How Hackers Get Around SMS Two-Factor Authentication

by

Every time you’re online and a site sends a separate code to check your identity, you’re using two-factor authentication. It’s become the norm. So, of course, hackers have figured out how to get around this, too. This article shows you how they do it and how to stay safe.

With billions of usernames and passwords leaked, access credentials everywhere are at risk, especially if you are reusing your log-in information on more than one site (don’t do it!).

Business websites want to offer a secure user experience, so two-factor authentication (2FA) has become the norm. It’s meant to help stop automated attacks in which bad actors use the leaked usernames and passwords.

Still, if the site you’re visiting uses short message service (SMS) to send a one-time code to your phone, you could still be at risk.

Hackers, using information they have from a data leak, can call your telephone company. They use your name, date of birth, and other identifiers available on the Dark Web, to impersonate you. Then, say you’ve lost your phone, they transfer your phone number to a device with a different SIM card.

That means when the one-time SMS code gets sent your phone number, the message will instead go to their device.

Android Users Also Beware

On Android devices, hackers have an easier time getting access to text messages. If they have access to your leaked Google credentials, they can log into your Google Play account. From there, it’s simply a matter of installing a message-mirroring app on your smartphone.

The app synchronizes notifications across your different devices. It’s for when you really need to be connected, and you’ll be able to see your phone’s SMS alerts on your tablet!

The app won’t work unless you give it permission when prompted to do so, but too many people don’t stop to read alerts from their own accounts: they assume it’s another necessary update and go on with their day. Otherwise, the hacker might call you in a social engineering ploy pretending to be a legit service provider. They’ll be familiar to you, so you’re more likely to listen when they ask you to give permission.

Again, when the one-time SMS code gets sent to your phone, because of the message-mirroring app, the hacker’s device will also receive the code.

What Can You Do to Protect Yourself?

It starts with using unique passwords for all sites you visit. Worried you’ll forget them? A password manager can keep all your access credentials in one secure place for you.

You should also confirm that your credentials haven’t been compromised. If you use Google’s password service, you can head to the password manager site and tap “check passwords” to see if there are any issues. On Firefox, head to the Firefox Monitor page and “Check for Breaches.” On Safari, click on Preferences, and then on Passwords to see what recommendations they have for your security.

Change any passwords that have been involved in a leak!

To avoid the SMS concern specifically, avoid using one-time SMS codes to verify your identity. Instead, you can use a non-SMS authentication tool such as Google authenticator, which provides two-step verification services within the app itself.

Need help learning if your credentials have been leaked? Or want assistance setting up more security for your online activity? We can help. Contact our IT experts today at (515)422-1995.

The Danger of IT Dashes for Small Business

by

Few of us would think we could run a marathon, or even a 10-mile race, without training first. Yet the number of people who think they could successfully run a 50-meter dash jumps dramatically, especially if they were being chased by a criminal, cougar, or scary clown. Still, that short sprint would be much easier with proper training, too. So, what does this have to do with IT? A lot, actually – keep reading.

Many businesses are taking a “we’ll dash when we need to” approach to IT. The news of ransomware at a hospital or a data breach at a national mobile carrier gets them spooked, and they are immediately running to try to solve the perceived cybersecurity problem. They’ll buy the newest app or device available, because it must be the best, right? After that they plod along, not paying much attention to good security practices until the next spike in adrenaline has them dashing to ramp up IT infrastructure again.

But anyone who tries running without stretching or putting on proper shoes knows it is painful. If not in the moment, then the next day when the muscles say, “no way are we getting out of bed today.”

In the IT equivalent, it is more effective to put effort into identifying the best technology for you. Reliable IT isn’t about dashing for that latest device or running from the newest attack – it’s a marathon. You need to be working on it continuously.

Minimize IT Risk with an Integrated Approach

Consistent practices such as ongoing equipment maintenance and patching software provide security long-term. Updating IT to better address threats or improve efficiency beats a reactionary buy.

