I know I mentioned this previously on Facebook and Google+, but I'll do so again. I passed the CompTIA Security+ exam last Monday. The minimum required to pass was 750 out of 900, and I scored a 798 (roughly 89%). I am extremely happy that I passed it and should not have to worry about taking it again for three years. But I did want to share some thoughts to pass on to people that may be taking the test in the near future.
In my opinion it was a difficult test, at least for me. I deal with very few of the topics that were on the test on a daily business in my line of work. The problem, though is that a lot of government and corporate institutions these days are starting to require that you have this certification either before you get a particular position or within a particular time frame after you take a position (usually about six months or so). For the U.S. government (at least in the groups for which I work) you are required to have the Security+ exam regardless of your position. You are also required to have the "subject matter" certifications as well. So if you are an MS Windows systems engineer for example you need to be certified in MS Windows (which, in many cases could require six or more tests!).
I have no problem with taking a test in your area of expertise, but requiring a test with topics you don't use on a regular basis is not a good idea. This is just another one of the federal government's "cookie cutter/one size fit all" directives that really needs to be better thought out. Particularly when these tests can cost the test taker a large amount of money. Security+ exams are $302 dollars! More advanced exams can cost the test taker over $500 dollars or more! If your company reimburses you for successfully taking the test, that's great! But many companies don't do that and you usually only get reimbursed for a successful completion. Heaven forbid if you fail the exam and have to take it over again!
So how to prepare for the test? Well, hopefully you have a little experience with the subjects of the exam. And we all have different ways of preparing for exams. I'll tell you my methods.
First thing I would suggest is that you need to block off time to study. The books all recommend a minimum of six weeks of studying every day. I would agree with that assessment, but I didn't take that long. I pretty much spent four weeks studying, the whole of the month of August. Every day I spent anywhere from two to five hours studying for the exam. A lot of that time was drilling sample exam questions that would be similar to what was on the exam. But get it in your mind that the questions will be similar to what is on the exam, but in most cases are not the same. More on that later.
Don't just focus on one book to cover all the topics. No matter what the books says, something will be missing. The main book I used was CompTIA Security+ SY0-401 Cert Guide, Deluxe Edition (3rd Edition) by David L. Prowse. This is the official book put out by the Pearson testing service and, for the most part it got me through the test. By the way, if you use this book you should upgrade the the "Premier" edition for an additional $15 at the Pearson site. It gives you the book in PDF, mobi (Amazon format) and ePub formats as well as the Pearson question engine which gives you access to around nine hundred prep questions.
But don't just rely on one book! I used two other books to prepare as well as well as a thousand or so more questions and a review syllabus that a supervisor at work had from a test preparation company he used. Don't skimp if you can on preparing for the test; use any means necessary to get prepared. I'll put links to the other books in a set of links.
One other thing that you need to do is practice the simulations on the test. Not only will you have a number of questions you have to answer, there will be several simulations that you have to work on and correctly answer or configure. You might be asked to match the different kinds of social engineering OR you might have to use a set of pictures and IP addresses to configure a demilitarized zone (DMZ). Both of these came in the supplemental materials that were in the Prowse book, but there could be even more. You need to look for simulations & demo videos that simulate some of the topics on the exam and you need to have these stone cold in your memory ready to implement them when/if they appear on the exam.
Make sure you read all of the primary book you are using. Don't just skim it. There is always information in it that will help you in the exam somewhere. Then go to your "supplemental" books and questions and focus on the topics that got little or no coverage in your main book. Don't assume that if it wasn't in one book it won't be on the test.
When I was going through the practice questions, I made sure that I didn't memorize any specific answers. You can't assume that the questions on the real exam will be the same as they were on the practice exam(s) or that they will be in the same answer order. Many of the questions are also of the "choose the best X answers" style and you cannot assume they will have all the choices you had. Try to remember to get the concepts down, not the exact answer.
I did two things that helped me a lot. The first was to set up groups of flashcards with items like ports for different protocols I needed to know via a flashcard program called Quizlet. I was able to do traditional flashcard as well as matching games with some of the topics. The second thing I did was take extensive notes when I missed one of the questions I was drilling. That helped reinforce the concepts, particularly when I was trying to remember the types of authentication (and believe me, you need to have that down pat).
