Secure your home network

Several years ago, creating a cybersecure home was simple; most homes consisted of nothing more than a wireless network and several computers. Today, technology has become far more complex and is integrated into every part of our lives, from mobile devices and gaming consoles to your home thermostat and your refrigerator. Here are four simple steps for creating a cybersecure home.

Your Wireless Network

Almost every home network starts with a wireless (or Wi-Fi) network. This is what enables all your devices to connect to the Internet. Most home wireless networks are controlled by your Internet router or a separate, dedicated wireless access point. They both work the same way: by broadcasting wireless signals. The devices in your house can then connect via these signals. This means securing your wireless network is a key part of protecting your home. We recommend the following steps to secure it:

• Change the default administrator password to your Internet router or wireless access point. (Whichever one is controlling your wireless network.) The admin account is what allows you to configure the settings for your wireless network.
• Ensure that only people you trust can connect to your wireless network. Do this by enabling strong security. Currently, the best option is to use the security mechanism called WPA2. By enabling this, a password is required for people to connect to your home network, and once connected, their online activities are encrypted.
• Ensure the password used to connect to your wireless network is strong and that it is different from the admin password. Remember, you only need to enter the password once for each of your devices, as they store and remember the password.
• Many wireless networks support what is called a Guest Network. This allows visitors to connect to the Internet, but protects your home network, as they cannot connect to any of the other devices on your home network. If you add a guest network, be sure to enable WPA2 and a unique password for the network.

Not sure how to do these steps? Ask your Internet Service Provider or check their website, check the documentation that came with your Internet router or wireless access point, or refer to their respective website.

Your Devices

The next step is knowing what devices are connected to your wireless home network and making sure all of those devices are secure. This used to be simple when you had just a computer or two. However, almost anything can connect to your home network today, including your smartphones, TVs, gaming consoles, baby monitors, speakers, or perhaps even your car. Once you have identified all the devices on your home network, ensure that each one of them is secure. The best way to do this is ensure you have automatic updating enabled on them wherever possible. Cyber attackers are constantly finding new weaknesses in different devices and operating systems. By enabling automatic updates, your computer and devices are always running the most current software, which makes them much harder for anyone to hack into.

Passwords

The next step is to use a strong, unique password for each of your devices and online accounts. The key words here are strong and unique. Tired of complex passwords that are hard to remember and difficult to type? So are we. Use a passphrase instead. This is a type of password that uses a series of words that is easy to remember, such as “Where is my coffee?” or “sunshine-doughnuts-happy-lost”. The longer your passphrase is, the stronger. A unique password means using a different password for each device and online account. This way, if one password is compromised, all your other accounts and devices are still safe. Can’t remember all those strong, unique passwords? Don’t worry, neither can we. That is why we recommend you use a password manager, which is a special security program that securely stores all your passwords for you in an encrypted, virtual safe.

Finally, enable two-step verification whenever available, especially for your online accounts. Two-step verification is much stronger. It uses your password, but also adds a second step, such as a code sent to your smartphone or an app on your smartphone that generates the code for you. Two-step verification is probably the most important step you can take to protect yourself online, and it’s much easier than you think.

Backups

Sometimes, no matter how careful you are, you may be hacked. If that is the case, often the only way you can recover your personal information is to restore from backup. Make sure you are doing regular backups of any important information and verify that you can restore from them. Most mobile devices support automatic backups to the Cloud. For most computers, you may have to purchase some type of backup software or service, which are relatively low- priced and simple to use.

Patch Tuesday Feb 2019

Microsoft on Tuesday issued numerous patches to correct at least 70 distinct security vulnerabilities in Windows and software designed to interact with various flavors of the operating system. This month’s patch batch tackles some notable threats to enterprises — including multiple flaws that were publicly disclosed prior to Patch Tuesday. It also bundles fixes to quash threats relevant to end users, including critical updates for Adobe Flash Player and Microsoft Office, as well as a zero-day bug in Internet Explorer.

Some 20 of the flaws addressed in February’s update bundle are weaknesses labeled “critical,” meaning Microsoft believes that attackers or malware could exploit them to fully compromise systems through little or no help from users — save from convincing a user to visit a malicious or hacked Web site.

