I know I mentioned this previously on Facebook and Google+, but I'll do so again. I passed the CompTIA Security+ exam last Monday. The minimum required to pass was 750 out of 900, and I scored a 798 (roughly 89%). I am extremely happy that I passed it and should not have to worry about taking it again for three years. But I did want to share some thoughts to pass on to people that may be taking the test in the near future.
In my opinion it was a difficult test, at least for me. I deal with very few of the topics that were on the test on a daily business in my line of work. The problem, though is that a lot of government and corporate institutions these days are starting to require that you have this certification either before you get a particular position or within a particular time frame after you take a position (usually about six months or so). For the U.S. government (at least in the groups for which I work) you are required to have the Security+ exam regardless of your position. You are also required to have the "subject matter" certifications as well. So if you are an MS Windows systems engineer for example you need to be certified in MS Windows (which, in many cases could require six or more tests!).
I have no problem with taking a test in your area of expertise, but requiring a test with topics you don't use on a regular basis is not a good idea. This is just another one of the federal government's "cookie cutter/one size fit all" directives that really needs to be better thought out. Particularly when these tests can cost the test taker a large amount of money. Security+ exams are $302 dollars! More advanced exams can cost the test taker over $500 dollars or more! If your company reimburses you for successfully taking the test, that's great! But many companies don't do that and you usually only get reimbursed for a successful completion. Heaven forbid if you fail the exam and have to take it over again!
So how to prepare for the test? Well, hopefully you have a little experience with the subjects of the exam. And we all have different ways of preparing for exams. I'll tell you my methods.
First thing I would suggest is that you need to block off time to study. The books all recommend a minimum of six weeks of studying every day. I would agree with that assessment, but I didn't take that long. I pretty much spent four weeks studying, the whole of the month of August. Every day I spent anywhere from two to five hours studying for the exam. A lot of that time was drilling sample exam questions that would be similar to what was on the exam. But get it in your mind that the questions will be similar to what is on the exam, but in most cases are not the same. More on that later.
Don't just focus on one book to cover all the topics. No matter what the books says, something will be missing. The main book I used was CompTIA Security+ SY0-401 Cert Guide, Deluxe Edition (3rd Edition) by David L. Prowse. This is the official book put out by the Pearson testing service and, for the most part it got me through the test. By the way, if you use this book you should upgrade the the "Premier" edition for an additional $15 at the Pearson site. It gives you the book in PDF, mobi (Amazon format) and ePub formats as well as the Pearson question engine which gives you access to around nine hundred prep questions.
But don't just rely on one book! I used two other books to prepare as well as well as a thousand or so more questions and a review syllabus that a supervisor at work had from a test preparation company he used. Don't skimp if you can on preparing for the test; use any means necessary to get prepared. I'll put links to the other books in a set of links.
One other thing that you need to do is practice the simulations on the test. Not only will you have a number of questions you have to answer, there will be several simulations that you have to work on and correctly answer or configure. You might be asked to match the different kinds of social engineering OR you might have to use a set of pictures and IP addresses to configure a demilitarized zone (DMZ). Both of these came in the supplemental materials that were in the Prowse book, but there could be even more. You need to look for simulations & demo videos that simulate some of the topics on the exam and you need to have these stone cold in your memory ready to implement them when/if they appear on the exam.
Make sure you read all of the primary book you are using. Don't just skim it. There is always information in it that will help you in the exam somewhere. Then go to your "supplemental" books and questions and focus on the topics that got little or no coverage in your main book. Don't assume that if it wasn't in one book it won't be on the test.
When I was going through the practice questions, I made sure that I didn't memorize any specific answers. You can't assume that the questions on the real exam will be the same as they were on the practice exam(s) or that they will be in the same answer order. Many of the questions are also of the "choose the best X answers" style and you cannot assume they will have all the choices you had. Try to remember to get the concepts down, not the exact answer.
I did two things that helped me a lot. The first was to set up groups of flashcards with items like ports for different protocols I needed to know via a flashcard program called Quizlet. I was able to do traditional flashcard as well as matching games with some of the topics. The second thing I did was take extensive notes when I missed one of the questions I was drilling. That helped reinforce the concepts, particularly when I was trying to remember the types of authentication (and believe me, you need to have that down pat).
