Category Archives: Infosec Communicator

  • 30
    Jun 11
  • 2

Updated: Choosing the Safest Browser, Part One

Category:Information Security,Infosec Communicator,Internet Safety,Uncategorized Tags : 

Swim safe!

This post provides an update to last year’s Choosing the Safest Browser post. Let’s take a look at what’s changed since June 2010.

Browsers

Last year, we looked at the following browsers to discuss which would be the safest:

Number of Vulnerabilities

How do you decide which browser is the safest? One way is to look at the vulnerabilities that were disclosed for each one. Attackers may exploit these vulnerabilities to place malicious code onto your computer.

In Spring 2010, my Cyber Self Defense class ranked the browsers in the order below according to which ones they thought had the most vulnerabilities:

  1. Internet Explorer
  2. Safari
  3. Opera
  4. Firefox
  5. Chrome

According to the  Symantec 2008 Internet Threat Report, here’s the list of browsers ranked from most reported vulnerabilities to the least:

  1. Firefox
  2. Internet Explorer
  3. Safari
  4. Opera
  5. Chrome

The class was really surprised by this ranking.

June 2011

Let’s see how the rankings look from the Symantec 2010 Internet Threat Report. Here’s the 2010 list of browsers and number of vulnerabilities:

  1. Google Chrome–191 vulnerabilities
  2. Apple Safari–119
  3. Mozilla Firefox–100
  4. Microsoft Internet Explorer–59
  5. Opera–31

I was surprised by this order. Ranking browsers by vulnerabilities reported, Chrome appears to be the worst and Opera the best. (In the 2008 report, Chrome had the fewest vulnerabilities!)

Average Time to Fix a Vulnerability

Another way to look at browser safety is how long it takes for a reported vulnerability to be fixed. How would you rank these same five browsers from shortest to longest patch time?

In the 2010 report, Internet Explorer had an average patch time of 4 days. Opera, Safari, and Chrome were each one day or less. (In the 2008 report, Safari had an average “exposure” time of nine days, compared to the “best,” Firefox, which normally took only one day to patch.)

Patch time alone doesn’t appear to be a factor when choosing the worst browser.

Safe browsing is important because the majority of attacks are web-based, peaking at  almost 40 million per day in September 2010.

Does Your Browser Choice Really Matter?

In my opinion, not so much. Internet Explorer vulnerabilities are targeted more because it’s the biggest target. However, all of the browsers mentioned have vulnerabilities and all are patched relatively quickly. Many attacks actually target applications such as Adobe Flash, QuickTime, and the like. Malicious PDFs have also become a huge problem in the last year. What matters are safe practices!

Related articles
Enhanced by Zemanta
  • 30
    Jun 11
  • 1

Choosing the Safest Browser, Part 2

Category:Information Security,Infosec Communicator,Internet Safety Tags : 

Safe Practices

Check your Browser Security Settings

How can you tell how secure your web browser may be? Scanit’s Browser Security Test checks your browser security settings and provides a report explaining the vulnerabilities, the potential impacts, and how to correct them.

Use Security Software

Your security software should include an antivirus, anti-spyware, and a firewall.

Update Regularly

Keep your browser and applications up to date. If you’re prompted for an update, accept it.

Use Strong Passwords

Use a strong complex password or passphrase. Consider using a password vault such as LastPass to generate and store your passwords.

Install Browser Tools/Add-ons

Current browsers all provide some protection against phishing. There are also browser tools that you’ll find helpful.

  • The Netcraft Toolbar is a browser plug-in available for Firefox. The toolbar helps stop phishing attempts by blocking known phishing sites and providing hosting information about the sites you visit.
  • The McAfee Site Advisor is a browser plug-in available for Internet Explorer and Firefox. The Site Advisor warns you of websites known to have malicious downloads or links by checking them against a database at McAfee.
  • WoT (Web of Trust) provides color-coded ratings of the safety and reputation of websites.

Limited Account Privileges

Limiting account privileges (WindowsXP) provides simple but effective protection when working online. Limited accounts allow you to do most daily activities but do not allow you to install software (only accounts with administrative privileges can install software on the computer).

Many attacks take advantage of administrative privileges to install malware on your computer. If you’re using a limited account, attackers and malicious websites will not be able to install malware. (This is less of an issue with Windows 7 and Mac OS X because they ask you to confirm software changes.)

Threats have doubled since 2009 and the threat vectors have increased. Vigilance is even more important.

One thing hasn’t changed. The key to safe browsing is not which browser you choose. It’s following safe practices.

