Security for Normal People, Part 5: Your Behavior

At the end of last week's article, I alluded to the idea that no software – anti-virus or otherwise – is going to mitigate your own bad behavior online. So what did I mean by that?

It occurs to me that there are things I do, or do not, do automatically because I know they are security risks. Now, having been online since . . . well, when I first got online, I was very young . . . Prodigy was still a thing (remember Prodigy? Anyone? Bueller?); being on CIS (CompuServe Information Systems) or GEnie (General Electric's answer to CIS) meant you were a geek (I was on both); modems were 1200 baud if you were lucky; Internet was dial-up only; and printers were dot matrix (ask your parents).

My point is that I've had a number of years to develop behaviors that are now so ingrained in me that I don't even think about them . . . behaviors that have kept me from having any major security issues. I've never had anything more serious happen than being infected with the odd virus every now and then, and much of that I owe to knowing what kind of behavior can be dangerous. It's a challenge to write this, since some of these things are completely unconscious at this point, but I'll give it a go. . . .

Be careful where you download from. You probably know this is important. But, though an anti-virus can alert you to problems once they've occurred, or warn you about risky behavior, it won't stop you from downloading that file or program. Why? Because if you want to download a new game or trial program, or whatever it might be, and your anti-virus tells you you can't, what is the first thing you'll do? Disable it! So then you have no protection. So the anti-virus will ask you if you are certain that you want to download it, it will warn you that it could give you a virus, but it won't stop you in the end. It's up to you to make sure that you're downloading from a reputable source, that the website is what it appears to be, and not a fake.

Be careful of fake sites that look like the real thing, and always check the URL (Uniform Resource Locator – also known as the website's address) to make certain it is genuine. If it says, ″www.yootoobe.com″ instead of ″www.youtube.com,″ you should run away! You'd be amazed at how many people don't notice, or worse, don't check. It's entirely possible to create a site that looks like the site you think you're visiting – logos, images and all – but is really a fake. This is particularly dangerous if it's your bank or other financial-related site. This is one place where spelling really does count! If you get an email from what you think is your bank, and it has a link, don't click on that link! If you look closely, what you think is a link to Wells Fargo may be a link to ″welsfargo.com″ - notice the spelling? Only one ″L″. It's the kind of thing that is easily-overlooked, and the Bad Guys know this. This type of link can be used to get you to log in to their fake site with your real password, which is then collected and used to drain your accounts. This is what is meant by, ″phishing.″

In fact, people so frequently are oblivious to this sort of ploy that some phishers, who are either lazy or cocky . . . or both . . . have even been known to use fake addresses like, ″www.hackyou.wellsfargo.com″ in the links they send out in emails. If it's hidden in an HTML email – since you don't see the actual link – you should be able to see it in the address bar if you click on it and it opens up a new tab or window. Which brings to mind a few more things you should not do: don't click on links in emails (with few exceptions), and don't use HTML mail.

Never click on links in emails; type the URL in yourself, from scratch. If your bank or other financial institution, or any other important site such as these, emails you, they shouldn't put links in the email; frankly, they should know better at this point. But if you really believe it's from who you think it's from, and you need to log in to your account, do not click on the link! I can't stress this enough! What you should do is to open a browser page and type in the address yourself. Yes, I realize that can be a little inconvenient, but it's much better than suddenly having no money in your account and no way to pay your mortgage or rent, let alone your bills, isn't it?

Don't use HTML Email. Most people, it seems, use HTML in their mail. I suppose that's because they don't know why they shouldn't. But if you use text-only in your email, for one thing, it can clue you in to a fake link like I've described above. If you can't see the links, you have no chance at all of spotting a fake. An HTML link to, say, Bank of America, can be hidden behind the familiar logo. In other words, you click on what appears to be a genuine Bank of America logo . . . and it probably is . . .genuine in that the Bad Guys downloaded it directly from the Bank of America website. And yes, that's easy. I can do it. (And I'm not even a hacker, I'm just a person with lots of experience on the 'net who knows what's possible – though I don't always know how it's possible. But this time I do know.)

HTML email also carries a greater risk of virus. I won't go into the technical details, because that's not what this series of articles is about. Suffice it to say that HTML email is more dangerous in this respect than text.