One of the best things you can do is set a goal/deadline date for the exam. That way you have a clear time to complete your preparations. You don't have to immediately schedule you exam, just set a deadline that you can reassess when needed. I set the last day of the month as my test date and was able to use that to focus my studying. Two weeks before the test, I assessed where I was in my preparations so I could adjust the test date if I needed to do so. I finally felt I had the confidence a week before to schedule the exam and did so.
So, what was exam day like?
Well, seem like any other day I guess. August 31 was last Monday. Saturday (about six hours, split into a four-hour session in the morning and two in the afternoon) and Sunday (straight four-hour morning session) I basically finished my review notes and the last of the sample questions. There was one simulation I was getting 90% right but never getting to 100% and I needed to get that down pat. Never did quite get it. I focused more on getting a decent amount of sleep and rest before the exam day. Nothing new, just quiet review.
I had to drive forty-five miles to the test site. You would think a major college town would have a Pearson test center. Nope. Luckily I scheduled it for mid-morning and left extra early to get there since I had not been to the test center before. I listened to a sci-fi audoibook on the way to relax me a bit. No additional review; I did not want to confuse myself. If I didn't know it already I wasn't going to know it by cramming it in at the last second.
One thing I would recommend is that you leave everything in your car that you can. Even your watch. The test centers are paranoid about people recording questions from the test. Just bring in your two forms of identification and your car keys. Lock the rest up out of sight in your car. The easiest thing to do.
So how was the test? Well, I felt like I had failed it. Really. The simulations were presented first. For some of them, I felt I was was prepared. It was the other simulations that got me worried. I did not recognize them AT ALL (Now you know why I'm telling you to find all the simulations you can and practice them like nuts). Then I went to the questions. And I felt like I was going to fail as I did not recognize a large majority of the questions. Two or three of them seemed completely familiar, the rest I felt out of my depth. I swear, when I got to the survey I thought I had failed. And they make you take the survey before you get the results.
Luckily I must have studied enough to absorb the needed knowledge or I must have had a major boost of luck on my side. I must have been one hell of a guesser, because I did pass. I was definitely relieved, that's for sure, but felt like I had passed only by the skin of my teeth. Yes, a pass is a pass, but I thought the margin was TOO close for comfort. But pass I did.
OK, I think that's enough for now. I'll provide my opinions on "after the test" topics in the next couple of days. I hope some of you find my observations useful.
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
19 August 2015
What's with All the Hoopla over a Email Server?
I'm sure you've noticed on the news recently that Congress is making a big deal about use of a email server by Hillary Clinton that was not vetted by the the various security apparatuses of the federal government. Many of you probably think it is politically motivated. Some of it probably is. We are political animals after all. But it really is a security issue if the former Secretary of State did send email that was supposed to be classified to an unclassified server that was not in a secure location.
So what's the big deal about classification? Well, it can be. Governments, other organizations, businesses, and individuals need to keep certain information private. There is information out there that should never be shared with anyone. Disclosure of certain information could lead to harm of that (for lack of a better word to call all these groups) actor. An actor needs to keep track of all information, decide how certain information should be protected (if it needs to be protected), how that information can be sent to allied actors, and how that information could harm the actor's property. This includes the actor's very life.
That's where classification comes in. Classification shows whether the information if released would harm the actor and the how much harm may be caused if the information comes to light. It ranges from little or no harm at all to life-threatening. That might seem like a bit too much melodrama, but that's basically the gist.
Let's take an example (you non-capitalists won't like this). Company A has come up with this really nice production process that could revolutionize the cell phone industry. If a competitor was able to get a copy of the plans for the process and get it up and running Company A could lose millions of dollars in profits. So Company A decides it needs to keep the process secret for a few years to maximize the profits.
How is information classified? Well, that is decided by an organization but it may also have to abide by government rules. HIPAA, for example, requires by law that all patient medical records need to be kept classified and protected so that the patients aren't harmed by the release of that information. If patient information is classified, a medical professional can be punished by a number of different methods for unknowingly releasing the information, including fines and prison time.
