10 Things Security
Experts Wish End Users Knew
Introduction
Security is an essential business operation more than
ever before. However, without end users improving their knowledge base and
behaviors, the technology that an organization deploys is insufficient. In this
white paper, I would like to discuss ten things that security experts wish end
users knew. The more users understand about risk and consequence, the more
likely they will adjust their behavior and assist with supporting security.
These concepts are concerns that security experts want you to know. We all know
that users are the weakest link. Please review and provide your thoughts in the
comments.
Software Updates
Should Be Installed Promptly
Security experts want you to know that software updates
should be installed promptly, but not blindly. Just because a vendor has
released an update does not mean it should be taken as a sign to install the
update instantaneously. The new code you would be adding to your system could
be flawed or could cause unexpected results in your system that the vendor did
not predict. Thus, under no circumstances should you install new updates before
testing them and learning from others.
Always test new updates on dedicated test systems. Then,
work through all major work tasks to ensure that the changes to the lab systems
do not interfere. Next, review any comments, reviews, or feedback available
about the update from others. You are unlikely the first person to consider
installing a new update. Thus, learning from the experiences of others can save
you from downtime and repair headaches. Once you are satisfied that an update
is reasonably safe and appropriate to install, take one more precaution: back
up your target systems. With a system backup, if the worst happens and the
update process fails, the update corrupts your system, or new unforeseen
consequences arise, you have a path to restore your environment back to a
functional state.
To be even clearer, software updates should be installed
promptly without skipping testing. In most cases, running the most current and
complete set of code available will provide you with the most security form of
the product. When updates are delayed or skipped, flaws will remain in your
environment, which can be discovered and exploited by attackers.
Account
Authentication Strength
A regular occurrence in technology news is a story about
yet another person’s account being hacked through the use of a password
compromise attack. What is so frustrating about many of these stories is when
the victim’s password is revealed to be something short, simple, and easy to
remember. What security experts want you to know is that a password can be made
securer with just a few basic steps:
1. Make your password longer. Twelve characters is a
reasonably secure length, assuming you follow other good password practices.
2. Use complexity. Use three or four character types:
uppercase, lowercase, numbers, and when possible, symbols.
3. Do not reuse the same or a variation of a password.
Ever. Not on the same site and not on different sites.
You can further improve your online password security
through the use of a credential manager, such as LastPass, KeePass, or
Dashlane. These will enable you to generate random passwords with the maximum
length allowed on each and every site, while securely storing those passwords
for you.
It is also important to use the two-step or two-factor
authentication offerings from an online site. A growing number of websites now
support multi-step authentication. You should enable this feature. While it
initially will be cumbersome, once you become familiar with the process, it
will make your online account significantly securer. Once you have secured your
online accounts to stronger passwords and/or multi-factor authentication (where
available), you can rest easier knowing that the media haranguing about another
account compromise will be even less likely to actually affect you.
All Software Has
Flaws
In the highly competitive marketplace of computer
software and related technologies, you often hear marketing and advertising
messages claiming their product is secure or at least securer than some other
product. Often these product slingers want you to believe that, just by
installing their solution, all your security worries will disappear. What
security experts want you to know is that there are no perfectly secure systems
and all software has flaws.
Software is written by humans (at least for the most
part). Humans are imperfect and they regularly make mistakes. When those humans
are writing software code, they are inevitably going to make mistakes as they
type the code. Some of those mistakes will be typos, others will be logical
flaws, while still others will be errors of omission or oversight (such as
failing to prevent an unwanted event rather than just planning for only
expected ones). As a software product grows larger and as more programmers are
involved in its development, the likelihood of errors making their way into the
final version is almost guaranteed.
A modern server operating system can include over one
hundred million lines of code written by hundreds of programmers. While
testing, auditing, and reviewing are often performed, it is just not feasible
to track down and correct every single issue. For a software product to be
perfectly secure, all errors and logic flaws need to be discovered and removed.
For a software product to be vulnerable, only a single error or oversight needs
to be left in the code. Attackers only need a single vulnerability to exploit a
system. At some point, the process of debugging code becomes too expensive.
