NWA-PCUG Newsletter Article, October 2012
October is National Cyber Security Awareness Month
By Ira Wilsker, Radio Show Host,
Columnist, College Professor and deputy sheriff
iwilsker@sbcglobal.net
(click to email author)

WEBSITES:
http://www.dhs.gov/national-cyber-security-awareness-month
http://staysafeonline.org/ncsam
http://staysafeonline.org/ncec/ (Educational information K-12 and College)
http://msisac.cisecurity.org
http://www.stopthinkconnect.org
http://www.prnewswire.com/news-releases/new-national-cyber-security-awareness-month-web-portal-offers-wealth-of-resources-to-stay-safe-online-169306026.html
http://staysafeonline.org/ncsam/events
https://www.facebook.com/staysafeonline
http://www.prweb.com/releases/cybersecuritytraining/cybersecurityconference/prweb9920629.htm
http://www.microsoft.com/security/resources/cybersecurity.aspx

Regular readers of this column are well aware that one of the most frequent topics covered is cyber security. Most computer users are blissfully unaware of the degree of cyber crime that is currently taking place, and the current threats to our computing safety. Virtually all computing devices are at substantial risk, regardless of operating system; Mac computers have recently become the targets of a large number of types of malware; Android devices, smart phones and tablets, are now being attacked at alarming rates; iOS devices (iPhones and Apple tablets) are likewise falling prey to malware attacks; Windows powered devices continue to be widely targeted due to the prominence of Microsoft operating systems (XP, Vista, Windows 7, and now Windows 8). According to Troels Oerting, the new chief of the European Union's (EU) European Cybercrime Centre (as quoted on EUobserver.com, September 17, 2012), " There is no absolute security, it is a myth." Oerting went on to describe, " ... that more than 200 billion spam emails are being sent every day and that 46 new malicious codes aimed to steal online data are being created every second. Foreign intelligence services are among the long list of culprits who increasingly use the Internet to steal data to gain inside advantages on trade. Activists, hackers and organised crime are also becoming more active."

Cyber security is a concern and a necessity at all levels. While computers and networks operated by governments, businesses, academia, and other associations and agencies have been prime targets of cyber attack, the number and rate of attacks on privately owned personal computers and smart devices has become explosively endemic. While cyber security and safety is a responsibility of all computer and smart device users, the federal government along with a variety of private and public partners has promoted "National Cyber Security Awareness Month" (NCSAM) for many years. Traditionally, the President of the United States had inaugurated NCSAM with a presidential declaration calling on everyone to be aware of cyber security, and to take all appropriate precautions to secure their digital devices from attack. During October, 2012, there will again be a national effort to encourage and promote cyber security.

This year, the lead federal agency promoting Cyber Security Awareness Month will be the Department of Homeland Security (DHS), which will be coordinating events and activities with the National Cyber Security Alliance (NCSA) and the Multi-State Information Sharing and Analysis Center (MS-ISAC). According to the DHS, this joint operation, " ... encourages Americans to ACT – Achieve Cybersecurity Together – reflecting the interconnectedness of the modern world and the responsibility each of us in securing cyberspace."

One may ask himself, "So what can I really do to help the cyber security effort?" The various agencies working together have come up with a list of actions and activities all computer and smart device users should implement. One of several behaviors encouraged by the alliance is to "STOP, THINK, CONNECT" (http://www.stopthinkconnect.org). According to the alliance, all users should: "STOP: Before you use the Internet, take time to understand the risks and learn how to spot potential problems. THINK: Take a moment to be certain the path ahead is clear. Watch for warning signs and consider how your actions online could impact your safety, or your family’s. CONNECT: Enjoy the Internet with greater confidence, knowing you’ve taken the right steps to safeguard yourself and your computer. Protect yourself and help keep the web a safer place for everyone."

There are several definitive steps that users can take to implement and improve the security of their digital devices. According to a Microsoft webpage devoted to the National Cyber Security Awareness Month (http://www.microsoft.com/security/resources/cybersecurity.aspx), there are six major practices that we should all accomplish in order to improve our cyber safety and security. Microsoft's first recommendation is to defend your computer by strengthening your computer's defenses, and not to be tricked into downloading malicious software. While these first recommendations may seem to be common sense for most computer users, these recommendations are also some of the least implemented. In order to defend our computers and other devices from attack, we need to keep all software (especially web browsers) up to date; install legitimate and comprehensive security software and keep it current with the latest updates (most security publishers now push hourly or continuous updates); use and never turn off the firewall; be sure to have a hard to guess password on your router (and my urging to implement the highest level of encryption available on your wireless access point or device); and to use USB and other flash memory devices cautiously, as they have become a major vector for passing malware between computers and other devices. Microsoft also warns, "Think before you open attachments or click links in an email message, an instant message (IM), or on a social network, even if you know the sender." Much of the spam and malware being disseminated appears to come from someone we know, as their computers, instant messaging account, address books, or email accounts have been hijacked, and used to spread malware and spam to others, under the guise that it is OK because it is from someone you know. Another component of this second recommendation is to never click on links or buttons that appear in pop-up windows.