One of the best things you can do is set a goal/deadline date for the exam. That way you have a clear time to complete your preparations. You don't have to immediately schedule you exam, just set a deadline that you can reassess when needed. I set the last day of the month as my test date and was able to use that to focus my studying. Two weeks before the test, I assessed where I was in my preparations so I could adjust the test date if I needed to do so. I finally felt I had the confidence a week before to schedule the exam and did so.
So, what was exam day like?
Well, seem like any other day I guess. August 31 was last Monday. Saturday (about six hours, split into a four-hour session in the morning and two in the afternoon) and Sunday (straight four-hour morning session) I basically finished my review notes and the last of the sample questions. There was one simulation I was getting 90% right but never getting to 100% and I needed to get that down pat. Never did quite get it. I focused more on getting a decent amount of sleep and rest before the exam day. Nothing new, just quiet review.
I had to drive forty-five miles to the test site. You would think a major college town would have a Pearson test center. Nope. Luckily I scheduled it for mid-morning and left extra early to get there since I had not been to the test center before. I listened to a sci-fi audoibook on the way to relax me a bit. No additional review; I did not want to confuse myself. If I didn't know it already I wasn't going to know it by cramming it in at the last second.
One thing I would recommend is that you leave everything in your car that you can. Even your watch. The test centers are paranoid about people recording questions from the test. Just bring in your two forms of identification and your car keys. Lock the rest up out of sight in your car. The easiest thing to do.
So how was the test? Well, I felt like I had failed it. Really. The simulations were presented first. For some of them, I felt I was was prepared. It was the other simulations that got me worried. I did not recognize them AT ALL (Now you know why I'm telling you to find all the simulations you can and practice them like nuts). Then I went to the questions. And I felt like I was going to fail as I did not recognize a large majority of the questions. Two or three of them seemed completely familiar, the rest I felt out of my depth. I swear, when I got to the survey I thought I had failed. And they make you take the survey before you get the results.
Luckily I must have studied enough to absorb the needed knowledge or I must have had a major boost of luck on my side. I must have been one hell of a guesser, because I did pass. I was definitely relieved, that's for sure, but felt like I had passed only by the skin of my teeth. Yes, a pass is a pass, but I thought the margin was TOO close for comfort. But pass I did.
OK, I think that's enough for now. I'll provide my opinions on "after the test" topics in the next couple of days. I hope some of you find my observations useful.
29 August 2015
Memories of an Event Ten Years in the Past
Today is one of those days some of us mark as watersheds in our lives. Sometimes those days are just personal and only have an effect on our immediate lives or the lives of those closest to us. And some will have an effect on much larger numbers of us. I guess this day is a little of both for me.
This was the day that Hurricane Katrina hit the Gulf Coast back in 2005. Mississippi, Alabama, and much of southeastern Louisiana were devastated. The much vaunted levee system maintained by the U. S. Army Corps of Engineers (which had never been tested before by a storm of that magnitude) failed, devastating much of St. Bernard, Orleans, Jefferson, and Plaquermines parishes in Louisiana. If the hurricane had jogged just a little more west as it was originally plotted to go it was have literally wiped New Orleans and southeast Louisiana from the face of the map, especially if the the nightmare scenario of the hurricane going up the mouth of the Mississippi river would have occurred.
I think about what happened quite often, usually on the anniversary of the event. I can't help but do that because August 29th just happens to also be the birthday of my late maternal grandmother, Geraldine. No, thank God, she did not lose her life in Katrina. It is just a bad association I have to make every year at this time.
I was one of the lucky people. I was living outside New Orleans at the time and was able to heed the warnings. The majority of my family lives on the north shore of Lake Ponchatrain in St. Tammany Parish. I got my grandmother out of the city and to my parents' home two days before the hurricane was forecast to hit (luckily it was a weekend so people had time to prepare and evacuate if they could). So personally, my grandmother and I were fine, riding out the storm at my parents' home.
I pretty much lost all of my possessions, as did my grandmother. Although there wasn't a whole lot of really bad flooding in my part of the suburbs, my apartment did get enough water into it to ruin the apartment and I lost all of my possessions. My brother could not get into my apartment for a month after Katrina. By that time he said he had to were a filter mask to go into the apartment because of the toxic mold that had built up. My grandmother lost everything as well, including her apartment which was in the brunt of the flooding in Canal Street.
