Cyber Security For All

Apetech Website: https://www.apetech.me/social

https://anchor.fm/apetech/message

Email: [email protected]

Twitter:  @apetechda

Backing up your data and all critical information is a great hobby you should get into. Whether you are backing up monthly, weekly, daily, or hourly, you should be backing up your data. You never know when you are going to have a hard drive failure, physical damage, natural disaster, or a cyber attack. All the data that you create on a day to day basis should be protected and backed up that way when disaster strikes, you can sleep in peace knowing that your data is safe and secure. But is backing up your data on a schedule enough? Let’s explore the concept of off-site backups.

The concept of off-site backups should be self explanatory. There are many ways to backup your data. You could go out and purchase an external hard drive and manually (or automatically) backup your data. This is a great, easy, and somewhat cheap solution to backups. But, while your data may be safe from a cyber attack on your network, what if the hard drive fails or worse, it catches on fire. It is not enough to just back up your data to an external drive, you should take an extra precaution and store that external drive, and in my opinion have multiple copies, in a different location. For example, you could keep a hard drive locked up in your drawer at work. Or you could keep the drive at a relatives house. If your data is that valuable, you could get a safety box at a bank and keep it there. Whatever your solution, having an off-site backup means that when tragedy hits, you will most likely have a reliable way to get your data back. The only downside to this is that since your drive is physically not with you, it becomes harder to do continuous backups.

Other solutions may be to use a public cloud like Dropbox, Box, or Amazon Drive. All these solutions are remote, they typically offer some sort of 99% up time, and they worry about physical failures for you. You pay a monthly or yearly fee, but all your data is automatically backed up and secure in a remote location. This option is great because you can have a scheduled backup, but it can get very expensive if you have too much data. Those storage plans can get pricey. My recommendation would be to have your utmost important data in both locations. Maybe you can live without backing up your 50 GB games, but your pictures from your wedding, those should probably be on the cloud and in an external hard drive.

Whatever strategy you pick, just make sure you have one. The number of people out there not backing up their data is mind blowing. Even if you are backing up your data to external drives, make sure you take a copy every once in a while and store it somewhere else. It’s always best to be prepared than to regret not having taken action when you had a chance. Be smart, backup and store off-site.

Apetech Website: https://www.apetech.me/social

https://anchor.fm/apetech/message

Email: [email protected]

Twitter:  @apetechda

Tabletop exercises are a great way to practice your security processes. If you are like most businesses, you can’t really afford to have your network go down or worse; lose your data. Many businesses have security processes in place that allow them to recover from an event. These events may be natural disaster based or cyber attacks. Depending on the type of business you have, there are different levels of recovery that are required. A tabletop exercise is a great way to practice your security policies without actually compromising your network or data. There are a couple of reasons to perform this practice. The biggest reason is that it lets you walk through the recovery plan that you have put in place. This is critical because it allows you to validate if your plan will work when you need it. If you do not ever practice your recovery plan, you will not find gaps in it until it is too late. By practicing a tabletop exercise, it gives you the ability to poke holes in your process and validate if your original plan works or not.

Tabletop exercises are not just for businesses. Anyone can create a plan for their home network and personal data. In fact, there really is no reason why you should not have a recovery plan for home. Once you have a recovery plan in place, you can then practice the tabletop exercise. I will not go into much details about what should be in your recovery plan as that is a topic for its own independent article, but some things to consider are documenting your data backup plans. How you detect intrusions to your network. Your important programs, services, and data should be well documented and if possible, you should have a remote location for a backup of all your data and configurations. Once you have all that information documented, you also want to document your process for recovering from an attack or loss. If you need to replace physical hardware, you should have either extras available, or at least documentation for how to replace those physical assets. Things that come to mind are hard drives, routers, switches, any other physical items that are part of your network or store your data.

With your recovery process in hand, it is time to actually walk through the plan in a typical tabletop exercise. Start by getting everyone together that needs to be a part of your recovery. Everyone that has a role to play should be present and they should have a copy of the recovery plan. Partaking in the tabletop exercise is straight forward. You go line by line and people act out their part. They pretend to do the action being requested with hopes of either finding gaps in the process or confirming that their plan will work. This is a great way to see how well you are set up to recover from an intrusion without actually breaking your system. You should go through your recovery plan any time you add to your network or at least every six months. Participating in a tabletop exercise should become second nature. When an actual attack does occur, the only thing in your head is worrying about the money being lost due to your services being down. This can cloud your judgment and your technical abilities to recover. By having practiced your actions, it can reduce some of the stress encountered when trying to actually recover a system.

