Dr. Glowcat's Debug Log

October is Cybersec Awareness Month!

As the title says! The goal of the initiative is to make people and businesses aware of the need to protect themselves, and how to accomplish that. Our lives are getting more and more online and the world is getting more and more dangerous, and so we all need to do something to protect ourselves. Yes, even you, mom
So here are a few simple questions to get you started. If you answer them honestly, you will have done half of the work already.

  1. Do you have good password hygiene? We've been trained for years to create password made of a mix of uppercase, lowercase, symbols and numbers, but the little-known truth is that all that matters for password strength is its length. It takes a couple of days for an automated script to crack a short string of gibberish, but centuries for it to crack a phrase-worth of normal text. Something like "glowcat pizza tractor flying". That's not more difficult to remember than fF0otb4LL?# and in fact it may even be easier, since it's normal spelling, but it's effectively impossible to guess or brute-force1. Still don't like it? Use a password manager! Then you only have to invent and remember the password for the pw manager itself, and it will deal with the others.
    Don't reuse passwords across services (to contain damage in case of a breach) and if/when a breach does happen change the affected password immediately.
  2. Have you changed your router's default credentials? If you haven't, any ol' dog with ill intentions can log onto your router and wreak havoc, for example using it in a botnet or sending you to phishing sites. I'm talking about the router's admin password here, but changing the WiFi network name to something unrelated to the brand and setting a hard password to connect is also very important. To do both, use your browser to navigate to your router's address, which you'll find in the instruction booklet or on the vendor's homepage. Log in with the default credentials (the ones you're going to change!) and navigate through the settings to find the security ones, where you can set new credentials. Done!
  3. Do you think before clicking links in emails? Look, I get it: we're all busy and swamped by emails, so it's easy to slip. I, too, have clicked on a phishy link! It was allegedly from a courier and I was expecting a package from exactly that courier. It was only after I had already clicked that I realised the courier wouldn't have contacted me on the work email address. Fortunately it turned out to be a phishing test from the workplace, so the only thing that got damaged was my ego, but it illustrates how smart phishing has become. Stopping and thinking, not doing things on autopilot, can avert a good deal of trouble.
  4. Do you do regular backups? If you get hacked or, even worse, catch a ransomware, sometimes the only thing to do is a factory reset of your device. Having a recent backup minimizes the losses and also lowers the psychological bar for actually pulling the plug.
  5. Do you keep your software updated? Yes, it's annoying to have to constantly update your apps, but those update often contain fixes to newly discovered vulnerabilities. That's why they're called "patches". Keeping software up to date reduces the chances of somebody exploiting a known weakness to target you.

Happy October, folks, and stay safe!


=^.^=


  1. quick addendum for the pedantic people up there: yes, symbols and numbers do make passwords harder to crack, but remember that the most effective cybersec practices are the ones users are willing to follow. Gibberish passwords are easy to forget and won't be used for long.↩