Please comment on the post and let us know some safe practices you recommend.

Related articles
Enhanced by Zemanta
  • 17
    Jun 11
  • 3

Avoiding Phishing

Category:Information Security,Infosec Communicator,Social Networking,Uncategorized Tags : 

phishing

What’s the easiest way to break into a computer account?

Cracking the password? Putting a trojan on the computer? Hacking? Unfortunately, it’s simply tricking you into giving up your password through a technique known as phishing.

Computers have vulnerabilities that can be exploited by attackers using different types of malware. However, your attacker is as likely to come after you through “social engineering” as they are through malware. Just as our computers have vulnerabilities, we too are susceptible to attack!

Social Engineering Attacks

Social engineering attacks are attempts to trick you into revealing private information. Successful attacks may result in identity theft and loss of funds. Social engineering attacks take a number of different forms, including phishing attempts, work at home scams, and Nigerian 419 schemes. Attackers often take advantage of current events, such as the tsunami that hit Japan.

Phishing

This article deals with one type of online scam—phishing attempts. Phishing is a common technique in identity theft. We’ve all received phishing emails or instant messages that appear to link to a legitimate site. These emails and web sites are designed to capture personal information, such as bank account passwords, social security numbers and credit card numbers. Losses to phishing attempts are estimated to be as high as $500M every year.

How Phishing Works

  1. Phishers send out millions of emails disguised as official correspondence from a financial institution, e-tailer, ISP, etc.
  2. You receive the phishing attempt in your email.
  3. After opening the email, you click on the link to access your financial account.
  4. Clicking on the link takes you to a web site that looks just like a legitimate site.
  5. At this point, you enter your account and password information, which is captured by the person who sent out the phishing attempt.

Phishing emails used to be easy to recognize because of their poor spelling and grammar. Now, phishing emails are often indistinguishable from official correspondence. Anyone can put together a phishing attack using resources (or kits) purchased on the Internet.

Practice Safe Computing

Safe computing practices are the best defense against phishing. Here are a few safety tips:

  • Never click on links directly from an email. Type the address into the address bar or go to the institution’s web site and navigate to the correct location.
  • Use File/Properties to find out which website you’re really on. You can check the properties from the file menu or by right-clicking on the web page and selecting Properties.
  • Look for the proper symbol to indicate you’re on a secure web site. Secure web sites use a technique called SSL (Secure Socket Layer) that ensures the connection between you and the web site is private. This is indicated by “https://” instead of “https://” at the beginning of the address AND by a padlock icon which must be found either at the right end of the address bar or in the bottom right-hand corner of your browser window. A padlock appearing anywhere else on the page does not represent a secure site.

Browser Helpers and other Software Solutions

Although avoiding phishing attempts is typically a matter of following safe practices, there are a number of browser helpers available to help warn you of suspicious web sites. Browser helpers normally work as another toolbar in your browser. Use one or more for your protection:

  • The Netcraft Toolbar displays information about a web site including whether it is a new site (typical of phishing) and which country hosts it. If you’re visiting a United States banking site and the Netcraft Toolbar displays a Russian flag, you’re probably at a phishing site. The Netcraft Toolbar also works like a neighborhood watch community, blocking access to member-reported phishing sites.
  • McAfee Site Advisor adds icons to your search results indicating the relative safety of sites you’re visiting.
  • Internet Explorer and Firefox also provide limited protection by denying access to many known phishing sites. Firefox and Chrome integrate Google Safe Browsing technology.
Related articles
Enhanced by Zemanta
  • 11
    Jun 11
  • 5

Parenting in the Cyber Age: A Parents’ Guide to Safer Social Networking

Category:Cyberstalking,Facebook,Infosec Communicator,Internet Safety,Privacy,Risk,Social Networking,Uncategorized Tags : 

At the computer
Are you as a parent worried about what your kids may encounter online? Are you unsure of how they or you can stay safe online when using social networking sites?  Although our kids are now college grads, we had the same concerns about the dangers our kids faced online as most of you do.

In my professional life, I’m a technical communicator at a large private technology university. I am responsible for making staff and students aware of information security issues—a role which has probably made me even more paranoid about the dangers out there on the Internet!

I’ve also had the opportunity to take part in a few K-12 Cyber Security Awareness initiative that gave me an opportunity to talk to teachers and parents about online issues and listen to their questions and concerns. I’ll address some of these concerns in this post. I am also interested in what you would like to know about security issues, so please comment on this post.

Oh…one other thing…my goal is to make this topic understandable for the average layperson. You do not need to be a technology expert to learn how to stay safe online and to keep your kids safe!