In the case of the federal government, there are several basic levels. Unclassified (which isn't really a level) means that no harm will come to the United States if the information is released to the public. Classified means that the information needs to be kept out of the public eye but no real harm would to the government would occur. Secret means that the information could cause some sort of harm to the government, and Top Secret means the information would cause an extreme amount of harm to the government. There are other levels and divisions within the basic levels I mentioned. It is a extremely complicated and convoluted process.
So what does this have to do with Hillary Clinton's server? Well, a lot. The question is what sort of information was contained that was sent to and from the server in question? For example (I'm not saying there was that information.) what if there was information in any of those emails on the Bengazi incident that the White House had deemed secret or top secret? That sort of information would have required the email be strongly encrypted and probably not even sent outside the federal government network. It would have had to be sent to a device that had been cleared to accept that sort of information. Those devices would have had top-of-the-line security that would protect the information from outside sources and even destroy the information if the device had been lost.
I've heard rumor that the server in question was just hidden in the bathroom closet of a mom-and-pop store or home somewhere in Colorado. If this was the case, then there is a problem. The server should have
If the server was not properly vetted for use as a classified server or better, than Hillary Clinton did break federal law, even if she inadvertently sent a piece of classified to or received from it. And she would have known better because she would have received the same training on the classification of data and acceptable use of resources that every federal employee and contractor receives every year at a minimum. Just because she was a senior cabinet member would not absolve her of this fact, partly because it would be her responsibility to insure all her employees received that training and were aware of the proper directives of her organization. Not doing so would make her negligent in her position and she should have been reprimanded.
Is this a minor thing that should be swept under the rug? I guess that's up to Congress and the White House to decide. But in my opinion it needs to be seriously investigated. The security of our country could be compromised.
So what's the big deal about classification? Well, it can be. Governments, other organizations, businesses, and individuals need to keep certain information private. There is information out there that should never be shared with anyone. Disclosure of certain information could lead to harm of that (for lack of a better word to call all these groups) actor. An actor needs to keep track of all information, decide how certain information should be protected (if it needs to be protected), how that information can be sent to allied actors, and how that information could harm the actor's property. This includes the actor's very life.
That's where classification comes in. Classification shows whether the information if released would harm the actor and the how much harm may be caused if the information comes to light. It ranges from little or no harm at all to life-threatening. That might seem like a bit too much melodrama, but that's basically the gist.
Let's take an example (you non-capitalists won't like this). Company A has come up with this really nice production process that could revolutionize the cell phone industry. If a competitor was able to get a copy of the plans for the process and get it up and running Company A could lose millions of dollars in profits. So Company A decides it needs to keep the process secret for a few years to maximize the profits.
How is information classified? Well, that is decided by an organization but it may also have to abide by government rules. HIPAA, for example, requires by law that all patient medical records need to be kept classified and protected so that the patients aren't harmed by the release of that information. If patient information is classified, a medical professional can be punished by a number of different methods for unknowingly releasing the information, including fines and prison time.
In the case of the federal government, there are several basic levels. Unclassified (which isn't really a level) means that no harm will come to the United States if the information is released to the public. Classified means that the information needs to be kept out of the public eye but no real harm would to the government would occur. Secret means that the information could cause some sort of harm to the government, and Top Secret means the information would cause an extreme amount of harm to the government. There are other levels and divisions within the basic levels I mentioned. It is a extremely complicated and convoluted process.
So what does this have to do with Hillary Clinton's server? Well, a lot. The question is what sort of information was contained that was sent to and from the server in question? For example (I'm not saying there was that information.) what if there was information in any of those emails on the Bengazi incident that the White House had deemed secret or top secret? That sort of information would have required the email be strongly encrypted and probably not even sent outside the federal government network. It would have had to be sent to a device that had been cleared to accept that sort of information. Those devices would have had top-of-the-line security that would protect the information from outside sources and even destroy the information if the device had been lost.
I've heard rumor that the server in question was just hidden in the bathroom closet of a mom-and-pop store or home somewhere in Colorado. If this was the case, then there is a problem. The server should have
- Been in a secure location that was protected from intruders easily getting access to the server. Anyone could have just walked into the bathroom, opened the closet, opened the server and stolen the hard drives where the email was stored.