Microsoft patched a bug in Internet Explorer (CVE-2019-0676) discovered by Google that attackers already are using to target vulnerable systems. This flaw could allow malware or miscreants to check for the presence of specific files on the target’s hard drive.

Another critical vulnerability that impacts both end users and enterprises is a weakness in the Windows component responsible for assigning Internet addresses to host computers (a.k.a. “Windows DHCP client”). That flaw, CVE-2019-0626, could let an attacker execute malcode of his choice just by sending the target a specially crafted DHCP request.

At the top of the list of patch concerns mainly for companies is a publicly disclosed issue with Microsoft Exchange services (CVE-2019-0686) that could allow an attacker on the same network as the target to access the inbox of other users. Microsoft said it has not seen active exploitation of this bug yet, but considers it likely to be exploited soon.

Security experts are fond of saying “patch now!” when it comes to Windows bugs, but in general it can’t hurt for regular users to wait a day or two after Microsoft releases monthly security updates before installing the fixes. That’s because occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out.

Just don’t put off the task too long. And bear in mind it’s a good idea to get in the habit of backing up your data before installing Windows updates, to hedge against the odd case in which a wonky patch ends up rendering your system unusable until you can work out how to reverse the changes.

Windows 10 likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update.

Microsoft also included fixes to address a single vulnerability in Adobe Flash Player. Microsoft and Adobe disagree on the severity of this flaw, according to security firm Qualys. Adobe labels it an “important” bug, while Microsoft tags it with a far more severe “critical” label. Regardless, Flash flaws are favorite targets of attackers. If you browse the Web with IE or Edge, this month’s patch batch from Microsoft has you covered.

Fortunately, the most popular Web browser by a long shot — Google Chrome — auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it (Microsoft also bundles Flash with IE/Edge and updates it whenever Windows systems install monthly updates). By the summer of 2019 Google will make Chrome users go into their settings to enable it every time they want to run it.

Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are here. Adobe will stop supporting Flash at the end of 2020.

Adobe also released updates for Adobe Acrobat and Reader that plug at least 70 security holes in these applications, so if you have either installed please be sure to update those.

As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.

Microsoft to end support for Windows 7 in Jan 2019

A new reminder for those who are still holding on to the Windows 7 operating system you have less than one year left until Microsoft ends support for its 9-year-old operating system. So it's time for you to upgrade your OS and say goodbye to Windows 7, as its five years of extended support will end on January 14, 2020.


After that date, the tech giant will no longer release free security updates, bug fixes and new functionalities for the operating system that's still widely used by people, which could eventually leave a significant number of users more susceptible to malware attacks.

However, the end of free support doesn't end Windows 7 support for big business and enterprise customers. As always, Microsoft does make exceptions for certain companies that are willing to pay a lot of money to continue their support.

According to a 'Death of Windows 7' report from content delivery firm Kollective, as many as 43% of enterprises are still running the nine-year-old operating system, of which 17% didn't know when Microsoft's end of support deadline hit.

Millions of Users Are Still Using Windows 7
Want to know how popular Windows 7 is among users? Even after aggressively pushing Windows 10 installations since its release in 2015, its market share finally managed to overtake the user-favorite Windows 7 just by the end of last year.

Windows 7 was released in 2009 and, according to December 2018 stats from Netmarketshare, is currently running on about 37 percent of the world's PC fleet, which is far ahead of its radically redesigned successor Windows 8 and 8.1 combined.

Microsoft stopped the mainstream support for Windows 7 in January 2015, but Windows users have continued to receive security updates and patches for known security issues as part of the company's extended support, which runs for at least five years.

In March 2017, Microsoft also started blocking new security patches and updates for Windows 7 and Windows 8.1 users running the latest processors from Intel, AMD, Qualcomm, and others.

"For Windows 7 to run on any modern silicon, device drivers and firmware need to emulate Windows 7's expectations for interrupt processing, bus support, and power states- which is challenging for WiFi, graphics, security, and more," the company said.

"The lifecycle begins when a product is released and ends when it’s no longer supported. Knowing key dates in this lifecycle helps you make informed decisions about when to update, upgrade or make other changes to your software."