Some of my co-workers weren't so lucky. A few months after I had heard that one of them had died during the height of the storm in St. Bernard Parish. She had not evacuated and had literally drowned. She was found in her home with her family covered in dried mud when they finally found her. She was a kind, quiet and shy soul. Just one of the 1800 lost to us I guess.
As I said, I was one of the really lucky ones. I lost possessions, but because of the nature of my work, I still had a job and I still had a car. The job got temporarily relocated to Fort Worth, where I spent seven months after Katrina literally setting up equipment that was being salvaged from New Orleans to insure others could work. The company I worked for insured we were still paid and had a roof over our heads (not to be sarcastic, but they could afford it because they were charging back to the government). It was tough to leave, but I felt I had to do it.
Let's get something straight here. Louisiana is home. It's where the majority of my family is and has always been. But after what happened after Katrina I realized I wanted to be elsewhere, at least for a while. I decided living in the proverbial bullseye of the "Storm of the Century" was enough for one lifetime. It was time to look at things elsewhere.
At the time I would rather have been somewhere like Dallas-Fort Worth or even Houston since it was closer to the family. But as luck would have it I got a job in Richmond VA, somewhere I had never been before in my life (closest I had been was Washington D.C.). It was a tough decision, but I think it was a good one. So in 2006 I moved to the mid-Atlantic and have been there since.
It's definitely been interesting since the move. Moved twice since moving to Virginia and changed jobs twice. Been two high school reunions in that time, the 25th and the 30th. I've lost an uncle on both sides of my family to cancer. My parents have celebrated their 50th wedding anniversary and both have turned seventy. Once niece popped into existence and seems to be a gymnastics phenom while the older niece seems to be a math geek while trying to be Mark Spitz (I guess I should say Ryan Phelps instead).
The tough loss was the death of my maternal grandmother only a few short months after her 90th birthday. But I think it started shortly after Katrina. Although it really wasn't anything really out in the open, what happened in Katrina really affected her. After the storm she was a little less lively and she wasn't as healthy. Her mobility seemed to deteriorate a lot and she lost a lot of her independence. I keep thinking that if the storm hadn't hit when it did she might still be around today and still have some of the fire and independence she had.
I've rambled enough on this subject today. For that I am sorry. But I felt I needed to make an acknowledgement of my own on this anniversary. If you did get through the whole of this long-winded, rambling post, I commend you on your perseverance and mental fortitude. I won't blame anyone who could not (but then, since you couldn't make it through the post you didn't get to this point, did you?).
This was the day that Hurricane Katrina hit the Gulf Coast back in 2005. Mississippi, Alabama, and much of southeastern Louisiana were devastated. The much vaunted levee system maintained by the U. S. Army Corps of Engineers (which had never been tested before by a storm of that magnitude) failed, devastating much of St. Bernard, Orleans, Jefferson, and Plaquermines parishes in Louisiana. If the hurricane had jogged just a little more west as it was originally plotted to go it was have literally wiped New Orleans and southeast Louisiana from the face of the map, especially if the the nightmare scenario of the hurricane going up the mouth of the Mississippi river would have occurred.
I think about what happened quite often, usually on the anniversary of the event. I can't help but do that because August 29th just happens to also be the birthday of my late maternal grandmother, Geraldine. No, thank God, she did not lose her life in Katrina. It is just a bad association I have to make every year at this time.
I was one of the lucky people. I was living outside New Orleans at the time and was able to heed the warnings. The majority of my family lives on the north shore of Lake Ponchatrain in St. Tammany Parish. I got my grandmother out of the city and to my parents' home two days before the hurricane was forecast to hit (luckily it was a weekend so people had time to prepare and evacuate if they could). So personally, my grandmother and I were fine, riding out the storm at my parents' home.
I pretty much lost all of my possessions, as did my grandmother. Although there wasn't a whole lot of really bad flooding in my part of the suburbs, my apartment did get enough water into it to ruin the apartment and I lost all of my possessions. My brother could not get into my apartment for a month after Katrina. By that time he said he had to were a filter mask to go into the apartment because of the toxic mold that had built up. My grandmother lost everything as well, including her apartment which was in the brunt of the flooding in Canal Street.
Some of my co-workers weren't so lucky. A few months after I had heard that one of them had died during the height of the storm in St. Bernard Parish. She had not evacuated and had literally drowned. She was found in her home with her family covered in dried mud when they finally found her. She was a kind, quiet and shy soul. Just one of the 1800 lost to us I guess.