Other reasons to not use HTML email seem obvious to me, but you may not know about them. Firstly, it's often slow. Why? It requires more bandwidth. Now, this may not seem important to you when you're on your high-powered desk-top, but if you're on Wifi, or a mobile phone network, you might be able to see the difference. Secondly, it often takes longer to appear than regular text, because it takes longer to load. In other words, it just uses up resources unnecessarily. Thirdly, you may not have any problems composing an email in HTML, but think about the recipients. Not everyone needs or wants your email with fancy backgrounds and pretty colors. (Personally I have my settings so that only text appears unless I click to load the rest.) What's more, there are still a lot of email apps that won't even read HTML email.

In the end, it's up to you whether or not to use and read HTML email, but knowing that text email is less likely to be a security risk, I hope you give this question some thought: do you even really NEED anything more than text in your email?! Does it make that much of a difference to you? If you can't answer an unequivocal, ″YES!″ to those questions, I strongly advise you to turn it off.

Another thing that people – especially younger people who have grown up with the internet and mobile phones – do that they should probably be more careful about is giving out information. People simply overshare information . . . about themselves, about their families . . . about all kinds of things. Without going into great detail (that might eventually become another article itself), let me just say here that it would be wise, before you post something on Facebook or Google Plus or even Path, before you Pin or Tweet or Share, and especially before you Snapchat (because just because you think it will go away, doesn't mean it actually does) . . . to ask yourself: do I really want to put this out their for all the world to see? Because on the internet, that's what you're doing. Regardless of where you post or how private you think it is, the rule of thumb is to never post anything you wouldn't want on the front page of the New York Times.

Once again, it looks like this is running long. So tune in next week for more about how your behavior can affect your security . . . and why you should be suspicious!

Security for Normal People, Part 4: Anti-Virus

The other thing that occurs to me that most normal people know they should do, but often don't, is to have a good anti-virus.

Now, you may think that, because you activated the free trial of Norton or McAfee when you got your computer, you're covered, but . . . not so fast!

Let me tell you why.

Firstly, how old is your computer? If it's older than a few months, your free trial will have expired. Secondly, even if you signed up with one of those companies and paid them for a subscription, that may not be the best thing, which I'll go into in a moment. But even if that were the absolutely best anti-virus software . . . are you updating it? Because if you don't make sure that it's updated, either by manually accessing the updates, or by setting the program to automatically update itself, it's almost like having done nothing.. Have you done that? Or, if you're doing it manually, are you doing it on a regular basis? (Personally, I prefer having the program update itself, since that way you don't just forget.)

Now, back to why Norton or McAfee isn't necessarily the best program to protect yourself with. Which I can tell you in one word: ″bloated.″ Sometimes these programs are bundled and sold as a package called, ″Internet Security,″ which you're charged even more for, and won't keep you any safer. Why? Several reasons. Firstly, because even if you've spent the money, you probably haven't gone through all of the settings and customized them. Secondly, again, ″bloated.″ If the anti-virus or ″Internet Security″ software is taking up so much of your computing resources that it slows down your machine (especially if it pops up while you're working) and you ignore it or – worse – disable it, then it's like you don't have anything at all. But frankly, even the anti-virus-only packages are bloated.

The folks that I listen to regarding security, again, are rather . . . ″in-depth″ is how I'd put it. Meaning they cover their topic thoroughly, to the point where my brain just stops processing information. Now, it's not actually meant for we mere dabblers, as much as for those who are responsible for security in some official capacity. But nevertheless, I listen, figuring that anything I do manage to pick up in the process is icing on the cake. And one of the things I have picked up is that there is one anti-virus software that is both light and efficient, and that would be something you've never heard of called NOD32, which is made by a company called ESET (you can also walk into any Fry's and pick up a copy on disc, which I highly recommend, despite it costing a few bucks more). I've used it, and it runs quietly in the background without taxing my resources, unlike the other two major companies' software, which I've had literally freeze me in my computing tracks from time to time.

If, however, you're looking for something free, which I have done on occasion when NOD32 comes up for renewal and I've had a dry-spell in cash-flow, I have another suggestion if you're using Windows (and yes, I used to use AVG until I heard of this, and my sources tell me that this is better). Go and download Microsoft Security Essentials. It's free, and it's kept me virus-free until I can pay for the next year of NOD32.

