6 Easy Cyber Security Steps

Technology can be overwhelming. It can seem like you are doing your best to stay secure and safe, but every time you turn around, there is a new hack, breach, or leak of sensitive data. The Twilio hack is sure to impact a large number of users’ opinions of security.

The sky is not falling. Following some basic security principles can help protect you from most of the attacks you’ll find coming at you from cyberspace.

1. Use a password manager

One of the biggest security risks these days is password reuse. Major websites and services report massive data breaches on a shockingly regular basis. If you’re using the same email and password for multiple accounts, and any of those accounts leak, attackers can hack into your other ones using the information. If you need help with password creation, check out the Password Card.

Using strong, unique passwords for every account you own protects against one of them getting hacked –but memorizing a different random password for every website you create an account for is next to impossible. These tools can create strong randomized passwords for you, store the information, and automatically fill in login fields on websites and software. Browsers offer password management tools but should be avoided. Investing in a proper password manager is well worth it. How much is your security worth?

Do not store passwords on the native device. In the event, your account is compromised, the additional layer of security is the separation of encryption for your data. A separate password manager for access credentials provides a defense in-depth approach to your most sensitive data.

This guide to password managers can help you find the perfect fit for your needs.

2. Enable two-factor authentication

The FIDO Alliance’s U2F open standard allows USB key drives and other small devices to simplify 2FA.

Most major services now offer a two-factor authentication feature, especially if they handle more sensitive personal data. Turn it on whenever you can. If a hacker can get hands-on your username and password it is very hard to get your 2FA key or one-time password that will allow them a successful login.

Two-factor authentication requires you to confirm your account two ways before you can log in: with something you know and something you have. The “something you know” is your username and password. The “something you have” comes from an authorized tool in your possession. Usually, 2FA requires you to input a code that’s either sent to you via text message (AVOID!) or email when you try to log in on a device for the first time, or to grab a code from a supported 2FA app, or connect a security device devoted to account authentication. The exact method varies by service, and many offer several 2FA options. Without that code, hackers can’t break into your account even if they have your login information.

There are pros and cons to software VS hardware 2FA. Check this out here to learn more.

3. Use encrypted messaging apps

Privacy is the priority. With apps built around private communication, there is a reduction in the collection on you as a user. SMS is an easy way to communicate with friends, family, and co-workers but is the weakest of communications methods offering no security between you and the other side. Too many apps come as “free” but cost in our privacy.

Start by asking if your friends and family already use one somewhere else that you can join them. It’s easiest to make the change as something you control. If they don’t, ask them if they are willing to chat with you on a different method. Offer one of the apps such as Signal, Session, or Element. They still offer the same level of fun in a chat room but have a highly increased level of security.

The most important thing is you get away from SMS. The Simple Messaging Service is exactly that, simple. It offers little to no encryption, and as it comes from your Mobile Network provider, it is in their records and can be subpoenaed by the government or stolen in a hack. At the end of the conversation, if the other side won’t go to an encrypted messaging app, get them to something, not SMS. It’s important for your privacy and security.

4. Minimize what you do on a phone.

The phone is a massive data collection platform designed to monitor everything you do, when you do, where you do it, record it in a high level and detail, and then share it for “diagnostic” purposes. The majority of this data is possible to be turned off. It takes time and constant effort. The best way to minimize this is to cut back on what you do on your phone. Yes, you will have to give up a little convenience. If you need to check something, try using a web browser and avoid the App Store.

The goal is to avoid downloading apps from the App Store. We see malicious apps added to the App Store for apple and android all the time, and sometimes these apps will exceed 1+ million downloads before they are caught and removed. Apps come loaded with extra code that is not required to check the one or two things you might need. As users of mobile devices, we need to evaluate what we are doing on these devices and trim back.

Notes:

• You can add an ultra-light laptop to your travel kit, so you have some way to check what you need and minimize the collection a phone or tablet brings.
• If you must use the app.
  • Download it, do what you need, uninstall the app, and restart your phone.
  • If anything came with the app, it is hopefully gone now.

5. Separate your browsing habits.

Web browsers have weaknesses. Your best security is to have a couple of different ones and separate what you use them for. For example:

• Brave Browser – Banking, Email, Bills, Personal accounts, not social media.
  • 3rd Party Password Manager
  • Do not store passwords in the browser
• Firefox – Social Media Accounts, communication accounts, Google, or another highly tracked provider
  • 3rd Party Password Manager
  • Do not store passwords in the browser
• Edge, Opera, Safari – Browsing the web, Searching, New Websites, questionable websites.
  • No passwords or accounts.
  • Do not store information in the browser.
  • Set it to clear cookies and history upon exit. Dump as much data when you close.

In the above, possibly extreme, example we start with a very secure browser that we use only for websites we MUST protect. They are our most critical and generally more secure. When done, we close out and clear cookies to ensure the session is closed.
The second browser is secured and protects us from the tracking that these accounts are very good at. We block as much of the ad tech and scripts that chip away at our privacy. We use a password manager and ensure we are protecting our accounts with unique passwords.
In the final browser, we harden as much as possible. If you don’t want to use a 3rd browser, consider using incognito mode with all plugins disabled and set your settings for security to the max. It takes a little effort each time, but your privacy is worth it.

6. Use a VPN

An easy way to protect yourself is to get a VPN. They have a number of features to protect you from viruses and adware, online tracking, and other threats. Read more about VPNs HERE.