CAM Week1 – Passwords, Password Managers, and Protecting Connected Devices

Passwords and Password Managers & If You Connect It, Protect It

Welcome to the first week of Cybersecurity Awareness Month! Each week we will discuss two primary topics. One of those topics will be the CAM 2020 “official” weekly topic and the other will be localized for the Berry community. This week, the official topic is “If You Connect It, Protect It”, and the local topic concerns passwords and password managers.

If You Connect It, Protect It

Once we connect a device to the Internet, via a wireless network or cellular data connection, or other method, it is exposed and vulnerable. That’s a terrible way to look at it, but there are stories every day of new vulnerabilities in software and hardware that we use all the time. In 2019 there were over 22,000 vulnerabilities identified, with over 12,000 of those reported and assigned a Common Vulnerabilities and Exposure (CVE) identifier, which is used to identify and promulgate information about the vulnerability.

That 22,000 number is across hundreds of companies and products, but you know the names of some of the most affected companies. They include Microsoft, Adobe, Apple, and yes, even Google. It’s a safe bet that whatever device you connect, it will already have, or will have in the future, vulnerabilities. What to do?

When reputable companies find or are told about vulnerabilities, they create and release updates, unless the software or hardware is no longer supported. We see evidence of this all the time…Windows wants to reboot to install updates, your phone tells you it needs to reboot to install updates. Don’t ignore these warnings, especially when first connecting a device to the network. At the same time, become familiar with what these warnings look like to avoid being fooled by fake update messages in the future.

All of this to say that the most important rule of properly securing connected devices is to keep your devices updated. The first thing to do after you connect something new to the Internet is update it.  On average, newly connected devices are attacked within 5 minutes and are targeted by exploits specific to the device within 24 hours. That’s not much time to go out and get the latest update for the device. Do it quickly!

Passwords and Password Managers

We talk about passwords a lot, for good reason. With all of their inherent flaws, passwords are the de facto way we authenticate to all of our accounts. The average person now has 27 discrete accounts, while people in information technology fields or younger people may have two or three times that many. This means the average person should have at least 27 different passwords, but humans take shortcuts, even when it is dangerous to do so.

One particularly dangerous shortcut people take is to reuse passwords for multiple accounts. Aside from the need to keep them secret, this is the most important rule in properly dealing with passwords – do NOT reuse them. Make sure passwords are unique across all accounts.

Good passwords are also long, complex, and not based on easily located data, like birthdays, pet’s names, high school mascots or other public record information.

How long?

Truthfully, twelve to fifteen characters, minimum.

How complex?

Have a mix of upper and lower case letters, numbers, symbols and even spaces, if an account allows it.

Based on what?

There’s several good ways to do this. If the password must be memorable, try imagining a picture of a favorite place, a scene from a book, movie or TV show, or other vivid image that you won’t forget, or be prone to alter. Pick four or five words that describe that image, string them together, capitalize a word, or all of them, and throw in a number. For example, a memorable scene might include a cowboy trying to stay on a bucking bull in a rodeo. Words to pick from this scene could include cowboy, bull, horns, bucking and a number could be 8 (as in, the cowboy has to stay on the bull 8 seconds to get a score).

The resulting password could be “Cowboy-Bull-Horns-Bucking-8”.

What makes this a good password?

    • It is long – 27 characters
    • It is complex – upper and lower case letters, a number, and symbols

What weakens this password?

    • It is based on words which are all in the dictionary

The length and complexity wildly outweigh the weakness of being based on dictionary words. This would be a great password, but read on for why it is not.

Our awesome example password is no longer a great password because it has been exposed. It has been used as an example and therefore should NOT be used as a password. No length or complexity will ever outweigh the disadvantage of an exposed password. Keep your passwords secret and never share or reuse them.

If you prefer not to create 27+ word pictures for your accounts, your passwords, of course, don’t need to be memorable if they will be stored in a password manager and possibly generated by a password manager. They can be as long, complex, and random as you wish, as you will never have to type them in, or even know them.

Password managers like LastPass, 1Password, BitWarden, and even iCloud Keychain for you Apple-only folks, allow you to use long, complex, and unique passwords for EVERY account you have. You only have to remember one, good, strong password to lock away the rest of your passwords. Visit the sites for the managers above or run a search in your browser for “password manager” and see how many results you get.