Once a vendor decides they have reached the point of exhausting the
cost-effectiveness of their debugging process, they hope that they have
discovered and resolved the easy-to-exploit issues and left behind only those
that are difficult to detect and exploit. However, we, as the software-using
public, know this process is not perfect as we are constantly installing
updates and still experiencing breaches.
An important takeaway from this issue that all software
has flaws is to use a multi-layered defense strategy. Rather than using a
single product or even multiple products from the same vendor, we should use
multiple products from multiple vendors to have overlapping security
protections. This defense-in-depth approach will minimize the chance that a
single flaw in a single product will result in the compromise of the entire
organization. Instead, the attackers will need to find a complex gauntlet of
flaws, which in turn makes it more likely their attack efforts will be detected
and thwarted long before they are ultimately successful.
Every Internet
Interaction Should Be Encrypted
In a world where you now know that the NSA and other
international government entities are actively monitoring Internet activity,
and where criminal organizations are lurking to find new victims, the fact that
we will perform most of our online activity in clear view form is absurd.
Security experts want you to know that you need every Internet interaction to
be encrypted. The only way to combat Internet eavesdropping is to encrypt your
packets.
Having every communication over the Internet be encrypted
is not automatic or guaranteed. But with a few simple steps, you can encrypt a
majority of your online communications. First, start using Chrome, Firefox, or
Opera as your Web browser with the plugin from Electronic Frontier Foundation’s
(EFF) HTTPS Everywhere (https://www.eff.org/Https-Everywhere). This browser
extension converts every URL you click or type from a plain-text HTTP link into
one requesting the TLS secured HTTPS version. Only if the server is unable to
offer an HTTPS response will you fail back to standard plain-text HTTP.
Second, for every other service you use, such as email,
file transfer, or even newsgroups (USENET), use the TLS encrypted connection
option provided by the server. This usually requires that you have a software
client on your system rather than using the web interface for these other forms
of online communication. When a service offers secured connection options, they
typically include a how-to guide that helps you through the configuration
process.
Third, use a VPN. There are a wide range of free and paid
VPN services online these days. Find one you like and use it. Especially, when
using wireless connections outside of your own home or office. That includes
Wi-Fi networks as well as mobile network operator networks. Setup the VPN to
operate on your home systems, your notebook/laptop, tablet, and smart phone.
Use it always.
The Cloud Is Not a
Security Silver Bullet
Cloud services are the new technology addiction for
companies small to large. Almost every major product vendor is offering cloud
services or cloud extensions or cloud access or cloud enhancements. Security
experts want you to know that the cloud is not a security silver bullet. Having
another organization perform a service for you or offer a product to you that
you could do yourself internally might be a good idea. Other organizations may
be better at offering technical support, running websites, or performing
accounting. Leveraging the skills and expertise of others is an important part
of the business world today. It can be cost-effective and efficient. But it is
not necessarily securer.
It is important to keep in mind the truth behind the
marketing phrase "the cloud" or "cloud services." There is
no cloud. There is no floating collection of magical Internet architecture
hanging majestically in the stratosphere just waiting to offer you newfangled
capabilities and throughput. Instead, the cloud is just remote virtualization.
In other words, the cloud is a collection of computer systems located in some
warehouse which run virtualization solutions in order to host numerous
operating systems and relevant software products. The resources and
capabilities these warehoused computers support are then sold off to customers
in a remote-access / remote-use concept under the label of "cloud
services."
Thus, being a cloud solution does not automatically make
it a securer option than what you could have created inside your own building.
You are dependent upon the cloud vendors’ security design, expertise, and
experience. If they did a poor job of implementing logical and physical
security, then that can directly and negatively affect your data and
communications hosted on their systems. Always thoroughly investigate a cloud
provider’s track record and security policy before placing the core of your
organization at risk.
A Hacker Is Not a
Criminal, Criminals Are Criminals
It has become a standard and regularly occurring news
story to discuss attacks and security breaches of both individuals and
organizations that are attributed to hackers. Security experts want you to know
that a hacker is not a criminal—criminals are criminals.
