Information Security Updates

Who Are You

The process of proving who you are (called authentication) is a

key step to protecting your online information. You want to be

sure only you have access to your private information, so you

need a secure method to prove who you are, such as when you

check email, purchase something online or access your bank

accounts. You can prove who you are in three different ways:

what you know, such as a password, what you have, such as

your passport, and who you are, such as your fingerprint. Each

one of these methods has its advantages and disadvantages. The

most common authentication method is using what you know:

passwords.

 

Passwords

You most likely use passwords almost every day in your life. The

purpose of a password is to prove you are who you say you are.

This would be an example of something you know. The danger

with passwords is that if someone else can guess or gain access to

your password, they can then pretend to be you and access all of

the information that is secured by it. This is why you are taught

steps to protect your password, such as using strong passwords

that are hard for attackers to guess. The problem with passwords

is they are quickly becoming dated. With newer technologies it is

becoming easier for cyber attackers to forcibly test and eventually

guess passwords or harvest them with technologies such as

keystroke loggers. A simpler yet more secure solution is needed

for strong authentication. Fortunately, such an option is becoming

more common-something called two-step verification. To protect

yourself, we highly recommend you use this option whenever

possible.

 

Two-Step Verification

Two-step verification (sometimes called two-factor authentication)

is a more secure way to prove your identity. Instead of requiring

just one step for authentication, such as passwords (which is

something you know), it requires two steps. Your ATM card is an

example. When you withdraw money from an ATM machine, you

are actually using a form of two-step verification. To prove who you

are when accessing your money, you need two things: the ATM

card (something you have) and the PIN number (something you

know). If you lose your ATM card your money is still safe; anyone

who finds your card cannot withdraw your money as they do not

know your PIN (unless you wrote your PIN on your card; which

is a bad idea). The same is true if they only have your PIN and not

the card. An attacker must have both to compromise your ATM

account. This is what makes two-step verification so much more

secure: you have two layers of security.

Using Two-Step Verification

One of the leaders in online two-step verification is Google.

With a variety of free online services such as Gmail, Google

needed to provide a stronger authentication solutions for its

millions of users. As such Google rolled out two-step verification

for most of its online services. Not only is Google’s two-step

verification a free service any Google user can sign-up for, but

other online providers are using similar technology for their

services, such as Dropbox, Facebook, LinkedIn and Twitter. By

understanding how Google’s two-step verification works, you

will understand how many other online two-step verification

services work.

Google’s two-step verification works as follows. First, you

will need your username and password, just as before. This is

the first factor, something you know. However, Google then

requires a second factor, something you have-specifically,

your smartphone. There are two different ways you can use

your smartphone as part of the log in process. The first is to

register your phone number with Google. When you attempt

to authenticate with your username and password, Google will

SMS a new, unique code to your smartphone. You then have

to enter this number when you log in. The other option is to

install Google authentication software on your smartphone. The

software then generates a unique code for you. The advantage

with this second approach is that you do not need to be

connected to a service provider, as your phone generates your

code for you.

Two-step verification is usually not enabled by default.; it is

something you will have to enable yourself. In addition, most

mobile apps are not yet compatible with two-step verification.

For most mobile apps you will need to use application-specific

passwords, which you can generate once you enable twostep

verification. Finally, you may have the option of creating

recovery keys in case you lose your smartphone. We recommend

you print those out and store them in a safe, locked location.

We highly recommend you use two-step verification whenever

possible, especially for critical services such as email or file

storage. Two-step verification goes much further to protect your

information , as criminals have to work much harder

to try and compromise your accounts.

 

 

 

 

 

 

What is Spear Phishing? I hope you don't think it involves shooting fish, cause it does not!

What is Spear Phishing?

You may be familiar with phishing attacks. These are emails
sent by cyber criminals to millions of potential victims around
the world designed to fool, trick or attack them. Usually, these
messages appear to come from a trusted source, such as someone
you may know. The emails often have an urgent message or deal
for you that is simply too good to pass up. If you click on the link
in a phishing email you may be taken to a malicious website that
attempts to hack into your computer or harvest your username
and password. Or perhaps the phishing email may have an
infected attachment—if you open the attachment it attempts to
infect and take control of your computer. Cyber criminals send
these emails to as many people as possible, knowing the more
people that receive the email, the more people will likely fall
victim.
While phishing is effective, a relatively new type of attack has
developed called spear phishing. The concept is the same:
cyber attackers send emails to their victim, pretending to be
an organization or a person the victim trusts. However, unlike
traditional phishing emails, spear phishing messages are highly
targeted. Instead of sending an email to millions of potential
victims, cyber attackers send spear phishing messages to a very
few select individuals, perhaps five or ten targeted people. Unlike
general phishing, with spear phishing the cyber attackers research
their intended targets, such as reading the intended victim’s
LinkedIn or Facebook accounts or any messages they posted
to public blogs or forums. Based on this research, the attackers
then create a highly customized email that appears relevant to the
intended targets. This way, the individuals are far more likely to
fall victim to the attack.

Effectiveness of Spear Phishing

Spear phishing is used when the cyber attacker wants to specifically
attack you or your organization. Instead of simple criminals out
to steal money, attackers who use spear phishing have very
specific goals, usually accessing highly confidential information
such as corporate business secrets, plans for sensitive technology
or confidential government communications. Or perhaps your
organization was targeted simply as a stepping stone to gain access
to another organization. Such attackers stand much to gain, and
they are willing to invest the time and effort to research their targets.
For example, a criminal entity may decide that your organization
holds personal customer information that is key to their economic
success and they begin to target you. They research your
organization’s website and identify three key individuals. These
attackers then research the LinkedIn, Twitter and Facebook pages
of those three individuals and create a complete dossier on them.
After analyzing these targeted individuals, the attackers then
create a spear phishing email pretending to be a supplier that your
organization uses. The email has an attachment pretending to be
an invoice, when in reality it is infected. Two of the three targeted
individuals are tricked by the spear phishing emails and open the
infected attachment, giving the criminal entity total access to their
computers and, ultimately, all of your organization’s customer data
and corporate strategic plans, which they will now exploit.
Spear phishing is a far more dangerous threat than simple phishing
attacks, as the attackers are crafting an attack specific to you or
your organization . Not only does this increase the chances of the
attacker’s success, but these attacks are far more difficult to detect.

Protecting Yourself

The first step to protecting yourself against these targeted attacks
is to understand that you may be a target. After all you and your
organization possess sensitive information that someone else
might want, or can be used to access another organization that is
the attacker’s ultimate goal. Once you understand that you could
be targeted, take the following precautions to safeguard yourselfand 
your organization:

• Limit the information you post about yourself, such as mail
forums, Facebook or LinkedIn. The more personal details
you share, the easier it is for cyber attackers to craft a spear
phishing email that appears relevant and genuine.

• If an email that asks you to open an attachment or click a
link appears suspicious or requests sensitive information,
verify the message. If the email appears to come from a
company or a person you know, use the contact details you
already have on file to contact the sender and verify that
they sent you the message.

• Support IT Computer Specialist security efforts by following the
appropriate security policies and making use of the security
tools that are available to you, such as antivirus,
encryptionand patching.

• Remember, technology cannot filter and stop all email
attacks, especially spear phishing emails. If an email
seems a bit odd at first, read through it carefully. If you are
concerned that you may have received a spear phishing
email or fallen victim to spear phishing attack, contact
IT ComputerSpecialist immediately.

Computer Security Services - Stuart - Port St Lucie - Jupiter