Besides ending support for Windows 7 next year, Microsoft will also end support for MS Office 2010, Windows Server 2008/2008 R2, SQL Server 2008/2008 R2, Exchange 2010 and Windows Embedded 7 in 2020.

As for Windows 8, the operating system's extended support is set to end on January 10, 2023.

Data Privacy Day

Nearly every day is some kind of holiday or special observance at the local, state or national level. Some days are assigned to multiple causes.

Feb. 2, for example is Groundhog Day and Feb. 3 is the Super Bowl, an undeclared national holiday that’s always on a Sunday.

Data Privacy Day, which is Jan. 28, comes a few days before. It’s a less heralded observance that has become increasingly relevant in the digital era. The international observance is designed to increase public awareness of the importance of respecting privacy, safeguarding data and enabling trust.

The special day, promoted by the National Cyber Security Alliance (NCSA) has been observed in Europe since 1981 and in the United States since 2008. In 2014, Congress adopted a nonbinding resolution that expressed support for the observance.

Advances in high-tech fields such as automation and artificial intelligence, as well as old-fashioned criminal greed, have made digital data difficult to protect.

Transparency can help a company build trust. But, of course, transparency isn’t enough. Responsible businesses also recognize that they have a strong obligation to protect information about their customers and employees.

Among the resources available to help businesses enhance the security of electronic information is the NCSA-powered website, StaySafeOnline.org. The NCSA also supports “Stop. Think. Connect.” That’s a global campaign whose supporters include businesses, law enforcement agencies and the federal government.

Free information on the StaySafeOnline site includes a two-page technology checklist designed to help small and medium-sized businesses. The checklist addresses several general areas of concern, including the use of Wi-Fi, mobile devices, email and other digital tools.

The section on websites, for example, offers the following advice:

• Keep software up to date.
• Require users to create strong passwords.
• Prevent direct access for uploading files.
• Use scanning tools to test a site’s security.
• Register sites with spellings similar to your site.
• Run the most current versions of content management systems or require web administrator/hosts to do so.

As StaySafeOnline noted in a recent news release, people are living in an unparalleled age of technological growth. By 2020, there is expected to be more than four connected devices for every person in the world.

“As businesses learn to extract value from and utilize data at a deeper level, it is essential for companies to be extremely conscientious about protecting personal information,” according to the group. “For any organization, respecting consumers’ privacy is a smart strategy for inspiring trust and enhancing reputation and growth.”

StaySafeOnline encourages organizations to create a culture that values privacy. It also offers three simple tips to help businesses build a high level of trust:

• If your company collects data about consumers and employees, protect it.
• Be open and honest about how information is collected, used and shared.
• Do what you say you do.

Recent Facebook Data Breach

With the recent data breach at Facebook, highlighting the importance of knowing how to minimize the risk of cyber threats and how to respond if your personal data may have been compromised is very important to everyone.

On Friday, it was reported that approximately 50 million user Facebook accounts were impacted by a data breach. Facebook did not indicate if any user information was accessed.

The Office of Consumer Protection recommends the following best practices for consumers who use social media:

§  Change your password regularly, and always use a strong password.

§  When available, use two-factor authentication for login.

§  Refrain from using any automatic sign-in functions/features of social media accounts and applications.

§  Monitor your privacy settings and adjust as needed.

§  Remove birth dates, addresses, and phone numbers from your account information.

§  Carefully consider the information you post, recognizing that in the event of a data breach, it could end up in the hands of people intent upon stealing your identity or conducting other malicious activities.

Scammers who obtain the personal information of others may try to open new accounts or extort money from their victims. According to the office of Consumer Protection, there are several options for people to monitor their credit and keep their identities safe, including:

§  Don’t pay a ransom. Paying a ransom is an ineffective way of handling the exposure of your personal information. It’s best to focus on proactively securing your identity.

§  Consider a free security freeze. A security freeze allows you to “lock up” your credit information so no one can access it without your permission. A freeze prevents a thief from taking out a new mortgage, applying for a credit card, or getting financing with your identity. When you “freeze” your credit, it stays frozen for as long as you’d like – until you can comfortably “thaw” it once again.