As I said, I was one of the really lucky ones. I lost possessions, but because of the nature of my work, I still had a job and I still had a car. The job got temporarily relocated to Fort Worth, where I spent seven months after Katrina literally setting up equipment that was being salvaged from New Orleans to insure others could work. The company I worked for insured we were still paid and had a roof over our heads (not to be sarcastic, but they could afford it because they were charging back to the government). It was tough to leave, but I felt I had to do it.
Let's get something straight here. Louisiana is home. It's where the majority of my family is and has always been. But after what happened after Katrina I realized I wanted to be elsewhere, at least for a while. I decided living in the proverbial bullseye of the "Storm of the Century" was enough for one lifetime. It was time to look at things elsewhere.
At the time I would rather have been somewhere like Dallas-Fort Worth or even Houston since it was closer to the family. But as luck would have it I got a job in Richmond VA, somewhere I had never been before in my life (closest I had been was Washington D.C.). It was a tough decision, but I think it was a good one. So in 2006 I moved to the mid-Atlantic and have been there since.
It's definitely been interesting since the move. Moved twice since moving to Virginia and changed jobs twice. Been two high school reunions in that time, the 25th and the 30th. I've lost an uncle on both sides of my family to cancer. My parents have celebrated their 50th wedding anniversary and both have turned seventy. Once niece popped into existence and seems to be a gymnastics phenom while the older niece seems to be a math geek while trying to be Mark Spitz (I guess I should say Ryan Phelps instead).
The tough loss was the death of my maternal grandmother only a few short months after her 90th birthday. But I think it started shortly after Katrina. Although it really wasn't anything really out in the open, what happened in Katrina really affected her. After the storm she was a little less lively and she wasn't as healthy. Her mobility seemed to deteriorate a lot and she lost a lot of her independence. I keep thinking that if the storm hadn't hit when it did she might still be around today and still have some of the fire and independence she had.
I've rambled enough on this subject today. For that I am sorry. But I felt I needed to make an acknowledgement of my own on this anniversary. If you did get through the whole of this long-winded, rambling post, I commend you on your perseverance and mental fortitude. I won't blame anyone who could not (but then, since you couldn't make it through the post you didn't get to this point, did you?).
19 August 2015
What's with All the Hoopla over a Email Server?
I'm sure you've noticed on the news recently that Congress is making a big deal about use of a email server by Hillary Clinton that was not vetted by the the various security apparatuses of the federal government. Many of you probably think it is politically motivated. Some of it probably is. We are political animals after all. But it really is a security issue if the former Secretary of State did send email that was supposed to be classified to an unclassified server that was not in a secure location.
So what's the big deal about classification? Well, it can be. Governments, other organizations, businesses, and individuals need to keep certain information private. There is information out there that should never be shared with anyone. Disclosure of certain information could lead to harm of that (for lack of a better word to call all these groups) actor. An actor needs to keep track of all information, decide how certain information should be protected (if it needs to be protected), how that information can be sent to allied actors, and how that information could harm the actor's property. This includes the actor's very life.
That's where classification comes in. Classification shows whether the information if released would harm the actor and the how much harm may be caused if the information comes to light. It ranges from little or no harm at all to life-threatening. That might seem like a bit too much melodrama, but that's basically the gist.
Let's take an example (you non-capitalists won't like this). Company A has come up with this really nice production process that could revolutionize the cell phone industry. If a competitor was able to get a copy of the plans for the process and get it up and running Company A could lose millions of dollars in profits. So Company A decides it needs to keep the process secret for a few years to maximize the profits.
How is information classified? Well, that is decided by an organization but it may also have to abide by government rules. HIPAA, for example, requires by law that all patient medical records need to be kept classified and protected so that the patients aren't harmed by the release of that information. If patient information is classified, a medical professional can be punished by a number of different methods for unknowingly releasing the information, including fines and prison time.
In the case of the federal government, there are several basic levels. Unclassified (which isn't really a level) means that no harm will come to the United States if the information is released to the public. Classified means that the information needs to be kept out of the public eye but no real harm would to the government would occur. Secret means that the information could cause some sort of harm to the government, and Top Secret means the information would cause an extreme amount of harm to the government. There are other levels and divisions within the basic levels I mentioned. It is a extremely complicated and convoluted process.