Social Networking Concerns

In the last several years, teens and young adults have flocked to social networking sites or blogging sites, such as MySpace and Facebook. This has given them opportunities to meet and communicate with people of similar interests, share information, gather numerous “friends,” share pictures and videos, and even discuss important issues. (Most of these social networking sites are inappropriate for preteens. Although most social networking sites require members to be at least 13, enforcement is next to impossible.)

Risks and Preventive Measures

Sharing Private information—It is extremely easy for unscrupulous people to gain access to you and your children’s private information. When your kids use social networking sites, read the site’s privacy policy. It tells you what information the owners of the web site collect, and how they intend to use it. Make sure that you and your kids understand how that information may be shared.

Profiles—Encourage your kids to guard their information. Keep private information private. Ask them to restrict access to their profiles, when possible, to “friends only.”

You may find that it’s hard for teenagers to take this seriously and understand the risks. Help them choose screen names carefully. Help them choose a reasonably “complex” password—at least 8 characters using a combination of upper and lower case letters, numbers, and symbols (when allowed).

Blogs—Encourage your kids to not share personal information, including their ages, schools, addresses, phone numbers, and parent and sibling names. Make sure they’re not posting information about their social plans. (Don’t give someone who is cyber stalking them information about where they’ll be at a given time.)

Moderating Comments—Ask your kids to approve comments by their friends before they allow them to be posted. Their friends may be less than careful with both their own and your kids’ information.

Inappropriate language and pictures—College admissions offices and potential employers search online to see what kind of information prospective students and employees post online, especially in social networking sites. If they see what appear to be “character issues” portrayed, your teens may not be accepted for their college or job of choice.

Making themselves a target—People can pose as anybody online. That 15-year-old friend might be a 45-year-old male looking for “company.” Sexual predators use social networking sites to identify and engage potential victims. Identity thieves look for private information to use to gain access to victim’s bank accounts or credit.

It’s forever—There is another big problem most of us do not think about. Information we post online NEVER really goes away. Even when you delete a blog entry or a picture, it is “cached” somewhere on the Internet. There are sites on the Internet that specialize in archiving other Web sites.

What you can do

  1. Talk to your kids.
  2. Ask them to help you set up your own profile and page on the same sites they use.
  3. Subscribe to their blogs and read what they are posting.
  4. Respond to their posts.
  5. Look at the pictures they have chosen to share.
  6. Find out who their friends are and see what kind of information they share.
  7. If you have a family computer, try to put it in an open area where you can see your kids’ online activities.
  8. If your family has multiple computers sharing an internet connection through a router, you may want to consider restricting the times their computers can connect to the Internet. Restricting access to reasonable hours helps ensure that they (or you) are not spending all night online.

My philosophy as a parent has been to teach my children how to interact with the world while maintaining their spiritual values. Despite your best efforts, your children are going to encounter these dangers at some time. In my experience, you cannot prevent them from doing something they are intent on doing.

Let’s make sure they know how to protect themselves now, before they’re in an environment where we aren’t there to supervise or teach these lessons.

Related articles
An earlier version of this article was published previously in Christian Computing Magazine.
Enhanced by Zemanta
  • 31
    May 11
  • 11

Unpacking My Takeaways from #STC11

Category:Infosec Communicator,STC,STC Rochester,Summit,techcomm,Uncategorized Tags : 

Open SuitcaseIt’s been a little less than two weeks since the Society for Technical Communication Summit in Sacramento ended. Summit was an intensive four day immersion in the multifaceted profession of technical communications. I wanted to share what I found really important about the event, before the memories fade. I’ll start unpacking my takeaways here and in future posts.

I hope you’ll take the opportunity to discuss what I’m unpacking and share what you unpacked when you got home by commenting on this post!

Here’s my Top Ten list of takeways:

