Secure Your Digital Information

If I actually had money, I would have been a hacker's dream come true. I've actually been hacked too! You would think I would have learned something. While I was at my cancer center getting one of my treatments, I decided to order tires for my car, because winter was coming. Scheduled my appointment, and paid for the tires, all on the comfort of my Kindle... using the cancer center's wi-fi... Thinking back on that now....

“Behold, I send you forth as sheep in the midst of wolves: be ye therefore wise as serpents, and harmless as doves.”

Matthew 10:16

Sorry, Lord...

Thankfully, I keep track of my budget (on my previously unprotected computer) and was able to find the hack that stole $400 from my bank account, which was used to purchase gift cards at Lowe's, and reported it to my bank. They launched their own investigation, and I got my money back. Whew! You would think that would have taught me something more than just “don't do financial transactions over public wi-fi.” But... I am an idiot.

I use my computer for hobbies (3d modeling, game design, programming and tutorials), playing video games, paying my bills, and making online purchases. I've never much worried about security, because that's all I do on it. Now, however, I am attending Lambda School to become a software engineer. Now I am downloading all sorts of new programs, including VS Code, node.js, postman, Ubuntu, MongoDB, and who knows how many libraries that are requirements for other libraries to work. In short, my computer has become a stomping ground for the mysterious unknown. I've also been introduced to the world of hackers, and now realize how many different avenues of approach that a hacker can use to gain access to somebody's computer. I always took it for granted that if I was only visiting trusted sites, that I didn't have to worry about being hacked. Now I know that a site may not even be aware that it is being used as an unwitting accomplice for a scumbag black hat hacker. So... Let's do a threat analysis of my current situation, and figure out how to go about correcting some of these issues.

Attack Surface:

• Desktop: Unprotected
• Cell Phone: Unprotected
• Laptop: Unprotected
• Physical File Folders: At least these are locked.
• Home LAN

Adversaries:

• Online hackers
• Thieves
• Local hackers

Attack Vectors:

• Online hacking
• Password theft/hacking
• Trojans/Viruses, and other malware
• Physical entry/theft

Mitigations:

• Anti-Virus Software
• Password manager software
• Physical lock for computer and files
• Password protected wi-fi access
• Limited use of devices

Anti-Virus Software
This may be hard to believe, but I have been running without an anti-virus since my last OS install, back about 7 months ago! Well... unless you count Bit Defender... heh... Today I tried Total AV, but the ad spam within the first 30 minutes was atrocious. Back to Sophos Home. Fuller protection than Total AV, including real time protection, ransomware protection, and malicious traffic detection, all on their free service. Oh, and no obnoxious advertisements. All I get is a simple little banner at the top of my UI, letting me know there's a 20% discount for the next 5 days, and I got one small gray box, letting me know how long I have my free trial of premium left. It also found more potential threats than Total AV. I am happy with Sophos.

Interested in using Sophos? Go to https://home.sophos.com to get your copy of Sophos Home.

Password Manager

But... why use a password manager at all? I'll just use the same password for everything, for ease of access for me. After all, I don't visit pornographic sites, so I wont ever be hacked. Right?

Yeah. That's where I was at. That's what I was doing. Now, I am using about 5 different passwords, but still... not hard to gain control of a good portion of my life with just 5 passwords, all of which are under 10 characters. Time to take care of that. Enter, Dashlane.

Not just a password, but a pass phrase! I was going to use that one, but I'm giving it to you for free, so I'll use another one. Now I can have Dashlane generate passwords for me, so they can be tremendously long, and fairly unhackable to everyone but the most extremely determined hacker.

It also saves stuff online, so I can put my security in the hands of a company that has more time to spend on security than I do.

2 Factor Authentication

Now this, I actually have in effect. I use this for my Steam account. Since this is all online, I appreciate the extra effort Steam has taken to help protect (at this point) a few hundred dollars worth of software and games. In order to log in from a new computer, you need access to my cell phone. To log in, Steam sends my phone a 5 or so digit code that is only good for less than a minute.

Physical Security

Cyber security goes beyond just passwords and virus protection. If somebody can install a thumb drive, or get in to your papers, they can get your information and/or steal your identity. My lock was mainly to keep my kids out of the computer after they destroyed two different printers, but it's also a great deterrent against thieves. They want easy access in and out. Hit and run, grab what you can. If it's not easy to get inside, they'll probably leave it alone. Unless they think there's something truly valuable inside.

Password Protected LAN

Another thing that I always had, was a password protected LAN. However, time to change it, because it is the same password, reused yet again... Look up what your LAN router's address, and go sign in, and change it from the default password.

Limited Use of Devices

Also a help, so that we don't have to worry about every single device, is that we only use specific devices to do specific things. My desktop is the hub, so we do pretty much everything on it. But phones, we limit to specific apps. No eBay or online shopping on the phones. The laptop is for the kids, so nothing adult goes on there. No credit cards, no passwords, nothing, unless it's for the kids. However, these devices have access to the LAN, so make sure to set up some basic security on your other devices, so it doesn't act like a back door to something more important (like my desktop).

Keep going!

Now, this is just the beginning of setting up some basic security for your online presence. If you're interested in getting further into securing your digital information, dig deeper, and find out more! Here's a good start:

SSH Keys

GPG Keys