Cyber Hygiene Rules
Why can cyber hygiene rules save you from cyber attacks?
While I do research about password managers, I have devoted considerable attention to potential cybersecurity vulnerabilities which may lead to a loss of information.
For personal security of your devices and information, all users must follow the basic rules of cyber hygiene. These rules are very easy, however they require using of services, some of them require purchasing a license.
It allows to increase the level of your cybersecurity and will reduce the probability that you leave a weak link in company security and targets for hackers.
Where the rule applies only to freelancers, the #yourlaptop hashtag will be used.
10 rules which help you to be better protected against cyber threats
- First rule: Best protection is your attention!
- Second rule: Personal passwords. Make it hard. Save it in secret. Regularly change it!
- Third rule: Do you have two-factor authentication (2FA)? Use it!
- Fourth rule: Your work is copied into the cloud!
- Fifth rule: Security information transferring!
- Six rule: Hide confidential information! Encrypt sensitive!
- Seven rule: Separate work! Separate private accounts!
- Eight rule: Use AntiVirus!
- Ninth rule: Regular updates!
- Ten rule: Don’t use pirate applications
First rule: Best protection is your attention!
Don’t open, don’t click and don’t execute any malicious files, attachments or archive files, links and applications if you don’t trust senders 100%. These files and links are malicious by default.
Malicious files
Be careful with files, which were received from internal and untrusted sources, mails, etc. General goal of creating these files is hidden from users and security tools. The best protection against these types of attacks is your attention. Please, always check file type and additional hidden type.
The most popular file type which can mark as malicious:
- different executable files: exe, com, bat, ps1, swf, jar, etc.
- MS Office files with macros: doc, docx, docm, xls, xslx, xslm and PDF
- archive files with password protections
Sometimes users cannot easily check legitime or malicious files. For fast file security checking you can use the service VirusTotal.
Attention! If you use VirusTotal then you should give files to other people.
Malicious links
When you receive emails with attached links — don’t click on them! Especially those that look familiar or that you don’t usually use. Please, you should check the links before clicking on them, however, attackers can change the link’s name. For example:
http://facelook.com
http://gooogle.comAdditionally, you check security connections. The browser lock is your friend. We consider the situation of the well known Ukrainian taxi service Uklon.
For example, you receive a link https://uklon.com.ua, but the victim sender changes “l”(L) on “l” (i) and then you click the incorrect URL — you can see a browser alert that the URL connection is insecure.
Correct URL:
Incorrect URL:
Malicious URLs can be encoded in QR-code or short URL. Don’t insert this link in your browser and don’t scan this QR-code!!!
Suspicious pop-ups
Be careful with pop-ups in your browsers, applications and operations systems. You should always read messages in pop-ups and don`t rush to give permissions or allow.
Pop-ups can be dangerous for many reasons:
- possibly install malicious SSL-certs for sniffing traffic
- possibly download and install malware applications
- possibly may redirect you to malware browser or websites
To prevent it I recommend using pop-up blocks applications as addons in your browsers. For example:
- Best Ad Blocker & Privacy Browser
- AdBlock
- Pop Up Blocker for ChromeTM — Poper Blocker Stands
My basic recommendation is to use Сlario
Second rule: Personal passwords. Make it hard. Save it in secret. Regularly change it!
Passwords are keys which protect your information. You should manage them gently.
Strong password requirements:
- Minimum 14 symbols and combination of letters, digitals and other symbols.
- Don’t use it on “easy” words — admin, password, etc.
- Don’t use personal data or system
- For different systems or services you should use your own password.
More information how you can use, manage, store and share passwords, please read this story about password management
https://medium.com/@mykhailo.antonishyn/password-managers-275eda189371
Third rule: Do you have two factor authentication (2FA)? Use it!
If you use 2FA or MFA you are secure against 99% of typical hacker attacks.
Simple example: you want to login to Facebook or Instagram. For it you enter login and password and this is the first factor of authentication. After that service sends you a confirmation code on your email, phone or IM. It is the second factor of authentication.
That’s why you should set up and configure 2FA in all your accounts ASAP:
https://support.google.com/accounts/answer/185839?hl=en&co=GENIE.Platform%3DDesktop
https://www.facebook.com/help/148233965247823/
Fourth rule: Your work is copied into the cloud!
#yourlaptop
There’s nothing worse than losing all your data. Save your data in the cloud!
A good example of necessary data backup was russian hackers’ attack on Ukraine NotPetya in 2017. It is important to protect ourselves against data loss:
- in the event of a voltage jump
- device loss
- malware attack
Cloud service examples:
- Google Drive
- Apple iCloud
- DropBox
- OneDrive
Fifth rule: Security information transferring!
You should use secure communication channels for transferring sensitive data.
In this case, I want to talk about file transfer. For sensitive files you need:
- Use corporate cloud service. We by default trust service providers.
- When you make a screenshot you should hide sensitive data on a screen.
- Monitoring access to files in cloud services.
If you want to share your password or certificates you should use password management tools and implement an access management process.
For secure chatting you can use special messengers, for example Signal or KeyBase. If you don’t want to install special messengers then you should enable secure chat.
Six rule: Hide confidential information! Encrypt sensitive!
#yourlaptop
You can use the hard drive encryptions functionality of your operating systems. Full local disk encryption is a free feature of your operating systems — Windows, Linux, MacOS.
If you lost your laptop or smartphone you lost your personal sensitive information and possibly company information if you work on a personal device — accounts to corporate emails, gitlab, etc.
MacOS:
https://support.apple.com/en-us/HT204837
Linux:
https://www.linode.com/docs/guides/use-luks-for-full-disk-encryption/
Windows:
Seven rule: Separate work! Separate rest!
#yourlaptop
If you work on a personal laptop you should use two different accounts:
- The first account is for work
- The second account is for your personal life.
This approach can save you from potential problems while attacking ordinary users.
Eight rule: Use AntiVirus!
#yourlaptop
This default recommendation. The new generation of antivirus can protect computers against famous types of computer viruses.
Attention! Nowadays antivirus has 30% effectiveness! But this depends on antiviruses and additional security tools.
Choosing an antivirus is a difficult task. It depends on price, functionality, test results. But “independents” test which all companies demonstrate is only marketing. I recommend to read infromation about antoivirus efectiuvity on AV-Test.org.
Attention! Regularly update your antivirus!!!!
Nineth rule: Regular updates!
#yourlaptop
If you work on corporate devices and the company has centralized patch management you don`t have to worry about updates.
If your device doesn’t have a centralized update you should update it independently. You should enable automatically updating operating systems and applications.
Windows instructions
- use the standard tools for Window update
MacOS instructions
- enable automatically AppleStore update
- use Homebrew utility for applications which didn’t AppleStore
Linux instructions
- use a standard package manager
Tenth rule: Use licensed applications and services!
#yourlaptop
If you use cracked applications on your devices, it can be easily hacked!
Please use only licensed applications and services. Possibly you can use an open source program. In this case, it checks the repository from your upload!