- Should have had major security on it. Everything that went onto the server would have been encrypted to make sure the emails would not be in plaintext. This would have included encrypting all the data on the hard disk(s) as well as the individual files. This would have made it extremely difficult for anyone to read the data without figuring out what was in the emails.
If the server was not properly vetted for use as a classified server or better, than Hillary Clinton did break federal law, even if she inadvertently sent a piece of classified to or received from it. And she would have known better because she would have received the same training on the classification of data and acceptable use of resources that every federal employee and contractor receives every year at a minimum. Just because she was a senior cabinet member would not absolve her of this fact, partly because it would be her responsibility to insure all her employees received that training and were aware of the proper directives of her organization. Not doing so would make her negligent in her position and she should have been reprimanded.
Is this a minor thing that should be swept under the rug? I guess that's up to Congress and the White House to decide. But in my opinion it needs to be seriously investigated. The security of our country could be compromised.
17 August 2015
Be Careful When You Click Those External Links on Facebook.
I've noticed recently that there seems to be an upswing in the number of people that take those so-called "quizzes" on Facebook. I'm not going to be derisive of anyone who takes those quizzes (I've even taken them on occasion). But I did want to comment on why you should be extremely careful when you click that link to take one of those quizzes.
It all goes back to our "friend" in the IT security world, social engineering. Getting you to click on a link is a form on social engineering, called phishing (no, English professors, its a real world in IT security circles). Phishing occurs when a individual or organization tries to get personal information out of you some way over the Internet. One such way is through email, another through web sites that pique your interest. The best known of these scams is the Nigerian email scam (you know, the one where you get an email from someone who says you won Country X's lottery, a relative you've never heard of died and left you a BIG inheritance, etc. You just have to provide personal information to get it transferred to your bank account).
Most of the time phishing is sent like spam; you aren't specifically targeted. But if the attempt is more narrowly focused it is known as spear phishing. And if the target is very well-known or well-off (like the CEO of a company or a big-time politician) then you have a case of whaling. Phone scams that attempt to get personal information is called vishing. Boy, these IT security guys come up with some wonderful names for this stuff, don't they.
So what does that have to do with you answering quiz answers on Facebook? Well now, every time you click on one of those links that takes you to an external quiz, you are passing on information to the site to which you are trying to connect. That usually includes information about you, your location via your IP address (even if you are attached to a Facebook server that information is stored on that server somewhere), etc.
It's even worse when you click on one of those quizzes that asks you to link your Facebook account to the site. Now you've even provided the site with ALL the information that is currently stored on your Facebook profile, including your Friends lists, any contact information you have in your account, and even personal information such as your birthday, your home location, etc. You've just opened yourself up to them.
So now the quiz site has access to all the information on your Facebook profile and page. What can they do with it? The least you'll have to worry about is spam. The worst is that you could lose you digital identity. Now they can use the information for impersonation purposes to get additional personal information on you, such as impersonating a government official, bank officer, etc. They may not have your birthday or social security number yet, but it doesn't take much for them to impersonate someone who can get that information.
Many of those places can also contain all sorts of malware. Once you link to the site you have opened up your computer to all sorts of threats from viruses, worms, Trojans, etc. Now you have even more headaches to worry about.
So what can you do? Well, first thing would be to make sure you don't do any of those quizzes that pop up again especially those quizzes that ask you for access to your Facebook profile or ask to post to you Facebook profile. I know you want everyone to know you are the modern Dumbledore, Captain Kirk, or have the soul of a arctic wolf because an unscientific quiz told you that you were. But is it really worth your digital identity to do that?
The next thing I would do is make sure your antivirus and firewall software is up-to-date. You want your software to catch any new little "visitors" into your computer system. If at all possible, you want to make sure you have a clean and up-to-date copy of your antivirus on a removable hard drive and USB drive that you can run every so often. Your antivirus and firewall can be infected just like any other program on your computer. The external antivirus will be slower than when it is installed on your computer, but it can still detect and address any problems that might appear and that your the antivirus you have installed on the computer missed.
I'm not saying stop trying out quizzes. Just be careful when you do one of the quizzes knowing that you could be opening your digital identity to all sorts of trouble.