Plus, by taking the time to make considered purchases, you can be sure you buy technology that:

  • integrates with your existing IT environment;
  • solves problems specific to your business needs;
  • minimizes your cybersecurity risks in both the short and long term;
  • doesn’t overcomplicate your infrastructure.

Think about the marathon runner who sets out a training schedule 12 weeks before the big race. They’re a lot less likely to give up or get hurt. Taking a long-term view of your IT needs offers the same benefits. You’re less likely to let it slide after the dash or experience costly downtime.

Managed Service Provider as Running Coach

If you watched the Olympics, you’ll have seen sprinter and distance runner coaches. In your push to build up your cybersecurity muscles, a managed service provider (MSP) can be a big help, too.

Partner with an MSP to gain access to IT experts. They can maintain tech, consult on upgrades, and help secure systems. Instead of paying for an urgent fix, budget around lower, predictable fees for proactive care.

Yes, we can also help you if you have to dash. MSPs have the expertise to diagnose and solve tough IT problems, but we’d much rather run the race alongside you, helping to keep your IT environment in tip top shape mile after mile.

What You Need to Know about Security Testing

by

You want to keep your IT in top shape. Your business technology supports both your productivity and profitability. You don’t want to be dealing with downtime. You also want to avoid running afoul of any industry regulations or standards. But how does a business gauge IT fitness? That’s where IT audits, security assessments and penetration testing come in.

First, understand that IT audits and security assessments are different things. Both are important to your business and its risk management practices. Yet they have distinct goals.

An IT audit evaluates if your business is meeting regulations or guidelines. A third party well versed in your industry’s technology best practices does the audit. It checks your technology processes, control systems, and data procedures and policies. All against standards established by government or industry associations.

Many industries need an external audit for certification. For example, merchants need to follow the Payment Card Industry Data Security Standard. A Report on Compliance (ROC) from an auditor details how cardholder data is protected.

The IT auditors have deep knowledge of the guidelines. They are going to dig into the finer points of your IT environment. Their audit identifies any shortcomings and gives you recommendations on how to improve. Failing to meet standards in the audit, though, can lead to compliance issues. That’s why security assessments are a good idea too.

The Value of Security Assessments

The security assessment can be done internally or with the help of an IT expert. Of course, where there are standards or regulations, there will be overlap. The security assessment determines what you are doing well and could be doing better.

This is a proactive step to identify and fix any deficiencies. Consistent security assessments provide benchmarks and prepare for the rigorous IT audit.

The assessment’s high-level look at security should follow any major business change. It can help determine if there are new risk factors.

Other Security Services for SMBs

You’ll also likely hear about vulnerability assessments and penetration testing. These are two more security services that are often confused. Like the two above, though, they have differences.

The vulnerability assessment is a component of a security assessment, but the difference is that a vulnerability scan is automated, and a security assessment has parts that require manual investigation.

A vulnerability assessment scans the business network for any security weaknesses. The best results let you know what vulnerabilities are the highest priority.

Penetration testing takes this to another level. Professionals experienced in circumventing security defenses do this testing. This testing attempts to exploit the vulnerability assessment’s weaknesses. This lets your business see where it is genuinely at risk of unauthorized network access.

Typically, the vulnerability assessment is done more often. The more involved penetration testing is more likely an annual event. The good thing about the latter is that you’ll also get a report with recommended remediations.

Get a broader and deeper understanding of your business technology. Any of these security services can help. Our IT experts can review your current setup. We’ll also recommend the best next steps to bolster your cyber security. Call us now at (515)422-1995.

Pushing Send? Know that Email Is Not Secure

by

We send an estimated 306 billion emails every day globally, personal and professional. Still, it’s not secure. Any private data, proprietary information or sensitive documents sent are at risk.

Sending an email is convenient and quick, but when it comes to confidential data, you’re better off choosing another method of delivery, one that doesn’t have as many potential points of access for an ill-intentioned actor.