Apetech Website: https://www.apetech.me/social

https://anchor.fm/apetech/message

Email: [email protected]

Twitter:  @apetechda

Ransomware is starting to gain more mainstream attention as media attention increases. Ransomware is a different, yet familiar type of cyber attack that can happen to just about anyone. Ransomware is when someone takes hold of your valuable data and then they demand that you pay them, typically in some sort of digital currency, if you want your data back. For businesses, this can be detrimental to them because they literally lose access to all their customer data, financials, etc. A few years ago, many hospitals in the United Kingdom fell victim to this type of attack. Hospital records and other pertinent confidential information was held captive, bringing the hospital networks down to a halt. Individuals are not immune to this type of attack. The only difference is that most individuals do not create the type of valuable information that attackers are looking for. This is mainly why ransomware attacks go after government entities, small and large businesses, but anyone can become a target. Everyone should protect themselves from ransomware, regardless of the type of data you have.

Before we go into how to protect yourself from a ransomware attack, let us first discuss what you can do today to reduce the risk of losing your data. Ransomware attacks typically encrypt the location of where your valuable data is stored. Usually this is the hard drive, or server environment for a business. The attacker will make a demand for money or something of value to them in exchange for freeing your data. Keep in mind that the attacker does not have to release your data, even after a payment is done. So, what can you do to protect yourself? The most simple solution is to backup your data. There are many different methods and strategies for backing up your data. Most large businesses have plans in place to backup their data, but small businesses and individuals do not typically have any kind of backup discipline set up. How often you backup your data is really up to you and the level of risk you want to carry. Having backups is a good practice even if you are not trying to protect yourself against cyber attacks and other non cyber attacks such as hard drive failure. At the very minimum, you should be backing up your data once a week. There are many software solutions out there that make this possible, so do some research and pick your favorite. If you are creating data on a day to day basis for yourself or for your business, then I would recommend you backup every night. If the data you have is extremely valuable, then hourly backups might be the way to go. While backup up your data does not protect you against a ransomware attack, it at least allows you to recover without falling victim to the demands brought forth by the attacker.

As far as actual protection from ransomware, there is no easy solution. You need to protect yourself in layers by using safe passwords, encrypting your hard drives, not falling victim to phishing attacks. You need to be a good steward of cyber security at all times. There is no fool proof way to protect yourself from a ransomware attack. You just need to remain vigilant and backup your data!

Apetech Website: https://www.apetech.me/social

https://anchor.fm/apetech/message

Email: [email protected]

Twitter:  @apetechda

After watching a few Tik Tok videos on a Saturday night, I noticed there was an alarming trend being showcased by the social media platform. In an interest to pique an audience’s interest, there are videos being made about people finding USB drives out in public places. The person in the video finds the drive, takes it home, puts it in their computer, and then proceeds to check out the contents of the device. From a security perspective, this is a horrible idea. Don’t ever plug in a USB drive that you find out in public into your computer. If you are going to be plugging in the device into a computer, make sure it is one that is not connected to your network and preferably a computer with no data other than the core OS on it. That way, if and when things get corrupted by the malicious payload on the USB drive, your data and network are not compromised.

Compromising your data or network is not difficult to do once you introduce a bad actor into your home. Most of the time, hackers have to figure out a way to get on your computer or network. This is the challenging part because once you have access, everything else is much easier given the array of software available to both white and black hat hackers. Inserting a USB drive you find on a public bus is a super easy way to get on that computer with minimal effort required. It may sound like a fun thing to try to do or if you are generally just curious about the contents of the drive, but do yourself a favor and don’t put that USB drive on your personal computer. This does not just apply to your personal life. Businesses are also vulnerable to this attack and quite frankly, it might be easier to pull off as an employee. For example, imagine you are walking to the office after parking your car. As you approach the building, you notice a shiny object on the floor. Clearly one of your coworkers dropped their precious USB drive. The next initial reaction is to plug it in and try to find out who it belongs to. This is a very innocent action from a coworker that cares. This type of behavior is exactly what an attacker wants to happen. They want you to take that USB drive and plug it into your work computer. Then, there goes the company network infected with the malicious payload. I know it is a bit of an exaggeration but the threat is real!

