Introverted Leadership Mentor
Collaborating Securely: Protecting Your Community and Yourself
I had the privilege of presenting Collaborating Securely: Protecting Your Community and Yourself to a room full of community leaders from the Society for Technical Communication.
My Shockproofing Your Use of Social Media: 10 Things You Should Know eBook is now available on Kindle!
For those of you who have attended one of my Lightning Talks about Internet Safety, this book fleshes out my recommendations for keeping safe online.
Please consider buying a copy. You’re welcome to lend your copy out and the book is also available from the Kindle Owners Lending Library and Kindle Unlimited.
If you read it, please leave a review!
If you’re interested, Nick Francesco and I are authoring a series of Your Guru Guides on computing-related subjects. (Search on Amazon
This post provides an update to last year’s Choosing the Safest Browser post. Let’s take a look at what’s changed since June 2010.
Last year, we looked at the following browsers to discuss which would be the safest:
How do you decide which browser is the safest? One way is to look at the vulnerabilities that were disclosed for each one. Attackers may exploit these vulnerabilities to place malicious code onto your computer.
In Spring 2010, my Cyber Self Defense class ranked the browsers in the order below according to which ones they thought had the most vulnerabilities:
According to the Symantec 2008 Internet Threat Report, here’s the list of browsers ranked from most reported vulnerabilities to the least:
The class was really surprised by this ranking.
Let’s see how the rankings look from the Symantec 2010 Internet Threat Report. Here’s the 2010 list of browsers and number of vulnerabilities:
I was surprised by this order. Ranking browsers by vulnerabilities reported, Chrome appears to be the worst and Opera the best. (In the 2008 report, Chrome had the fewest vulnerabilities!)
Another way to look at browser safety is how long it takes for a reported vulnerability to be fixed. How would you rank these same five browsers from shortest to longest patch time?
In the 2010 report, Internet Explorer had an average patch time of 4 days. Opera, Safari, and Chrome were each one day or less. (In the 2008 report, Safari had an average “exposure” time of nine days, compared to the “best,” Firefox, which normally took only one day to patch.)
Patch time alone doesn’t appear to be a factor when choosing the worst browser.
Safe browsing is important because the majority of attacks are web-based, peaking at almost 40 million per day in September 2010.
In my opinion, not so much. Internet Explorer vulnerabilities are targeted more because it’s the biggest target. However, all of the browsers mentioned have vulnerabilities and all are patched relatively quickly. Many attacks actually target applications such as Adobe Flash, QuickTime, and the like. Malicious PDFs have also become a huge problem in the last year. What matters are safe practices!
How can you tell how secure your web browser may be? Scanit’s Browser Security Test checks your browser security settings and provides a report explaining the vulnerabilities, the potential impacts, and how to correct them.
Your security software should include an antivirus, anti-spyware, and a firewall.
Keep your browser and applications up to date. If you’re prompted for an update, accept it.
Use a strong complex password or passphrase. Consider using a password vault such as LastPass to generate and store your passwords.
Current browsers all provide some protection against phishing. There are also browser tools that you’ll find helpful.
Limiting account privileges (WindowsXP) provides simple but effective protection when working online. Limited accounts allow you to do most daily activities but do not allow you to install software (only accounts with administrative privileges can install software on the computer).
Many attacks take advantage of administrative privileges to install malware on your computer. If you’re using a limited account, attackers and malicious websites will not be able to install malware. (This is less of an issue with Windows 7 and Mac OS X because they ask you to confirm software changes.)
Threats have doubled since 2009 and the threat vectors have increased. Vigilance is even more important.
One thing hasn’t changed. The key to safe browsing is not which browser you choose. It’s following safe practices.
Please comment on the post and let us know some safe practices you recommend.
What’s the easiest way to break into a computer account?
Cracking the password? Putting a trojan on the computer? Hacking? Unfortunately, it’s simply tricking you into giving up your password through a technique known as phishing.
Computers have vulnerabilities that can be exploited by attackers using different types of malware. However, your attacker is as likely to come after you through “social engineering” as they are through malware. Just as our computers have vulnerabilities, we too are susceptible to attack!
Social engineering attacks are attempts to trick you into revealing private information. Successful attacks may result in identity theft and loss of funds. Social engineering attacks take a number of different forms, including phishing attempts, work at home scams, and Nigerian 419 schemes. Attackers often take advantage of current events, such as the tsunami that hit Japan.
This article deals with one type of online scam—phishing attempts. Phishing is a common technique in identity theft. We’ve all received phishing emails or instant messages that appear to link to a legitimate site. These emails and web sites are designed to capture personal information, such as bank account passwords, social security numbers and credit card numbers. Losses to phishing attempts are estimated to be as high as $500M every year.
Phishing emails used to be easy to recognize because of their poor spelling and grammar. Now, phishing emails are often indistinguishable from official correspondence. Anyone can put together a phishing attack using resources (or kits) purchased on the Internet.
Safe computing practices are the best defense against phishing. Here are a few safety tips:
Although avoiding phishing attempts is typically a matter of following safe practices, there are a number of browser helpers available to help warn you of suspicious web sites. Browser helpers normally work as another toolbar in your browser. Use one or more for your protection:
