InfoSec Basics for Families

Information Security Basics: What every family should know about using the Internet

“Digital security education is like drug education and sex education in that people believe all kinds of things that are simply not true.” Eva Galperin, Global Policy Analyst at EFF

Everyone gets pwned. Some don’t know it. Others don’t want to admit it.

http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

The chances of an intrusion going from bad to worse - identity theft or social ostracization -  are reduced when families openly discuss and support each other without edicts, judgement, shame, or blame. Open, frequent discussion about how to protect personal (inter-related) information and how to practice safe surfing are key to maintaining online privacy.

Know Thy Enemy - Hackers are like witches; there are good hackers and bad hackers.

• “Getting Hacked” is a bunch of FUD; sensationalized news about targeted POI or organizations that are famous, gatekeepers, or victim of personal revenge or bullying
• Bad Hackers use FUD to sway the masses

• Joe Blow and Jane Doe? Chronic long-term disregard for basic security, safety, and privacy settings. Bad Hackers use sophisticated readily available automated tools and high powered computers to process 1000s of records to glean a few hundred logins. Then:

• Try the combination and variations on other sites
• Match against other sources and start building a profile
• Sell the data or publish for free

Basics:

• Set devices to automatically lock after a period of time
• Use 2 Factor Authentication whenever possible
• Use a (reputable) Password Manager to generate and store passwords
• Apply OS and application updates as soon as possible
• Choose your browser well (aka All browsers are not made the same)
• Unsubscribe from email you don’t care about
• Freeze your credit, and avoid establishing credit for your child as long as possible

Intrusion:

• Mechanisms: Email attachments, Click-bait, Phishing, Spear-phishing, SE, Shoulder surfing, Brute force, Re-using Logins, Wifi & Bluetooth, Anti-virus SW, Flash, USB & other external storage media,
• Malware: Trojans, Adware, keyloggers, browser hi-jackers, backdoors, ransomware,
• RATs: Camera & Mic - Tape the camera!
• Location tracking

Calculate Risk:

• Accessible vs. Hardcore (Linux, Signal, Tor, and PGP)

Build Common Sense:

• Instead of relying on Filtering vs. Monitoring...neither are very effective.
• The Internet never forgets; archives of old emails, chat rooms, blogs, tweets, etc.
• Don’t dox yourself or your family. Avoid using key identifiers in social media like names, (DO)Birthday, locations, pictures, credit cards, 1st paycheck, pic of your house with address number, pic of your car with the license plate, etc.
• Write (post) like everyone is watching
• Don’t give your trust to strangers - or acquaintances
• Think before you click (aka There is no such thing as “free”...)
• Be Prepared!
• Backup your devices
• Air gap personal data
• Secure physical medium: Cross-cut paper shredder