  1. The strength (and pride) of STC lies in its communities. Over the last few years there have been questions about the value that geographic chapters provide in an era when people are increasingly connected online. The Pacesetter Awards show that innovation comes from the grassroots level, whether from a geographic chapter or SIG. Some of the communities have done outstanding work in building and documenting solutions that can be applied across STC. For example, the Carolina chapter broke new ground in providing webinars for their geographically diverse membership and in partnering with Southeastern Michigan and Rochester to co-deliver online content.
  2. Relationships between communities bear fruit. STC recognized several chapters and SIGs with Community Achievement Awards and Pacesetter Awards. What I found interesting about the communities receiving the awards was that key leaders of these communities consulted with, counseled, mentored, and exchanged ideas with each  other. These awards aren’t a competition. The recipients found ways to build each other up during the year. My conversations with community leaders during the year sparked much of what the Rochester chapter accomplished and helped us move forward in unanticipated ways.
  3. STC will continue to move forward as it provides value, although with an increasingly new base. Although I believe membership is down slightly from last year, STC is operating in the black and is continuing to add new members. (Personally, I believe the tide has turned.) The launch of key initiatives such as certification and MySTC should have a continuing impact as we move forward.
  4. Twitter played (and will continue to play) a key role at Summit. Twitter was used in two chief ways at Summit: to tweet and retweet session content and to facilitate face-to-face networking opportunities. The Twitter stream using the #stc11 hashtag provided an easy way to find out what was happening. There were more than 5000 tweets associated with the #stc11 hashtag in less than a week. That’s a lot of communication.
  5. There are some really committed and capable people in and moving into community leadership. I’m very impressed with the earnestness and ability of the people I had the pleasure of meeting and talking with during Leadership Day and afterwards. I’ve only gotten to know the leadership of Toronto, Philadelphia, Carolina, and Southeastern Michigan at all well. What I’m seeing in those chapters is encouraging and demonstrates a desire to serve their members and to  strengthen STC as a whole. They’re not in it for their own glory. They’re in it to make us better.
  6. Leadership Day provides a foundation of knowledge and, more importantly, connections for new community leaders. I can’t overstress the importance of Leadership Day for the new and current leaders. Last year, I found the sessions explaining the intricacies of community leadership for new leaders absolutely critical to moving our chapter forward. This year I was able to participate in the progressions where community leaders shared their insights for success (and their struggles), providing sparks for new ideas and solutions for overcoming common, but vexing issues we face. Although I didn’t know it at the time, the connections I made at Leadership Day last year became my chief contacts in discussing issues and opportunities at the community level.
  7. MySTC can play a key role in strengthening community. MySTC provides a social networking platform on which members (and invitees) can share ideas, “friend” each other, create discussion and task groups, share photos and videos, and CONNECT with other members. We’re still figuring out how to use it. It’s not perfect, but it’s really great to have an easy way to connect with members outside and inside our current communities. The innovators among us will jump in and determine ways for us to work collaboratively.
  8. The vote on student membership rights at the business meeting was profound. Student members of STC were never enfranchised to vote in international elections, although their rights varied at the community level. The business meeting saw discussion and a vote on a proposed amendment to give them the vote. The proponents for student voting rights spoke passionately when presenting their arguments for passage of the student voting amendment. Opponents, although fewer, were articulate in their defense of the status quo. The amendment required a two-thirds vote of the members present. The amendment passed handily and the atmosphere in the room was charged. I did not expect the feeling of accomplishment we had when the amendment was approved.
  9. Certification may help the profession, especially by providing credentials for technical communicators who do not have degrees that relate clearly to the profession. I have degrees in anthropology, church history, and am ABD on my PhD in early modern European history. This is not obvious preparation for a career in technical communications. I was concerned about credentials so that I could get past initial screenings. Certification can provide credentials for those of us who have “non-standard” educational backgrounds.
  10. The content of the sessions at Summit was great. Isn’t it interesting that the content at Summit was the last thing I listed in my top ten? I enjoyed (and learned something in) almost all of the sessions I attended. However, for me the chief benefit of the conference was establishing and strengthening connections. These people are my techcomm tribe. They get it.
Related articles
Enhanced by Zemanta

[twitter-follow screen_name=’benwoelk’ show_count=’yes’]

Site Search

Subscribe to Podcast

Apple PodcastsAndroidPodchaserby EmailRSS

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,235 other subscribers

Categories

Selected Swag

Support Introverted Leadership on Patreon

Become a Patron!
Blubrry affiliate banner

Subscribe to Podcast

Apple PodcastsAndroidPodchaserby EmailRSS

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 2,235 other subscribers

Support Introverted Leadership on Patreon

Become a Patron!

Recent Posts

promo image for midday mentors interview

Why CPTC Certification?

August 24, 2021
RIT CPTC Class promo photo

RIT CPTC Exam Preparation Class Beginning June 2021

April 7, 2021
Victoria Lioznyansky Headshot

Episode 34: Victoria Lioznyansky–Public Speaking for Introverts

July 23, 2020
Victoria Lioznyansky Headshot

Episode 033: Victoria Lioznyansky–Introverts and Starting a Business

March 29, 2020

Site Search

Privacy Policy

WordPress Web Hosting

Copyright 2018  Theme developed By Weblizar