Blue Scream of Jeff

Saturday, May 29, 2021

Cybersecurity: 2FA or not 2FA? That’s the question…

Graphic courtesy of Marshall University IT Department

Okay, you’ve learned how to spot fraudulent e-mail and text messages and have followed my advice about creating different, strong passwords for each of your online accounts. Now you can relax, knowing all your important information is safe and secure, right?

Wrong!

No matter how unguessable you think your password is or how careful you are about avoiding online scams, your credentials could still be stolen by hackers who target the companies who store those passwords. That’s why you need to further secure your important accounts by using something called Two Factor Authentication (2FA) or Multi-Factor Authentication (MFA).

Doing this creates an extra step to prove your identity when you go to login to a website, device or application, by having you enter a second piece of information completely separate from your username or password.

Yes, this extra step may be inconvenient, but it provides an extra layer of security because the more time and hoops you make a hacker jump through, the more likely it is that he or she will just give up and move on to another victim whose account is easier to crack.

Even for cyber criminals, time is money, and the goal of any good cybersecurity strategy shouldn’t be to
stop every attack. Frankly, that’s not possible. It should be to put so may barriers up between you and the hackers, that it’s simply not worth their time to victimize you.

So how exactly does all this work? And isn’t that second piece of information just as vulnerable to being stolen as a password?

No.

You see the way 2FA/MFA typically works is that the site or device you are trying to log in to either sends that second piece of information to another device in your possession or prompts you to enter information from an app you have on that second device. Either way, that information – usually a six-digit code – constantly changes and is only good for a few minutes. So even if a hacker manages to get ahold of the code, they can’t keep using it over and over again to gain your account like they could a stolen password.

Like all things, this method is not fool-proof, and there are ways around it even without direct access to your second device. But those methods are harder to do and hackers may decide it’s not worth the time and trouble and move on to someone else.

Currently, most people usually use their cell phone as that secondary device to setup multi-factor authentication, and that’s what I’d recommend doing if you have one. It’s more secure than having messages sent to an e-mail account which is easier to hack than a device you almost always have with you anyway.

If you decide to use your cell phone for this, I’d also recommend registering another mobile device -- if you can -- as a backup. This way if you lose your phone, you can have your cell phone provider help you remotely wipe it, disabling its ability to do MFA, yet still be able to authenticate with the other device.

There are several different ways MFA works. Here are the five most common ones:

‘Push’ Notification to a Mobile Device

With this method, the account that you are trying to log into will create a popup message on your cell phone or other mobile device notifying you that someone is trying to log in and ask you to either allow or deny the attempt.

It’s called a “push” notification because the website that’s being logged into initiates the communication and allows you to hit a big red or green button to either allow or deny the login right from that notification.

What makes this method so secure is that A) you get real-time notification when someone is trying to log in to your account and B) any bad guy trying hack into your account must have physical access to your mobile device to be able to log in.

The downside to this is not all websites that support MFA support push notifications which leads us to…

Text or SMS Notification

Similar to a push notification, the account that you are trying to log into will initiate communication, but this time, instead of giving you the yes/no option in a quick popup message, it will send you a text message with a six -or eight- digit code you will need to manually enter on the website’s login page to continue.

It has the same advantages of a push notification but does have the additional downside of having to manually enter a potentially long code from your phone.

Mobile App on your device

The third method, involves you having to download a mobile app such as Google Authenticator , Duo Mobile, Microsoft Authenticator or LastPass Authenticator. Each of these apps constantly generates changing codes based on an algorithm that only it and the site you are trying to login to know.

So when you go to login to that website, the website will only let you in if the code its algorithm creates matches the code the algorithm on your phone produced. Since the codes are set to change every minute or two, it’s extremely unlikely a cyber crook could guess that password in so short a time.

Again, the main advantage here is that the attacker has to have physical access to your mobile device, but does come with the disadvantage of not getting any real-time notifications should someone else try to log into your account.

If you don’t know which one of these apps to use, PC Magazine’s recent review of The Best Authenticator Apps for 2021 can help you decide. And don’t feel like you have to choose only one of them. I use two different ones on my phone without issue. (However, having only one does make things easier to manage).

Physical Token

Physical tokens are small key-chain sized devices that do exactly the same thing as the mobile apps. They were prevalent in the days before smart phones became ubiquitous and have the same advantages and disadvantages of those mobile apps. There are also versions that look like a USB thumb drive that plug into your computer and provide the second form of authentication automatically.

Email Code Method:

This method works similarly to the text/SMS code method except that the code is sent to an e-mail account that you told the website to use. This is perhaps the least secure method of them all, because cyber criminals do not need physical access to a device in your possession and assuming you haven’t secured this account with 2FA, only need to guess your password to get in.

Does it mean you should not use it?

As a primary authentication method, I’d advise against it, but it’s not bad to have it set up as a backup or third way to authenticate should your phone be unavailable. (Some sites allow you to set multiple ways to authenticate while others only allow one way, which is why it’s called either Two- or Multi- factor authentication.) Just be sure to make sure you have the strongest possible password on that account.

Setting up 2FA/MFA

How you set all this up will differ with each website you use. But the options you will need to configure will often be found on the settings page under either the security or login sections.

