Today is one of those days some of us mark as watersheds in our lives. Sometimes those days are just personal and only have an effect on our immediate lives or the lives of those closest to us. And some will have an effect on much larger numbers of us. I guess this day is a little of both for me.
This was the day that Hurricane Katrina hit the Gulf Coast back in 2005. Mississippi, Alabama, and much of southeastern Louisiana were devastated. The much vaunted levee system maintained by the U. S. Army Corps of Engineers (which had never been tested before by a storm of that magnitude) failed, devastating much of St. Bernard, Orleans, Jefferson, and Plaquermines parishes in Louisiana. If the hurricane had jogged just a little more west as it was originally plotted to go it was have literally wiped New Orleans and southeast Louisiana from the face of the map, especially if the the nightmare scenario of the hurricane going up the mouth of the Mississippi river would have occurred.
I think about what happened quite often, usually on the anniversary of the event. I can't help but do that because August 29th just happens to also be the birthday of my late maternal grandmother, Geraldine. No, thank God, she did not lose her life in Katrina. It is just a bad association I have to make every year at this time.
I was one of the lucky people. I was living outside New Orleans at the time and was able to heed the warnings. The majority of my family lives on the north shore of Lake Ponchatrain in St. Tammany Parish. I got my grandmother out of the city and to my parents' home two days before the hurricane was forecast to hit (luckily it was a weekend so people had time to prepare and evacuate if they could). So personally, my grandmother and I were fine, riding out the storm at my parents' home.
I pretty much lost all of my possessions, as did my grandmother. Although there wasn't a whole lot of really bad flooding in my part of the suburbs, my apartment did get enough water into it to ruin the apartment and I lost all of my possessions. My brother could not get into my apartment for a month after Katrina. By that time he said he had to were a filter mask to go into the apartment because of the toxic mold that had built up. My grandmother lost everything as well, including her apartment which was in the brunt of the flooding in Canal Street.
Some of my co-workers weren't so lucky. A few months after I had heard that one of them had died during the height of the storm in St. Bernard Parish. She had not evacuated and had literally drowned. She was found in her home with her family covered in dried mud when they finally found her. She was a kind, quiet and shy soul. Just one of the 1800 lost to us I guess.
As I said, I was one of the really lucky ones. I lost possessions, but because of the nature of my work, I still had a job and I still had a car. The job got temporarily relocated to Fort Worth, where I spent seven months after Katrina literally setting up equipment that was being salvaged from New Orleans to insure others could work. The company I worked for insured we were still paid and had a roof over our heads (not to be sarcastic, but they could afford it because they were charging back to the government). It was tough to leave, but I felt I had to do it.
Let's get something straight here. Louisiana is home. It's where the majority of my family is and has always been. But after what happened after Katrina I realized I wanted to be elsewhere, at least for a while. I decided living in the proverbial bullseye of the "Storm of the Century" was enough for one lifetime. It was time to look at things elsewhere.
At the time I would rather have been somewhere like Dallas-Fort Worth or even Houston since it was closer to the family. But as luck would have it I got a job in Richmond VA, somewhere I had never been before in my life (closest I had been was Washington D.C.). It was a tough decision, but I think it was a good one. So in 2006 I moved to the mid-Atlantic and have been there since.
It's definitely been interesting since the move. Moved twice since moving to Virginia and changed jobs twice. Been two high school reunions in that time, the 25th and the 30th. I've lost an uncle on both sides of my family to cancer. My parents have celebrated their 50th wedding anniversary and both have turned seventy. Once niece popped into existence and seems to be a gymnastics phenom while the older niece seems to be a math geek while trying to be Mark Spitz (I guess I should say Ryan Phelps instead).
The tough loss was the death of my maternal grandmother only a few short months after her 90th birthday. But I think it started shortly after Katrina. Although it really wasn't anything really out in the open, what happened in Katrina really affected her. After the storm she was a little less lively and she wasn't as healthy. Her mobility seemed to deteriorate a lot and she lost a lot of her independence. I keep thinking that if the storm hadn't hit when it did she might still be around today and still have some of the fire and independence she had.