So what does this have to do with Hillary Clinton's server? Well, a lot. The question is what sort of information was contained that was sent to and from the server in question? For example (I'm not saying there was that information.) what if there was information in any of those emails on the Bengazi incident that the White House had deemed secret or top secret? That sort of information would have required the email be strongly encrypted and probably not even sent outside the federal government network. It would have had to be sent to a device that had been cleared to accept that sort of information. Those devices would have had top-of-the-line security that would protect the information from outside sources and even destroy the information if the device had been lost.
I've heard rumor that the server in question was just hidden in the bathroom closet of a mom-and-pop store or home somewhere in Colorado. If this was the case, then there is a problem. The server should have
If the server was not properly vetted for use as a classified server or better, than Hillary Clinton did break federal law, even if she inadvertently sent a piece of classified to or received from it. And she would have known better because she would have received the same training on the classification of data and acceptable use of resources that every federal employee and contractor receives every year at a minimum. Just because she was a senior cabinet member would not absolve her of this fact, partly because it would be her responsibility to insure all her employees received that training and were aware of the proper directives of her organization. Not doing so would make her negligent in her position and she should have been reprimanded.
Is this a minor thing that should be swept under the rug? I guess that's up to Congress and the White House to decide. But in my opinion it needs to be seriously investigated. The security of our country could be compromised.
So what's the big deal about classification? Well, it can be. Governments, other organizations, businesses, and individuals need to keep certain information private. There is information out there that should never be shared with anyone. Disclosure of certain information could lead to harm of that (for lack of a better word to call all these groups) actor. An actor needs to keep track of all information, decide how certain information should be protected (if it needs to be protected), how that information can be sent to allied actors, and how that information could harm the actor's property. This includes the actor's very life.
That's where classification comes in. Classification shows whether the information if released would harm the actor and the how much harm may be caused if the information comes to light. It ranges from little or no harm at all to life-threatening. That might seem like a bit too much melodrama, but that's basically the gist.
Let's take an example (you non-capitalists won't like this). Company A has come up with this really nice production process that could revolutionize the cell phone industry. If a competitor was able to get a copy of the plans for the process and get it up and running Company A could lose millions of dollars in profits. So Company A decides it needs to keep the process secret for a few years to maximize the profits.
How is information classified? Well, that is decided by an organization but it may also have to abide by government rules. HIPAA, for example, requires by law that all patient medical records need to be kept classified and protected so that the patients aren't harmed by the release of that information. If patient information is classified, a medical professional can be punished by a number of different methods for unknowingly releasing the information, including fines and prison time.
In the case of the federal government, there are several basic levels. Unclassified (which isn't really a level) means that no harm will come to the United States if the information is released to the public. Classified means that the information needs to be kept out of the public eye but no real harm would to the government would occur. Secret means that the information could cause some sort of harm to the government, and Top Secret means the information would cause an extreme amount of harm to the government. There are other levels and divisions within the basic levels I mentioned. It is a extremely complicated and convoluted process.
So what does this have to do with Hillary Clinton's server? Well, a lot. The question is what sort of information was contained that was sent to and from the server in question? For example (I'm not saying there was that information.) what if there was information in any of those emails on the Bengazi incident that the White House had deemed secret or top secret? That sort of information would have required the email be strongly encrypted and probably not even sent outside the federal government network. It would have had to be sent to a device that had been cleared to accept that sort of information. Those devices would have had top-of-the-line security that would protect the information from outside sources and even destroy the information if the device had been lost.
I've heard rumor that the server in question was just hidden in the bathroom closet of a mom-and-pop store or home somewhere in Colorado. If this was the case, then there is a problem. The server should have
- Been in a secure location that was protected from intruders easily getting access to the server. Anyone could have just walked into the bathroom, opened the closet, opened the server and stolen the hard drives where the email was stored.
- Should have had major security on it. Everything that went onto the server would have been encrypted to make sure the emails would not be in plaintext. This would have included encrypting all the data on the hard disk(s) as well as the individual files. This would have made it extremely difficult for anyone to read the data without figuring out what was in the emails.
If the server was not properly vetted for use as a classified server or better, than Hillary Clinton did break federal law, even if she inadvertently sent a piece of classified to or received from it. And she would have known better because she would have received the same training on the classification of data and acceptable use of resources that every federal employee and contractor receives every year at a minimum. Just because she was a senior cabinet member would not absolve her of this fact, partly because it would be her responsibility to insure all her employees received that training and were aware of the proper directives of her organization. Not doing so would make her negligent in her position and she should have been reprimanded.