Here are two examples of how to access them in Facebook and Google:

FACEBOOK:

Click on the account dropdown button next to your profile picture and from the dropdown menu and select the Settings and Privacy option.
When the dropdown menu changes, click on the Settings option
When the settings page loads, click on Security and Login on the left-hand rail and look for the Two-Factor Authentication section and switch it to ON to begin setting it up.

GOOGLE/GMAIL:

Make sure you are logged into your Google or Gmail account, and click on the button that looks like checkerboard on the upper right of the page and from the dropdown pick menu that appears click the Account button.
Click on the Security link in the left-hand rail, then scroll down the page until you come to the Signing in to Google section. Under that click on the arrow next to 2-step verification to begin setting it up.

Is going through all this on every site you use worth it?

The answer depends on how much time and aggravation it will take you to recover a hacked social media account, or how much money you could potentially lose if a cybercrook gains access to your online financial accounts.

But one thing you should always keep in mind is that 2FA/MFA isn’t perfect and cyber cooks are constantly coming up with ways to circumvent security. So just because you set this up doesn’t mean you can now relax your guard. If anything, it should only make you more vigilant about cybersecurity than ever.

Friday, April 30, 2021

Cybersecurity: Pass the word about good passwords

Comic courtesy of xkcd.com. You can see the full comic here

One of the many things I’ve discovered while working in IT is that most people treat passwords like vegetables on their dinner plate.

Everyone knows veggies are good for them, but hate eating them. So they either rush through creating a password as if trying to wash down a forkful of spinach with a glassful of milk, or, worse yet, try to hide the fact they haven’t changed a weak, default password, like they were trying to disguise the fact they didn’t eat all their peas by pushing them under some left-over mashed potatoes.

And like avoiding eating your veggies, ignoring good password practices can have a disastrous impact on your (financial) health.

SOURCE: cybintsolutions.com

In 2020, IBM calculated that the average cost of a data breach to be as much as $3.86 million. In prior
years, about 80 percent of beaches were caused by stolen passwords.

Sure, a vast majority of those breaches happened to big businesses. But don’t think for a moment that those breaches don’t affect your personal finances or that hackers don’t target the average Joe, because they do. According to a recent AARP study, fraud due to identity theft could cost the average person anywhere from about $200 to over a $1,000 assuming it’s detected quickly.

This is hardly news to most people, yet when I broach the subject with folks outside the IT world, the most common excuse I get for not having or keeping strong passwords is that they are hard to remember.

Well of course they should be! That’s kinda of the point.

If your password is easy to guess, it’s not doing its job in keeping your data safe from prying eyes. You might as well not have a password at all and that’s not a viable strategy these days with more and more of our personal and financial data moving online.

There are many ways to come up with a good strategy for creating and remembering complex passwords, but most cybersecurity gurus agree on the following tips:

USE A LONG PASSWORD

The longer a password, the harder it is for hackers to figure out. Even if hackers use a fast computer to run through every possible combination of letters, numbers, and symbols, the longer the password, the more time it will take them to crack your account. And the longer it takes a hacker to do that, the more likely it is that they will give up on you and move to an easier target.

For instance, a simple eight-character password with all lowercase letters can be cracked in about five hours, where a password with 12 all lowercase characters would take slightly over 200 years. (Times are based on Tulane University's Brute Force Calculator)

USE A PHRASE AS YOUR PASSWORD

When I tell people they should have a long password, they naturally think about using a phrase or
passage of text they’ll remember. The problem is that hackers are well aware of this tactic and will also try using common or well-known quotes from literature, the bible, TV shows and movies to crack your password.

So while you might think “OpenThePodBayDoorsHal” maybe a good password because it long and has a mix of upper and lowercase letters, it’s also probably on the list of top five phases hackers will try because it's so obvious.

Your best bet here to use a nonsensical phrase or phrase that contains random words. Also do not use characters that are sequential on a keyboard, numbers in order or the widely used “qwerty” because those are also on the list of default passwords hackers will try to get into your account.

INCLUDE NUMBERS, SYMBOLS, AND MIXED-CASE LETTERS

By now we are all familiar with this as many sites require you to use symbols, numbers and letters in your passwords. One of the things I will do is come up with some phrase then substitute numbers or symbols for the following letters:

A =@ S = $ or 5 E =3 i =! or 1 O = zero

So if I decide to use the not-so-nonsensical phrase like: New Pair of Shirts

I can make it more secure by using the substitutions like I mentioned above to turn it into this: N3wP@1r0f$h1rt$

If you use one of these as your password, you really need to change
it immediately! (Source: zdnet.com)
AVOID USING PERSONAL INFORMATION IN YOUR PASSWORDS

This is a big one, especially in the age of social media quizzes that often ask you for seemingly harmless information like the month you were born, your favorite food, color or movie. Hackers can use this information to help guess your password, because they know people often use that kind of information for their passwords. They also know people tend to use important dates and names in their passwords, so don’t use birthdays, anniversary, addresses, city of birth, high school, and relatives’ and pets’ names in your passwords either, because that information is often easily discoverable online. On that note, if you are required to choose security questions and answers when creating an online account, select ones that are not obvious to someone browsing your social media accounts.

DO NOT REUSE PASSWORDS

If you only take away one thing from this post, remember this. Don’t use the same password on all your accounts!

Yes, I know it’s hard to remember just one password and now I’m telling you that you should have 20. But hackers know people are lazy and if they crack your e-mail or social media account password, the very next thing they are going to do is start trying to use that password on various banking and financial sites to see it if works.

I often council my employees at work to also change the passwords on their personal accounts whenever we detect that their work account password was compromised. I do this because even though our employees seldom use their work e-mail address as their username on personal sites, hackers are smart enough to try the password they cracked for Mary.Jones@MyCompany.org on accounts for mary.jones@gmail.com, mjones@gmail.com, etc.

USE A PASSWORD MANAGER

Okay, you’ve followed all my rules and created several strong passwords, but what good will they be if you can’t remember them when you need them?

The answer is simple. Stop trying to remember them and start using a password manger.

Password managers are small programs which you can install on your computer and phone which not only keep track of all your passwords, but also helps you create strong and different passwords for every site you visit. The beauty of using one is that you only have to remember a single, strong password and many can be unlocked by a finger print so you don’t even have to remember a password if you don’t want to.

Yes, some most modern browsers like Chrome and Firefox have features similar to this, but they are much less secure than dedicated password managers. So if your gmail account ever gets hacked, then all the passwords you have stored on your Google account will be exposed.

In my job, I use LastPass and have come to rely on it a lot. It works on both my phone and computer and integrates with Chrome pretty painlessly. I highly recommend it, but it’s not the only one out there. Here are a few others recommended by PC Magazine and CNET are worth checking out.

If you don’t want to spend money on one of these programs you can always do what Mrs. BlueScreamOfJeff does and turn one of those old-fashioned pocket phone/address books into an offline, physical password manager. Instead of using it to keep track of all her friends, family members and acquaintances, she uses each section to store the username and password for all her various accounts. For example on the “A” section pages, she has entries for her AOL, AirB&B and Applebees.com. Under the “B” section she has her Bank of America, Barnes and Noble and BBC.com login info.

Yes, this does go against “the rule” of not writing your passwords down, but it is OK to write them down as long as you store them in a secure location like a locked drawer when you’re not using it.

CHECK ON YOU PASSWORDS

Finally, you should periodically check to make sure your passwords are still secure and haven’t been hacked.

Sites like Have I Been Pwned?, BreachAlarm and Dehashed all let you check on whether your account has been compromised by a past data breach.

They are pretty simple to use. Just go to the page, enter your e-mail address and click the search button and these sites will then look through a list of accounts known to have been breached by hackers show you if your address was possibly compromised.

If it was, you should change that password immediately.

I know I’ve made it seem like creating and keeping your passwords safe is a lot of work. But like your mother always told you when you complained about having to eat your vegetables: You may not want to do it, but it's good for you.

Wednesday, March 31, 2021

Cybersecurity: Is there something phishy going on in your inbox?

SOURCE: Jeffrey L. Price, 2020

Have you ever noticed how many fishing lures are shiny and brightly colored?

It’s because fish can’t resist them, and it seems we humans also have this same flaw. Send someone a flashy message promising them some reward or a vaguely worded threat and we just can’t resist clicking on the link or attachment in that message to see what it is.

Cybercriminals know this and depend on your trust and curiosity to make their scams work. And just like that poor trout who goes to investigate that shiny thing floating around in the water, it doesn’t end well.

So how do you avoid becoming some cyber-fisherman’s catch of the day?

The answer is deceptively easy. When it comes to e-mails -- and even text messages – trust nobody. Assume every message you get is fake until you can confirm it’s not.

And how do you go about confirming a message isn’t fake?

By following some simple precautions I outline below. While this list isn’t exhaustive and doesn’t guarantee you will never be fooled, you will be surprised how often it can save you from being hooked.

Skepticism is your best defense

First and foremost, be skeptical of any message you get. Are you expecting a message from this person and what are they asking you to do? If they are asking you to download an attachment or requesting you to sign into some site – even one that seems legitimate – ask yourself if this person really needs to know that information.

If a stranger came up to you on the street and introduced themselves as a friend of a friend then asked you for your social security number, would you give it to them? Probably not. So you shouldn't do it with an e-mail from some stranger either.

If the message appears to be from a bank or other institution you do business with and they are requesting you verify information they should already have, then don’t give it to them. Again, you wouldn’t give the keys to your safe deposit box to some Joe on the street who introduces himself as the VP at your bank, would you?

Remember hackers are extremely good at what they do. They are experts at creating seemingly valid email addresses, language, and mimicking brand logos. So be skeptical when it comes to your email inbox – if an email looks even remotely suspicious, do not open it. Instead, delete it. It is always better to be safe than sorry.

Look closely at the display name and email address

Faking or forging the display name on an email (or even a text message) is a classic phishing ploy. Many times hackers will intentionally misspell a name betting you won’t notice the difference between something like CityBank and Citibank to get you to think their message is real.

