Defenses against phishing

In a local Slack forum someone recently asked about how phishing and IoT attacks compare in number.  My answer was...

Phishing in all its variants is by far the biggest vector because (in most forms) it requires essentially no effort by an attacker.  An IoT attack needs to be specifically executed against a target by an attacker, so most "run of the mill" SMBs are not that likely to be on the receiving end of this.  All orgs are going to be on the receiving end of phishing, though, and continually.

For phishing, the best defenses are:

• training users about phishing
• using long, random strings for all passwords
• providing the org's users with a password manager (e.g., BitWarden, 1Pasword, LastPass)
• enabling 2FA on all accounts that support it (preferably not SMS-type 2FA; TOTP authenticator apps like Authy are nice compromise between security, cost, and convenience)
• through the org's Acceptable Use Policy (AUP), requiring employees to (a) use long, random strings for all passwords, (b) use only the org's designated password manager for storing the credentials for all accounts, and (c) enable 2FA on all accounts that support it, and to use SMS-type 2FA only if there is no other option available
• using an email provider that does a very good job of filtering out spam
• if the org is larger, providing a Single Sign-On (SSO) system to employees, to get rid of as many password-based account logins as possible (e.g., Okta, Ping, Microsoft AAD)

SIM swapping

If you think that SIM swapping just means you putting a new SIM card into your phone, you should read this great article:

Sharp SIM-Swapping Spike Causes $68M in Losses | Threatpost

SIM swapping is a very real threat that, if executed against you, can result in the takeover of some of your Internet accounts.  And it's quite easy to execute.

Here are some addition suggestions beyond those in the article:

1. Put a strong, unique password on your cellular account login. The article mentions "variation of unique passwords" but that's not secure.  You should be using long random passwords for all accounts and a password manager to manage those passwords.
2. Call up your cellular carrier and tell them you want to place a special password on your account to block malicious porting (= SIM swapping) of your phone number.  Not all carriers will allow this.
3. Alternatively, for more security but less convenience, call up your carrier and tell them not to allow any changes to your account unless you're physically present in one of the carrier's stores and a carrier employee verifies your ID.  Not all carriers will allow this.
4. Even better, get a second, separate phone number for use only for account ownership, authentication, and 2FA.  Don't this use account to call anyone, and keep the number as private as possible. Google Voice is a great choice.  There are ways of getting a GV number if you live in Canada or another unsupported country.
5. Put a PIN on your phone's SIM card. You do this from your phone's settings. This is actually to protect you in case your phone gets stolen, not to prevent SIM swapping. But the effect of a stolen phone -- and therefore stolen SIM card -- is essentially the same as that of SIM swapping: your accounts that use SMS for ownership, authentication, or 2FA can get taken over.
6. Make sure you store the passwords/PINs mentioned above in your cloud-based password manager, and for resilience make sure you can access your password manager from all of your devices.  (This also applies, of course, to all your other account credentials.)

Cybersecurity hygiene for the new year

Happy new year!  Here are some cybersecurity greetings for the new year -- it's a very dangerous world out there.

I hope all of you are doing these basic cybersecurity hygiene things:

• You're using a cloud-based password manager, e.g., 1Password, LastPass, or Bitwarden -- and all your passwords are long, random, and unique (never reused).  (Proper use of a password manager will make you very resistant to phishing.)
• You're using cloud-based 2FA, especially Authy -- and you've enabled 2FA on all services that support it.
• You're backing up all your data both to at least one cloud backup service (e.g., CrashPlan, Backblaze, Sync.com, Duplicati) and to at least one external drive -- and those external drives have full-disk encryption.

Update 2025-04-27: Given this story, you probably shouldn't use Backblaze: https://www.morpheus-research.com/backblaze/

• You've hardened all your devices with strong passwords/PINs, full-disk encryption (for Windows you need BitLocker), and regular updates.
• You've junked all computers, phones, and tablets that no longer get updates.
• (I could go on and on, but that's a good start.)
• You might think all this will consume too much time, but you'll be saving yourself a lot more wasted time from your digital life getting compromised.  Most of the above are mainly one-time actions to set up.

If you're still using your ISP's email service, like @telus.net and @shaw.ca, this is for you:

• If/when you decide to look to greener hills, you'll find it really painful to move to a new ISP since your existing one has you by the short and scruffy. The issue is not all your contacts that use that address, it's all your cloud services that have that address as the owning email id.
• I recommend that you start fixing this now: create a permanent email address like @gmail.com or @outlook.com and slowly move over all your cloud accounts to that new address. Then you'll be free to switch ISPs if you ever want to. The longer you wait to do this, the more cloud accounts you'll have, and the more painful the eventual fix will be.
• (Yes, the above falls under security: it's availability, which is a key part of the confidentiality/integrity/availability security triad.)

Tips for protecting your password manager account

This is a great article that applies to any password manager (PM):

7 Tips to Protect Your Bitwarden Account | Bitwarden

If you've implemented a password manager for you or your org, there is more to do!  Here are some additional suggestions that build on the article:

• Treat as a crown jewel the email account that owns your PM account and all your other cloud accounts.  If baddies can take over that account, they can take over almost all your accounts by doing password resets.
• You have to properly use a PM to get the value: it's not enough to just have a PM account and store your logins in it.  For starters, for your important accounts, change their passwords to long random strings, and use the PM to autofill your credentials into web login pages; that will make you very resistant to phishing.
• Two-factor authentication (2FA) is critical for your important accounts, including your PM and email accounts.  Authy is an excellent 2FA authenticator app/service.
• Backing up your vault is a great idea, but be aware that if you're on a Windows PC, your main drive is not encrypted unless you have enabled BitLocker (or the Device Encryption found on Microsoft Surface-type devices); so you'll need to store your PM vault export somewhere else.

If you or your org haven't yet implemented a PM, it's usually the very first thing to do (along with 2FA) to improve your cybersecurity. Three excellent PM to consider are BitWarden, 1Password, and LastPass.  Check out their business tiers if your org is multi-person.

Buying a new smartphone: security updates

When buying an Android phone, or tablet, you need to pay a lot more attention to the issue of security updates speed and longevity than with an Apple device. 

Most of the articles listed on the first page of the search below are worth reading to understand what manufacturers/phones are the best for security updates.  You want a phone manufacturer that will quickly pass on to you the security updates that Google releases, and will continue to do so for as many years as possible.  When the Android security updates stop getting to your phone, it's good only as a paperweight.

https://www.google.com/search?q=best+android+phones+for+security+updates

With Apple you have much less to think about, and a phone will always get 4 or 5 years of updates.  Some 5-year old iPhone and iPad models are getting 6 years, which is unusual.  And Apple is even providing occasional security updates to devices on iOS 12 (and above), which way behind the current iOS 15.