Think about the path an email travels:

  • First, you write it on your PC, laptop, tablet, or phone. This stores the information in your email program. A hacker who has accessed your device using malware could read it.
  • The email then goes out to your email server. If that server is hacked, your data is at risk.
  • Your message then travels through online networks to reach your recipient, but there’s no guarantee those networks are secure, especially not if you are crafting and sending that email from a public network in an airport or at a coffee shop.
  • The email then hits the recipient’s email server, then their email program, and then their device. But the same risks that arose at your end are replicated on their side of the exchange, too.

Basically, when you send an email you lose control of the security of that communication, and potential problems abound:

  • Hackers could be intercepting and reading your email.
  • You can’t be certain that your recipient’s server or storage is encrypted at all times.
  • A bad actor could impersonate a server to intercept messages, and you wouldn’t know any better.
  • Your recipients may save that email in their mailbox for months or even years. Down the road, if they are compromised, your email is vulnerable.
  • Recipients can inadvertently forward that email on to unexpected parties.
  • You can’t assign permissions or password protect that email.

 

The Solution to Email Insecurity

Stop sending sensitive information via email. Instead, select a method that allows you to check and control who has access to that data. This could mean uploading the information to a private portal or sending using an encrypted file-sharing service such as Google Drive or Dropbox. There are also encrypted messengers such as Signal, Wire, and Wickr Me, which offer end-to-end encryption and autodelete data to cut the risk of email exposure.

If the recipient needs a username and password, send the two credentials separately. You might text them the password, mail it, or call and give it to the individual directly. When using a system that sends a password email to the user, contact that individual direclty. Ensure that they receive the email, log in, and change the password to something else.

A virtual private network (VPN) is another good tool for securing email. A VPN is like an online tunnel that keeps your email traffic safe. The message sent or received is encrypted from the rest of the internet. In fact, the VPN masks your internet protocol (IP) address, too, meaning you are also protecting your original location.

Sending information online is a tricky business. Don’t put your sensitive information at risk by relying on email communications. Instead, use the solutions above to protect your private and proprietary data.

A managed service provider can set up the solutions you need. Contact us today at (515)422-1995 to protect your conversations online.

Beware These Social Media Scams

by

Huntington Volvo? Rowe Subaru? What will your hilarious quiz results be when you enter your fourth-grade teacher's name and first model of car? You may think it's silly entertainment … until it isn't. Many fun social media questionnaires are set up by hackers to steal your identity.

It seems like a harmless collection of random facts from your past. These quizzes might ask for details such as:

  • What was your first job?
  • What was the name of your first-grade teacher?
  • What car did you learn to drive in?
  • What was your first concert?

These popular quizzes promise to tell your "rock star" name or your "superhero" name. You know it's as reliable as the Magic Eight ball, but you play along anyway. We all need a laugh, right?

Except that the people really laughing are hackers. Many of the questions posed are also security prompts used to verify your identity online.

Cybersecurity experts agree: don't take these quizzes. It's not as if there is any real value in filling out the social questionnaire. You're simply taking the bait and risking having your personal data stolen.

Avoiding Social Media Scams

Here are some tips to help keep you safe from social media hackers:

  • Don't get hooked by clicking on that post that seems too good to be true, especially shocking, or scandalous.
  • Be wary of any quiz that asks for information that could be relevant to your online password.
  • If you must quiz, fill out questionnaires on reputable websites only.
  • Avoid quizzes that ask you to provide your email address.
  • Contact companies through trusted channels only.
  • Make sure that you are dealing with the proper entity's real website and not a look-alike site created by a scammer.

Also, think twice about apps that change your face into a cartoon character or a painting. Facial recognition is a more common security tool. Be cautious about letting unknown apps collect your photos and facial details.

What to Do If Your Online Accounts Are Hacked

Cry. Curse. Panic. Any of these may seem like a reasonable response in the moment. Still, there are better things to do for long-term recovery.

#1 Have your devices inspected by trusted IT experts. This is one more area to be wary. Scam artists will set up sites that appear to be affiliated to the manufacturer or phone numbers that appear to go to technical support specialists. It's best to take your devices to a physical repair shop with a real human doing the work.

#2 Change your passwords. When your account is hacked, you'll want to change that password immediately. Plus, as annoying as it is, change passwords for all accounts accessed on the compromised device. The hackers may have installed a malware that tracked all data transmitted on the device.