Another trick they use is to slightly change the name of a person or colleague they might think you regularly communicate with. So instead of getting a message from a Michael Smith, hackers might try to disguise themselves as Micheal Smith, Mike Smith or even Mika Smith, again betting your familiarity with their name will make you overlook the misspellings. Also be on the lookout for names in the wrong order. At my company display names from internal employees are always listed as LastName, FirstName. So when I see a message from our CFO with a display name of FirstName Lastname, I know it is fake.

Next take a look at the email address following that display name. Does it match and appear to come from the right organization? A message from Citibank for example, should come from someone@citbank.com and not Citibank@abc.com.

The tip here is to always look at the part of the email address that follows the @ sign. Remember that no legitimate organization will send an email using a public domain like email address like ones ending with @gmail.com, @comcast.net, @yahoo.com, @aol.com, etc. Every organization will have its own email domain (the part of the address that follows the @ sign) and only send from official company accounts. The best way to find out what an organization’s real domain name is is to type that company’s name into a search engine.

Also be on the lookout for domain names that mimic real ones. Hackers are betting that you will overlook misspellings like @citbank.com (missing the second “i”), @citybank.com (using a “y” instead of an “i) or even wrong endings like citibank.net instead of citibank.com.

Finally, watch out for is mismatched display names and e-mail addresses. If the display name says Michael Smith, then the e-mail address should not give another name like marcia.brown@gmail.com. If the first part of the address is a random string of numbers or letters – such as 1234VZE@verizon.net – then it’s a good bet the message is from someone trying to hide their true identity from you and you should automatically treat that message as fake.

Review the salutation

Who is the email addressed to? Is it to a vague “Valued Customer?” Legitimate businesses will often use a personal salutation with your first and last name, so beware if it doesn’t. Likewise if you get a message that has your name misspelled or appears to be from someone you know and they use your formal name rather than the nickname they’ve always used with you, then again, you can bet the message is a fake.

Be warry of urgent or threatening language

Cyberscammers often try to put you off guard by using fear or the threat of legal or financial action against you or play on your emotions by creating a false sense of urgency in their messages. Commonly, they will have subject lines such as “urgent payment request” or make claims that your “account has been suspended.” Others will say you have won an expensive prize in a contest you don’t remember entering telling you you must claim the prize now or it will go to someone else.

These messages will often direct you to click on some link or download an attachment that could infect your device with malware or trick you into revealing usernames and passwords to important accounts.

Guard your confidential information as if your life depended on it

Legitimate businesses will never ask for personal credentials through an email.

Ever.

These types of phishing scams often proport to be from a bank or other financial institution, the IRS or even online shopping sites like Amazon.

Again, ask yourself if you would give up that information to some guy on the street who just came up to you saying they were from your bank or the IRS and didn’t show you any hard proof of who they were.

So ignore any requests you get to “reset,” “sign in,” or input username or password through email – it’s almost always a scam.

The one exception to this rule is if you get a password reset message immediately after clicking the “I forgot my password” link on a site you usually do business with.

Also remember that legitimate businesses will never ask you for your account numbers, social security numbers, dates of birth or other information that could be used to personally identify you via an email. They should already have this information on file. If they ask you for it in an e-mail or text message, it’s either a phish or it’s a company you should stop doing business with immediately!

Think before you click

Note the link in the body says one thing, but when you hover

over it, the real link shows a different address!

Hackers love to embed malicious links in what look to be legitimate messages. To expose this fraud,
hover your mouse over the link. If the link address looks weird, DON’T click on it. If you’re skeptical about the link, call an IT pro to have them check it out. If you don’t have a favorite IT person you can bug, then look up the business’ contact information via a google search or go old-school and use a phone book, and call the company and ask them about the message.

Don’t click attachments either

Just like malicious links, hackers like to embed malicious attachments that contain viruses and malware in their phishing emails. Malware can steal your passwords, damage files on your computer, or spy on you without you ever knowing. Curiosity killed the cat, so don’t open any email attachments you weren’t expecting.

Texts messages aren’t any safer

Almost all of these rules can apply to text messages too. So don’t think that just because you don’t use e-mail that much, you’re safe.

You’re not.

Cyber criminals know more and more people are ditching e-mail for texting and are quickly adapting their tactics to target all you thumb-typers out there, so you need to heed these guidelines too.

Now, after reading all this, if you’re beginning to feel paranoid, and think every e-mail or text message you get could be bomb ready to go off in your face, good. I did my job! You should feel paranoid these days! Because that old saying is true. Just because you’re paranoid, it doesn’t mean the world isn’t out to get you.

Sunday, February 28, 2021

Cybersecurity speak: Is it all geek to you?

When IT folks like me start talking about cybersecurity we often throw around a lot of terms we just assume everyone is already familiar with. I mean in this day and age, who could possibly NOT know what phishing, ransomware, smishing, vishing, spear-phishing or even malware is?

Yet according to a 2020 report from the e-mail security firm, Proofpoint, quite a few non-IT people don’t.

So before I start telling you how you can better defend yourself against online threats, I’d like to spend some time defining the terms we IT folks often use to make sure everyone understands what I’m talking about from here on out.