§  Place a fraud alert on your credit. Fraud alerts are a special message you can place on your credit report. The alert tells credit issuers there may be fraudulent activity on an account. Fraud alerts last for 90 days; although they won’t stop a scammer from being issued new credit, they can slow them down.

§  Request a free credit report annually.  Reviewing your credit report is a great way to check for unauthorized activity.  Visit www.annualcreditreport.com or call 1-877-322-8228 to request your free annual report.

§  Credit monitoring services offer additional protection.  Credit monitoring services track changes in your behavior and send you notifications about your credit score and potential fraud. These services typically cost between $10 — $30 per month.

Spectre & Meltdown - What you should know

Security researchers revealed two more major software vulnerabilities that, in one way or another, affect just about anything with a processor. The flaws, called “Spectre” and “Meltdown,” can potentially allow hackers to steal encrypted passwords as you type them in. If Spectre has you spooked, read on to learn more about these vulnerabilities and what’s being done to fix them.

What are Spectre and Meltdown?
Both Spectre and Meltdown refer to variants of the same vulnerabilities, all of which many researchers are considering catastrophic due to their widespread nature. And, they’ve been given names to match the extent of their impact. Spectre refers to a root cause, or to something that is difficult to fix (and will haunt us for years to come!). Meltdown is used to describe the “melting of the security boundaries” that is occurring, since the bugs make the usual protections from hardware unenforceable.

The vulnerability was originally thought to only impact Intel chipsets. However, it’s far more complex and widespread: nearly all systems are affected, from desktops and laptops to mobile devices, across Intel, AMD and ARM processors. All memory data from running apps is potentially vulnerable: password managers, photos, documents and more. As one researcher told ZDNet, “an attacker might be able to steal any data on the system.”
Essentially, each vulnerability is a security flaw in nearly every processor built in the last 20 years. This means a vast number of systems – all those built with Intel, ARM, or AMD processors – will require a security update. The bug itself is linked to how regular apps and programs “discover the contents of protect kernel memory areas.” In operating systems, kernels act as the core component; tying together applications and data processing, memory and hardware. The flaw in the affected processors may allow hackers to maneuver around the processor’s kernel access protections, making the contents of the kernel’s memory vulnerable.

Just how bad is it?
The initial focus of the patches has been on personal devices. Numerous patches are already available, but researchers are still investigating the effect Spectre may have on cloud services,
where several organizations are sharing the same resources. There’s been some speculation about data vulnerabilities—where one cloud tenant may be able to access the data of another.
Consider the impact, across the cloud, with privilege escalation. The reality is, data could be stolen in any instance where tenants share the same chip in services such as Amazon Web Services (AWS) or the Google Cloud. Small to mid-size organizations are especially vulnerable here, since so many of them run their entire businesses on shared cloud services.

Regarding your personal computer, this is when a hacker could leverage Spectre essentially take over your entire computer. But before you panic, remember, there are other ways a hacker could do this today (without these newly discovered vulnerabilities), so frankly, it’s up in the air as far as how much your risk has increased.

What’s being done about it?
Software patches have been released one after the other to help reduce the risk. Microsoft released an emergency patch January 3 and Intel is issuing updates for all types of processors, starting with those new in the last five years. Apple has released three updates to protect Safari and WebKit. And, cloud service providers, such as AWS and Microsoft Azure, are all deploying patches as well, while they wait for third-party patches to roll in to complement their efforts. But to truly reduce the risk, updates will need to be released across all vendors, from Intel and AMD to anti-malware vendors whose software needs to work appropriately with the new patches.

There’s been much discussion among IT professionals about the impact that these updates and patches could have on system performance. Some speculate it could cause systems to dramatically slow down, and others say that if Intel processors are using Skylake or more recent architecture, the impact will hardly be noticed. If organizations do experience a noticeable slowdown in performance, it’s likely they are using older processors.