Being a good samaritan isn’t always a bad thing. As mentioned earlier, the right thing to do is to turn in the drive to your local security office. If you are at home and you really want to find out what’s on that drive, plug it in to an isolated computer that has nothing on it. Be on the lookout for suspicious red flags such as the name of the drive or the contents of the drive. But, if you can avoid it all together, just get rid of the USB drive. Compromising your private network or data isn’t worth the hassle of figuring out how to get everything back to normal.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

Steganography is the subtle art of hiding information out in plain sight. It is a fascinating way of transmitting messages and other digital data out in the open without the risk of getting caught*. Data can also be encrypted to help add an extra layer of security. Almost any type of digital media can be used to hide any digital message. This sounds all very covert and spy-like, but what does this have to do with cyber security? Let’s dig a little deeper into what steganography is at a fundamental level and then we’ll make the correlation back to security.

The fundamentals of steganography are pretty simple. You take a message that you want to send to another person. Rather than sending the message in plain text, you hide the message in an image or any other type of digital file. How does this work? If you’ve ever done any web development or worked with colors, you may recall that every shade of color is created by manipulating the values for red, green, and blue. If you change the value of just one of those colors, then you essentially still have the same color to the naked eye, but the digital value behind it is now different. By manipulating the values in an image, you can embed something else. In the case of steganography, you would put your secret message there. The information is basically useless unless you have the key to translate the message back to the original language. Anyone else that intercepts the message has no idea what they are looking at. Even if they try to reverse engineer the message, without the key, it’s very difficult to figure out what the hidden message is.

How does this simple and effective way of hiding messages relate to security? Messages is the perhaps the simplest use case for steganography but malicious hackers can hide malicious code in their messages. There are various programs that facilitate the creation of steganography based messages. The use of these programs makes it super simple to send someone an image that contains a malicious piece of code which then can compromise a computer when the end user opens the picture. Since the image looks like any other image, and it has characteristics like any other image, most software designed to protect you from malicious attacks is ineffective. As you can see, this poses a rather difficult situation for white hat hackers because it is much more challenging to defend against an attack that you cannot see. With that said, there are however some ways to protect yourself.

When receiving any file from anyone, make sure it is from a trusted source. If you did not request something, even if it appears to be harmless, question the validity of the item. It could be containing a dangerous payload that could cause serious damage to you and your data. If you are interested in learning more about steganography, I recommend you do some research. There is a lot of technical information out there that goes deeper into the algorithms used to create, distribute, and access the hidden data. Stegeneography has been around for centuries and its style has only evolved. The concept is still the same, but the means to deliver the message has obviously changed with time. Steganography is an interesting way to stay covert and share information with anyone.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

Ever get a suspicious email with a link to change your password?  If so, you'll want to listen to this entire episode!

We are going to talk about Phishing attacks and how to protect yourself from falling victim of an attack!

Several states started issuing shelter-in-place directives, which basically stated that people should stay in their homes and avoid going outside whenever possible. One of the main reasons people leave their house is to go to work. In order to comply with state mandated directives, businesses all over the country have transitioned to a work from home plan where employees do not come into a physical office, but are still able to get work done from the comfort of their homes. Other businesses are not able to provide this luxury and have been forced to close their doors. This new way of life has introduced new cyber threat vectors because many people and businesses are not used to taking their technology home to perform work which contains sensitive information.

One of the easiest ways to social engineer people is through the art of phishing. During these challenging times, when people are looking to get more information on what is going on with the world, it has become far too simple to deploy a phishing attack. People everywhere are curious about how COVID-19 is going to impact their work, business, mortgage, and school. People everywhere are getting hundreds of emails with more information about how COVID-19 is impacting their sector. As such, sending out a phishing email with the promise of providing some sort of COVID-19 coverage is making it easier for attackers to trick people into clicking on their link.