There are so many options and in your search results you’ll also find sites that will compare some of the available managers, providing recommendations and showing how they stack up against each other. Some have unique features or are better suited for families. Some may not support all of your devices, so be sure to check that your chosen phone, tablet, or operating system is supported. Be sure to pick a recent review, as vendors continuously attempt to improve their products, pricing and supported platforms. Find one you like, try multiple ones out if you need to. Many have trial periods, others don’t cost anything to use, but may have severe limitations. You are almost guaranteed to find one that matches your needs, wants, and budget.

Virtual Scavenger Hunt

If you missed the information about the Virtual Scavenger Hunt (VSH) in the October newsletter, head over there to read about it, then read the CAM 2020 page, and then the VSH Start Page. It will tell you about the hunt, how to participate, and information about the grand prize.

Good hunting!

If you get stuck in the VSH, be sure to follow Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit) for clues. Other, potentially more important information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check the InfoSec News And Alerts Site for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like training will be posted.

 

Photo Credit: Photo by BENCE BOROS on Unsplash

October News from Information Security

October is here! Did you know there are 190 official and unofficial “days” in October? I know, there are only 31 actual days, but many days are workhorses, serving as “the day” for multiple celebrations, from National Pumpkin Day to World Animal Day to the International Day of Non-violence. More immediately on many of our minds here at Berry, Mountain Day is around the corner, along with long-sleeve weather. October is also the height of “pumpkin spice everything”, and…Cybersecurity Awareness Month!

Yes, it’s Cybersecurity Awareness Month! Let’s just call it CAM. It used to be called National Cyber Security Awareness Month or NCSAM, but it is observed internationally now. You can find out about our planned topics on the CAM 2020 page. There will be weekly articles as well as a month-long virtual scavenger hunt…and prizes…and candy…and learning! Head over to the CAM 2020 page to check it out after you finish reading this article. Come on, stay focused here! There will be another link at the bottom of the page.

As already mentioned, look for weekly articles on various security awareness topics posted right here each Monday of October. They, along with the security awareness posters on all the residence hall bulletin boards and in Krannert, will be essential to completing the scavenger hunt. You might be asking yourself, why burn 5-10 minutes of time each week in October tracking down scavenger hunt items? Because everyone who completes the scavenger hunt will be eligible for a drawing for the grand prize of a pair of Monster Isport Ear Buds Monster Clarity 102 AirLinks Wireless Ear Buds

As a part of CAM, the Office of Information Technology (OIT) is strongly urging everyone to sign up for Multi-Factor Authentication (MFA) for their Berry account (and all other accounts you have, but we are particularly concerned with your Berry account). MFA brings another level of security to your account and can protect you if the password for your Berry account is exposed. The setup is easy, and you’ll be able to keep your Berry account password for an entire year, assuming it does not get exposed. Email computing@berry.edu and let them know you want MFA. MFA will be required for all current students, faculty, and staff soon, so you should beat the rush and get signed up now!

In addition to encouraging everyone to sign up for MFA, OIT is also encouraging everyone to sign up for security awareness training. OIT is implementing a brand new security training platform and we want as many as possible to experience the new system. While we will continue to focus on specific training for now, we are looking to expand the system to accommodate everyone as soon as we can. More details will be provided, either in one of the CAM 2020 weekly emails or the November monthly newsletter.

There are other ways to participate in training. You can attend a one hour, Zoom-based, focused training on phishing emails or passwords and password managers, or request one-on-one training on a particular topic. Since the theme for CAM is “Do Your Part – #BeCyberSmart” we encourage you to develop your cybersecurity “smarts” in whatever way fits your schedule and goals.

If, after reading the CAM2020 page and looking over the rest of the website, you think I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the calendar where events will be posted and you can register for these events.

The Berry CAM2020 page

Go directly to the scavenger hunt page!   This link will not be active until Monday October 5th,  2020, at 8:00AM

Upcoming Events

 

 

 

 

Featured Image: Photo by Joanna Kosinska on Unsplash

June News from Information Security

Welcome to the very late June newsletter!

A failure to plan and pre-write the June newsletter, plus a virtual conference during the first week of June, then a frenzy of activity at work, then a couple of vacation days has pushed this edition way past its normal publishing date.

But here we are, still stewing in the social distancing mire, but at least able to do more things, like eat AT restaurants instead of getting food delivered, or, gasp!, going out and picking it up curbside. I hope all of you are healthy and well and have been able to resume some sense of “old normalcy”.