MALWARE

Let’s start with the most generic term, malware.

As the name implies, malware is any program or application that does bad things to your device (Mal = malicious or bad / Ware = an abbreviated form of software). It’s also not just something that can get installed on your computer or laptop. Malware can infect your cell phone, tablet, smart TV or any other internet-connected device. And contrary to what you might have heard, users of Apple devices are just as vulnerable to malware as those running Microsoft or Android-based software.

The writers of this bad software go where the users are and will target their programs to take advantage of the most popular platforms. So if iPhones are the most popular type of cell phones, you can bet that cyber crooks are working on ways to exploit these devices.

To get users to download these bad programs, criminals will often disguise this software as something desirable, often a “free” or heavily discounted version of a legitimate program like Microsoft Office, Adobe Photoshop; a game or pirated copy of a popular TV show, movie or music.

RANSOMWARE

Ransomware is a particularly nasty subset of malware which seeks out a user’s data, encrypts it so it cannot be opened by any program until the user pays a cyber criminal a fee to unlock it. What makes this type of malware so insidious is that the malware not only effects the device that it’s downloaded on, but can also spread to other devices the infected machine is connected to.

Ransoms can be as “small” as $100 or range into the millions. It’s often demanded in bitcoin, a type of virtual or electronic currency that is hard to trace, and there is no guarantee that even if you pay the ransom, the hostage taker will give you the key to unlock your data.

Most people have probably heard about the recent ransomware attacks on big hospitals and municipal governments, but do not let that fool you into thinking that cybercriminals only target big institutions with deep pockets.

They don’t.

You are just as vulnerable to this type of attack as they are, as this type of infection is often spread through bogus e-mails where the sender tries to get you to open an infected attached file or click on a link to website that will download the malware to your device.

PHISHING

SOURCE: Jeffrey L. Price, 2020

Unlike, malware, the goal of phishing (pronounced “fishing”) isn’t to put any malicious software on
your computer or lockup your data. It’s to trick you into willingly reveal your sensitive information or data to an attacker. Attackers will do this by trying to impersonate someone you know or an institution you trust to not only get you to reveal your usernames, passwords and/or financial information, but also trick you into sending money to some fake account they have control of. Phishers also use these types of attacks to gather other background information on you such as your birthdate, social security number, previous employers, salary, etc. so they can use that information to open fake credit accounts in your name.

These types of attacks come in the form of e-mails, but have been branching out to other types of electronic communications as well

SPEAR-PISHING

Spear-phishing is a phishing attack where the cyber crook is directly targeting someone or some company, using information specific to the targeted victim, rather than sending out a more generic-sounding message aimed at everyone on the Internet. It is designed to make the victim think they are communicating with a known or trusted colleague. An example of this type of attack is a fake e-mail purporting to be from a company’s chief financial officer, directing some low-level staff accountant to transfer money to some new or unknown account.

SMISHING

While phishing attacks generally take place over e-mail, smishing happens through text messages. So instead of getting an e-mail from someone masquerading as a trusted friend, colleague or institution, the fake message comes in the form of text. This type of text often asks you to click on a link which takes you to fake website which will then ask you for things like a username or passwords.

VISHING

While the term vishing maybe new, this type of attack has been around for a long time. It’s just a fake phone call from someone saying they are from a company you might do business with or government agency demanding money or other information. Examples of this might be a recorded call from the IRS saying you are behind on your taxes and will be audited unless you call a certain number.

SOCIAL ENGINEERING

The one thing almost all these different types of “ishing”-attacks have in common is that the attackers are trying to fool you into thinking they are someone you already know or someone you can/should trust. In the pre-internet days, we would have called this people Con Men or Con Artists, because their game is exactly the same as their online counterparts. Only instead of trying to talk you out of your money face-to-face by putting on some great performance and pretending to be someone they aren’t, they substitute in-person contact with e-mail (phishing), texts (smishing) and phone calls (vishing). But that’s not the only way social engineers ply their trade. Many hang out on social media sights trying to lure you into revealing information that could be used to impersonate you by creating quizzes to see which celebrity you are most like or buddying up to you by claiming to be some half-remembered high school acquaintance or friend of old friend you haven’t talked to for a while.

AGE DOESN’T MATTER

SOURCE: Proofpoint 2020 State of the Phish report

While it’s easy to believe that social engineers and other online fraudsters only target less tech-savvy
and older folks, you’d be dead wrong. “Digital natives” – the generation who has never known a world without all this technology – aren’t immune from falling victim to cybercrime.

In fact, it’s they appear even more clueless about the dangers lurking out there in cyberspace than their older counterparts.

Maybe it’s because they just take this always-connected world for granted. Or maybe it’s a case of familiarity breeding contempt. Maybe it’s even a failure by us older folks to teach them the little we know about keeping safe online.

Whatever the cause, Proofpoint’s “2020 State of the Phish” report showed “Baby boomers outperformed everyone in their recognition of phishing and ransomware terminology. Millennials had the best recognition of only one term: smishing.”

The report showed that only 47 percent of adults between the ages of 18 and 22 correctly identified what phishing was compared to 65 percent of adults aged 39-54 and 66 percent age 55 and over. Older adults also scored 20 percent better than younger ones in knowing what Ransomware was too.