It is so easy to get caught up in the moment that you forget to check for some basic common sense items. There are going to be a lot of phishing campaigns that are going to try to take advantage of the fact that people are waiting to hear information from banks, credit lenders, schools, and businesses. Other types of news people might be looking for are those related to containment of the virus, or the spread. In any case, it is extremely important to remain vigilant and be on the look out for phishing emails that try to steal your personal information. What exactly is a phishing email and how do you protect yourself against it? A phishing email is an email that tries to look legit but it is actually trying to steal your personal information. There are many common sense steps you can take to protect yourself. The following are a few basic tips that should help you weed out the bad emails and hopefully just find the valid emails.

First big tip is to check the sender! Oftentimes, these phishing emails come from bogus emails that are blatantly obvious. That is not always the case, but for the most part, there is mostly always something fishy about the sender’s email address that does not quite add up to the original from a trusted sender. The next major thing to check for is the body of the email. Most, if not all senders state they will never ask you for credentials or other sensitive information over an email. When you get a phishing email asking you to sign into something, that should be a huge red flag. Do not log in using the link in the email. Lastly, check for other anomalies in an email. Just because we are always in a rush, does not mean we should not pay attention to places where we put in our sensitive information. If the logo looks weird, things are misspelled, any other strange things, please do not click on the link. Stay safe out there and make sure you check for trusted sources when trying to find out what’s going with COVID-19.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

In this episode, we are going to talk about why you shouldn’t share your password with people.

This is one of those episodes I was hoping I wouldn’t have to write, but after watching a Tik Tok last night, I determined it was to create it and share it with the world in case someone really needed to hear it.  Please, under no circumstances should you share your password with anyone.  There are obviously a few exceptions to this rule, and we’ll get to them in a minute, but under general guidance, it’s always a bad idea to share your password.  Let’s talk about why passwords are so important and go over the reasons why it’s a bad idea to share your password.

First, a password serves as an identity for people.  Passwords authenticate a person.  They are used to gain access to a system or account.  In most cases, the only person you want accessing that system or account are verified users.  These accounts can contain sensitive data that shouldn’t be viewed by unauthorized users.  For example, your tax records, bank records, and private data should be kept private.  If you share your password, then the security put in place is invalidated.  Anyone with that password can access the information.  There are some exceptions to this of course.  You might want to share your password with a significant other or if you have children, you probably want to know their passwords in case they forget.  Overall though, unless you explicitly want someone to pretend to be you online, don’t share your password.

The next reason is a little more complicated.  For normal people around the world, having a password is a means to gain access to social media accounts, bank accounts, and websites where you may have an account registered.  If you analyze the types of accounts that folks use passwords on, the most sensitive information is usually financial information.  There’s other data like addresses, phone numbers, birthdates, but for the most part, your credit card or bank account information is what most people tend to try and keep secure.  But, in the business world, passwords are a little more powerful.  Having a password there usually means it’s a way on to a machine that then has company data.

Having a password to an asset that doesn’t belong to you is very important to keep private.  I know a lot of my podcast episodes make me sound like a paranoid person, but if someone else gets your password, they can basically impersonate you.  This might not sound too bad, but what if they send an email on your behalf or delete something that might get you in trouble.  Things can escalate even more if you have admin rights to a server.  Servers are used to store customer or company data.  This data is utilized to run the business.  Any compromise to this data could not only be catastrophic, but it could also mean loss of revenue.  When you have admin rights to a company server, you want to take extra precaution to make sure no one ever knows your password.  I’ve worked in some places where everyone shares an admin password. This is a HORRIBLE idea.  If someone does something malicious, whether intentional or on accident, there is no way of knowing who did it. If you share your password with someone, you open yourself up to a bunch of issues that you just shouldn’t open yourself up to.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

In this episode, we are going to talk about 4 reasons why you should have a guess password for your wifi.

Your home network should be a very private thing.  All of your devices are connected to this network which means that your personal information transmits through this network.  Because of this, you should always know what devices are on your network and who is accessing your network.  When people come over to your house and they want to join your private wifi network, I would advise that instead of giving them full access to your network, you give them access to a guest network.  Most modern routers have this feature built and and allows you to separate your personal devices from those of visitors.  Some routers will even allow you turn your guest networks on and off by simply asking Alexa to enable the guest network.