#3 Set up credit monitoring. Notify any financial institutions or credit card companies if those accounts are hacked. You'll likely need to have them issue you new cards with fresh account numbers. You can also ask them to monitor your accounts for fraudulent transactions. You might also set up credit monitoring with your region's credit reporting agencies.

Keep in mind that criminals can be patient and may not use your information right away. So, don't think you're in the clear because nothing happens in the first month.

Need help protecting your devices and online accounts? Contact our IT experts today at (515)422-1995. We can also review your security setup at home to help prevent you being victim of a cyberattack.

Business Continuity vs. Disaster Recovery: What’s the Difference?

by

The risk of cyberattack is still growing globally, and no business is too small to hack or breach. It’s important to plan for business continuity and disaster recovery, and to do so in advance so you’re prepared for the worst. But first, you’ll need to understand the difference between the two.

Some use business continuity and disaster recovery interchangeably, yet there are differences between these two areas focused on safeguarding your business.

Business continuity planning ensures operations continue in the event of disruption. Whether it’s a natural or man-made disaster, national emergency, sabotage, theft, or utility failure, your business needs to prepare. Business continuity anticipates what you’ll do about physical premises, staffing, and IT.

A business continuity (BC) plan:

  • identifies business processes;
  • assesses risk;
  • weighs costs versus benefits;
  • establishes priorities;
  • earmarks resources;
  • designates responsibilities.

BC planning will outline the procedures to follow and who is in charge of which processes. Think of it like a checklist to continue operations as close to normal as possible despite a crisis.

How is BC different from Disaster Recovery?

Disaster recovery focuses on providing a backup when unforeseen interruptions hit: actions needed to restore IT assets, communications, and essential hardware systems.

Disaster recovery (DR) plans aim to reduce downtime and restore vital systems as soon as possible. After all, statistics around small businesses suffering IT disruptions are not encouraging. Depending on where you look:

  • 93% of companies suffering an IT disaster file for bankruptcy within one year.
  • 40% of businesses don’t bounce back from a disaster.
  • 60% of breached small businesses can expect to shut down within six months.

While there is no consensus, the takeaway remains the same: downtime = business disaster.

The best way to reduce risk is BC and DR planning.

Still, how is disaster recovery different from continuity efforts? Business continuity tackles all operations. Yet in many environments, disaster recovery is a subset of business continuity. That’s because disaster management hones IT infrastructure. DR gets IT back up and restores data access after a disaster.

Disaster planning establishes procedures for restoring critical applications. You establish where and how you’ll backup important data, you make decisions about what to repair and restore first, and you decide on your restore-point tolerance. This is the acceptable amount of time between your last backup and when the system went down. This will vary among businesses. A business conducting hundreds of online transactions daily has different needs than one with less data.

Planning ahead is essential for both

Although disaster recovery and business continuity have different timelines, both prepare in advance. Business continuity plans are set in motion as soon as operations are threatened. For instance, in the event of a hurricane, the BC plan would alert stakeholders, tell emergency procedures, and transition to alternate operations. Yet the DR team won’t do anything until the storm actually affects the business.

Your business may be able to ride out a short, planned downtime, but disruptions from weather events, power failure, or malevolent attack can be crushing. Take the time, when not in crisis, to plan your business continuity and disaster recovery.

A managed service provider can help you develop the best business continuity and disaster recovery strategies. Contact us today at (515)422-1995 for a personalized approach to planning ahead for catastrophe.

Stop Your Tech from Stalking You

by

Unless you’re a reality television star, you probably don’t like the idea of being watched at all times. So, why would you want your technology to know all about you? With digital technology today, it’s far too easy for our devices to turn creepy. Here are some suggestions to stop the stalker-like tendencies of the technology you rely upon.

Today’s marketing and online communications are all about customization and personalization. If you like a friend’s picture of an Art Deco door in Belgium, you see many more posts featuring similar designs. Or if you view an area rug on a website, you’re suddenly bombarded with ads for rug stores when you next go online.