I've rambled enough on this subject today. For that I am sorry. But I felt I needed to make an acknowledgement of my own on this anniversary. If you did get through the whole of this long-winded, rambling post, I commend you on your perseverance and mental fortitude. I won't blame anyone who could not (but then, since you couldn't make it through the post you didn't get to this point, did you?).
29 August 2015
19 August 2015
What's with All the Hoopla over a Email Server?
I'm sure you've noticed on the news recently that Congress is making a big deal about use of a email server by Hillary Clinton that was not vetted by the the various security apparatuses of the federal government. Many of you probably think it is politically motivated. Some of it probably is. We are political animals after all. But it really is a security issue if the former Secretary of State did send email that was supposed to be classified to an unclassified server that was not in a secure location.
So what's the big deal about classification? Well, it can be. Governments, other organizations, businesses, and individuals need to keep certain information private. There is information out there that should never be shared with anyone. Disclosure of certain information could lead to harm of that (for lack of a better word to call all these groups) actor. An actor needs to keep track of all information, decide how certain information should be protected (if it needs to be protected), how that information can be sent to allied actors, and how that information could harm the actor's property. This includes the actor's very life.
That's where classification comes in. Classification shows whether the information if released would harm the actor and the how much harm may be caused if the information comes to light. It ranges from little or no harm at all to life-threatening. That might seem like a bit too much melodrama, but that's basically the gist.
Let's take an example (you non-capitalists won't like this). Company A has come up with this really nice production process that could revolutionize the cell phone industry. If a competitor was able to get a copy of the plans for the process and get it up and running Company A could lose millions of dollars in profits. So Company A decides it needs to keep the process secret for a few years to maximize the profits.
How is information classified? Well, that is decided by an organization but it may also have to abide by government rules. HIPAA, for example, requires by law that all patient medical records need to be kept classified and protected so that the patients aren't harmed by the release of that information. If patient information is classified, a medical professional can be punished by a number of different methods for unknowingly releasing the information, including fines and prison time.
In the case of the federal government, there are several basic levels. Unclassified (which isn't really a level) means that no harm will come to the United States if the information is released to the public. Classified means that the information needs to be kept out of the public eye but no real harm would to the government would occur. Secret means that the information could cause some sort of harm to the government, and Top Secret means the information would cause an extreme amount of harm to the government. There are other levels and divisions within the basic levels I mentioned. It is a extremely complicated and convoluted process.
So what does this have to do with Hillary Clinton's server? Well, a lot. The question is what sort of information was contained that was sent to and from the server in question? For example (I'm not saying there was that information.) what if there was information in any of those emails on the Bengazi incident that the White House had deemed secret or top secret? That sort of information would have required the email be strongly encrypted and probably not even sent outside the federal government network. It would have had to be sent to a device that had been cleared to accept that sort of information. Those devices would have had top-of-the-line security that would protect the information from outside sources and even destroy the information if the device had been lost.
I've heard rumor that the server in question was just hidden in the bathroom closet of a mom-and-pop store or home somewhere in Colorado. If this was the case, then there is a problem. The server should have
If the server was not properly vetted for use as a classified server or better, than Hillary Clinton did break federal law, even if she inadvertently sent a piece of classified to or received from it. And she would have known better because she would have received the same training on the classification of data and acceptable use of resources that every federal employee and contractor receives every year at a minimum. Just because she was a senior cabinet member would not absolve her of this fact, partly because it would be her responsibility to insure all her employees received that training and were aware of the proper directives of her organization. Not doing so would make her negligent in her position and she should have been reprimanded.
Is this a minor thing that should be swept under the rug? I guess that's up to Congress and the White House to decide. But in my opinion it needs to be seriously investigated. The security of our country could be compromised.
So what's the big deal about classification? Well, it can be. Governments, other organizations, businesses, and individuals need to keep certain information private. There is information out there that should never be shared with anyone. Disclosure of certain information could lead to harm of that (for lack of a better word to call all these groups) actor. An actor needs to keep track of all information, decide how certain information should be protected (if it needs to be protected), how that information can be sent to allied actors, and how that information could harm the actor's property. This includes the actor's very life.
