa, and American Express all ffer such cards, and lsing accunt infrmatin is nt the level f hassle that lsing a regular credit card accunt identity bring. Yu als limit yur lsses up frnt by deciding hw much balance t lad n the cards. D understand the fees assciated with these cards carefully befre yu select ne. Shp arund as there is a lt f variance and deals.

8 Physically destry hard drives in bslete PC s befre yu take them t recycle. Even if yu have a high grade disk wiping prgram, yur infrmatin can still be recvered. Encrypt sensitive files n yur hard drive, such as tax returns r yur mnthly accunt statement strage files. These files culd be very dangerus if malware cpies them ut t the bad guy. Summary The Hme Cmputing user faces the same challenges as the Business Cmputer user, but with many less resurces t help yu. Yu are n yur wn. Preparatin f yur defenses and maintaining them in a current up t date status is the key t prtecting yur cmputing envirnment. A cautius attitude and apprach t infrmatin sharing is als key t prtecting yur family and assets. Make sure that everyne in yur Hme Cmputing user envirnment is aware f the risks and the steps t take t mitigate thse risks and prtect yur family s security! Check fr advice and infrmatin n hw t make yur hme cmputing envirnment safer at: Windws Supprt-Security, Privacy, and Accunts Stay Safe Online.Org Micrsft.Cm Safety and Security Center