Which reminds me . . . don't think that being on an Apple device makes you immune to viruses! Sadly, that is no longer the case. I don't know much about anti-virus software for Apple devices, but I do know that there's a version of the same software I recommended above called ESET Cyber Security for Mac I can't tell you if there's an equivalent to Microsoft Security Essentials, but if anyone wants to chime in on that, feel free to Comment.

Now, if you already have Norton or McAfee, and you don't want to pay for another program while that's still valid, I can understand that. I will only tell you here that, if money's not an issue, I recommend doing that; I would definitely do it myself. But as I've said before, some security is better than no security, so if you can't or won't switch until your year is up, at least you have something. Just remember that you shouldn't have two kinds of anti-virus software at the same time. (I've known people who have done this, thinking it's twice the protection, but all you accomplish is gumming up the works, and neither program will work properly.)

Also, pay attention to any pop-up notices. Don't just click, ″OK″ to whatever it wants just to get rid of the pop-up! Make sure you read those, as they most frequently are warning you of some sort of problem, like a suspect file. You may, indeed, want to follow the recommended course of action, but you should be aware of what it's warning you about. If you have a lot of warnings, you should look more closely and see if there's a pattern. Frequent warnings about the same thing justify further investigation, and perhaps additional action.

Whatever you decide to use, though, make sure that you keep it up-to-date by updating regularly or having it auto-update, and remember that the software can't protect you from your own behavior. But that's the subject of another article. . . .

Security for Normal People, Part 3: Back-Up

Since I've been on a bit of a roll, I might as well continue with the kinds of basic things that also fall under the security umbrella. Now, if you're a computer-nerd, you probably already know these things. But if you're just a normal person who knows they should be aware of security, but doesn't really know what that means or where to begin, this (along with my two previous articles) is for you.

Other than mobile phone security and how to make a password that is both hard to crack and actually possible to remember, there are a few other basics you should know. While I'm not an expert, I have acquired this knowledge through experience and listening to other geeks and various podcasts, most of which will seem tedious and somewhat boring to regular folk (because frankly, some of it is over my head, too; at a certain point it turns into white-noise hum).

However, I've got a pretty good handle on the basics, and my intention is to give you a place to start. After all, some security is better than no security. Think of it this way: if you lock your car doors, a thief might keep moving looking for unlocked doors; if you have a Club, the thief will prefer someone with just locked doors. The more security layers you have, the more of a nuisance it is to someone trying to get in, and the more likely they will just move on to someone with less security.

If you are interested in learning more, at least you'll know what to look for when you investigate. (You can email me if you need further resources, but for most people I think that these articles are probably sufficient, assuming you even get all the way through them!)

So, here goes . . .

This time, I'm going to talk about backing up. And yes, it still falls under the general heading of security, because if your other security measures fail, you will still have your data if you're backing it up, even if you need to take your computer in to a shop to be worked on. Here's the thing about doing that, and your local computer shop should warn you, but sometimes they assume you know: ALWAYS BACKUP YOUR COMPUTER BEFORE YOU TAKE IT IN TO BE WORKED ON!!! Because if you get a virus, the only real way to be certain that it's been eradicated is to reformat the hard drive, which, by the nature of what that means, will destroy all of your data.

It should go without saying that you should back up regularly, but most people don't. Even one of my friends, who has gone to school to become a bona fide computer geek (and if he reads this, you know I mean you!), ignores this vital function himself, and has lost data because of it. The important thing to remember is that it's waaaaay easier to retrieve data that has been backed up than to have to hire an expert to retrieve it for you. It's also much, much less expensive. If you have a hard drive crash and need to get vital data off of it, it can cost you thousands of dollars, and there's no guarantee it will be successful. So just make backing up a part of your life; get used to it. There are painless and inexpensive ways to do this, so take advantage of them.

There are two ways to go: back up yourself, or pay someone else to do it. If you are like most people and you don't have the time and simply don't want to be bothered, sign up for something like Carbonite. It's relatively inexpensive (about $60 a year for one PC, though they have other plans, depending upon how many devices you need to back up), and once you set it up, you don't really have to think about it.

If you don't like that idea, or you're just a DIYer, there are other ways to backup.

But firstly, there is a strategy you should follow called 3-2-1. That requires a little explanation. You see, most people don't really understand what a back-up actually is. They think that if they copy their data (documents, photos, videos . . . basically any type of file that is user-generated – that is to say, made by you) to a CD or DVD, or jump drive, or whatever, they can then delete it from where it originally was, because they now they have a backup. Let me emphatically tell you that, THIS IS WRONG! And the fact that I'm using capital letters, underlining, bold, and italics – all at once! – should tell you just how wrong it is.