Is this a minor thing that should be swept under the rug? I guess that's up to Congress and the White House to decide. But in my opinion it needs to be seriously investigated. The security of our country could be compromised.
17 August 2015
Be Careful When You Click Those External Links on Facebook.
I've noticed recently that there seems to be an upswing in the number of people that take those so-called "quizzes" on Facebook. I'm not going to be derisive of anyone who takes those quizzes (I've even taken them on occasion). But I did want to comment on why you should be extremely careful when you click that link to take one of those quizzes.
It all goes back to our "friend" in the IT security world, social engineering. Getting you to click on a link is a form on social engineering, called phishing (no, English professors, its a real world in IT security circles). Phishing occurs when a individual or organization tries to get personal information out of you some way over the Internet. One such way is through email, another through web sites that pique your interest. The best known of these scams is the Nigerian email scam (you know, the one where you get an email from someone who says you won Country X's lottery, a relative you've never heard of died and left you a BIG inheritance, etc. You just have to provide personal information to get it transferred to your bank account).
Most of the time phishing is sent like spam; you aren't specifically targeted. But if the attempt is more narrowly focused it is known as spear phishing. And if the target is very well-known or well-off (like the CEO of a company or a big-time politician) then you have a case of whaling. Phone scams that attempt to get personal information is called vishing. Boy, these IT security guys come up with some wonderful names for this stuff, don't they.
So what does that have to do with you answering quiz answers on Facebook? Well now, every time you click on one of those links that takes you to an external quiz, you are passing on information to the site to which you are trying to connect. That usually includes information about you, your location via your IP address (even if you are attached to a Facebook server that information is stored on that server somewhere), etc.
It's even worse when you click on one of those quizzes that asks you to link your Facebook account to the site. Now you've even provided the site with ALL the information that is currently stored on your Facebook profile, including your Friends lists, any contact information you have in your account, and even personal information such as your birthday, your home location, etc. You've just opened yourself up to them.
So now the quiz site has access to all the information on your Facebook profile and page. What can they do with it? The least you'll have to worry about is spam. The worst is that you could lose you digital identity. Now they can use the information for impersonation purposes to get additional personal information on you, such as impersonating a government official, bank officer, etc. They may not have your birthday or social security number yet, but it doesn't take much for them to impersonate someone who can get that information.
Many of those places can also contain all sorts of malware. Once you link to the site you have opened up your computer to all sorts of threats from viruses, worms, Trojans, etc. Now you have even more headaches to worry about.
So what can you do? Well, first thing would be to make sure you don't do any of those quizzes that pop up again especially those quizzes that ask you for access to your Facebook profile or ask to post to you Facebook profile. I know you want everyone to know you are the modern Dumbledore, Captain Kirk, or have the soul of a arctic wolf because an unscientific quiz told you that you were. But is it really worth your digital identity to do that?
The next thing I would do is make sure your antivirus and firewall software is up-to-date. You want your software to catch any new little "visitors" into your computer system. If at all possible, you want to make sure you have a clean and up-to-date copy of your antivirus on a removable hard drive and USB drive that you can run every so often. Your antivirus and firewall can be infected just like any other program on your computer. The external antivirus will be slower than when it is installed on your computer, but it can still detect and address any problems that might appear and that your the antivirus you have installed on the computer missed.
I'm not saying stop trying out quizzes. Just be careful when you do one of the quizzes knowing that you could be opening your digital identity to all sorts of trouble.
It all goes back to our "friend" in the IT security world, social engineering. Getting you to click on a link is a form on social engineering, called phishing (no, English professors, its a real world in IT security circles). Phishing occurs when a individual or organization tries to get personal information out of you some way over the Internet. One such way is through email, another through web sites that pique your interest. The best known of these scams is the Nigerian email scam (you know, the one where you get an email from someone who says you won Country X's lottery, a relative you've never heard of died and left you a BIG inheritance, etc. You just have to provide personal information to get it transferred to your bank account).
Most of the time phishing is sent like spam; you aren't specifically targeted. But if the attempt is more narrowly focused it is known as spear phishing. And if the target is very well-known or well-off (like the CEO of a company or a big-time politician) then you have a case of whaling. Phone scams that attempt to get personal information is called vishing. Boy, these IT security guys come up with some wonderful names for this stuff, don't they.