As I mentioned in the last newsletter, phishers, scammers, and the like have been VERY busy trying to take advantage of this time of flux, if not outright chaos. I write this newsletter as cities around the country stagger under the effects of not just the coronavirus, but protests and riots. Both are happening, and many protests that start peacefully are stirred into riots by organized bad actors. I hope you or your loved ones have not been affected…and that’s all I’m going to say about that.

I’ve interacted with several of you about suspect emails over the last few weeks and I appreciate your caution and skepticism. Everything from fake voice mail notifications to fraudulent signature requests have arrived in our email inboxes. Companies continue to improperly care for the data they acquire from us. There are a couple of upcoming breach notifications that I need to finish and publish to the site.

With that said, I encourage everyone to go to Have I Been Pwned to see what data about you has been exposed. Notice I don’t say “IF” data has been exposed, but “what” data has been exposed. It’s easy. Go to the site, put in your email address(es), and be sure you are sitting down when you click “pwned?”. While you are there, sign up to be notified when information connected to your email addresses has been exposed. You’ll have to register each email individually.

As I mentioned in May’s newsletter, all email should be carefully examined. Actually, I said that “almost all emails should be considered suspect” and I stand by that statement. I also said that this was the number one safety tip I could offer during this time. Here are tips two and three.

Most Important Tip #2: Update your devices.

Your device, whether it is a Windows or macOS computer, or an Android or iOS device should be set to automatically update. If you have an undeniable fear of automatic updates, then at least make sure that update notifications are turned on. Then, when Windows or macOS notify you of an update, or your Android or iOS device chime to tell you an update is available, first confirm that it is a real update notification. Update notifications don’t come in your email, nor do they pop up inside your browser. These notifications come directly from the operating system of the device. Examples are shown below:

Windows 10 :

macOS:

Left iOS (iPhone and iPad) and Right Android phone (Motorola, others may vary)

Most Important Tip #3: Use a strong, unique password and multi-factor authentication for every login account you have.

What do I mean by a strong password?

  • At least 13 characters long, 20 is better…
  • Don’t worry about complexity unless the particular site or service requires it.
  • No dictionary words by themselves.
  • Do not use any part of your username or real name/nickname in the password.

What?! Thirteen characters? Twenty characters? Yes. Find a password manager you like and use it to both generate and store your passwords. That means you only need to remember one long password, to open the password manager. Longer passwords are better than short, complex passwords. If you insist on making long passwords that are non-random, don’t use long dictionary words. Use multiple, unrelated words, as explained in the Good Password Guidelines Quick Info article here on this site.

Get multi-factor authentication enabled on every account you can, especially accounts for banks and other financial sites, sites which handle your medical records, other confidential and sensitive sites, and your Berry account.

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup takes only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!
If I’m not covering a topic of information security you are interested in or concerned about, please let me know. I want to be your first and best resource on information security, so let me know how I can help and inform you.
If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

 

Photo Credit: Photo by Max Kleinen on Unsplash

Watch Out for Social Media “Surveys”

With everyone spending more time at home, traffic on social media sites has grown tremendously. One particular item to avoid during this time of boredom meltdown, even though they may be fun, are so-called “surveys” on social media sites. You know, the ones that ask about favorite colors, pet’s names, mother’s maiden name, what schools you attended, favorite songs, movies, cars, or whatever? Do these questions sound familiar?

If you have ever set up backup “security questions” for a web site, you’ll notice the surveys ask for many of the same bits of information. A fair percentage of these surveys are simply intended to grab your username for the social network, then slyly ask you to hand over potential security question answers.

Don’t fill out these surveys. Yeah, they can be fun, maybe, but if the information you willingly hand over may allow someone to reset your password by knowing the answers to your security questions, then they are a really bad idea!

With that in mind, whenever you fill out these backup security questions, you should never put real information in as your answers. Make up answers for these questions, then record those answers somewhere safe, like in a password manager, along with your unique password for the site! This way, you can provide the answers to these questions, but no one else will be able to discover than information from the far reaches of the Internet, or from your answers to a social media site “survey”.

If you would like more information on password managers, check out the short password manager article here on this site.

 

If you haven’t signed up for multi-factor authentication (MFA), what are you waiting for? This adds an additional layer of protection to your Berry account and lets you keep the same password for a whole year! Setup take only a few minutes. Make your request by emailing computing@berry.edu to tell them you want MFA!

