People are still the weakest links in cybersecurity defenses, expert warns. He suggests people always enable two-factor authentication for accounts and says you should encrypt traffic and tighten up password security.
Never in American political history have hacked and stolen emails played such a central role in a presidential campaign. But hackers are likely to target you as well – though perhaps with smaller repercussions for the world as a whole.
Every one of October’s surprises, from the leaks of Clinton campaign chairman John Podesta’s purported emails to those of the Democratic National Committee, was achieved using a surprisingly simple email deception technique called ‘spearphishing.’
The same technique was used to attack Hillary Clinton’s private email server: Two spearphishing messages were found on it.
Many people know that the term ‘spearphishing’ typically describes emails trying to get someone to click on a link to, say, their online bank account – but actually sending them to a lookalike site where their login information can be stolen.
Some others hide malicious software (or ‘malware’) within links or in attachments that when clicked give the attacker control of the system or even an entire corporate network.
But despite years of national efforts to promote cybersecurity, spearphishing remains fruitful: People are still the weakest links in cybersecurity defenses.
There are, however, simple ways we can all step up to protect our own information – whether we’re central to presidential politics or regular people.
In general, people are fairly aware of the potential for cyber attacks. Some are even good at spotting them. In fact, both Podesta and Clinton were suspicious of the phishing emails they received.
Before clicking, Podesta even asked his tech-support staff if a link was legitimate. Those experts should have known how to spot a phishing attack, but failed: They told him to click on the malicious link.
The problem is not lack of awareness or even knowledge, though some of us need more of that too. It’s actually one of complexity.
Researchers think of computer users as working on an email while focused solely on a computer screen. But reality paints a different picture. Today, people use a variety of internet-connected gadgets and apps, with myriad prompts, feeds and notifications, all vying for their attention.
Estimates are that the average person checks his smartphone 80 to 100 times each day. This does not even include desktop and laptop computer screens, tablets or smartwatches.
People routinely use all of those devices as well, checking, recording, reviewing and responding to requests in the office and on the go – walking, talking and even driving. These interactions present a near-constant stream of information and requests. The user typically feels that he has just seconds to consider each – even though any one of them could define the fate of an entire organization or a political campaign.
In the face of all this complexity, the best answer is a very simple one: a checklist. Atul Gawande, in his book ‘The Checklist Manifesto: How to Get Things Right,’ details the importance of checklists in highly specialized fields.
These are work environments where success depends on coordination between a number of trained professionals – airline pilots, surgical teams, construction engineers.
Often, trained people remember to do complex tasks, like medical professionals performing difficult surgical procedures, but forget to do simple things, like washing hands prior to surgery.
Much like in cybersecurity, the problem is one of complexity and human error, with potentially severe consequences.
For instance, one in every 200 medical errors involves performing the wrong procedure, or even working on the wrong patient. That’s where a checklist comes in, reminding the medical staff to reconfirm the patient’s name and visibly mark the correct surgical site.
In much the same way, a checklist could help us routinize the minimum actions necessary for achieving cybersafety.
With this goal in mind, here is a checklist of five best practices that could help protect us online.
HOW TO CHOOSE A SECURE PASSWORD
- Avoid favourite sports. ‘Baseball’ and ‘football’ were both in the top 10 worst password list.
- Birthdays and years of birth are easy to guess with the help of personal information.
- Common names such as Michael and Jennifer are insecure, with many making SplashData’s Top 50 list, too.
- Experts suggest using eight mixed types of characters, with seemingly random combinations if possible.
- They say that passphrases – short words with spaces or other characters separating them – are easy to recall and are relatively secure if seemingly random words are used.
- Experts also advise having different passwords for different sites, instead of relying on one, which if hacked, could prove particularly serious.
FIVE STEPS TO MORE SECURE ONLINE OPERATIONS
- Enable two-factor authentication (2FA). Most major online services, from Amazon to Apple, today support 2FA.
- Encrypt your internet traffic. A virtual private network (VPN) service encrypts digital communications, making it hard for hackers to intercept them.
- Tighten up your password security. This is easier than it sounds, and the danger is real: Hackers often steal a login and password from one site and try to use it on others.
- Monitor your devices’ behind-the-scenes activities. Many computer programs and mobile apps keep running even when they are not actively in use.
- Never open hyperlinks or attachments in any emails that are suspicious.
Arun Vishwanath is the Associate Professor of Communication, University at Buffalo, State University of New York
Online Source: Daily Mail Australia.