So what does that have to do with you answering quiz answers on Facebook? Well now, every time you click on one of those links that takes you to an external quiz, you are passing on information to the site to which you are trying to connect. That usually includes information about you, your location via your IP address (even if you are attached to a Facebook server that information is stored on that server somewhere), etc.
It's even worse when you click on one of those quizzes that asks you to link your Facebook account to the site. Now you've even provided the site with ALL the information that is currently stored on your Facebook profile, including your Friends lists, any contact information you have in your account, and even personal information such as your birthday, your home location, etc. You've just opened yourself up to them.
So now the quiz site has access to all the information on your Facebook profile and page. What can they do with it? The least you'll have to worry about is spam. The worst is that you could lose you digital identity. Now they can use the information for impersonation purposes to get additional personal information on you, such as impersonating a government official, bank officer, etc. They may not have your birthday or social security number yet, but it doesn't take much for them to impersonate someone who can get that information.
Many of those places can also contain all sorts of malware. Once you link to the site you have opened up your computer to all sorts of threats from viruses, worms, Trojans, etc. Now you have even more headaches to worry about.
So what can you do? Well, first thing would be to make sure you don't do any of those quizzes that pop up again especially those quizzes that ask you for access to your Facebook profile or ask to post to you Facebook profile. I know you want everyone to know you are the modern Dumbledore, Captain Kirk, or have the soul of a arctic wolf because an unscientific quiz told you that you were. But is it really worth your digital identity to do that?
The next thing I would do is make sure your antivirus and firewall software is up-to-date. You want your software to catch any new little "visitors" into your computer system. If at all possible, you want to make sure you have a clean and up-to-date copy of your antivirus on a removable hard drive and USB drive that you can run every so often. Your antivirus and firewall can be infected just like any other program on your computer. The external antivirus will be slower than when it is installed on your computer, but it can still detect and address any problems that might appear and that your the antivirus you have installed on the computer missed.
I'm not saying stop trying out quizzes. Just be careful when you do one of the quizzes knowing that you could be opening your digital identity to all sorts of trouble.
12 August 2015
Links for Charity that Get You Interesting Stuff
I'm a big fan of charity sites where you can donate and get something back for your donation. How does that work? Well, the site usually has several groups of items at different price levels. The higher you pledge the more you get. Proceeds in most cases go to one of more charities that the group who donates designates. Pretty neat, huh? Here are two of my favorites at the moment:
- Bundle of Holding: If you're looking to complete your collection for older games in PDF format or sometimes games still in print this is a great site. There is a basic level that is set at a particular price and a more "advanced" level where there is a sliding scale where you can get several more books beyond the basic level. The "advanced" price is based on the number of people who have donated so far. Previous offerings include an assortment of FATE RPG games, the Classic Traveller, MegaTraveller, and Mongoose Traveller games, and several items from the Deadlands role-playing game. PDFs are stored both on the Bundle of Holding's servers or on DriveThruRPG/RPGNow's servers. Really can be a bargain when you get the majority of a game line for less that on sourcebook costs these days.
- Humble Bundle: Similar methodology to the folks at Bundle of Holding. Humble Bundle, though, usually has four different bundles on sale at one time, a basic Humble Bundle, a Weekly Bundle, a Book Bundle, and a Mobile Bundle. Each of these offer different levels of pledges based on what you want to pay. The items in your bundle are stored on their servers. There is also a Humble Store where you can purchase games and other products that are different from the items in the other bundles.
Report on Cyberattacks and the Human Factor
Watched this report today at lunch. It was interesting and worth watching. I know that some of you have a bias against certain news networks. Try not to dismiss this report out of hand and ignore any of the finger pointing that is in the report. Instead focus on what the report is actually about when you watch it. I think the gentleman being interviewed is trying to stay on point in the interview.
Anyway, it's up to you, of course. The topic is important. It's worth a few minutes to watch.
The sound gets really bad toward the end and there is a thirty-second commercial at the start. I just wanted to give you a fair warning there.
Did Russian hackers break into Pentagon servers?
Anyway, it's up to you, of course. The topic is important. It's worth a few minutes to watch.
The sound gets really bad toward the end and there is a thirty-second commercial at the start. I just wanted to give you a fair warning there.
Did Russian hackers break into Pentagon servers?
11 August 2015
What Do I Think about Password Manager Applications?