 

If you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the events calendar where events like tables in Krannert and LunchITS will be posted.

 

Photo Credit: Photo by William Iven on Unsplash

January News from Information Security

Welcome to this special “mid-January” monthly edition of news from Information Security!

With the students not returning to class until the 13th of the month, this edition was delayed to roughly coincide with their arrival. Also delayed are the security awareness posters, for those who get them and post them in their offices. If you would like to have security awareness posters to put on a departmental or office bulletin board or at “the watering hole” for your area, please email infosec@berry.edu and mention you would like to receive these on a monthly basis (and how many). They will normally be distributed at the first of the month, but again, for January, 2020, they will be distributed the week of the 13th.

I’ve already sent a couple of emails to faculty and staff this year, one about the new idle workstation lock policy that went into effect on the 6th of January, and another pointing to a post here urging everyone to be particularly vigilant in the next few weeks, and beyond, as tensions with Iran continue to build. It is assumed that part of Iran’s counterattack will be conducted in the digital realm. You can read the warning by clicking here.

On the topic of returning things, there will be a LunchITS scheduled toward the end of January. The topic will be account security, including information about usernames, passwords, password managers, and multi-factor authentication. If any of that sounds unfamiliar, then this LunchITS is for you. I will send out an email when the schedule is confirmed and you can always check the event calendar right here on the InfoSec News & Alerts site for future events. February will see the return of the phishing LunchITS and a brand new LunchITS geared toward a broader overview of security awareness.

Wait, what’s a LunchITS, you ask? LunchITS, which is short for “Lunch+Information Technology Security” are one hour training sessions, held during the lunch hour (12:00 noon – 1:00 PM) in Krannert, where you can come, with your lunch, and learn more about information security. You can pick up lunch at Krannert, or brown bag it. Just be prepared to learn while you eat. You’ll get information to take back with you, with all of the main points of the session included on the provided literature, for those of us who can’t eat and take notes at the same time.

Also coming up in January is Data Privacy Day, celebrated on the 28th of the month, which just happens to be a Tuesday, and Information Security will have a table in Krannert from 11:30AM until 1:00PM where you can drop by and ask questions, pick up information, and grab some gratuitously bad edible items. This event will also be on the event calendar on this site and an email will go out the day before to remind you.

Finally, coming soon to a computer or phone screen near you (probably on your desk or in your hand) is the next in-house written, filmed, and produced security awareness video. The intrepid Director of Information Security will help yet another would-be victim with their security awareness. As soon as it is ready, an announcement will go out over email and on social media.

On that topic, if you’re not following Berry OIT on Facebook (@BerryCollegeOIT), Twitter (@berryoit), or Instagram (@berrycollegeoit), you should be, as more information from OIT and specifically Information Security, will be provided using these outlets. Remember you can always check back here for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me, and the previously mentioned events calendar.

That’s it! Welcome back to a new year, everyone, whether you just got here or have been here for two weeks this year already.

.

Photo Credit – Photo by Glen Carrie on Unsplash

 

 

November News from Information Security

The days keep marching on! It’s November already and holidays and finals are growing ever closer. Fall weather is finally here, just in time for winter to blow in.

I want to thank everyone who came by the table in Krannert during National Cyber Security Awareness Month in October. We had more people stop by this year than ever before and one lucky person won the big prize on Halloween. In addition to some Berry-branded drinking apparatus, they got lots of candy and a Yubico YubiKey that will help them increase the security on lots of their online accounts. There were over 60 visits to the table this year, the weekly articles were viewed over 170 times and the videos had dozens of views. I hope you had as much fun watching the last two videos as I did writing and making them.

Another piece of information I want to pass along is the implementation of automatic idle lock for campus workstations. This has been mentioned before, but to refresh your memory, this simply means that most computers on campus, if left idle for ten minutes, will lock the desktop, requiring the user to enter their credentials to gain access. Information Technology has been working hard to make sure this policy does not impact computers in classrooms, meeting rooms, and other places where there is a potential for the policy to interrupt class or meetings. The important information I want to pass along is that this policy will go into effect on January 6th, 2020, when everyone returns from the holidays. More information will be provided between now and the end of the semester.

