Protecting Yourself Online

Reading Matt Honan’s story caused several readers a bit of anxiety. One said that his shotgun couldn’t even help. What can help? There are steps that Matt could have taken to further secure his online presence such as two-way authentication with Google, variation on emails, offline backups, and so on. In this column, I want to consider a few steps to improve your protection when engaging online.

It is important to remember that Matt’s attack was not simply a matter of some genius hacking. It was also some genius social engineering. I’ve written in the past and want to reiterate again that some of the most dangerous attacks against businesses, governments and even individuals involve a combination of malware/hacking/breaching security and social engineering. For a detailed explanation of social engineering, see Defend Against Social Engineering. Essentially, it’s a technical sounding term for conning people.

Matt Honan’s attackers learned how to con both the Apple and Amazon customer service into giving away Matt’s information. As a result of the attack, both Apple and Amazon changed their policies. High level attacks commonly use a combination of a scam that extracts key information from humans and some type of online software attack. A good security strategy can help build defenses against both.

Some of the security steps below may have helped in warding off Matt’s attack:

Offline Backups – In an age of cloud computing, it’s becoming more and more convenient to backup online. I started backing up online several years ago, when George Lucas had his backup drive stolen, and he lost irreplaceable information. Businesses should have a multi-tiered backup plan, and it’s probably a good idea for individuals to do the same. Using an online backup system in tandem with a local backup may be a good idea.

Risk mitigation planning would suggest that backups should be stored at least 90 miles away from your site in case of a local emergency like a hurricane, tornado, fire, or earthquake that devastated local infrastructure. This is where online or cloud backups can be a real benefit. Your data is stored offsite and away from local infrastructure. At the same a local backup can mitigate against the risk of security or attacks in the cloud. Thus some type of multi-tiered backup system can provide a greater level of security against data loss.

Two-Step Verification – For Gmail users, Google offers two-step verification requiring your phone and your computer for login. You can set it up across all devices and applications that interact with your Gmail account to decrease the likelihood that an online attack could invade your account. If Matt Honan had used two-step verification, his account would have not been hacked.

After writing last week’s post, I set up two-step verification on my account. To be honest, it could be time-consuming based on the number of devices and applications accessing your Gmail. And on my Android tablet, one application needed re-authentication when I was away from my computer, which meant I could not access Google Drive until I came home that day. In spite of the headache, it is a great way to secure your information. I’ll let Google explain the process below:

Passwords and Emails – It should go without saying that you should be using different passwords on every account you use. There are tools to help you remember and/or generate your passwords like LastPass but even these need attention to security measures. (See Lifehacker on how to make your LastPass even more secure.)

Also, if you use multiple emails, it be a good idea to vary the name on each email account. Matt’s attacker guessed his .me email because the name was the same as his Gmail account.

For a comprehensive security assessment of your business, you should consider asking Integracon. Our professional team can provide an exhaustive report that identifies potential risk areas and recommendations for security enhancements, policies & procedures, controls, staff training, and more. To learn more contact Integracon at 865-330-2323 or chat at Integracon.