This is important, so I'm throwing the Full Emphasis Package at it:

ANYTHING YOU HAVE ONLY ONE COPY OF IS ***NOT*** BACKED UP!!!

Let me repeat that:

ANYTHING YOU HAVE ONLY ONE COPY OF IS ***NOT*** BACKED UP!!!

Unless you have several copies of your data, it's as good as gone. You are one stray power surge away from having nothing.

The only way to be reasonably sure that your data is safe is to use the 3-2-1 strategy. (And even this is no guarantee; it merely increases your odds of being able to retrieve your data.)

What this means is:

″3″: You should have 3, count 'em, three copies of any one file. That means, an original, and 2 copies.

″2″: They should be on at least 2 different types of media (such as a hard drive, a CD, a DVD, a jump drive, or ″in the cloud″).

″1″: One copy of the data should be off-site. If you sign up for Carbonite, or some other, similar service, you have this part covered, but you still need to make sure you have the two other copies. If you don't like Carbonite (there are other, similar services, but some people simply don't like them), or for whatever other reason you want to do this yourself, there are other ways to accomplish this same thing.

A secondary, external hard drive that automatically copies everything you deem vital is great, but it's not off-site. (It's fine to have a backup on an external hard drive if you're also using Carbonite or have some other method of off-site storage.) If, however, you take that hard drive (and you should have at least two to do this properly, so you can switch off) and mail it to your mother or friend in another region for safe-keeping, that will do it. You can also get a Drop Box account (follow this link to get an extra 500MB of space for yourself, and I will get the same, which I will very much appreciate!).  Again, there are other, similar places; Google: ″Drop Box alternative″ or ″cloud storage″ to find them, and regularly copy your most vital files to one such site.

If, however, you want to back up music (and you have a lot of it), or videos (which are much larger files) cloud storage might simply not be practical. In that case, I recommend the external hard drives, or even just CDs and DVDs. As long as you pack them up and ship them out regularly to someone outside of your region, it'll be fine. (Note: The reason I say ″region″ here is that if you are in, for instance, an area where there are frequent hurricanes and you send them to someone who is also in that kind of area, it might not help much. A friend of mine in hurricane-country sends her things to me here, in the desert, where I'm far more likely to have an earthquake, and vice versa.)

This might sound a little overly dramatic, but just think how you'd feel if you lost your children's baby pictures, or the novel you'd finally completed, or home movies of your long-dead relatives. It can happen. Don't let it happen to you!

The one other thing I wanted to mention is a book that I've heard about for photographers, called The DAM Book: Digital Asset Management for Photographers that I am told is excellent. So if you're into photography, and you have any aspirations of being a professional, go take a look. Because you don't get a second chance at photographing someone's wedding.

I had planned on including other things into this article, but since, once again, it turned out longer than I thought it would, I will simply have to cover another aspect of basic security in my next article.

I hope someone out there is getting something out of these! Please leave a comment if you are, or drop me an email!

Security for Normal People, Part 2: Security and Passwords

On first glance, passwords don't seem all that complicated. But too many people use their birthdays, their anniversaries, the names of their pets, or other such easily-hacked information, that an article for normal people – who may not have the experience that I do – about what makes a good password seems like a good idea.

The most commonly-used password, according to ZDnet, is: “password,” believe it or not. The second most common is: “123456.” Also on the list: “letmein,” “baseball,” “superman,” and “111111.”

What this tells us is that most people aren't terribly concerned with their passwords.

They should be.

Being hacked can lead to many problems, aside from the obvious having someone drain your bank account and purchasing expensive items on eBay or Amazon and sticking you with the bill.

Because, make no mistake, once someone has one of your passwords, they can also very likely get into your network and do all kinds of things that will affect you, not to mention your credit report, adversely. And then there's your computer. If someone gains access to your computer it can be used for all kinds of purposes – the most common being as a way to use your computer for what I will just refer to here as Bad Things.

I won't go into a great deal of detail here on what these things are, or how they are done, because that's not really the point. The point this: there are many Bad Things that can be done by devious people who can and will gain access to your computer, files, and/or network. You're just going to have to trust me on this.