What you can do about it
There’s a few things you can do now to mitigate your risk. The following steps will help shield you from the Meltdown variant:
• If you use Chrome or Firefox, update to the latest versions
• In the meantime, for Chrome users, here’s an easy workaround: copy and paste “chrome://flags/#enable-site-per-process” into your browser, and click “Enable.” Site Isolation loads each individual website as a separate process, preventing other remote connections from hijacking otherwise safe sites.
• Be diligent about your Windows updates. Make sure update KB4056892 is installed.
• Regularly check with your PC manufacturer’s website to see if they’ve released any news or firmware updates.
• Wait and install third-party updates as they become available.

Rules for Securing Your IoT

Most people here have likely heard or read various prognostications about the impending doom from the proliferation of poorly-secured “Internet of Things” or IoT devices. Loosely defined as any gadget or gizmo that connects to the Internet but which most consumers probably wouldn’t begin to know how to secure, IoT encompasses everything from security cameras, routers and digital video recorders to printers, wearable devices and “smart” lightbulbs.

Throughout 2016 and 2017, attacks from massive botnets made up entirely of hacked IoT devices had many experts warning of a dire outlook for Internet security. But the future of IoT doesn’t have to be so bleak. Here are some basic rules for minimizing the chances that your IoT things become a security liability for you or for the Internet at large.

Avoid connecting your devices directly to the Internet — either without a firewall or in front it, by poking holes in your firewall so you can access them remotely. Putting your devices in front of your firewall is generally a bad idea because many IoT products were simply not designed with security in mind and making these things accessible over the public Internet could invite attackers into your network. If you have a router, chances are it also comes with a built-in firewall. Keep your IoT devices behind the firewall as best you can.

If you can, change the systems default credentials to a complex password that only you will know and can remember. And if you do happen to forget the password, it’s not the end of the world: Most devices have a recessed reset switch that can be used to restore to the thing to its factory-default settings (and credentials). Here’s some advice on picking better ones.

I say “if you can,” at the beginning of Rule #2 because very often IoT devices — particularly security cameras and DVRs — are so poorly designed from a security perspective that even changing the default password to the thing’s built-in Web interface does nothing to prevent the things from being reachable and vulnerable once connected to the Internet.

Also, many of these devices are found to have hidden, undocumented “backdoor” accounts that attackers can use to remotely control the devices. That’s why Rule #1 is so important.

Update the firmware. Hardware vendors sometimes make available security updates for the software that powers their consumer devices (known as “firmware). It’s a good idea to visit the vendor’s Web site and check for any firmware updates before putting your IoT things to use, and to check back periodically for any new updates.

Check the defaults, and make sure features you may not want or need like UPnP (Universal Plug and Play — which can easily poke holes in your firewall without you knowing it) — are disabled.

Want to know if something has poked a hole in your router’s firewall? Censys has a decent scanner that may give you clues about any cracks in your firewall. Browse to whatismyipaddress.com, then cut and paste the resulting address into the text box at Censys.io, select “IPv4 hosts” from the drop-down menu, and hit “search.” If that sounds too complicated (or if your ISP’s addresses are on Censys’s blacklist) check out Steve Gibson‘s Shield’s Up page, which features a point-and-click tool that can give you information about which network doorways or “ports” may be open or exposed on your network. A quick Internet search on exposed port number(s) can often yield useful results indicating which of your devices may have poked a hole.

If you run antivirus software on your computer, consider upgrading to a “network security” or “Internet security” version of these products, which ship with more full-featured software firewalls that can make it easier to block traffic going into and out of specific ports.

Alternatively, Glasswire is a useful tool that offers a full-featured firewall as well as the ability to tell which of your applications and devices are using the most bandwidth on your network. Glasswire recently came in handy to help me determine which application was using gigabytes worth of bandwidth each day (it turned out to be a version of Amazon Music’s software client that had a glitchy updater).

Avoid IoT devices that advertise Peer-to-Peer (P2P) capabilities built-in. P2P IoT devices are notoriously difficult to secure, and research has repeatedly shown that they can be reachable even through a firewall remotely over the Internet because they’re configured to continuously find ways to connect to a global, shared network so that people can access them remotely. For examples of this, see previous stories here, including This is Why People Fear the Internet of Things, and Researchers Find Fresh Fodder for IoT Attack Cannons.