It all goes back to our "friend" in the IT security world, social engineering. Getting you to click on a link is a form on social engineering, called phishing (no, English professors, its a real world in IT security circles). Phishing occurs when a individual or organization tries to get personal information out of you some way over the Internet. One such way is through email, another through web sites that pique your interest. The best known of these scams is the Nigerian email scam (you know, the one where you get an email from someone who says you won Country X's lottery, a relative you've never heard of died and left you a BIG inheritance, etc. You just have to provide personal information to get it transferred to your bank account).
Most of the time phishing is sent like spam; you aren't specifically targeted. But if the attempt is more narrowly focused it is known as spear phishing. And if the target is very well-known or well-off (like the CEO of a company or a big-time politician) then you have a case of whaling. Phone scams that attempt to get personal information is called vishing. Boy, these IT security guys come up with some wonderful names for this stuff, don't they.
So what does that have to do with you answering quiz answers on Facebook? Well now, every time you click on one of those links that takes you to an external quiz, you are passing on information to the site to which you are trying to connect. That usually includes information about you, your location via your IP address (even if you are attached to a Facebook server that information is stored on that server somewhere), etc.
It's even worse when you click on one of those quizzes that asks you to link your Facebook account to the site. Now you've even provided the site with ALL the information that is currently stored on your Facebook profile, including your Friends lists, any contact information you have in your account, and even personal information such as your birthday, your home location, etc. You've just opened yourself up to them.
So now the quiz site has access to all the information on your Facebook profile and page. What can they do with it? The least you'll have to worry about is spam. The worst is that you could lose you digital identity. Now they can use the information for impersonation purposes to get additional personal information on you, such as impersonating a government official, bank officer, etc. They may not have your birthday or social security number yet, but it doesn't take much for them to impersonate someone who can get that information.
Many of those places can also contain all sorts of malware. Once you link to the site you have opened up your computer to all sorts of threats from viruses, worms, Trojans, etc. Now you have even more headaches to worry about.
So what can you do? Well, first thing would be to make sure you don't do any of those quizzes that pop up again especially those quizzes that ask you for access to your Facebook profile or ask to post to you Facebook profile. I know you want everyone to know you are the modern Dumbledore, Captain Kirk, or have the soul of a arctic wolf because an unscientific quiz told you that you were. But is it really worth your digital identity to do that?
The next thing I would do is make sure your antivirus and firewall software is up-to-date. You want your software to catch any new little "visitors" into your computer system. If at all possible, you want to make sure you have a clean and up-to-date copy of your antivirus on a removable hard drive and USB drive that you can run every so often. Your antivirus and firewall can be infected just like any other program on your computer. The external antivirus will be slower than when it is installed on your computer, but it can still detect and address any problems that might appear and that your the antivirus you have installed on the computer missed.
I'm not saying stop trying out quizzes. Just be careful when you do one of the quizzes knowing that you could be opening your digital identity to all sorts of trouble.
12 August 2015
Report on Cyberattacks and the Human Factor
Watched this report today at lunch. It was interesting and worth watching. I know that some of you have a bias against certain news networks. Try not to dismiss this report out of hand and ignore any of the finger pointing that is in the report. Instead focus on what the report is actually about when you watch it. I think the gentleman being interviewed is trying to stay on point in the interview.
Anyway, it's up to you, of course. The topic is important. It's worth a few minutes to watch.
The sound gets really bad toward the end and there is a thirty-second commercial at the start. I just wanted to give you a fair warning there.
Did Russian hackers break into Pentagon servers?
Anyway, it's up to you, of course. The topic is important. It's worth a few minutes to watch.
The sound gets really bad toward the end and there is a thirty-second commercial at the start. I just wanted to give you a fair warning there.
Did Russian hackers break into Pentagon servers?
11 August 2015
What Do I Think about Password Manager Applications?
A classmate from high school (yes, I know, that was a long time ago. But I know it wasn't as long ago as some of you out there, now is it?) asked me a question based on my last blog post. My classmate was wondering what I thought about password manager applications that are out there on the World Wide Interwebs. I asked her if I could ruminate for a little while on that.
Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before. I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers. I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through). However, I do know where it is at all times and up to now it works for me.
But maybe I really should change that attitude a bit. I'm getting old and these hands are starting to cramp up sometimes. Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes. I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.