The other point is that, though there are other things you can do to help protect yourself, creating good passwords are among the most basic. This is something easy that anyone can do; you don't have to be a computer whiz or a cryptographer, you just have to follow some basic advice.

Firstly, I'll give you the Don'ts:

Don't use any single dictionary word – i.e., any single word that can be found in a dictionary. There are programs that are capable of trying every word in a dictionary in an extremely short amount of time. This includes compound words as well

Don't use your birthday, your spouse's birthday, your children's birthdays, current phone numbers, pets' names, current addresses, social security numbers, credit card numbers, or any other piece of information that is either easily obtained, easily guessed, common, secret, or discoverable – and when I say, “easily,” I mean by people who have abilities or access to things you probably don't have access to, most likely because they've hacked a database that this information is in.

Don't use words related to your favorite fandom, which is to say, if you're a Star Wars fan, don't use things like, “lightsaber,” “Jedi,” or “theforce,” or any other word or catch-phrase from or related to Star Wars. The same thing goes for Star Trek, Game of Thrones, Harry Potter, Grimm, Lost Girl, or any similar universe that has its own vocabulary. And while I'm on the subject, don't use words in Klingon, Castithian, Dothraki, or any other language that is made up for a Science Fiction or Fantasy universe. The same rule that applies to dictionary words applies to these; there are hackers who can run through an entire Klingon dictionary in a very short time, too. Amazing, I know, but true, nevertheless. You'll just have to take my word on this.

And by now you're probably thinking, “What's left?”

So, now I'll tell you how to make good, secure passwords. There are a number of strategies, any one of which (or combination thereof) will help you come up with solid passwords.

Firstly, the longer a password is, the harder it is to crack. While many sites will only let you do eight characters, some will allow you to create much longer ones. I'd say that unless you've got highly sensitive information or are security-conscious to the point of paranoia, usually somewhere between 8 and 16 characters is sufficient. (If you're using a password locker, such as LastPass, you might just want to use the password creation function and set it to 16 characters.)

Other things that make passwords stronger are including both upper- and lower-case characters, numbers, and special characters (such as $ or %, and so forth). Or, better yet, all of the above. The more of these things you include, the harder it is to discover your password. If you use a mnemonic method (or even if you don't), which often won't include special characters or numbers, you can also add a little something additional to all passwords, like, for instance, the phone number or zip code from where you lived as a kid (of course, if you inherit your parents' house, you might have to come up with something else).

So, knowing what makes a password stronger gives you several ways to create passwords. . . .

1. Use three short dictionary words that are unrelated, connected with or interrupted by upper- and lower-case letters, numbers, and/or special characters. For example:

bear!Arm53soccer is good, though if you want go a little further: be2ar!Arm53soc7cer is even better.

Which may be hard to crack, but may also be a little difficult to remember. (Though you might come up with some weird memory trick even for unrelated words like this: “If the bear ate my arm, I'd miss the soccer game.”) So, a couple of strategies that may make remembering your passwords a little easier. . . .

2. Use a mnemonic device to create your passwords, such as the first letters of a line of a song, or a quotation, using capital letters, for, say all nouns (or any other part of speech you like), for example, using this technique, taking the first line of Edgar Allan Poe's “The Raven,” and capitalizing the letters that represent nouns, you would get, “ouaMdwIpwaw,” which may not roll off your fingers, but is reproducible, as long as you know the poem. Of course, there are no numbers or special characters in this, so as I mentioned above, if you add your childhood zip code, and you're from Boston, you might get, “ouaMdwIpwaw02134,” which is probably pretty hard to crack.

3. Make up your own word, then add capital letter(s), numbers, and special characters. So, I just made up a word, “suvavatinz.” I know it's not a word because I just Googled it. If you include less-frequently-used letters in your word, like z, or q, in your made-up word, so much the better. But now, add a cap or two and an old phone number, and you wind up with “suVaVatiNz9084873311,” and that's pretty hard to figure out, too. A good way to remember your made-up word, though, is to give it a meaning that makes sense to you – in this case, it sounds like a competitor to No Doz to me.

You can mix and match these methods, but by now you probably get the idea now how to go about making up your own relatively secure passwords.

There are a few other things you should think about doing for basic computer and Internet security, in addition to mobile phone precautions and good passwords, so I'll do a separate article about those. . . .