That's where classification comes in. Classification shows whether the information if released would harm the actor and the how much harm may be caused if the information comes to light. It ranges from little or no harm at all to life-threatening. That might seem like a bit too much melodrama, but that's basically the gist.
Let's take an example (you non-capitalists won't like this). Company A has come up with this really nice production process that could revolutionize the cell phone industry. If a competitor was able to get a copy of the plans for the process and get it up and running Company A could lose millions of dollars in profits. So Company A decides it needs to keep the process secret for a few years to maximize the profits.
How is information classified? Well, that is decided by an organization but it may also have to abide by government rules. HIPAA, for example, requires by law that all patient medical records need to be kept classified and protected so that the patients aren't harmed by the release of that information. If patient information is classified, a medical professional can be punished by a number of different methods for unknowingly releasing the information, including fines and prison time.
In the case of the federal government, there are several basic levels. Unclassified (which isn't really a level) means that no harm will come to the United States if the information is released to the public. Classified means that the information needs to be kept out of the public eye but no real harm would to the government would occur. Secret means that the information could cause some sort of harm to the government, and Top Secret means the information would cause an extreme amount of harm to the government. There are other levels and divisions within the basic levels I mentioned. It is a extremely complicated and convoluted process.
So what does this have to do with Hillary Clinton's server? Well, a lot. The question is what sort of information was contained that was sent to and from the server in question? For example (I'm not saying there was that information.) what if there was information in any of those emails on the Bengazi incident that the White House had deemed secret or top secret? That sort of information would have required the email be strongly encrypted and probably not even sent outside the federal government network. It would have had to be sent to a device that had been cleared to accept that sort of information. Those devices would have had top-of-the-line security that would protect the information from outside sources and even destroy the information if the device had been lost.
I've heard rumor that the server in question was just hidden in the bathroom closet of a mom-and-pop store or home somewhere in Colorado. If this was the case, then there is a problem. The server should have
- Been in a secure location that was protected from intruders easily getting access to the server. Anyone could have just walked into the bathroom, opened the closet, opened the server and stolen the hard drives where the email was stored.
- Should have had major security on it. Everything that went onto the server would have been encrypted to make sure the emails would not be in plaintext. This would have included encrypting all the data on the hard disk(s) as well as the individual files. This would have made it extremely difficult for anyone to read the data without figuring out what was in the emails.
If the server was not properly vetted for use as a classified server or better, than Hillary Clinton did break federal law, even if she inadvertently sent a piece of classified to or received from it. And she would have known better because she would have received the same training on the classification of data and acceptable use of resources that every federal employee and contractor receives every year at a minimum. Just because she was a senior cabinet member would not absolve her of this fact, partly because it would be her responsibility to insure all her employees received that training and were aware of the proper directives of her organization. Not doing so would make her negligent in her position and she should have been reprimanded.
Is this a minor thing that should be swept under the rug? I guess that's up to Congress and the White House to decide. But in my opinion it needs to be seriously investigated. The security of our country could be compromised.
17 August 2015
Be Careful When You Click Those External Links on Facebook.
I've noticed recently that there seems to be an upswing in the number of people that take those so-called "quizzes" on Facebook. I'm not going to be derisive of anyone who takes those quizzes (I've even taken them on occasion). But I did want to comment on why you should be extremely careful when you click that link to take one of those quizzes.
It all goes back to our "friend" in the IT security world, social engineering. Getting you to click on a link is a form on social engineering, called phishing (no, English professors, its a real world in IT security circles). Phishing occurs when a individual or organization tries to get personal information out of you some way over the Internet. One such way is through email, another through web sites that pique your interest. The best known of these scams is the Nigerian email scam (you know, the one where you get an email from someone who says you won Country X's lottery, a relative you've never heard of died and left you a BIG inheritance, etc. You just have to provide personal information to get it transferred to your bank account).