So, what is a password manager application? Well, it's exactly what is says to be for the most part. You can keep your passwords in it. But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc. Pretty much anything you can think of can go into the manager application. There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category. There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.
So, do you need one? Well, that's up to you. Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time? Sounds like a good reason to me to get it. Just be careful.
Remember that a password manager is a program like any other. Any program can be modified. A program's security can be cracked. You're only as safe as the encryption that exists on the program. But don't let that scare you off, OK?
One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords. mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use. Remember, you want as long as possible) with different character types. The only thing I would add would be to allow you to start the password with a letter. A lot of applications out there don't like it if you start a password with a number or special character.
You need to take the time and research which one is right for you. There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications. Whichever one you want to try is up to you.
My suggestion (and there are really ONLY my suggestions!) are this:
I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications. I'll update this once I do more research if I have any better ideas.
mSecure Password Manager
Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before. I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers. I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through). However, I do know where it is at all times and up to now it works for me.
But maybe I really should change that attitude a bit. I'm getting old and these hands are starting to cramp up sometimes. Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes. I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.
So, what is a password manager application? Well, it's exactly what is says to be for the most part. You can keep your passwords in it. But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc. Pretty much anything you can think of can go into the manager application. There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category. There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.
So, do you need one? Well, that's up to you. Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time? Sounds like a good reason to me to get it. Just be careful.
Remember that a password manager is a program like any other. Any program can be modified. A program's security can be cracked. You're only as safe as the encryption that exists on the program. But don't let that scare you off, OK?
One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords. mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use. Remember, you want as long as possible) with different character types. The only thing I would add would be to allow you to start the password with a letter. A lot of applications out there don't like it if you start a password with a number or special character.
You need to take the time and research which one is right for you. There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications. Whichever one you want to try is up to you.
My suggestion (and there are really ONLY my suggestions!) are this:
- Do the research. Already mentioned that. 'Nuff said.
- Make sure whatever program you decide to get, make sure it has the strongest encryption possible. Encryption is the part of the program that is going to hide the data by making it unreadable. That encryption really needs to be tough to crack to protect your passwords! My suggestion is that you make sure the program uses AES256 or 256-bit Blowfish, which is the federal government's encryption standard and has been very successful since it was developed several years ago.
- Don't be a cheapskate. Pay the money for the program. A lot of the free or trail versions are probably good and will do the job. But honestly, this IS your digital life you're trying to protect. If the paid version has some additional features that will secure you data I would go for it and pay for the full version.
- Make sure you put a strong password on that password manager application. If you don't put a strong password on your password manager the hacker won't need to break the encryption. He'll already be in your password manager.
I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications. I'll update this once I do more research if I have any better ideas.
mSecure Password Manager
09 August 2015
Passwords and Security - Why Can't I Use Puppy-Boo-Boo's Name as My Password?
Well now, my first real blog post, and less that ten minutes after my first! Bet you didn't see THAT coming, did you? Actually, I promised this post on Facebook, so many of you I think probably did expect it, didn't you. OK, OK, I'll stop rambling and get to it.
The background on this post is based on two sources. One is that recently a relative remarked having an email account hacked. The relative will remain anonymous. This occurred about the same time that I was studying one of the chapters for the COMPtia Security+ exam (SY-401) to update one of my IT certifications. So I decided that I should try to impart some wisdom related to the problem since may of you readers (those of you in IT or with some experience are excluded) don't really deal with the issue a lot. You can guess the topic from the post's name I hope.
You've probably heard it on the news in quick little morning show segments that try to put a nice face on the problem, but the point is usually pretty important. Sometimes the information is really good. But you can never really tell if the segments are any good. But I digress.
You really need to pay attention when you are designing your own passwords. Yes, the statement so important I needed to bold and underline it. Usernames and passwords are the way computer systems identify that you are you to put it simply. The pair acts as the key to the gateway that is your identity in the digital world. If someone is able to guess your password easily through either a brute-force method (where they are able to guess your password) or through a password-cracking program, they have the ability to become you. Yes, identity theft in the simplest description.
So, here are some recommended things that I have learned and I hope you consider when creating a new password.