A classmate from high school (yes, I know, that was a long time ago. But I know it wasn't as long ago as some of you out there, now is it?) asked me a question based on my last blog post. My classmate was wondering what I thought about password manager applications that are out there on the World Wide Interwebs. I asked her if I could ruminate for a little while on that.
Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before. I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers. I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through). However, I do know where it is at all times and up to now it works for me.
But maybe I really should change that attitude a bit. I'm getting old and these hands are starting to cramp up sometimes. Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes. I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.
So, what is a password manager application? Well, it's exactly what is says to be for the most part. You can keep your passwords in it. But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc. Pretty much anything you can think of can go into the manager application. There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category. There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.
So, do you need one? Well, that's up to you. Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time? Sounds like a good reason to me to get it. Just be careful.
Remember that a password manager is a program like any other. Any program can be modified. A program's security can be cracked. You're only as safe as the encryption that exists on the program. But don't let that scare you off, OK?
One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords. mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use. Remember, you want as long as possible) with different character types. The only thing I would add would be to allow you to start the password with a letter. A lot of applications out there don't like it if you start a password with a number or special character.
You need to take the time and research which one is right for you. There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications. Whichever one you want to try is up to you.
My suggestion (and there are really ONLY my suggestions!) are this:
I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications. I'll update this once I do more research if I have any better ideas.
mSecure Password Manager
Truth is I'm afraid I am a bit of a neo-Luddite as I mentioned before. I actually write down my passwords in a little Moleskin notebook which I don't keep anywhere near any of my computers. I generally keep the password book locked up in a lockbox I have hidden at home or it is always on my person (usually in my backpack under layers of stuff that no one else really wants to go through). However, I do know where it is at all times and up to now it works for me.
But maybe I really should change that attitude a bit. I'm getting old and these hands are starting to cramp up sometimes. Luckily they stay in exercise on a regular basis typing on keyboards, but there are twinges sometimes. I probably should start keeping password and other information safe somewhere that I can't easily lose and I don't have to use my ugly handwriting.
So, what is a password manager application? Well, it's exactly what is says to be for the most part. You can keep your passwords in it. But you can usually store other information as well, like information on your credit cards, important business cards, information on your personal documents, etc. Pretty much anything you can think of can go into the manager application. There's usually some templates in the application that have specific fields for you to enter the information as well as a catch-all to allow you to add in information that does not fit in a particular category. There are versions for the PC, Mac, Android, iOS, Linux, UNIX, and probably any other system out there.
So, do you need one? Well, that's up to you. Do you need a secure location that you can access quickly to get information on a particular credit card or you need you ATM password you've forgotten for the umpteenth time? Sounds like a good reason to me to get it. Just be careful.
Remember that a password manager is a program like any other. Any program can be modified. A program's security can be cracked. You're only as safe as the encryption that exists on the program. But don't let that scare you off, OK?
One good thing about most password manager applications is that it will have utility built-in that will help you generate random strong passwords. mSecure, for instance, has a utility that will generate a random string of ten to thirty characters (depending on the length you want to use. Remember, you want as long as possible) with different character types. The only thing I would add would be to allow you to start the password with a letter. A lot of applications out there don't like it if you start a password with a number or special character.
You need to take the time and research which one is right for you. There are tons of free ones, free ones which are really tryout versions to get you to buy the application, and paid applications. Whichever one you want to try is up to you.
My suggestion (and there are really ONLY my suggestions!) are this:
- Do the research. Already mentioned that. 'Nuff said.
- Make sure whatever program you decide to get, make sure it has the strongest encryption possible. Encryption is the part of the program that is going to hide the data by making it unreadable. That encryption really needs to be tough to crack to protect your passwords! My suggestion is that you make sure the program uses AES256 or 256-bit Blowfish, which is the federal government's encryption standard and has been very successful since it was developed several years ago.
- Don't be a cheapskate. Pay the money for the program. A lot of the free or trail versions are probably good and will do the job. But honestly, this IS your digital life you're trying to protect. If the paid version has some additional features that will secure you data I would go for it and pay for the full version.
- Make sure you put a strong password on that password manager application. If you don't put a strong password on your password manager the hacker won't need to break the encryption. He'll already be in your password manager.
I will I could have been more helpful, but at this point I don't have an opinion one way or another on password manager applications. I'll update this once I do more research if I have any better ideas.
mSecure Password Manager
Subscribe to:
Posts (Atom)