Jersey Library Lunchtime Talks
11th October 2016 · Tom Brossman
Thanks - Anne King Jersey Consumer Council - Jersey Library for hosting | About me - Support & advice for small business & individuals - 7 years here - Care about privacy
-Which threats are you defending against?
-What are you worried about losing?
Your bank has security professionals
Your bank can spot patterns of fraud
-Banks have already hardened their defences
-Distance selling legislation
-banks often cover 100%, in excess of requirements
Your Money Is Protected
Distance selling regulations
Banks usually waive ALL your liability
Read the small print & follow best practices
You can restore from backups
Much of your data is stored remotely
Off-site backups guarded by security pros
A backup you haven't tested isn't a backup
Sync is not backup!
Your Data Can Be Protected
Many backup options
Inexpensive and automatic, backed up by security pros
How do you get your privacy back?
Did you secretly donate to Donald Trump's campaign?
What would your neighbours think!
A 'full profile' of your data is worth around £300 to criminals.
Opt-out when possible
Don't be mad, servers cost money!
Do not assume the company is competent
Do not assume you will be notified if you data leaks
UK Data Breaches
“Service providers are required to notify the ICO if a ‘personal data breach’ occurs. They must also notify customers if the breach is likely to adversely affect customers’ privacy, and keep a breach log.”
Unambiguous - "Must" and "Required"
Jersey Data Breaches
“Organisations have no legal obligation to notify the Commissioner of a security breach, however the circumstances of the breach may lead you towards issuing a notification.”
Let's be nice and say "could be improved"
Warns: “Have you considered the dangers of ‘over notifying’?”
Have I Been Pwned?
Check if you have an account that has been compromised in a data breach
haveibeenpwned.com 1,485,000,000+ accounts to date
"Pwned" frequent typo for "Owned" (slang for compromised)
Yahoo! 500M accounts 2 weeks ago...
Ask about retention
Test password recovery, etc.
Use Anti-virus software
Use strong passwords
Change passwords frequently
Only visit websites they know
Don’t share personal info
Top priority is antivirus
How do they remember strong passwords?
Install software updates
Use unique passwords
Use two-factor authentication
Use strong passwords
Use a password manager
Top priority is updates
Antivirus didn't make the list!
AV like car air-bags, useful only after something went seriously wrong. Better habits = better protection
Always Protect Email
Fraudsters can quickly build a profile on you
"Forgot password" option gives them your other accounts
After a compromise, double-check recovery settings
Emil is the single most important account to protect
Email is the "Master Key" to everything else
Criminals change recovery options to backdoor their way in again...
Every site gets a unique password, no exceptions
Start using a password manager immediately
-Can also use a Yubikey to lengthen your password
-Password manager, automatic once set up
Default: Your Web Browser!
KeePass (Windows, macOS, Linux, Android, iOS) Free
LastPass (Windows, macOS, Linux, Android, iOS) $12/year
Dashlane (Windows, macOS, Android, iOS) $40/year
Browser can sync across devices
Managers can generate passwords too
Is your Mother's maiden name on Facebook?
These are passwords too!
Paris Hilton used her dog's name - Tinkerbell - was on TV show
Free Mobile App
Codes change every minute
Protects you if passwords stolen
Second line of defence against infection
Protect against "shoulder surfing"
Remote attacks nearly impossible
Use a passcode / fingerprint lock
Set up & test tracking of "lost" device
Apple calls it find my iPhone
Android, everyone has it
Humans always the weak link in security
We want to help & trust others
Fraudsters exploit this
An attempt to obtain sensitive information such as usernames and passwords under a false pretext.
west.com / bankofthe vvest.com paypal.com /
Can be broad and obvious
lookalike domain names, often subdomains
Can also be targeted and very convincing
Who Initiated Contact?
Single most important indicator
Never trust message content
A genuine alert can be handled by calling back
Hover over links before you click
When you initiate contact, you know who you are emailing or speaking with
Basic Website Security
“If there is NO padlock in the browser window or ‘https://’ at the beginning of the web address to signify that it is using a secure link, do not enter personal information on the site.”
HTTPS is free and takes minutes to set up
Information Commissioner explicitly says to use it
Many local sites ignorant of the risks
Ad networks are criminals' PREFERRED malware distribution method. Used to be porn sites, now adverts.
Blocking all ads is now a basic security precaution
"Malware-squirting ads appear on websites with 100+ million visitors" -
The Register "Research reports malvertising events rose 375% in 2014 and another 260% in 2015" -
Online Trust Alliance
Ad networks are attacking your computer today
This is unacceptable
Spotify last week?
Desktop: "uBlock Origin" for
Firefox or Chrome Mobile: "uBlock Origin" for
Can block with router hosts file, much more complicated though
Firefox on Android or "Adblock Plus" for iOS
"Privacy Badger is a browser add-on that stops advertisers and other third-party trackers from secretly tracking where you go and what pages you look at on the web."
Does nothing by default
Detects 3rd-party tracking and blocks it automatically
Security for home connection
Security for public WiFi
OpenDNS "Family Shield"
Both block malware & Phishing sites
Family shield - blocks everything
Home - Free account, configurable
HTTPS connections are end-to-end encrypted and secure
HTTP connections are not secure
Best practice - use a VPN service
Safe default is to use a VPN
Virtual Private Network
Location tracked within store
You are paying with your data again...
Internet Of Things
"Smart" thermostats, smoke detectors, devices, etc
Ever Update This Thing?
Last time you updated this?
It's your firewall & all your traffic passes through it.
"Some Fitbit users' sex stats on Google search" -
Security often an afterthought
After-sale support poor
Opt-out where possible
Can I borrow your printer?
tinfoil hat time...
OpenDNS Phishing quiz?