Introduction
No matter what the organizational, economic, social and political circumstances, it’s best to set up your organization with layers of security to ensure there’s a reduced risk of inadvertent or intentional data loss and intrusive attacks by bad actors.
Generally speaking, you want to treat your personal and organization security similar to how you may do so for a highly sensitive physical location. Your most basic level of physical security for a building is the perimeter security guards that check whether a person has the right to be let in. They may check the entrant’s ID and their belongings to ensure they are a known and safe entity.
Once allowed in, the entrant may still need to be escorted by an internal staff, if not part of the staff, or be required to scan their badge to get past the front door. Even when they are in the building, various security personnel may roam the hallways looking for suspicious behavior and flag a person as a potential hostile to be escorted out.
Your data security should be treated in this same manner. Here’s the general breakdown:
| Physical Access | Data Access Equivalent |
| Perimeter Security Gate and Guard | VPN |
| Front Door Badge Scanner | Firewall Strong Passwords |
| In-Building Security Guards | Anti-Malware Software |
Beyond the software, there’s also general awareness by staff about social attacks, known as Social Engineering and Phishing.
Social Engineering and Phishing
Social Engineering refers to attempts by a bad actor to impersonate someone you know, in order to get sensitive data or login credentials from you. You may receive a text, call, or email that appears to come from someone you know by name, but it may come from a phone number or email address that has their name, but is otherwise unfamiliar to you. Think of a scenario where you receive an email from your boss, LaToya Johnson, but the From email address is through gmail.com, not your corporate email.
You may also get notification from people impersonating officials, like law enforcement, or official sounding companies.
In emails you may be asked or through other means tempted to follow a link or download an attachment.
In any of these cases, the attempt will be to create urgency while asking for some sensitive information, like a login, or details of bank accounts, your internal policies or secrets. Or it may be a means to install some malware on your system to snoop out organization secrets.
No matter what, below are some Best Practices to follow and steps to take in you suspect a threat.
Best Practices for Phishing attempts
- Don’t share your passwords with anyone directly. If you trust them and they have a formal relationship with you or your organization, use secure password sharing applications like 1Password with a known and validated email address that you’ve previously confirmed.
- Don’t share your passwords with even people you know in the organization directly, whether by phone, email, or text.
- Refer all official requests for sensitive information to Operations and Management for review and response
Best Practices for Safe Browsing and Downloading
- Do not open any attachments from people you don’t know
- Do not immediately trust nor open attachments from even those you trust whenever you received short / no-content texts or emails with attachments
- When browsing a site, if the content seems suspect or the website address doesn’t match the branding, do not download any document and report the site to our Operations team
- Be sure to use a private Browser. The usual suspects, like those pictured here, are not your best options as they track your browsing history. We suggest a browser with security-privacy-first model, like the Brave browser and using the Tor private window for sensitive searches and sites where you want to ensure your surfing history is NOT kept nor actions recorded on Internet devices.
- Use a Private Search Engine. There are a number of good options here. We suggest DuckDuckGo or Ecosia, with Ecosia having the added benefit of all profits from ad dollars being used to plant trees to fight climate change.
If you’re unsure how to change your default search engine, you can check this search result for your browser (Ecosia search results).
What to do if you suspect a threat
- Change your password using good password hygiene. See below Strong Passwords section.
- Notify the Operations and Management team about it
- If a phishing attempt is from someone you know and you suspect their phone, email, logins are compromised, use a secure medium to inform them.
VPN
A VPN (Virtual Private Network) is software installed on your computer or your network devices, like wifi routers, that establish a secure connection between your system and other known systems in your network, or simply to ensure bad actors are not able to snoop around on your network connection to grab sensitive information.
For personal use, we recommend that you download NordVPN. Ideally, we would set up a VPN for the whole organization using NordLayer with a minimum of using the Nord servers or, ideally, establishing your own organizational private VPN servers.
With either software, you’ll want to configure the software to establish a VPN connection every time your computer is on and connected to the Internet, no matter what you’re working on.
Be sure to also set up the software to regularly get security and software updates.
Firewall and Malware
As the last two layers of security, you’ll want to ensure that you have your default system firewall turned on and anti-malware software running.
Be sure to also set up all of these software to regularly get security and software updates.
Below are the instructions for the two major systems you’ll likely be running on your desktop, but similar measures can be taken for your mobile devices as well.
- Windows
- Turn on Your Windows Firewall
- Ensure Windows Security is Turned on and up to date (green checkmarks) for the following services
- Virus & threat protection
- App & browser control
- Device security – Review built-in security options to help protect your device from attacks by malicious software.
- Apple
- Turn on Your Apple Firewall
- Apple has built-in data protection and anti-malware. Users can check on what data is shared and how apps access their system, if they want to restrict certain apps.
Strong Passwords & Password Storage
Lastly, you’ll want to ensure you’re always using strong passwords and avoiding common names for them. So, for example, avoid any combinations of letters and numbers that spell out “Password”. They are easily guessed or hacked through brute force or dictionary attacks.
Here’s our recommendation on how to create your strongest passwords:
- Use long passwords
Think 15 to 30 characters - Use letter and numbers
- Mix upper and lower case
- Mix in some random special characters
- Do NOT write down your passwords on any physical medium like paper or unsecure software
- Do NOT reuse passwords. Create unique passwords for each site and application.
- When available, use two factor authentication like use of security code sent via text, email or the use of a separate security token generation application like Google Authenticator (Google Store, App Store) or 1Password’s internal token generator
As you can imagine, having such long passwords that meet all of the above requirements is hard to remember. You definitely need a way of storing these. To that end, we recommend purchasing a secure password manager that stores encrypted data, requires two factor authentication and has self-destruct capabilities. You don’t want to store them on your browser’s default password manager. A password manager like 1Password will do a great job since it works both for the whole organization and, as an added benefit, each corporate license also provides a personal vault to use with up to 5 family members.