Most of the time phishing is sent like spam; you aren't specifically targeted. But if the attempt is more narrowly focused it is known as spear phishing. And if the target is very well-known or well-off (like the CEO of a company or a big-time politician) then you have a case of whaling. Phone scams that attempt to get personal information is called vishing. Boy, these IT security guys come up with some wonderful names for this stuff, don't they.
So what does that have to do with you answering quiz answers on Facebook? Well now, every time you click on one of those links that takes you to an external quiz, you are passing on information to the site to which you are trying to connect. That usually includes information about you, your location via your IP address (even if you are attached to a Facebook server that information is stored on that server somewhere), etc.
It's even worse when you click on one of those quizzes that asks you to link your Facebook account to the site. Now you've even provided the site with ALL the information that is currently stored on your Facebook profile, including your Friends lists, any contact information you have in your account, and even personal information such as your birthday, your home location, etc. You've just opened yourself up to them.
So now the quiz site has access to all the information on your Facebook profile and page. What can they do with it? The least you'll have to worry about is spam. The worst is that you could lose you digital identity. Now they can use the information for impersonation purposes to get additional personal information on you, such as impersonating a government official, bank officer, etc. They may not have your birthday or social security number yet, but it doesn't take much for them to impersonate someone who can get that information.
Many of those places can also contain all sorts of malware. Once you link to the site you have opened up your computer to all sorts of threats from viruses, worms, Trojans, etc. Now you have even more headaches to worry about.
So what can you do? Well, first thing would be to make sure you don't do any of those quizzes that pop up again especially those quizzes that ask you for access to your Facebook profile or ask to post to you Facebook profile. I know you want everyone to know you are the modern Dumbledore, Captain Kirk, or have the soul of a arctic wolf because an unscientific quiz told you that you were. But is it really worth your digital identity to do that?
The next thing I would do is make sure your antivirus and firewall software is up-to-date. You want your software to catch any new little "visitors" into your computer system. If at all possible, you want to make sure you have a clean and up-to-date copy of your antivirus on a removable hard drive and USB drive that you can run every so often. Your antivirus and firewall can be infected just like any other program on your computer. The external antivirus will be slower than when it is installed on your computer, but it can still detect and address any problems that might appear and that your the antivirus you have installed on the computer missed.
I'm not saying stop trying out quizzes. Just be careful when you do one of the quizzes knowing that you could be opening your digital identity to all sorts of trouble.
It all goes back to our "friend" in the IT security world, social engineering. Getting you to click on a link is a form on social engineering, called phishing (no, English professors, its a real world in IT security circles). Phishing occurs when a individual or organization tries to get personal information out of you some way over the Internet. One such way is through email, another through web sites that pique your interest. The best known of these scams is the Nigerian email scam (you know, the one where you get an email from someone who says you won Country X's lottery, a relative you've never heard of died and left you a BIG inheritance, etc. You just have to provide personal information to get it transferred to your bank account).
Most of the time phishing is sent like spam; you aren't specifically targeted. But if the attempt is more narrowly focused it is known as spear phishing. And if the target is very well-known or well-off (like the CEO of a company or a big-time politician) then you have a case of whaling. Phone scams that attempt to get personal information is called vishing. Boy, these IT security guys come up with some wonderful names for this stuff, don't they.
So what does that have to do with you answering quiz answers on Facebook? Well now, every time you click on one of those links that takes you to an external quiz, you are passing on information to the site to which you are trying to connect. That usually includes information about you, your location via your IP address (even if you are attached to a Facebook server that information is stored on that server somewhere), etc.
It's even worse when you click on one of those quizzes that asks you to link your Facebook account to the site. Now you've even provided the site with ALL the information that is currently stored on your Facebook profile, including your Friends lists, any contact information you have in your account, and even personal information such as your birthday, your home location, etc. You've just opened yourself up to them.
So now the quiz site has access to all the information on your Facebook profile and page. What can they do with it? The least you'll have to worry about is spam. The worst is that you could lose you digital identity. Now they can use the information for impersonation purposes to get additional personal information on you, such as impersonating a government official, bank officer, etc. They may not have your birthday or social security number yet, but it doesn't take much for them to impersonate someone who can get that information.