Some of this isn’t really that surprising as other studies have shown folks that between 18-22 prefer texting to e-mailing. However, it’s still no excusing for not knowing that the same types of scams you might see in a text can and do effect other online communications as well.

So next time you see a member of the Instagram-generation dissing an older colleague for not understanding the latest tech with one of their “OK Boomer” memes, remind them of this: Old-timers may not be as adept at using the latest tech as they are, but we older folk are better at something even more important – identifying cyberscams. (Then tell them to get off your virtual lawn before you ask them for the millionth time what a ‘hashtag’ is!)

2FA/MFA

We’ve talked a lot about jargon we tech-types use to describe the types of attacks you might see out there in cyberspace, but what about other jargon we use to describe defensive measures? Aren’t there things called firewalls? DMZs? E-mail protection gateways? VPNs? IP addresses?

Yes, and while they are important, I’d argue they aren’t as important to the average person as 2FA or MFA is.

These acronyms stand for Two (2) Factor Authentication or Multi Factor Authentication, and what it does is require you to prove who you are by providing two (or more) forms of identification before you can login to a website or application.

Think of this as having to provide both your ticket and driver’s license before boarding a bus or airplane. Or having to provide your birth certificate, passport, and a current utility bill in order to renew your driver’s license.

In the online world, 2FA/MFA works by sending you a text message, e-mail or phone call with a temporary code to a secondary device or account you own. Without entering this one-time-use code on the website on in the program, you won’t be able to log in, even though you’ve entered the correct password.

The idea is that while a cyber crook might have figured out your username and password, they won’t have access that second piece of information or device (often your cell phone), thus be unable to impersonate you.

Like everything else in life, this is not foolproof, but the more hurdles you make cybercriminals jump over, the more likely they are to abandon the attack on you in favor of easier targets. So if you are not using 2FA/MFA now, you should start.

Immediately.

Look these days we all carry a cell phone, and while having to grab it, look for that code and enter it every time you need to login someplace may seem like a giant inconvenience, the extra 30 seconds it takes will seem like nothing when trying to get your Facebook account back after some hacker has stolen it from you.

Ultimately this is what cybersecurity is all about: taking time now to prevent a lot of headaches later. And that now that you understand some of the jargon we IT folk use, I hope you’ll come back next month when we start discussing how to actually spot and defend yourself against these types of attacks.

Until then, stay safe out there!

Sunday, January 31, 2021

When it comes to Cybersecurity, humans are the weakest link

In my day job, I keep watch over my company’s computer systems, not only making sure everything is
working correctly, but also to make sure no one’s accessing them who shouldn’t be.

It may sound like a simple task, but with over 6,000 employees scattered across 70-plus offices in 10 states, it’s not as easy as it sounds. Especially the cybersecurity aspect of it.

Yes, we have firewalls and other gadgets and software watching our systems so I’m not the only guard at the virtual castle gate telling every visitor: “Halt! Who goes there?” But as 2020 showed us in perhaps the most dramatic way possible, our collective workplaces are no longer a physical place that can be defended by virtual fortifications.

Nor are they even like the Iron Ring of castles that King Edward 1st of England built to subdue Wales back in medieval times.

In 2021, the workplace can be anywhere and it can change not only from day-to-day, but even hour-to-hour. The old way of constructing permanent, impenetrable walls around our workplace computer systems is about as useful as Edward’s quaint old castles against a modern army using artillery firing high-explosive rounds.

The key to cybersecurity these days is to protect the data no matter where it is. So instead of focusing on building bigger and better walls, we should instead concentrate on protecting the messengers who carry the king’s missives between his castles and cities.

IT folks like me are already doing this, but the more I learn about how to protect these messengers from the brigands and bandits who lay in wait in the dark alleys off the information superhighway, the more I realize that just throwing more technology at the problem is NOT the answer. In my opinion, it may actually make matters worse.

Adding complexity to any system, means there are more things that can go wrong, and as we’ve learned time and again, hackers are adept at exploiting the tiniest of flaws they find in any system. Adding complexity also makes it harder for regular folks to use and understand it. Human nature being what it is, means that people will then try to find a “quicker and easier” and way to get their work done, often bypassing the thing that’s meant to keep them safe.

And that’s really the biggest challenge in Cybersecurity these days.

The weakest link has – and always will be – the human element.

The average person does not know (or really care) about how technology works. Most only want to know which buttons to press to get a particular task done. The rest to them is magic.

And therein lies the problem.

IT professionals like me need to help to demystify technology and help regular folks understand how the devices they have come to rely on work. I’m not saying the average Joe needs to know how to debug a kernel panic, install an operating system or even swap out a memory module before using a cell phone, sending a text message or ordering pizza or toilet paper online. However, they should be taught how to apply the same basic safety tips and skepticism they use in the real world to the virtual one so they can keep themselves safe.

I know this seems rather obvious, but then again, so does driving a car. The gas pedal makes it go, the brake pedal makes it stop and the steering wheel lets you make turns.

Every kid knows this.