Consider the cost. Bear in mind that when it comes to IoT devices, cheaper usually is not better. There is no direct correlation between price and security, but history has shown the devices that tend to be toward the lower end of the price ranges for their class tend to have the most vulnerabilities and backdoors, with the least amount of vendor upkeep or support.

One final note: I realize that the people who probably need to be reading these tips the most likely won’t ever know they need to care enough to act on them. But at least by taking proactive steps, you can reduce the likelihood that your IoT things will contribute to the global IoT security problem.

How to Get Your Employees Thinking about Cyber Security

Large scale cyber-attacks are, it seems, never far from the headlines these days and each event ought to serve as a warning to businesses alike. In September alone we have had four examples where we have been impacted by a data breach. Deloitte, SEC, Equifax, and Sonic among the organizations breached.

But, it isn’t just the big boys who are suffering at the hands of hackers. It’s said that 14 million small businesses in the US were hacked in the last year – which is about half of the total.

It’s a big threat for businesses, and that means you have to think about how these businesses can protect themselves. One of the most important things to remember is that security is a team effort. Your business won’t be secure if everyone doesn’t know how they can play their part. If you can get everyone thinking about cyber security—and appreciating the role that they can play—then that’s half of the battle overcome.

So, how can we get there?

Introduce processes

You need to introduce processes in your business that put cyber security at the forefront. Whether it’s the way you manage the passwords used to access your systems, the way in which you handle your paperwork to keep confidential data secure, or the way in which you deploy antivirus software and encryption to protect your systems and the data held within them, it all needs solidifying. Crucially, you also need to ensure that your processes are effectively communicated to every member of your staff and that there’s a clear structure in place for anyone to raise queries, report issues or suggest gaps in your defenses that need to be addressed.

Nominate people with responsibility

With that in mind, your processes will be most effective if they are introduced alongside a structure. This might mean nominating one person to take the lead on cyber security within your organization or, if you’re big enough, it might mean appointing a team of people. These people can monitor and review your processes, ensure they are implemented and be at the center of an effective communication strategy. By making responsibility clear, it helps to avoid a situation where employees all presume that it’s someone else’s job.

Training sessions

Once you have your structure in place and your process mapped out, it’s time to think about training. Every member of your staff should be clear on your cyber security strategy—but should also receive training on the nature of the threat posed by hackers online. It’s important that you know what you’re up against—and that the potential danger is spelled out so that people know that all of this isn’t being done for nothing. Effective training will definitely get your employees thinking and, hopefully, talking about cyber security.

Training, structure and process are the three main pillars required to get your employees thinking about cyber security. Together, they form the foundation of a business equipped to cope with the threats now faced online. So, implement this advice and see if your business is safer as a result.

Steps to Staying Secure

As technology continues to gain a more important role in our lives, it also grows in complexity. Given how quickly technology changes, keeping up with security advice can be confusing. It seems like there is always new guidance on what you should or should not be doing. However, while the details of how to stay secure may change over time, there are fundamental things you can always do to protect yourself. Regardless of what technology you are using or where you are using it, we recommend the following steps to stay safe.

First and foremost, keep in mind that technology alone will never be able to fully protect you. Attackers have learned that the easiest way to bypass even the most advanced security technology is by attacking you. If they want your password, credit card, or personal data, the easiest thing for them to do is to trick you into giving them this information. For example, they can call you pretending to be Microsoft tech support and claim that your computer is infected, when in reality they are just cyber criminals that want you to give them access to your computer. Or perhaps they will send you an email explaining that your package could not be delivered and ask you to click on a link to confirm your mailing address, when in reality they are tricking you into visiting a malicious website that will hack into your computer. This is how attacks such as Ransomware or CEO Fraud start. Ultimately, the greatest defense against attackers is you. Be suspicious. By using common sense, you can spot and stop most attacks.

Passwords: The next step to protecting yourself involves using a strong, unique password for each of your devices and online account. The key words here are strong and unique. A strong password means one that cannot be easily guessed by hackers or by their automated programs. Tired of complex passwords that are hard to remember and difficult to type? Try using a passphrase instead. Instead of a single word, use a series of words that is easy to remember, such as “Where is my coffee?” The longer your passphrase is, the stronger. A unique password means using a different password for each device and online account. This way, if one password is compromised, all of your other accounts and devices are still safe. Can’t remember all those strong, unique passwords? Don’t worry, neither can we. That is why we recommend using a password manager, which is a specialized application for your smartphone or computer that securely stores all of your passwords in an encrypted format.  