This can add convenience, but it is also unsettling. What companies online know about you could be more detailed than what your friends know. Take the following steps to regain control of what your computer, phone, and apps know about you.

Review your privacy settings

Whether going online from a phone, laptop, desktop, or tablet, get to know the device’s privacy settings. Some important settings to review include:

  • email tracking – this can let people know if you opened their message or not;
  • location tracking – personalizes recommendations but also tells search engines where you are;
  • voice recordings – manufacturers use these to train virtual assistants, but pause this to keep your conversations to yourself;
  • purchase history – this helps feed the machine so that businesses know how to target you in the future.

Opt out or block ads

Opting out of ads limits the information collected from your browser or device. The site or business still receives basic information about you, but you will no longer receive targeted, interest-based ads any longer. Apple’s iOS 14 allows app blocking, and you can also express your choice on Android devices.

Otherwise, use browser ad blockers, such as AdBlock Plus, or JavaScript blockers, such Ghostery, to limit ad tracking. Also known as content blockers, these software programs prevent ads from showing on websites you visit. You can find ad blockers for Chrome, Firefox, Opera, Safari, and Internet Explorer.

Check your permissions

Watch the permissions you give apps. We have already talked about checking device settings, but you can also limit the permissions you give to apps. For example, social media accounts have privacy settings that allow you to control what’s logged about you.

Plus, check permissions for other apps. Clash of Clans doesn’t need location services, for instance. Or you might not want to give Slack access to your microphone and video recordings.

Use webcam covers

Covering your webcam stops someone from potentially seeing and recording you. If you think you’d see the light come on to show the webcam is in use, know that hackers can disable that. A simple sliding webcam cover closes the webcam when you are not using it to avoid a cybercriminal having access.

Covering your webcam can also come in handy in all those online meetings you’re having. A covered camera means you don’t run the risk of your colleagues catching you unprepared.

Limit information you provide

Social media has created a culture of oversharing. There are probably many things you’ve seen about friends online that you would rather not know. You’re also sharing more than you need to with the companies that you interact with online.

If you’re filling out a form for a download, you might fill out only the required fields. When you add an app, be stingy with your personal details. Think about it from a need-to-know perspective. For instance, that home design game you love to play doesn’t need to know where you went to high school or with whom you bank.

Need help keeping the privacy-busting algorithms at bay? We can help. Our IT experts can configure device settings to limit information gathered about you online.

Contact us today at (515)422-1995!

What to Do If You’re a Ransomware Victim

by

You’ll know if you’re a victim of ransomware. Often you’re met with a red screen telling you your business files are encrypted. You won’t be able to do anything on the computer, although the cybercriminals will provide helpful instructions for how to pay up. How nice. Here’s what to do instead if you’re the victim of a ransomware attack.

Cybersecurity Ventures predicts ransomware will impact businesses every 11 seconds in 2021. Yes, you read that right. That’s up from every 14 seconds in 2019. Another research company reported ransomware increasing 485% year-over-year in 2020.

Know that it’s widely considered a bad idea to pay the ransom because you’re rewarding the cybercriminal. Plus, you can’t even be sure that they will provide the encryption key needed to regain the use of your files. What! You were going to trust the bad guys?

The Important First Step

The first thing you’ll want to do is make it all go away. Yet wishful thinking is not going to get the job done. Instead, you’re going to have to turn immediately to your disaster response plan, because, of course, you have one of those already. Really, don’t underestimate the value of planning in advance for IT infrastructure compromise. Doing it proactively means calm, considered decisions rather than reacting in a crisis.

Step one is going to be identifying the systems involved and isolating them. Once you detect a compromise, limit the spread of infection by disconnecting the devices affected. Ideally, you take only a few computers offline or disconnect an individual network. Even in a large-scale compromise, remove all affected devices from the network to contain the malware.

As part of the isolation, don’t forget to disconnect any connected devices such as storage drives. The ransomware infection will even seek out USB thumb drives.

Power down only the affected devices if you are unable to disconnect them from the network. Why? Because turning them off means you might lose potential evidence.