Oh, and this includes items such as your wireless routers at home. You really need to set up the password on that router if you haven't done so and make sure you set up the encryption correctly with long wireless keys to insure someone isn't able to break into your network and use it for his/her own purposes. There are people who will go around with wireless antenna searching for wireless signals that are easy to crack or are wide open.
Well, that's enough for now I think. If you haven't been bored senseless I hope you find it of some interest or help.
References:
The background on this post is based on two sources. One is that recently a relative remarked having an email account hacked. The relative will remain anonymous. This occurred about the same time that I was studying one of the chapters for the COMPtia Security+ exam (SY-401) to update one of my IT certifications. So I decided that I should try to impart some wisdom related to the problem since may of you readers (those of you in IT or with some experience are excluded) don't really deal with the issue a lot. You can guess the topic from the post's name I hope.
You've probably heard it on the news in quick little morning show segments that try to put a nice face on the problem, but the point is usually pretty important. Sometimes the information is really good. But you can never really tell if the segments are any good. But I digress.
You really need to pay attention when you are designing your own passwords. Yes, the statement so important I needed to bold and underline it. Usernames and passwords are the way computer systems identify that you are you to put it simply. The pair acts as the key to the gateway that is your identity in the digital world. If someone is able to guess your password easily through either a brute-force method (where they are able to guess your password) or through a password-cracking program, they have the ability to become you. Yes, identity theft in the simplest description.
So, here are some recommended things that I have learned and I hope you consider when creating a new password.
- You should make your password as long as possible. Most experts recommend a minimum length of eight characters (letters, numbers, "special" like &*%$, etc.). Some suggest as long as fourteen characters as a minimum. This makes it almost impossible for a hacker to guess using a brute-force method and almost impossible using a password-cracking program (if the computer has enough processing power any password can be cracked given enough time).
- The password should be made up of a combination of characters. There needs to be at least one lowercase letter, one uppercase letter, one number, and one "special" character. This makes the password more complex and harder to crack.
- Don't use a password that you can find in the dictionary without altering it in some way. Many of the password cracking programs will search through tables that have all the words of the entire dictionary stored. It will take a while for the program to search for the word, but it will find it. So if you, say use the word stealthy, you need to alter it in such a what that it can't be easily recognize, such as, for example, s7&aL7y*!4.
- Definitely don't use a word that someone can associate with you. You have all heard the term "social engineering" I hope. There are people out there who use methods to learn your habits any lifestyle just to somehow get into your digital life. The methods could be anything like flattery, bullying, impersonating friends and loved ones over email. Those are just a couple of the ways If you use something like your child's name, pet's name, your profession, anything that is associated with your life you are helping the social engineer to discover a way into your digital life.
- Do your best not to write your password down. If you do write it down, do NOT put it on a "sticky note" or an item out in the open for someone to discover. I know, passwords, especially long ones can be hard to remember. Everyone wants to put the password somewhere so it can be easily accessed. But it should never be out in the open or somewhere that is easily accessible to anyone who can walk into your office. If you have to write it down, write it down somewhere no where near your computer that someone cannot easily access it. If you keep it on you smart phone, get a password storage program that will encrypt the password (make it difficult to read). Regardless, guard that password like it is life or death since IT IS YOUR DIGITAL LIFE.
- Don't use the same password for all of you online sites. If someone guesses your password and you used it at multiple places, it won't take much for the hacker to discover the other places you have accounts and get access to those other accounts.
- Don't share your password with others unless you absolutely trust them. Even then don't do it. You don't want them to accidentally give it to someone else.
- Change your passwords as often as possible. The longer a password is out there, the more likely it will be discovered.
- When you change your password, don't use the same one over and over again. If you change the password to the same one as before, you're not really changing the password and you have the same problem as mentioned in the previous step.
Oh, and this includes items such as your wireless routers at home. You really need to set up the password on that router if you haven't done so and make sure you set up the encryption correctly with long wireless keys to insure someone isn't able to break into your network and use it for his/her own purposes. There are people who will go around with wireless antenna searching for wireless signals that are easy to crack or are wide open.
Well, that's enough for now I think. If you haven't been bored senseless I hope you find it of some interest or help.
References:
Subscribe to:
Posts (Atom)