A hacker is anyone who invests time and effort into
thoroughly understanding a system, solution, or device. A hacker often
disassembles and reassembles, while making adjustments and modifications to
learn how the system reacts or changes based on those changes. A hacker can be
thought of as an enthusiast. A hacker might focus on learning and
understanding, improving and adjusting, or finding flaws and holes that need
addressing.
The problem is when someone uses the term hacker to
always mean a criminal or malicious hacker. Without proper context and
explanation, the term hacker can cause confusion as well as place blame on
those who are innocent. With the terms criminal and attacker, it is direct and
obvious that the individual being referred to is violating a company policy
and/or a law. But with hacker, that is not necessarily obvious. If people who
consider themselves hackers violate polices and the law, then they have become
a criminal. However, if they stay within the confines of company policy and
legal restrictions, then they are still just hackers. It is good practice to
use a distinct qualifier when intending to use the term hacker for the purposes
of referring to a criminal, for example an unauthorized hacker, unethical
hacker, malicious hacker, or criminal hacker.
Ultimately, hackers—especially the ethical ones, not just
the criminal ones—help make technology securer. Just because hackers know how
to bypass security or break a system does not mean they intend to do so nor
that they have the intention of causing harm. Many security researchers are
effectively hackers. Most product vendors have code reviewers, auditors, and
internal testers, all of which are a form of hackers. By discovering and
understanding the flaws and mistakes in technology, those concerns can be
patched or otherwise addressed. Hackers have the ability to think in odd and
unexpected ways: they don’t have to follow the logic of the computer program;
they can make unexpected assumptions or take unpredictable actions. This
freedom to examine technology without being forced to abide by its rules helps
hackers understand and ultimately improve that technology.
New Is Not
Necessarily Secure
New software solutions and hardware products are
announced at an ever more fervent pace than before. Many tout their improved
reliability, efficiency, and security. But before you spend your money or place
your trust in some cutting-edge technology, security experts want you to know
that new is not necessarily secure.
The primary issue or concern with new products is that
they have not had sufficient testing performed against them. Products that have
been in the marketplace for years have had more time to be improved and
matured. The new product may have modern features and faster performance, but
until the world community has had the opportunity to use, abuse, and hack it,
the measure of its security has yet to be taken.
Another aspect of the new is not necessarily secure
thinking is that many new products may come pre-infected with malware or have
known security holes. For example, in early 2015 it was revealed that a wide
range of Lenovo laptop models were "pre-installed" with Superfish (a
vulnerable adware product). It is not the case that computer technology becomes
less secure over time. Instead, most technologies become securer over time as
flaws are discovered and patched. However, once the vendor ends support for a product,
it then begins to revert back into a less secure product. For example, public
support for Windows XP ended on April 8, 2014, and as new flaws were discovered
and exploits created for that OS, the security that Microsoft had integrated
into one of its most popular OSes has been degrading ever since that date.
Another nuance in this area relates to the updates to
your operating systems, updates for installed applications, and firmware
updates for hardware products. In most cases, installing updates promptly is a
good security practice. But what often is overlooked is the essential need to
test and evaluate those updates before blindly installing them into a
production system. Just because new code is released from a vendor does not
guarantee that it will prevent it from introducing new problems to your
systems. These problems could interrupt mission critical business tasks or
otherwise make your system unusable. Always test new updates on lab systems
before installing them onto production equipment.
Computer Attacks
Are Rare But Overly Emphasized by the Media
It is easy to be worried and frightened by the worst
computer-based criminal attacks, but these attacks are rare. But due to our
fight-or-flight-tuned brain, we often over emphasize the unlikely threats and
under appreciate the more likely ones. Security experts want you to know that
serious computer attacks are rare, but they are over emphasized by the media.
Large-scale, massively damaging cybercrimes make for great headlines and
attention-grabbing thriller plot lines, but they are very rare in comparison to
more mundane exploits.
Most of the issues we should be concerned about are using
poor passwords, sharing too openly on social networks, and using plain-text
Internet communications. The chance that an attacker will figure out your
password, attempt to scam you through email, or eavesdrop on your Internet
activities is much more common than having your identity stolen, your
retirement accounts being emptied, or your car remotely controlled by an
attacker. Plus, with just a few simple actions on your part, you can reduce
these common threats. Making stronger passwords and encrypting your Internet
connections were covered earlier in this paper. How to be securer online in
general online, especially with social networks, is detailed in my white paper
"How to Secure Online Activities."