Malicious actors may be monitoring your business communications. So, move offline to coordinate your response. Phone calls or text messaging will work, or personal email accounts.

Don’t attempt to restore critical systems until you have identified and isolated them. After that, your business can move into triage mode. Prioritize what to restore, and recover using your data backup (again, of course, you have one of those, too). Consider how critical each system is for health and safety and revenue generation. Then, get to work restoring systems in an efficient, organized fashion.

Minimizing Ransomware Risk

Ransomware is a major threat to every business sector, and you don’t want to become the next victim. Common best practices include:

  • preventing an attack with anti-virus and anti-malware tools;
  • installing email filters to keep phishing emails from reaching your employees;
  • making frequent backups and keeping them separate from your network;
  • keeping up with ransomware and other cybersecurity threats.

Businesses that partner with a managed services provider have someone supporting their efforts to cut ransomware risk. Plus, if the worst happens, the MSP’s IT experts are ready to identify and isolate. They can find the samples needed, determine the malware strain you are dealing with, and report the attack.

Your data backup should have recent copies of all information up to (or close to) the time of infection. So, once the MSP has removed all ransomware, they will wipe your systems and storage devices. They can swiftly reformat the hard disks and reinstall everything from scratch.

An MSP can help you plan ahead to contain the damage from a cyberattack. Let our IT experts install best practices, set up safe backups, and track the activity on your network. Contact us today at (515)422-1995.

Lessons Learned from an Oil Pipeline Ransomware Attack

by

Your business may not be supplying oil to the United States, and you may not even be in the critical infrastructure business, but don’t think that means ransomware can’t happen to you, too. This article shares lessons learned from a headline-grabbing event, and they’re applicable to businesses of all sizes in all industries.

First, what happened? The May 2021 ransomware attack crippled a 5500-mile gasoline pipeline. The Colonial Pipeline serves up nearly half of the gasoline used by the East Coast of the United States. The attack thought to be the largest ever on US oil infrastructure, encrypted almost 100 gigabytes of data. Russian hacker group DarkSide took the systems hostage, demanding an undisclosed ransom. The pipeline was offline for days, and the disruption plagued the country for weeks.

The lesson learned? Businesses cannot underestimate the importance of being proactive about preventing cybercriminal attacks. The Colonial Pipeline attack originated in Russia and attacked the US, but the motive was financial. The majority of cyberattacks come down to money. That means your business could be at risk, too.

Lesson #1: Educate employees

Avoid falling victim to a devastating ransomware attack by educating employees about cybersecurity. Train your employees to recognize phishing emails and other scams, teach them about the importance of strong passwords, help them understand the potential dangers of using unsecured wireless networks or unencrypted devices, and prevent their downloading unsanctioned apps onto work computers.

Lesson #2: Use firewalls and email filtering

Configure firewalls to protect your network and block access from malicious IP addresses. Geo-fencing can reduce traffic from foreign actors in known cybercrime hubs.

Additionally, set up advanced spam filters. These help identify and stop phishing emails before they even get to your employees.

Lesson #3: Limit access

You’re thinking you’re doing that already with firewalls and filtering, but this refers to limiting access for the people who work for you. Configure credentials so that employees can access only what’s needed to do their job. Limiting administrative access makes it more difficult for bad actors to do damage.

Also, limit permissions to reduce access. One employee may need to read certain files but have no need to edit them. Configure the file and directory access accordingly.

Lesson #4: Monitor and patch

Even if you’re not online at all hours of the day, you should be monitoring IT 24/7. Set up alerts to identify any suspicious activity. You want to know as soon as possible if there is a vulnerability so your business can limit its exposure.

Also, patch: don’t ignore update notifications from your software providers or operating system manufacturers. Every piece of technology in your office could be an entry point for a bad actor. Cybercriminals are always finding new modes of attack and vulnerabilities. You have to be vigilant and keep your systems updated to cut your risk.

Lesson #5: Have a backup plan

If cybercriminals take your system hostage, you don’t want to have to pay a ransom. It’s costly, and you can’t guarantee you’ll get a functional system back. You will still suffer downtime and a damaged reputation from the attack.