Many of those places can also contain all sorts of malware. Once you link to the site you have opened up your computer to all sorts of threats from viruses, worms, Trojans, etc. Now you have even more headaches to worry about.
So what can you do? Well, first thing would be to make sure you don't do any of those quizzes that pop up again especially those quizzes that ask you for access to your Facebook profile or ask to post to you Facebook profile. I know you want everyone to know you are the modern Dumbledore, Captain Kirk, or have the soul of a arctic wolf because an unscientific quiz told you that you were. But is it really worth your digital identity to do that?
The next thing I would do is make sure your antivirus and firewall software is up-to-date. You want your software to catch any new little "visitors" into your computer system. If at all possible, you want to make sure you have a clean and up-to-date copy of your antivirus on a removable hard drive and USB drive that you can run every so often. Your antivirus and firewall can be infected just like any other program on your computer. The external antivirus will be slower than when it is installed on your computer, but it can still detect and address any problems that might appear and that your the antivirus you have installed on the computer missed.
I'm not saying stop trying out quizzes. Just be careful when you do one of the quizzes knowing that you could be opening your digital identity to all sorts of trouble.
12 August 2015
Links for Charity that Get You Interesting Stuff
I'm a big fan of charity sites where you can donate and get something back for your donation. How does that work? Well, the site usually has several groups of items at different price levels. The higher you pledge the more you get. Proceeds in most cases go to one of more charities that the group who donates designates. Pretty neat, huh? Here are two of my favorites at the moment:
- Bundle of Holding: If you're looking to complete your collection for older games in PDF format or sometimes games still in print this is a great site. There is a basic level that is set at a particular price and a more "advanced" level where there is a sliding scale where you can get several more books beyond the basic level. The "advanced" price is based on the number of people who have donated so far. Previous offerings include an assortment of FATE RPG games, the Classic Traveller, MegaTraveller, and Mongoose Traveller games, and several items from the Deadlands role-playing game. PDFs are stored both on the Bundle of Holding's servers or on DriveThruRPG/RPGNow's servers. Really can be a bargain when you get the majority of a game line for less that on sourcebook costs these days.
- Humble Bundle: Similar methodology to the folks at Bundle of Holding. Humble Bundle, though, usually has four different bundles on sale at one time, a basic Humble Bundle, a Weekly Bundle, a Book Bundle, and a Mobile Bundle. Each of these offer different levels of pledges based on what you want to pay. The items in your bundle are stored on their servers. There is also a Humble Store where you can purchase games and other products that are different from the items in the other bundles.
Report on Cyberattacks and the Human Factor
Watched this report today at lunch. It was interesting and worth watching. I know that some of you have a bias against certain news networks. Try not to dismiss this report out of hand and ignore any of the finger pointing that is in the report. Instead focus on what the report is actually about when you watch it. I think the gentleman being interviewed is trying to stay on point in the interview.
Anyway, it's up to you, of course. The topic is important. It's worth a few minutes to watch.
The sound gets really bad toward the end and there is a thirty-second commercial at the start. I just wanted to give you a fair warning there.
Did Russian hackers break into Pentagon servers?
Anyway, it's up to you, of course. The topic is important. It's worth a few minutes to watch.
The sound gets really bad toward the end and there is a thirty-second commercial at the start. I just wanted to give you a fair warning there.
Did Russian hackers break into Pentagon servers?
11 August 2015
What Do I Think about Password Manager Applications?
A classmate from high school (yes, I know, that was a long time ago. But I know it wasn't as long ago as some of you out there, now is it?) asked me a question based on my last blog post. My classmate was wondering what I thought about password manager applications that are out there on the World Wide Interwebs. I asked her if I could ruminate for a little while on that.
Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before. I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers. I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through). However, I do know where it is at all times and up to now it works for me.
But maybe I really should change that attitude a bit. I'm getting old and these hands are starting to cramp up sometimes. Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes. I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.
So, what is a password manager application? Well, it's exactly what is says to be for the most part. You can keep your passwords in it. But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc. Pretty much anything you can think of can go into the manager application. There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category. There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.