Take steps to reduce your risks on the more common but
less dramatic concerns. Then, calm you fears over the massive cyber terrorism
plots you hear about from TV, movies, or the media. They are much rarer than
you are assuming, and you are an unlikely target. Sorry, but unless you are
Warren Buffet, Elon Musk, or Richard Branson, you are just not worth the
effort.
There Is More to the Internet than What Google Can Search
Most of us experience the world through a social network
and Google. We think that we can learn anything or locate something just by
typing in a few keywords for a search. Well, think again. Security experts want
you to know that there is more to the Internet that what Google can search.
Google and other search engines use automated spiders or
robot website crawlers (both a form of web browsing software) to retrieve
information about websites. This information is then stored and indexed in
their massive databases. When you perform a search, your keywords are used
against this collected dataset to produce the results from which you select and
click to traverse to the original source. However, due to website design,
authentication requirements, or web crawler restrictions (such as robots.txt),
search engines are not able to travel to all possible web pages.
There is also a plethora of other content that is not web
based and thus is not able to be indexed by a web-focused site crawler. This
non-searchable content is known as the Deep Web. This can include file stores;
older Internet communication concepts, such as gopher and USENET; as well as
custom content and temporary/temporal content.
While most of what we search for is part of the surface
web (i.e., the part of the web that is search engine indexed), often once we
click on a search result and dive deeper into the visited site, we may be
encountering a part of the Deep Web (i.e., content that is not searchable). To
learn more about the Deep Web, a quick surface web search will lead you to
numerous articles and how-to guides if you want to go Internet spelunking.
Keep in mind that the Deep Web is a separate concept from
that of the Darknet. The Darknet is the collection of computers and services
that cannot be accessed (at least not directly) from the Internet as any
standard website or service can. Instead, special VPN or anonymization services
must be used to gain access. Examples of Darknet Services have included
Silkroad and Agora Marketplace. Often these Darknet Services are by invitation
only or are exceedingly challenging to locate. One popular access portal to
some Darknet Services is Tor (https://www.torproject.org/). However, this does
not mean Tor is only used for Darknet access or only questionable purposes—it
is just a tool.
Social Engineering
Protection and Physical Security Are Just As Important As IT Security
Security is an essential business task. But it also an
essential concern for individuals. It should be a company policy, and it also
should be a personal lifestyle. Security experts want you to know that social
engineering protection and physical security are just as important as IT
security. IT security, a.k.a. technical and logical security, are all of the
computer hardware and software components that we commonly associate with
improving online security, such as encryption, firewalls, authentication, logging,
intrusion detection systems, and deep content inspection. However, IT security
is just one aspect of organizational and personal security. It is essential not
to overlook social engineering protection and physical security. Without all
three of these security efforts, your protection infrastructure is incomplete.
Social engineering protection is the attempt to limit or
restrict the ease by which an attacker can take advantage of you through cons,
scams, or hoaxes. Social engineering attacks can occur in a face-to-face
encounter, over the phone, through email, or through text messages. Being aware
that such attacks are possible and being on guard against them is the first
step to being securer. You need to avoid the trap of automatically trusting everything
that is online or electronically delivered to you. All communications can be
falsified or spoofed. So, take the effort to verify identity before you depend
upon your assumptions.
Physical security is also important. Even with the best
IT security money can buy, if your equipment is damaged by a flood or fire or
stolen during a facility break-in, your data is still in the hands of
attackers. Keeping doors locked, using locked containers or tethers, tracking
visitors, and using video recording systems will help improve physical
security.
Paying attention to security means sufficiently
addressing logical, social, and physical security concerns. Only through a
well-designed and balanced effort will a security infrastructure withstand a
multitude of attack attempts.
Conclusion
Security is complicated. This has led to the many
misconceptions and misunderstandings about security. By paying attention to
these ten concerns that security experts want you to know, you can gain
knowledge and understanding about security and be securer both at work and in
your personal life.
