Musings from a Internet Security Professional

I've been working in the Silicon Valley in the Internet Security field for over 10 years. I have worked for companies such as Barracuda Networks, Symantec, and currently employed with Agari. My main focus is email security, however I dabble in web based security as well. Here is where I'll share some tips and tricks as well as my view on current trends.

[fuzzypinklaptopsecurity-blog]

[fuzzypinklaptopsecurity-blog]

Agari’s Quarterly Email TrustIndex offers a unique scorecard to see how well both individual companies (147 companies) and industries as a whole (11 industries) are protecting their customers from email cyberattacks.

[fuzzypinklaptopsecurity-blog]

MUST CLICK! DON’T CLICK! There is no spider under the skin. Promise!

I see it more and more. You think that people would start to understand the dangers of the Internet and start practicing a bit of caution. Unfortunately our human curiosity takes over and we MUST CLICK! But I’m here to tell you DON’T CLICK! This is a scam.

Usually people will take advantage of current events. Something that people are really interested in. For example, when Paul Walker passed away, people were wanting to click links stating things like “Paul Walker is Alive, click here to watch” or “Watch live video of Paul Walker exit the vehicle”. These low life scumbags of the interwebs will really aim low to get you to click through or what we call “Clickjacking”.

This particular video claiming to be a young girl who has a spider crawling under her skin has actually made it’s rounds a few times online. One of the first was July 2011. If you clicked to view the video you would be prompted to an “Age Verification” page. Once you put in your age, you were presented with a page asking you to fill out an online survey.  Will a online survey cause you harm? No (unless of course the page used had a virus of some sort. The internet is an onion folks. There are layers).  Most of the time it’s just a survey with questions they want to know.

Sometimes these videos or “MUST CLICK” to view something really interesting is just not worth it. You can be lucky and only be led to an online survey, but then sometimes you can be directed somewhere worse or a place which is infected and can harm your system and personal information. Not to mention how embarrassing it could be when you’re on your lunch break at work clicking on a video that takes you to some hardcore porn site. Yeah, try getting anyone to listen to you about how you ended up there. Trust me, it’s not a conversation you want to have.

My advice, just don’t f’ing click it. It’s not worth it. Want to see a spider crawl inside someone’s skin? Pick a new hobby!

[fuzzypinklaptopsecurity-blog]

How to stay safe online

I have been working in the internet security field for roughly 10 years. Whenever I am asked what I do for a living and my response is "Internet Security" I always get the same response. People want to know how to be safe on the internet.

There are some basic steps that can help keep you save using email and the internet. Is this the full list? Heck no! But if you can manage just remembering these few points, your going to be much safer.

Virus Protection

You do not need to pay for virus protection. There are a lot of companies out there (I've worked for some, trust me) who are selling products that really are just comprised of free information that they then package in their own branding and then sell. Lame right? The truth is, there is a lot of free services that are great. The internet security community (on the whole) is about keeping the internet safe and to do so, EVERYONE needs to be vigilant. I myself primarily use a Mac. I currently use Sophos. I really like it and recommend it for anyone running a Mac platform. For all you PC peeps, there is a larger list out there of some free virus protection software. I would research and see what works best for you. A few that are popular today would be: avast!, Panda Security, and ClamAV

Online Purchasing

Buying things online has made my life so much easier. I hate being stuck in a busy mall, pushing my way through people to get to a store where I find they don't have what I want anyways. Buying online allows me to research a product and find the best pricing. However, when you are adding your personal details such as bank account, credit card, or mailing address, it can be pretty scary. Some tips to make sure you are safely buying online:

If you don't feel comfortable buying something online, don't. If the website looks different to you, or you just don't feel comfortable, don't do it. Simple.

ONLY provide your details to a website you are connected securely to. To connect securely, you need to make sure the URL starts with https:

Remember: All browsers (Chrome, Firefox, Safari) will display this differently. Some will be green bars while others just simply will have https. Https means your information is traveling on a secure channel. In order for a website to provide you with https, they have to purchase something called a SSL certificate. The SSL Certificate will tell the end user (that's you!) who the actual company is. This is important, especially when you are shopping and wanting to make sure it's not a fake site put up online to look like a legitimate site. Here is what the SSL certificate for Amazon looks like:

You can see the "Common Name" which is the website address the certificate is purchased for. The "Organization" field is the company that has been validated. If the information here does not match, or if there is a problem with the certificate, do not proceed.

If at all possible, use Paypal to buy your products. Setting up a Paypal account will ensure your financial information stays private. It's also very handy to use. Never save your credit card information on your computer. Do not write it down on a sticky note. That's bad. Just don't.

Staying Safe with Email

The invention of email was HUGE. Think of what your work would be like without email? And as wonderful as I find stationary, I still find writing an email so much easier. Unfortunately, when email was created it was not really done so with the intention of EVERYONE AND THERE MOTHER using it. Therefor it has a lot of faults that us internet security professionals are trying to fix everyday. Why not start over? It's just not possible. Instead of getting burnt by email, here is how you can stay protected:

NEVER EVER EVER EVER open an email from someone you don't know. Seriously, don't do it. This is bad. Even if your like "Hmm that name sounds familiar. Maybe we went to school together". Nope. Just don't. Even if you do not send a response, there are ways for senders to see if you opened their mail. It just takes one time to peek and your screwed. Just delete the message if you can't hold yourself back.

Never open attachments unless your machine is protected. Never open attachments from someone you do not know (Again, see step 1).

If it's too good to be true, it probably is. An email from a long lost cousin who wants to leave you their fortune? Yeah right. Like that actually happens to people. Seriously, most people would be like "Um no. I don't have a cousin in Nigeria". But there are still people out there who fall for this. That is why it's still in play. Crazy huh? Don't be that person.

Never use your personal email address to sign up for something online. This is a big one. There are a lot of places online that do not let you enter until you give them your email address. It's becoming increasingly difficult to not provide your email address these days. Do what I do. Create a separate account for "Junk". Only actual people  you know should ever have your email address.

Stop forwarding chain mail and stupid jokes. Most people don't realize your just providing a list of email addresses for someone to send crap to. Also, there is no such thing as getting bad luck from an email. Trust me. Also, it's just annoying.

Never provide personal information or banking details. Sometimes scammers will send out very real looking emails claiming to be from your bank or possibly other organizations you deal with. No legitimate organization will ever require you to provide this information. If they need it, then go to the bank branch and speak to someone in person.

Password Protection

Never give your account or password information to anyone. If someone emails you asking for your password, delete the message. No one will ask. I also suggest changing your passwords periodically. Sometimes you are requested to add a security question/answer. Make sure this is not common knowledge. For example, if you have a security question that asks "What high school did you graduate from" I'm pretty sure you could find that info on Facebook or LinkedIn. Make sure the question is something you can answer that no one can find online.

Just following these few simple rules will keep you pretty safe. Just remember, if it seems weird or your not comfortable, do not continue. Never provide personal details online, change your passwords, be virus protected, and just be smart about it.