Better Security for 2018

B

The more I’ve been working in marketing and around technology, the more I’ve seen security disasters and the more I’ve become self-aware and educated about privacy and security.

Better personal and online security starts now, ahead of the breaches and attacks in 2018.

After all the breaches, leaks and hacks of 2017, do you honestly doubt that you need to take better care of your online security for you and your family?

While the Equifax hack, where over 143 million people’s personal information, such as names, birth-dates, addresses, social security numbers, driver’s license numbers and credit card information was leaked, was the main headline in 2017, there were over 40 major data breaches where personal information was leaked or mismanaged by the companies we trust, including Gmail, Chipotle, Whole Foods, Yahoo!, Uber, eBay.

One would think that with all the technology and security that runs behind the scenes of those companies, there would be tighter control over the personal data they manage.

The good news is that as more of these attacks and breaches happen, there is still a lot of very simple steps you can take to protect yourself against many forms of cyber attacks.

Yesterday, I was in a popular coffee shop around my neighborhood that’s typically full of students, families and freelancers working. While overhearing a conversation between a consultant and her client, they touched a bit on security, while at the same time were exchanging login credentials in the open. Obviously, not the consultant I’d want to be working with, however, it also highlights the naivety we have around the security of our information.

Get Real about Password Management

One of my pet peeves is when people use weak and predictable passwords. Not being stupid here really is one of the best ways to protect yourself, and password managers and authentication apps and tools make this easy.

With these tools, there is no reason for anyone to have passwords for everything that don’t look something like ^}ke=V(2^~QC”e’BN4&pChT

My password manager of choice is Dashlane. I used LastPass for years and made the switch in 2017 as I was looking for something that enabled me to be more secure on and offline.

Dashlane
Dashlane – My preferred password manager

One of the features I like most is Dashlane’s Security Dashboard, which provides you with a security audit of all your online accounts to ensure you don’t have any overlap of passwords. From there, you can even have Dashlane automatically log into at-risk accounts and update the credentials automatically.

Dashlane also has another great feature called Emergency, which allows you to provide someone to either all of your passwords, a portion of them, or even modify them in an emergency situation.

You basically set a contact – someone you obviously trust – that can request access to your Dashlane data. You then define a set amount of time where you can either reject or approve the request, or, define it so that they have immediate access if you wish.

I like this in case I’m in an accident and someone needs to access key information for myself or something related to my family and I can not.

On top of Dashlane, you should be using 2-Factor authentication for very sensitive programs like your email, financials, storage, etc.. You can do this easily either via text, an app like Google Authenticator, or a personal Yubikey.

Back up all of your data

If you aren’t backing your life up, you’re already failing. This is probably the easiest step you can take to protecting your data by storing it somewhere other than on your computer.

I approach this in a couple of ways with a local backup and an online backup.

Local Backups

For my local solution, I back-up / sync all of my devices to my primary notebook. My family is pretty much in an Apple environment with a family iTunes account, so backups are simple and pretty straight forward.

The device backups shoot to iCloud, and I use Time Machine to backup my notebooks to a G-Drive from G-Tech (I’ve been using G-Tech for years) every week.

Online Backups

Local backups are simple safety nets, but I push online backups daily using Arq and Wasabi. You could easily sign up for other automated online backup services, but the control and security options of using Arq with Wasabi (or Amazon’s S3 service) are second to none.

With Arq, all of your data is encrypted before it leaves your computer vs at the destination. This means that if any data is intercepted during transmission, it can’t be read by whomever grabs it.

Arq BackupArq also de-dupes files so that you’re not backing up the same file more than once, saving backup size and improving backup efficiency.

Wasabi Backup StorageAs for Wasabi, there is price and there’s security. Against Amazon’s S3 service, Wasabi costs about 1/5th of S3 and runs even faster. They also take security seriously and take proactive measures to protect against hacks, malicious destruction and ensuring data integrity in ways that Amazon does not. This gets nerdy, but those interested can read more about Wasabi’s features here.

Most of us think of online backups as a place to keep our photos safe. However, it’s a strong security measure as more and more ransomware attacks are going to move into the consumer space. One simple way to avoid the next WannaCry attack, just have an a backup of before you were impacted and there’s no need to pay any ransom.

Use More Secure Email

I’ve used Gmail for years and have fallen in love with how simple Google makes your life integrating across so many products and services – especially if you’re in marketing or technology.

However, as I’ve become more aware of security and privacy issues, Google and I started to part ways personally. If you’re using the paid version of Gmail, then at least you’re a little bit better off. But if you’re on the free version – like most – you sort of have to realize that if you’re not paying for the product, you are the product, and I don’t like that.

I email personal things around finances, with accountants, attorneys, my kids, my family, etc.. Knowing that this information is readable by others doesn’t sit well and is initially what made me want to find a more secure solution like ProtonMail.

ProtonMailProtonMail is the first email service to provide end-to-end encryption, which basically means that no one except for you can read the messages in your inbox. Further, messages in transit also can not be read by anyone as the messages are encrypted before being sent and are only decrypted by the recipient on the other end.

Read more about ProtonMail’s encryption on their site.

I also feel comfortable that my communication likely can not be read by anyone that I don’t want messing around in there. ProtonMail is based in Switzerland and stores data in European countries that have strong privacy protections and are not under the jurisdiction of NSA or US Surveillance laws.

I’m obviously not doing anything illegal, but the point is that you shouldn’t have to be doing illegal things to have your life protected.

VPNs and Identity Protection

Identity fraud increased by 16% last year, allowing thieves to rake in over $16b of other people’s money. That’s a lot of money and it happened to me when I was 16 years old.

A couple of ways you can protect your identity is to secure your web browsing with a VPN, and to enroll in an identity protection service. Let’s start with a VPN.

VPN Services

If you’re unfamiliar, a VPN is a Virtual Private Network. This is somewhat nerdy, but it’s also very simple to understand. When you use a VPN while browsing online, you’ve got a direct, encrypted connection between you and the website or service you’re using.

Without a VPN, you’re just browsing in the open and you’re a simple target for attack. If you’re using free public Wi-Fi, like you do at Starbucks, a very junior level hacker can easily intercept your data and access sensitive information without you knowing. A VPN will stop that.

ProtonVPNThere are many personal VPN services out there. I personally use ProtonVPN from the same company behind ProtonMail.

Identity Protection Services

This is one of those services that get equal recommendations for using as well as equal recommendations against. You should do your own due-diligence here and decide if it’s worth the money for you to be monitored, as many of the protections these services offer you can do yourself.

However, if you know you’re going to be lazy and not take measures, then you should sign up for a service. Also, if you know your data has been breached in some way, you should also consider using one of these services, which may be covered by the company that lost your data in the first place.

Check out NerdWallet’s review on Identity Protection services here – it’s more complete than I could provide.

With all this being said, these steps really only help to mitigate any damage that hackers may cause. More and more companies are going to be compromised, and more and more viruses and malicious code will end up on your system at some point. At least you can do your part and try to protect yourself as much as possible in 2018.