Finally, one of the most important steps you can take to protect any account is enable two-factor authentication. Passwords alone are no longer enough to protect accounts; we all need something stronger. Two-step authentication is much stronger. It uses your password, but also adds a second step, either something you are (biometrics) or something you have (such as a code sent to your smartphone or an app on your smartphone that generates the code for you). Enable this option on every account you can, including your password manager, if possible. Two-step verification is probably the single most important step you can take to protect yourself, and it’s much easier than you think.

Updating: Make sure your computers, mobile devices, applications, and anything else connected to the Internet are running the latest software versions. Cyber criminals are constantly looking for new vulnerabilities in the software your devices use. When they discover vulnerabilities, they use special programs to exploit them and hack into the devices you are using. Meanwhile, the companies that created the software for these devices are hard at work fixing them by releasing updates. By ensuring your computers and mobile devices install these updates,

Backups: Sometimes, no matter how careful you are, you may be hacked. If that is the case, often your only option to ensure your computer or mobile device is free of malware is to fully wipe it and rebuild it from scratch. The attacker might even prevent you from accessing your personal files, photos, and other information stored on the hacked system. Often the only way to restore all of your personal information is from backup. Make sure you are doing regular backups of any important information and verify that you can restore from them. Most operating systems and mobile devices support automatic backups. In addition, we recommend you store your backups in either the Cloud or on an external device offline to protect them against cyber attackers.

By following the steps above, you will go a long way to protecting yourself while leveraging the latest technology.  You will make it much harder for someone to hack you.            

Why Are We So Stupid About Passwords?

Yet another study has revealed that people are picking millions of weak passwords. Password management software vendor Keeper Security reviewed 10 million passwords that came to light in 2016 via data breaches and found that nearly one in six were "123456."

"If the media stopped saying 'hacking' and instead said 'figured out their password,' people would take password security more seriously." 

Keeper Security published a list of the top 25 most commonly used passwords, reporting that they account for more than half of the 10 million passwords it analyzed. How many countless hours have been lost by security experts attempting to share with friends and loved ones the optimal secrets for picking passwords or helping to set up password management software to ensure they never reuse the same password across multiple sites?


The latest analysis of leaked passwords shows that in recent years, unfortunately, little has changed when it comes to how most people pick their passwords (see Why Are We So Stupid About Passwords?). Part of the problem is perception, according to Khalil Sehnaoui, managing partner of information security firm Krypton. He says that the majority of what gets referred to today as "hacking" is really just attackers guessing passwords.

Not So Secret: '18atcskd2w'

One interesting finding from the Keeper Security study is that across 10 million leaked passwords, the 15th most used one was "18atcskd2w." In a list populated by numeric sequences, "qwerty," "passwords" and "google," that's an obvious anomaly. The prevalence of "18atcskd2w" was seen last year as well, after paid breach-reporting service LeakedSource in April detailed a February breach of Verticalscope.com that resulted in a dump of 45 million records relating to more than 1,100 websites and communities that the site runs, ranging from Techsupportforum.com and MobileCampsites.com to Pbnation.com and Motorcycle.com.


In the Verticalscope.com breach, 18atcskd2w was the second most common password used on the site. "What I believe happened is that these accounts were created by bots, perhaps with the intention of posting spam onto the forums," security expert Graham Cluley wrote in a blog post at the time.
Verticalscope.com subsequently confirmed the data breach, but it has yet to reveal the cause. Still, the organization reset all passwords and said that while it was "already using encrypted passwords and salted hashes to store passwords," it would also require users to follow stronger password rules, saying that "passwords now require a minimum of 10+ characters and a mixture of upper- and lower-case letters, numbers and symbols."