Yet we’d never give car keys to a teenager on their 16th birthday and let them figure out the rest on their own. Instead, we make them learn the rules of the road from a (hopefully) more experienced driver.

And that’s what I want to do over the next 12 months with a majority of my blog posts. I want to help folks learn how to detect possible scams and view every online transaction with the same degree of suspicion they’d have if someone claiming to know them came up to them on the street and asked them for their house or car keys.

I’m hoping this can be an open and interactive discussion, so please feel free to ask any questions, no matter how basic they seem, in the comments below and I’ll do my best to answer them for you either in the comments or in the next month’s post.

Thursday, December 31, 2020

2020 hindsight

As this very unusual year draws to an end, I thought it would be a good idea to look back at the last 12 months and see what, if anything, we have learned.

The sad truth is I don’t think we’ve learned a thing.

I still hear people who think that the Coronavirus is no worse than the seasonal flu despite the fact that as of this writing, 334,029 people in the United States have died of it since Jan 21, 2020. In contrast, only 22,000 people died of the normal flu in 2019-2020 flu season. .

Yet despite all the evidence around them -- like over-flowing hospitals and a healthcare system on the brink of collapse -- I still see people asserting their “rights” not to wear masks or protesting government restrictions limiting large gatherings. To make matters worse, unscrupulous politicians are using this crisis not bring the country together, but to separate us into small tribes as if this were some sort of game.

This has left me feeling frustrated on a number of levels and makes me feel like the year 2020 is going to be the year that began the decline and fall of one of the greatest countries on Earth.

The United States was built on all of us being one, unified people. It’s right there in the pledge of allegiance we all recited as children: “one nation under G-d, indivisible, with liberty and justice for all.” Yet politicians seem bound and determined to divide us into small groups: red and blue, Democrat or Republican, liberal or conservative, snowflake or fascist.

For G-d’s sake, didn’t we fight a war over this 150 years ago? Does no one remember that famous Lincoln quote: "A house divided against itself cannot stand."?

The United States didn’t expand across an entire continent, help turn the tide in the world’s first mechanized war, survive a great depression, defeat fascist regimes bent on world domination and win a cold war, by turning against each other and fighting among ourselves.

On the contrary, we put on our big-boy pants, put aside our differences, and came together to fight whatever the current threat was. But today there seems no interest in this. All people seem to be interested in today is their own good. Screw the other guy, as long as they get what’s good for them, they don’t care what happens to anyone else.

This has never become more clear to me than the people who still refuse to mask up. “It violates MY rights,” they say. “I shouldn’t be forced to wear a mask.”

And they are right. They do have a right NOT to wear that mask. But to paraphrase the late, great Stan
Lee, “With our great First Amendment rights, comes great responsibility” and while some people are all about defending those rights, they forget about their responsibilities to their fellow citizens that comes with them.

Especially their responsibilities to keep their fellow citizens from getting sick.

Look, our rights do NOT let us do anything we want. The U.S. Constitution guarantees us to the right of free speech, but you can be damn sure that if I yell “Fire!” in a crowded theater (remember them?) that you’d be arrested for causing a stampede if not a few deaths.

Likewise, there is no law that says you have to wear any clothing if you don’t want to. But you still can’t go out in public naked, even if you find clothing gives you a rash or prevents your skin from breathing. You’d be arrested for public indecency. And what about my right to go around shirtless with nothing on my feet? I should be able to walk into any restaurant and get something to eat, right? So where is all the outrage over those “No shirts, no shoes, no service signs” I see posted on almost every eatery’s door?

Then, on top of all this disregard for our fellow citizens, we’ve suddenly turned our collective backs on another thing that allowed this country to excel: our reverence for science and the opinion of experts.

Our history is chockful full scientists, doctors and engineers whose inventions and discoveries helped change the world: Benjamin Franklin, Samuel Morse, Eli Whitney, George Washington Carver, Thomas Edison, George Eastman, Walter Reed, Philo Farnsworth, Robert Goddard, Benjamin Spock, Jonas Salk. Then there are others like Albert Einstein and Nikola Tesla who came to this country and became citizens because of the value our country placed on science.

But I’m afraid that wouldn’t happen today. If Einstein and Tesla were thinking of about coming to our country now, they’d probably be turned off by self-proclaimed, armchair experts who think that because they saw something on Facebook or spent 10 minutes Googling something, that they suddenly know more about science and engineering than they do.

It’s sad because I always thought that we were better than this. I always believed each new year would bring us one step closer to the shiny utopian future portrayed in “Star Trek” and not toward the bleakness of the Empire’s rule in the “Star Wars” universe.

But if 2020 has taught me anything, it’s that maybe it’s time to retire those rose-colored glasses and optimistic attitude I’ve always viewed the future with and start looking at it with a more skeptical eye.

I hope 2021 will change this attitude, but at the moment, I’m not counting on it.

Wednesday, November 25, 2020

Follow these online shopping tips to stay safe this holiday season

Cyber Monday is right around the corner and cybercriminals are gearing up to take advantage of unsuspecting people during the biggest online shopping day in the United States. It’s especially important this year, as many people will be foregoing their annual shopping trips to potentially crowded malls and stores to avoid the risks of contracting Covid 19.

