By Nicolai Solling, Chief Technology Officer, Help AG
Smart devices are impacting all elements of the private and work sphere – TVs, fridges, door-locks, heating and cooling as well as your pet food dispenser are all connected and interconnected today by an expanding number of devices and applications that rely on your personal data, including behavioral trends, geographic location, and financial transactions.
With just a click, we now have seamless access to a multitude of services, transforming how we interact with financial institutions, grocery stores, ride-hailing, and government services. However, this convenience is a double-edged sword, demanding a higher level of vigilance from us all.
Generational differences in digital literacy further complicate the issue, given that younger generations can’t imagine a world without smartphones, while some of us can still fondly remember our first SMS-capable device. The technical aspects of the cybersecurity industry make it challenging for the average consumer to fully comprehend the concept.
For these reasons, I am often exposed to friends and family members who ask me what they should do to stay secure and cyber smart.
The Password
I will start with something fundamental for pretty much every solution. It is to ensure that the person that is logging in is actually that person. Cyber attackers today still focus a lot on stealing identities, since your identity is typically tied up around a username and a password.
Today, understanding the importance of protecting identity is the responsibility of users. And here we should start with passwords.
If you are not using a unique password your identity can be stolen across multiple apps if your password is compromised – While I have no reason to believe you will lose your password, the app provider might. Since they could get compromised too and therefore when you use the same password, the blast radius of a lost password can be very large. So reusing passwords is today a no-go.
The average user has approximately 80 apps installed on their smart phone (Apps Statistics 2023 – TrueList) in addition to websites they sign up for. Needless to say, remembering this number of passwords is impossible for anyone. So, you have to come up with the right approach.
Password managers are probably the best option today. You might have one already from your device provider protected by their eco-system – So as for the book, make sure your identity for that device is protected.
Start by ensuring that you enable two-factor authentication (2FA) on any application or service that allows for it. This form of security ensures that you are identified not just by a username and password, but also by a second layer of identification. At the fundamental level, your social media accounts, email, and financial apps should all have 2FA enabled.
However, for a more comprehensive safety measure, you should consider multi-factor authentication (MFA). MFA provides an even higher level of security than 2FA by using multiple verification methods. Your email, being a central hub for service notifications and password resets, is especially critical to protect with MFA. It’s vital to ensure that even if your password is compromised, potential attackers cannot access your email.
Protect Your Email
E-mail is probably where most of us started with the internet. And it is still the most important way we all communicate and identify ourselves. For the very same reason, e-mail is also the most targeted vector when talking about infections. As we use e-mail for a lot of sensitive work, it is probably the most important service you can secure.
Attackers thrive upon the basic fact that attachments in e-mails are meant to be opened and URLs are meant to be clicked, so when we, as security professionals, are telling you not to click or open, we are telling you to do something against normal behavior.
Unfortunately, as part of the responsibility of using e-mail, you need to be aware that attachments and URLs can be malicious – And keeping this in mind when you receive an e-mail is an important step.
One quick statistic that puts all of this in perspective is that there are approximately 350B e-mails sent on the internet every single day. Out of that, 50% of them are either spam or outright malicious intent. Luckily most e-mail services are good at identifying malicious intent and spam, but staying alert is important.
If you click on a link, make sure you do not fill out any personal or financial information – As an example: No financial institutions would ever ask you for your account details or credit card information via e-mail. As for malicious attachments, it is advisable to refrain from opening any files or attachments unless they are from a known and trusted source. If the sender is unknown or if the file appears suspicious, do not open the attachment as it may contain malware or other malicious software.
Protect Your Social Media Accounts
No matter the purpose, a social media account taken over by hackers can be abused to damage your reputation, and for those who use it for business purposes, it can be held for a ransom payout. Always protect your social media accounts with unique passwords and multifactor authentication. Also make sure your privacy settings are configured correctly and that you know who you are sharing with. Remember, nothing online is ever truly private, so be aware of what you post and anything that can reveal personal information.
Finally, think of what you are sharing and if it can be used for illegitimate purposes. Yes, it is nice to post a picture of yourself in the airport on your way to vacation but remember this also gives away vital information about your whereabouts, which in the wrong hands can be used maliciously.
Protect Your Home
Smart devices are popping up everywhere – By 2025 it is believed that as many as 30B connected devices will be surrounding us. Smart devices have made our lives easier. However, with these devices being online, they too come with the potential risk of being targeted by malicious actors.
A key issue is around the lifecycle of devices and the fact that IoT devices often receive software updates for a lot shorter period than the product is in use. This potentially creates an environment where your home network is scattered with devices with outdated software and outright vulnerabilities that are potentially utilized for malicious intent.
There are simple ways you can ensure your environment at home is protected. First of all, make sure you use a good strong Wi-Fi standard, which protects access to your network. While not impossible, attackers need to be lucky and very persistent to get access to a properly configured Wi-Fi network. Next you should ensure your devices are up-to-date and receive the newest releases of software. A good step to ensure you are secure is to only install software from trustworthy sources and vendors – It may be tempting to install from an alternative source, but it comes with the risk of malware and if you are using outright pirated or cracked software you are exposing yourself to a tremendous risk of getting malware on your device. If your smart-TV is out of support and not receiving updates anymore, maybe it is a good idea to disconnect it from the network and simply use an external media player with current software support.
Protect Your Children
Young children are impressionable when it comes to the dangers of the online world and are therefore particularly vulnerable to social engineering and phishing attacks in addition to exposure to content that is inappropriate to them.
The most crucial step you, as a parent, can take is to spend time to educate and discuss with your children online presence, access, and usage. In many households an iPad with YouTube or other application access can be an easy time off for any parent, but unfortunately unsupervised internet access should not be allowed for children until they are older. It is important to understand the content they are exposed to, how games work, and put parental controls for the content they are accessing. In recent years, there has been a lot of focus on online safety of children and most schools have awareness programs in this area. However, as parents, we have the responsibility to educate ourselves around the same.
Stay Vigilant
The last, and maybe most important piece of advice is to stay vigilant and skeptical. Malicious online actors do not discriminate. They cast their nets far and wide, looking for vulnerabilities in both behavior and technology to exploit. And once they’ve breached your defenses, they can take over your digital footprint with ruthless efficiency.
That’s why vigilance is key. Human error is behind most cyber breaches, so education and awareness are vital to protecting you and your loved ones in this digital era. Security always starts with you, so it’s important to be cybersmart, and take control of your digital journey!