Stop Expiring Passwords

The service said it would also automatically expire passwords "to encourage more frequent password changes," but many security experts now say that forced password expiration puts users at greater risk. Indeed, last year, the U.K. government's National Technical Authority for Information Assurance, now the National Cyber Security Center, warned in its guidance: "It's one of those counter-intuitive security scenarios; the more often users are forced to change passwords, the greater the overall vulnerability to attack." It notes that related risks include users being more inclined to reuse passwords, write them down, base new passwords on old ones or to choose weaker, easier-to-remember passwords.


As a result, the NCSC noted it "now recommends organizations do not force regular password expiry. We believe this reduces the vulnerabilities associated with regularly expiring passwords ... while doing little to increase the risk of long-term password exploitation."

Spear-Phishing Success Continues

Training users to expect that their passwords will need resetting puts them at greater risk from spear-phishing attacks, which remain highly effective and low-cost ways for sidestepping both sites that secure passwords well and users who pick strong passwords. Take the Democratic National Committee, which was allegedly targeted by hacking teams sponsored by the Russian government that are often referred to as Cozy Bear and Fancy Bear. Thomas Rid, a professor of security studies at King's College London, noted in an October 2016 feature for Esquire that Fancy Bear targeted Gmail-using victims via spear-phishing emails that contained links shortened with the Bitly service that led to phishing sites designed to trick Gmail users into changing their password. In reality, however, the fake password-reset site was harvesting their passwords so attackers could use them to access their Gmail accounts.


Between October 2016 and May 2016 these attacks targeted 4,000 accounts and were wildly successful, with one in seven victims ultimately revealing their passwords, Rid writes. "Among the group's recent breaches were the German parliament, the Italian military, the Saudi foreign ministry, the email accounts of Philip Breedlove, Colin Powell and John Podesta - Hillary Clinton's campaign chairman - and, of course, the DNC."

The New PCI Data Security Standard 3.2 Refresher

The new and always evolving requirements make up the greatest changes – most of which do not go into effect until February 1, 2018:

• Section 3.3 is an updated requirement that clarifies that any displays of a primary account number (PAN) greater than the first six/last four digits of the PAN requires a legitimate business need.
• Section 3.5.1 is a new requirement for service providers only to maintain a documented description of the cryptographic architecture (algorithms, protocols, and keys) involved in their cardholder data environment (CDE).
• Section 6.4.6 is a new requirement for change control processes to incorporate verification of other PCI DSS requirements that are impacted by a change such as network diagrams, endpoint controls, and the inclusion of new systems into the quarterly vulnerability scan process.
• Section 8.3 has been expanded into sub-requirements to require multi-factor authentication for all personnel with non-console administrative access and all personnel with remote access to the CDE. This includes a new requirement, 3.2, that addresses multi-factor authentication for all personnel with remote access to the CDE and a new requirement 8.3.1 that addresses multi-factor authentication for all personnel with non-console administrative access to the CDE. In other words, we're going to start seeing a lot more multi-factor authentication.
• Sections 10.8 & 10.8.1 are new requirements for service providers to detect and report on failures of critical security control systems such as firewalls, anti-virus, and audit logging mechanisms.
• Section 11.3.4.1 is a new requirement for service providers to perform penetration testing on segmentation controls at least every six months.
• Section 12.4.1 is a new requirement for service providers whereby executive management must establish responsibility for the protection of cardholder data and a PCI DSS compliance program to include accountability and a charter to ensure the program is communicated to management.
• Sections 12.11 & 12.11.1 are new requirement for service providers to perform quarterly security program reviews and maintaining documentation and sign-off of those reviews.
• New Appendix A2 that outlines additional requirements for SSL/TLS, namely:
  • After June 30, 2018, stop using SSL/early TLS as a security control and use only secure versions of the protocol (i.e. TLS v1.2).
  • Prior to June 30, 2018, existing implementations that use SSL and/or TLS 1.0 and 1.1 must have a formal Risk Mitigation and Migration Plan in place.

There's also additional clarification in PCI DSS version 3.2 that directly impacts application security programs such as:

• Backup/recovery sites need to be considered when confirming PCI DSS scope.
• Added Testing Procedure (11.3.4.c) to confirm penetration test is performed by a qualified internal resource or qualified external third party.
• Training for developers must be up to date and occur at least annually.

A complete summary of all changes can be found in the document Summary of Changes from PCI DSS Version 3.1 to 3.2.