As usual, cybercrooks will try to lure you into giving up your personal information like your credit card numbers, usernames and passwords, social security number and even date of birth by doing the following:

Creating fraudulent (but real-looking) web sites and email messages
Intercepting insecure transactions
Targeting computers that are not running the latest security patches, have minimal or no antivirus software on them or are already infected with malware.

Fortunately, with a little foreknowledge and some precaution, you can avoid many of these cyber-threats. Think of these eight steps recommended by IT security professionals, as the same type of common-sense things you’d do when shopping in person: like locking the car and putting away your cash or credit card when you’re done with your purchase.

Shop reliable websites and get there safely

If an offer sounds too good to be true, it probably is. Don't be fooled by the lure of great discounts from unfamiliar websites or companies you may not have heard of. Most likely they are fake! Use the sites of retailers that you know and trust, and get to their sites by directly typing a known, trusted URL into the address bar instead of clicking on a link. Also look closely at the names of the company and make sure they are who you think they are. Many scammers may try to fool you by misspelling or using a look-alike name of a better known company (for example Wallmart.com or Wal-Mart.com instead of Walmart.com or Amazzon.com instead of Amazon.com)

Beware of seasonal scams

Fake package tracking emails, fake e-cards, fake charity donation scams, and emails requesting that you confirm purchase information are another common tactic cyber criminals use this time of year. Treat every message you get like this as suspicious and use known, trusted web address instead of clicking on the links in these messages. If you don’t know the URL of a charity or company look it up and confirm it across several websites. Which leads us to our next tip:

Graphic courtesy of Kaspersky Labs https://www.kaspersky.com/

Conduct research

When considering a new website or online company for your holiday purchases, read online reviews of it on other websites to see whether others have had issue with them. Never trust the reviews on the company’s web site itself. You can use sites like Yelp.com, Better Business Bureau and Consumer Reports to help you rate shopping sites, while the Federal Trade Commission recommends using BBB Wise Giving Alliance, Charity Navigator, CharityWatch, and GuideStar to check out charitable organizations .

And remember, if a site looks suspicious, avoid it!

Think twice before clicking on links or opening attachments

Even if links appear to be from people you know, legitimate organizations, your favorite retailers, or even your bank, messages can easily be faked. Use known, trusted URLs instead of clicking on links. And only open known, expected attachments. If in doubt, use a phone number you know to call your bank, a store or your contact and find out if they really sent you that attachment. I you can’t do that and still are in doubt, throw it out!

Make sure your device is patched and up-to-date

Before shopping online at anytime of the year, you should always make sure your device, apps, browser, and anti-virus/anti-malware software are patched and up to date. Make sure automatic updates are turned on and periodically restart your devices to ensure that updates are fully installed.

Protect your passwords

Never reveal your passwords to anyone. Make them long, strong, unique, and use multi-factor authentication (MFA) wherever possible. MFA requires you to have a second device – most often a cell phone -- that a message can be sent to, to ensure it’s really you trying to log into some website and not someone who may have stolen your username or password.

Use different passwords for different accounts and don’t use the same passwords you use at home for work accounts and vise-versa. We IT pros know that doing that is cumbersome and it’s hard to remember all those passwords, but that is what cybercrooks count on! They know that if they crack one of your passwords they will often be able to gain access to all your other accounts as well!

To help you remember all those different passwords consider using a password manager such as LastPass or RoboForm to store all them. That way you only have to remember one master password. Better yet buy a small notebook like an old-fashion address book and write down all your usernames and password in that and always keep it in your desk at home.

And finally, don’t let your apps and websites remember your passwords. If your device is ever stolen or lost, whoever finds it will then have a record of all your usernames and passwords.

Check your credit card and bank statements regularly

These are often the first indicators that your account information or identity has been stolen. If there is a discrepancy, report it immediately.

If you have the option, turn on text alerts. Most banking apps and sites provide them and allow you to create alerts for things like transactions over a specified dollar amount or a daily text summary of your current balance. Getting these types of alerts can help you to spot signs of unusual activity before thousands of dollars are either charged or withdrawn from your accounts.

Lastly, check your credit report at least annually. The Federal Trade Commission provides information about getting free credit reports and what to do if you find discrepancies.

Secure your home WiFi

To prevent eavesdroppers and data thieves, ensure that you have a strong passphrase (12 characters or more with your wireless network set to WPA-2). Change your network’s name (SSID) from the default to something that does not obviously belong to you. Limit who has administrative access to your home network. Finally, log into your wireless router periodically to check for software updates (many home routers don’t auto-update).

Get savvy about WiFi hotspots and public computers. Treat all WiFi hotspots and public computers as compromised, even if they appear to be safe. Limit the type of business you conduct on them, including logging in to key accounts, such as email and banking, and shopping. And set your devices to “ask” before joining new wireless networks so you don’t unknowingly connect to an insecure or fraudulent hot spot.

Following all these tips may sound like a lot to remember, but they’re really no different than the precautions you’d usually take when planning a shopping trip to the mall during the busy holiday season. And they are certainly easier than trying to find that coveted parking spot close to the entrance in a crowded lot!