Having several system backups, tested regularly for accuracy, helps protect you from catastrophe. We recommend a 3-2-1 approach. That’s three separate copies of the backup on two different storage types, and at least one of them should be off-site.

Customize your backup plan around the specific needs of your business. One company might be fine backing up daily, whereas another may suffer if it loses even a few hours of data.

Cybersecurity doesn’t have to be complicated

Ransomware attacks are expensive and time-consuming. Partner with a managed service provider to keep an eye on your systems. Our IT experts can configure protection, track activity, and provide backup solutions. Take preventative action to protect your business against ransomware and other cyberattacks. Work with professionals to install a layered IT security strategy today. Contact us now at (515)422-1995.

What to Do If Your Data Is Included in a Leak

by

Data breaches are now daily occurrences and can happen to any business. The April 2021 leak of 533 million Facebook records was one of the largest known data leaks, but even if you weren’t affected by that one, you may still be at risk.

There is no easy way to know if your information has been leaked. When a business is hacked, it typically sends a notification letting you know, but this isn’t guaranteed. And you can’t go in and check the Dark Web. It is difficult to find and dangerous to access, and that is why the bad guys like it.

It’s a good idea to navigate to https://haveibeenpwned.com to see if your email address or phone number is on any data breach files. This isn’t conclusive, but it can help.

Even, if you’re not sure if you’ve been a victim of a data leak, you’ll want to take action.

There are several smart strategies to follow immediately.

#1 Limit your social sharing

It is simple to share on social media – that is part of the fun. You share the pictures of your wedding day or anniversary, or your new house with its address. You’re filling in family and friends in your life, right?

Well, if you are using any of that information to create access credentials, you are sharing too much. Someone with a beloved cat called “Petunia” in every photo who uses the feline’s name as a password gives hackers an edge.

You might think you are sharing harmless information, but those birthday party photos posted on the big day are a clue to your identity that hackers can exploit.

#2 Use Unique Passwords

Would you believe people still use “12345678” and “password” as their passwords? If you are one of them, stop now. We’ve said it before, and we’ll say it again and again: use unique passwords for every one of your accounts. Yes, it is more to remember, but it helps cut the risk of a data breach at one site snowballing to disastrous consequences for you.

You might use a password keeper such as 1Password or LastPass to manage your many passwords. This is more secure than the password manager offered by your Web browser, although those are better than revising passwords or trying (hopelessly) to memorize them.

#3 Add Two-Factor Authentication (2FA)

Enabling two-factor authentication (2FA) makes it more challenging for the bad actor. Now, they will need to obtain access not only to log in credentials but also to your personal device. However, since phone numbers are often included in a data leak, this isn’t the best solution. If the hacker has your name, address, and birthdate from the Dark Web, they can take over your phone number, too. They call the company and say, “I lost my phone. Can I get another SIM card.” Then, they are the ones to get those verification codes via message, not you.

Better still, use a 2FA app to confirm your identity. Authy or LastPass are good authenticator apps. After you attempt to log in, you will need to enter a time-sensitive code generated by the app to complete access.

#4 Stop Signing into Other Sites Using Social

Sure, it is convenient to use your Facebook or other social media account to sign in to connected applications, because you have fewer passwords to remember. Some of your data is automatically transferred, so signup is streamlined, too. Yet you are increasing the risk of account compromise.

The hacker may access the third-party application and use that as a stepping stone to get into your social account. That’s where the trove of data is.

#5 Develop an Alternate Ego

It all sounds super spy, but you might have one email account you open to be a burner account for social media. You could also use a fake birth date, a fake alma mater, and other alternative facts to fill out the social profile.

Don’t fabricate personal details for an employer, or a financial or educational institution. But you might use a fake identity for entertainment, gaming, and social sites that bad guys may mine for personal data.

Need help securing your social media or other online activity? Our experts can help. Contact us today at (515)422-1995!

Click to see our BBB Report

FOLLOW US

VISIT US

Privacy Policy