Identity theft and related financial crimes has become a huge source of revenue for cyber crooks the world over, and Microsoft covers this in its second recommendation, "Protect Sensitive Information." Microsoft warns users that before they enter any sensitive data on a website or online form, look for indications that the webpage is secure, such as the web address beginning with "https" rather than "http", and some indication from the browser that the connection is secure. Most browsers use a padlock (clearly open or closed) or some similar indication of a secure connection. Another common trick to steal personal information, such as usernames, passwords, banking and credit card information, and other personal information is commonly referred to as "Phishing", where identity thieves attempt to trick the user into disclosing personal information. Much of this phishing is by way of emails informing the user that their email account will be locked unless they respond with their username and password; apparently legimate (but false) contacts from retailers, credit card companies, banks and other institutions asking for personal credit card or bank account information; offers of riches in exchange for helping some foreign official or widow to place investments in this country; foreign lottery winnings; and a variety of other scams. One of the latest common scams is known as "ransomware", where the user's computer is locked, and a warning from the FBI or other law enforcement agency appears on the screen informing the user that unless he pays a "fine", typically $200, his computer will remain locked, and he will be prosecuted for several felonies, including possessing child pornography.

Similar requests for personal information that can be abused often arrives in instant messages or social networking postings. Another common email scam is a post apparently from a friend or relative that claims they lost their wallet, checkbook, passport, return airline tickets, and credit cards while visiting a foreign country, and are stranded unable to return home. This recognizable friend or relative then asks you to make him a loan and wire a large sum of money to him such that he can get home; of course, "I will pay you back as soon as I get home." The problem is that this is a complete fraud, and that friend or relative overseas is a name stolen from a hijacked email account or address book! Also be aware of phone calls claiming to be from Microsoft (or a recognizable computer security company) telling you that your computer is infected with a virus, and that either for free or for a fee charged to your credit card, they will remotely access your computer and clean it for you, "so please give us remote access to your computer". Not just will they not clean your computer of malware, but they will likely plant malware on your computer as well as access and steal all of your personal data and information on your machine.

Third on Microsoft's list of recommendations is to create strong passwords, and keep them secret. Passwords should be complex long phrases, consisting of upper case (capital) and lower case letters, along with numbers and symbols. These passwords should not be easy for other to guess like permutations of your name, address, phone number, kids names and birthdays; pets' names; and other information that can be easily obtained through public or online resources. It is also necessary to utilize different passwords on different websites, such that if one website is compromised, it will not adversely impact your passwords and accounts on other websites. Microsoft emphasizes that it is especially important to use different complex passwords on websites that contain your financial information, such as banking, credit card, and shopping websites.

Number four from Microsoft is "Take charge of your online safety and reputation. Discover what is on the Internet about you and periodically evaluate what you find." What others say about you online in social networking services, blogs, and even eBay user ratings can adversely impact your online reputation. It is important to both maintain a positive online reputation, and correct erroneous postings about you, but be careful not to fall into someone's trap and disclose too much personal information.

In its fifth security recommendation, Microsoft urges that users exercise care when using social networks, such as Facebook and Twitter. All of the legitimate social networking services offer "settings" or "options" where users can set and manage their privacy and security settings. Users should control who can access their private information, what private information is available, and how others can search for your information. It may often be very appropriate to block other people from viewing your information. In addition to Microsoft's suggestions, I would also add do not post information that you are out of town, on vacation, or even at a movie or at dinner, as burglars and other literal crooks read Facebook and Twitter looking for empty homes to burglarize. Turn off the GPS in your digital camera or Smartphone before taking pictures that you want to post on a social networking site, such as Facebook, or otherwise strip off the GPS information, as crooks and pedophiles have been well known to use the GPS information encoded in digital photographs posted online to locate homes, cars, valuables, and children for the purposes of victimization. An old cliché' says "Don't do anything that you would not want your grandmother to read in the newspaper," and that applies to social media postings as well.

Number six from Microsoft says, "Take extra steps to help keep kids safer online." Online safety and security must be a family effort, and incorporate some mix of guidance and monitoring. Microsoft suggests that, " (Parents) negotiate clear guidelines for web and online game use that fit your kids' maturity and your family's values. Pay attention to what kids do and who they meet online." Pedophiles and identity thieves troll chat rooms, social networking websites, blogs, and other online resources looking for potential victims. Parents and children need to be cognizant of the risks and educated in what to watch for that may indicate potential risks to children. Children must never disclose personal information to anyone, especially others who claim to be the same age and gender as the child (pedophiles often pretend to be a child in order to gain the confidence of the potential victim). Identity thieves try to gain the trust of children and trick them into disclosing private family information; residential burglars will do the same, asking the child about vacation or dinner plans; "We are going out for pizza and then a movie" tells the burglar that the house may be a good target. Children should never go to meet someone face to face that they met online, unless under the direct supervision and participation of a parent.

There are a number of National Cyber Security Awareness Month events posted online (staysafeonline.org/ncsam/events), several of which will be streamed free over the internet. There are also free materials available for parents, teachers, children, and businesses that can be used in a variety of environments for educating others (staysafeonline.org/ncsam). While October is officially National Cyber Security Awareness Month, every month should be a NCSAM. Stop, think, and connect properly, and stay safe online.


Click here to return to top
====================================================================

==================================================================