At this point you might be thinking. . . what’s the big deal if I have others join my home network.  Let me run you through some of the most common scenarios that typically happen.  I’ll start by the most riskiest.  If you have complete strangers come to your house asking to join your network, this should be an immediate red flag.  These people can be folks from a utility company, a contractor working on your house, etc.  These folks should not, under circumstance gain access to your private home network.  Some of the risks include them setting up a man in the middle attack where they can see your personal and private data.  They might be able to access your shared network drives and printers which again contain your personal data.  They could also introduce malicious attacks/malware that can compromise the other computers in your network.  As you can see, giving someone you don’t know access to your network, while not always dangerous can have some serious consequences if the wrong person gains access.

Next up are friends and family.  The same risks from the previous example still apply with the exception that you actually know the people you are granting access to.  Even though you know them, you still shouldn’t just hand out network access.  All of the same attacks and vulnerabilities still apply with friends and family.  If they want to do harm to you, having access to your personal home network is an easy way to get started.  Sometimes, we like to let our guard down when we are with those we love and trust. But sometimes, that love and trust becomes our biggest vulnerability.  I’m not saying you need to stop loving your friends and family, but why not exercise every precaution to keep your data safe.  Enable that guest network and let them connect to that network.  The peace of mind is worth it in my opinion.

When someone access your network, they can then see other devices and data on that network.  Network shared drives are starting to become a common thing in home networks.  As we create more and more data, our devices overfill and all that data goes on to a network drive.  These network drives can then easily be accessed by devices on your network.  This is common with media servers that are usually used to store and stream videos and photos.  When you allow someone outside your home to access your wifi, you are potentially allowing these folks to also access your files.  If this is not your intention, letting them connect to a guest wifi can easily remediate this problem.  Adding layers of security to your shared network services can also help remediate.

Apetech Website: https://www.apetech.me/

https://anchor.fm/apetech/message

Email: [email protected].

Twitter:  @apetechda

In this episode, we are going to talk about the good and the bad about changing your password every 90 days

Passwords are susceptible to all kinds of attacks.  If you haven’t listened to our first episode, I recommend you listen to that episode first. We’ll highlight some of the topics discussed, but for full details, make sure to give that episode a listen.  If you work at companies that take security VERY seriously, then you’ve probably have had to change your password every 90 days.  Not only do you have to change your password every 90 days, but you can’t reuse an old password, and you have always meet the minimum criteria for a strong and secure password.

While it may be an inconvenience to have such stringent rules, there are some benefits to changing your password every 90 days.  But like everything else in life, there are some downfalls as well.  So, let’s look at the good and the bad in this episode.

Why password expiry is good

Let’s start off by talking about the good stuff.  Changing your password often is a good thing.  It can protect you from being exposed in case your existing password has been compromised. If someone gains access to a website that may contain your password, it might not matter anymore because you would have already changed your password.

Another benefit of changing your password is if you accidentally store your credentials on a different device, that device will no longer have access to your account.  This is a good thing because oftentimes, we forget where we logged into accounts.  By changing your password frequently, you minimize the changes of someone else logging into your account without you knowing.

As a side note, and not related to the topic of this episode, a good way to find out if someone has your password or log in information is to check the login history on your account.  Some accounts like gmail and facebook have a setting that allows you to see every time someone logs into your account.  Review it and if you notice a location that isn’t one where you were at personally, then you should immediately change your password because there’s a high chance that someone is logging into your account.

Changing your password often also means that it breaks all those saved passwords that you stored in the browser.  If you haven’t listened to our previous episode about why it’s not a good idea to store your password in the browser, make sure you listen to that episode as we go into more detail why this is a bad idea.  Nonetheless, if you change your password, you’ll be required to update your saved password.  If you don’t have access to a device that you might have saved your password in, then that password will no longer work and people with access to that device will not be able to access your account.

Why password expiry is bad

We are creatures of habit.  Maintaining a password that is safe and secure is already hard enough.  Now, imagine you need to make a unique password every 90 days.  That’s a lot of different passwords.  So, what do humans like to do to make things easier?  They’ll make a pattern out of their passwords so they are easier to remember after each change. This is a bad idea because if an attacker gets access to an old password, they can try to figure out your pattern and then figure out your new password(s).