So, do you need one? Well, that's up to you. Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time? Sounds like a good reason to me to get it. Just be careful.
Remember that a password manager is a program like any other. Any program can be modified. A program's security can be cracked. You're only as safe as the encryption that exists on the program. But don't let that scare you off, OK?
One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords. mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use. Remember, you want as long as possible) with different character types. The only thing I would add would be to allow you to start the password with a letter. A lot of applications out there don't like it if you start a password with a number or special character.
You need to take the time and research which one is right for you. There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications. Whichever one you want to try is up to you.
My suggestion (and there are really ONLY my suggestions!) are this:
I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications. I'll update this once I do more research if I have any better ideas.
mSecure Password Manager
Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before. I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers. I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through). However, I do know where it is at all times and up to now it works for me.
But maybe I really should change that attitude a bit. I'm getting old and these hands are starting to cramp up sometimes. Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes. I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.
So, what is a password manager application? Well, it's exactly what is says to be for the most part. You can keep your passwords in it. But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc. Pretty much anything you can think of can go into the manager application. There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category. There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.
So, do you need one? Well, that's up to you. Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time? Sounds like a good reason to me to get it. Just be careful.
Remember that a password manager is a program like any other. Any program can be modified. A program's security can be cracked. You're only as safe as the encryption that exists on the program. But don't let that scare you off, OK?
One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords. mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use. Remember, you want as long as possible) with different character types. The only thing I would add would be to allow you to start the password with a letter. A lot of applications out there don't like it if you start a password with a number or special character.
You need to take the time and research which one is right for you. There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications. Whichever one you want to try is up to you.
My suggestion (and there are really ONLY my suggestions!) are this:
- Do the research. Already mentioned that. 'Nuff said.
- Make sure whatever program you decide to get, make sure it has the strongest encryption possible. Encryption is the part of the program that is going to hide the data by making it unreadable. That encryption really needs to be tough to crack to protect your passwords! My suggestion is that you make sure the program uses AES256 or 256-bit Blowfish, which is the federal government's encryption standard and has been very successful since it was developed several years ago.
- Don't be a cheapskate. Pay the money for the program. A lot of the free or trail versions are probably good and will do the job. But honestly, this IS your digital life you're trying to protect. If the paid version has some additional features that will secure you data I would go for it and pay for the full version.
- Make sure you put a strong password on that password manager application. If you don't put a strong password on your password manager the hacker won't need to break the encryption. He'll already be in your password manager.
I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications. I'll update this once I do more research if I have any better ideas.
mSecure Password Manager
09 August 2015
Passwords and Security - Why Can't I Use Puppy-Boo-Boo's Name as My Password?
Well now, my first real blog post, and less that ten minutes after my first! Bet you didn't see THAT coming, did you? Actually, I promised this post on Facebook, so many of you I think probably did expect it, didn't you. OK, OK, I'll stop rambling and get to it.
The background on this post is based on two sources. One is that recently a relative remarked having an email account hacked. The relative will remain anonymous. This occurred about the same time that I was studying one of the chapters for the COMPtia Security+ exam (SY-401) to update one of my IT certifications. So I decided that I should try to impart some wisdom related to the problem since may of you readers (those of you in IT or with some experience are excluded) don't really deal with the issue a lot. You can guess the topic from the post's name I hope.
You've probably heard it on the news in quick little morning show segments that try to put a nice face on the problem, but the point is usually pretty important. Sometimes the information is really good. But you can never really tell if the segments are any good. But I digress.
You really need to pay attention when you are designing your own passwords. Yes, the statement so important I needed to bold and underline it. Usernames and passwords are the way computer systems identify that you are you to put it simply. The pair acts as the key to the gateway that is your identity in the digital world. If someone is able to guess your password easily through either a brute-force method (where they are able to guess your password) or through a password-cracking program, they have the ability to become you. Yes, identity theft in the simplest description.
So, here are some recommended things that I have learned and I hope you consider when creating a new password.