Keep an eye on this site to see when the next Krannert table is scheduled. The front page has an “Events” link in the main menu that will show all of the upcoming events being offered by Information Security. Also listed on the events page will be any upcoming LunchITS, where we dig into a topic for the duration of the lunch hour while enjoying our lunch. There will be one in early November, but the date is not yet finalized.

You can also check back for warnings about current phishing emails, confirmations of valid emails you might have a question about, and data breach notifications. There’s also the Q&A section, where you can ask a question and get an answer directly from me.

If you notice any issues with the site, as it is undergoing an upgrade and expansion, please let me know by emailing infosec@berry.edu.

Let’s take a few moments and dig into this month’s topic. Data security.

As I hope you inferred from all of the events and activity during October, information security efforts will only be successful when all members of the campus community understand the risks and take steps to avoid them. One of the biggest risks is the exposure of confidential data.

Did you know? In 2017 the education industry (which includes K–12 and higher education institutions) had 7,837,781 records breached in 35 events. To put that into perspective, the healthcare industry had 6,058,989 records breached in 428 events, and the retail industry had 123,652,526 records beached across 33 events. (See Privacy Rights Clearinghouse Chronology of Data Breaches, 2017 data.)

More than half of the breaches in the education sector were caused by activities directly attributable to human error, including lost devices, physical loss, and unintended disclosure (see figure 1). These breaches were arguably preventable through basic information security protection safeguards.

bar chart showing types of security breaches among educational institutions
Figure 1. Types of security breaches among educational institutions

What can you do every day to protect data? There are very few, if any, verticals such as higher education that transmit, process, access, and share such varying sensitive data elements. There is not a “one size fits all” blueprint for information security controls that all institutions can follow. Yet all campus members have a responsibility to know basic information security protections to safeguard data and prevent those data from being mishandled:

  • Update your computing devices: Ensure updates to your operating system, web browser, and applications are being performed on all personal and institution-issued devices. Updates to college owned computers is handled automatically as long as it is online to receive the update and is rebooted on a regular basis.
  • Use multi-factor authentication: Whether for personal use or work, multi-factor authentication (MFA) can prevent unauthorized access even if your login credentials are stolen or lost. If you would like MFA enabled for your account, please email computing@berry.edu and request it.
  • Create really strong and unique passwords: Create unique passwords for all personal and work accounts. In today’s environment, one of the best ways to create a really strong password is to use a password manager for all of your accounts. A password manager will alleviate the burden of having to memorize all the different complex passwords you’ve created by managing them all in one “vault” and locking that vault with a single master password.
  • Protect your devices: Using biometrics or six-digit passcodes on smartphones and tablets is critical to keeping curious minds from accessing personal information, work email, or retail/banking applications. It also helps protect your device if you lose or misplace it.
  • Understand where, how, and to whom you are sending data: Many breaches occur because of “oopsie moments” where we accidentally post sensitive information publicly, mishandle or send to the wrong party via publishing online, or send sensitive information in an email to the wrong person. Taking care to know how you are transmitting or posting data is critical.

Getting ready to send data to a vendor or sign a contract? With more and more services moving to the cloud, higher education institutions have an additional obligation to ensure that third parties are protecting our most sensitive information. If you or your department is looking to purchase or adopt a service or technology that uses institutional data, it is imperative that you include the Office of  Information Technology (OIT) at the beginning of the project or contract process to help ensure that data are properly protected. To determine whether or not OIT should be involved in the vendor/contract process, ask yourself the following questions:

  • Does the project (and in-scope technologies) involve the handling or storage of personal data (e.g., student data, employee data, donor data, research data, or financial data)?
  • Does the project (and in-scope technologies) involve the handling or storage of personal data that is regulated by government entities or has special contractual obligations to a third party (e.g., contract sponsored for research)?
  • Is there transfer of any institutional data from an institution-owned system or device to a third-party vendor-contracted system or device?
  • Does the project involve acquiring/implementing/developing software, services, or components that your institution has not previously deployed?
  • Does the project involve providing a new data feed to an existing campus partner?
  • Does the project involve accepting card payments in any way?

If the answer to any of the above questions is “yes,” please collaborate with OIT at the beginning of the project to ensure that institutional data are properly protected. You can simply email computing@berry.edu and let the Technical Support Desk know you have a new service you want to implement. They will get the right staff in touch with you.

Have a great November!

 

Photo by Priscilla Du Preez on Unsplash