Keep this in mind on Cyber Security Awareness Month
October is National Cyber Security Awareness Month and President Obama is partnering with the National Cyber Security Alliance (NCSA) to start the month with a public awareness campaign they call “Lock Down Your Login.”
The idea behind this campaign is to encourage more people to go beyond mere usernames and passwords for authentication purposes when online. According to the White House, as many as 62% of successful data breaches could have been prevented with better use of authentication systems such as biometrics or dual-factor authentication to supplement usernames and passwords.
An example of the benefits of using increased authentication can be found in the recent guilty plea of hacker Edward Majerczyk who hacked into the email accounts and iCloud accounts of as many as a hundred celebrities and stole nude photos and videos from them. The manner by which Majerczyk managed to accomplish this hacking was simple but effective. He sent "spear phishing" emails to his intended victims that appeared to come from Apple or Google security in which, under various pretenses, he merely requested his victims’ usernames and passwords, which his victims provided thereby enabling him to access their email accounts and iCLoud accounts from which he stole photos and videos.
There are a number of lessons to be learned from this crime about protecting your security. It is important to resist providing your usernames and passwords in response to emails and text messages unless you have absolutely confirmed that the request is legitimate, which such requests seldom are. If you have the slightest concern that such a request might be legitimate, all you need to do is contact the real company to find out if such a request was a scam or not.
However, another way to avoid being hacked in this situation is to utilize dual-factor authentication where your password is only the starting point for accessing your account. After you have inputted your password, the site you are attempting to access will send a special one-time code to your smartphone for you to use to access your account. In some instances, the companies will only send the code to you if your account is attempting to be accessed from a different device than you usually use to access your account. Had the celebrity victims of Majerczyk used dual-factor authentication, Majerczyk would not have been able to hack their accounts.
Another problem with passwords is that for the sake of convenience, many people use the same password for all of their online accounts. This puts them in tremendous jeopardy if any place where they use a password is hacked and their password is stolen because that password could then be used by an identity thief to access multiple accounts of the victim which may include online banking. Even Mark Zuckerberg, the founder of Facebook and a sophisticated user of technology was guilty of this practice. During the summer, his password was stolen during a LinkedIn data breach and used to access his Twitter and Pinterest accounts.
This serves as yet another reminder to everyone that you should have unique passwords for all of your accounts. A strong password will contain capital letters, small letters and symbols. A good way to pick a strong password is to take an easily remembered phrase as your base password and then adapt it for each of your accounts. For instance, you can use a phrase such as IDon’tLikePasswords as your base password. Ad a couple of !!s to the end of the password and you have a strong password base. Then add a few letters to this base password to distinguish each of your particular accounts. Thus your Amazon account password could be IDon’tLikePasswords!!Ama. This is an simple way to create easy to remember, unique passwords for all of your accounts.
However, strong passwords are not enough to keep you safe. The security of your password may be compromised in a data breach of a company with which you do business or you may, as Majerczyk’s victims did, fall victim to a socially engineered spear phishing attack and provide your password directly to a hacker. Fortunately, however, there are other options including dual-factor authentication and biometrics such as fingerprints, methods that are convenient and will dramatically enhance your personal security.
A number of companies are participating in the “Lock Down Your Login,” including Facebook, MasterCard and USAA.
Facebook is encouraging people to use its Security Checkup to get login alerts notifying them when a new device is used to access their account. Facebook is also encouraging people to use its dual-factor authentication feature.
MasterCard, in a partnership with BMO-Harris Bank, will be launching the MasterCard Identity Check Mobile solution for BMO Harris Bank’s commercial credit cards which will provide for the user to authenticate purchases with either their fingerprint or a selfie.
USAA, a large financial services company has been providing multi-factor authentication since 2011 that includes fingerprint, voice, and facial recognition options. USAA is now automatically enrolling new customers in its multi-factor authentication programs.
Cyber security is something we should care about every month, but October, as National Cyber Security Awareness Month is a good time for all of us to give some extra thought as to how we can better protect our security when using the Internet.
Steve Weisman, an expert in preventing cyberscams and identity theft, is a lawyer and professor at Bentley University. He writes the blog scamicide.com, where he provides daily update information about the latest scams. His new book is Identity Theft Alert.