Oh, and this includes items such as your wireless routers at home. You really need to set up the password on that router if you haven't done so and make sure you set up the encryption correctly with long wireless keys to insure someone isn't able to break into your network and use it for his/her own purposes. There are people who will go around with wireless antenna searching for wireless signals that are easy to crack or are wide open.
Well, that's enough for now I think. If you haven't been bored senseless I hope you find it of some interest or help.
References:
The background on this post is based on two sources. One is that recently a relative remarked having an email account hacked. The relative will remain anonymous. This occurred about the same time that I was studying one of the chapters for the COMPtia Security+ exam (SY-401) to update one of my IT certifications. So I decided that I should try to impart some wisdom related to the problem since may of you readers (those of you in IT or with some experience are excluded) don't really deal with the issue a lot. You can guess the topic from the post's name I hope.
You've probably heard it on the news in quick little morning show segments that try to put a nice face on the problem, but the point is usually pretty important. Sometimes the information is really good. But you can never really tell if the segments are any good. But I digress.
You really need to pay attention when you are designing your own passwords. Yes, the statement so important I needed to bold and underline it. Usernames and passwords are the way computer systems identify that you are you to put it simply. The pair acts as the key to the gateway that is your identity in the digital world. If someone is able to guess your password easily through either a brute-force method (where they are able to guess your password) or through a password-cracking program, they have the ability to become you. Yes, identity theft in the simplest description.
So, here are some recommended things that I have learned and I hope you consider when creating a new password.
- You should make your password as long as possible. Most experts recommend a minimum length of eight characters (letters, numbers, "special" like &*%$, etc.). Some suggest as long as fourteen characters as a minimum. This makes it almost impossible for a hacker to guess using a brute-force method and almost impossible using a password-cracking program (if the computer has enough processing power any password can be cracked given enough time).
- The password should be made up of a combination of characters. There needs to be at least one lowercase letter, one uppercase letter, one number, and one "special" character. This makes the password more complex and harder to crack.
- Don't use a password that you can find in the dictionary without altering it in some way. Many of the password cracking programs will search through tables that have all the words of the entire dictionary stored. It will take a while for the program to search for the word, but it will find it. So if you, say use the word stealthy, you need to alter it in such a what that it can't be easily recognize, such as, for example, s7&aL7y*!4.
- Definitely don't use a word that someone can associate with you. You have all heard the term "social engineering" I hope. There are people out there who use methods to learn your habits any lifestyle just to somehow get into your digital life. The methods could be anything like flattery, bullying, impersonating friends and loved ones over email. Those are just a couple of the ways If you use something like your child's name, pet's name, your profession, anything that is associated with your life you are helping the social engineer to discover a way into your digital life.
- Do your best not to write your password down. If you do write it down, do NOT put it on a "sticky note" or an item out in the open for someone to discover. I know, passwords, especially long ones can be hard to remember. Everyone wants to put the password somewhere so it can be easily accessed. But it should never be out in the open or somewhere that is easily accessible to anyone who can walk into your office. If you have to write it down, write it down somewhere no where near your computer that someone cannot easily access it. If you keep it on you smart phone, get a password storage program that will encrypt the password (make it difficult to read). Regardless, guard that password like it is life or death since IT IS YOUR DIGITAL LIFE.
- Don't use the same password for all of you online sites. If someone guesses your password and you used it at multiple places, it won't take much for the hacker to discover the other places you have accounts and get access to those other accounts.
- Don't share your password with others unless you absolutely trust them. Even then don't do it. You don't want them to accidentally give it to someone else.
- Change your passwords as often as possible. The longer a password is out there, the more likely it will be discovered.
- When you change your password, don't use the same one over and over again. If you change the password to the same one as before, you're not really changing the password and you have the same problem as mentioned in the previous step.
Oh, and this includes items such as your wireless routers at home. You really need to set up the password on that router if you haven't done so and make sure you set up the encryption correctly with long wireless keys to insure someone isn't able to break into your network and use it for his/her own purposes. There are people who will go around with wireless antenna searching for wireless signals that are easy to crack or are wide open.
Well, that's enough for now I think. If you haven't been bored senseless I hope you find it of some interest or help.
References:
Subscribe to:
Posts (Atom)