Wiki

Security tips we should all be following. (This page is work in progress.)

Summary

Modern computers and mobile devices store vast amounts of information, some of it sensitive, and yet more of our data is in "the cloud", held by corporations such as Facebook and Google. Just as we've learned that keeping a front door key under the door mat might not be a good idea, there are important and not always obvious lessons we need to learn about keeping our digital lives safe. This page covers the basics.

Security Top Tips

Google carried out research comparing the top security tips given by security experts with the top security measures general users believed were important, and found worrying differences, as shown below.

	Non-Security Expert	Security Expert
1	Use antivirus software Virus authors test their wares against a whole slew of antivirus products to ensure they're not easily detected. Antivirus gives a false sense of security, but since free products are available, by all means use one.	Install software updates Malware generally gets its foothold through unpatched vulnerabilities. People sometimes worry that updates might break something. You might want to wait a few days to give the vendor time to pull a bad patch but no more. Proactive defence by installing updates is much better than reactive defence using antivirus.
2	Use strong passwords Yes of course use strong passwords, but just as important, don't reuse them across multiple sites.	Use unique passwords If one site leaks your password the bad guys will try it on many other sites to see what else they can compromise.
3	Change passwords often This is an age-old myth that has been accepted as fact. If it's hard to think of a good password it's much harder still to think of a new good one every few months. Whilst of some value, if your password is leaked it will still leave you at risk for a number of weeks. Much better to choose a really good password and stick with it.	Use 2-factor authentication A password is "something you know" - a secret that can easily escape. Requiring you to prove your ownership of "something you have" (such as a token or a mobile phone) or "something you are" (such as a fingerprint or iris scan) raises the bar very considerably.
4	Only visit websites you know Oh for the good old days when you could feel reasonably safe if you steered clear of porn, gambling and hacking sites etc. Today, even the most reputable sites have been known to host 3rd party ads containing malicious content, and the bad guys regularly perform automated scans for vulnerable sites which they can infect, which could include your local football club website or that of a national retailer. Now do you understand why patching is the top of the list?	Use strong passwords Yes of course use strong passwords, and strong means long. Making your password just a few characters longer strengthens your password more than using upper and lower case, numbers and symbols.
5	Don't share personal information Of course, be careful what you share online and who you share it with, but sensibly used, social networks can be fun and a good way of keeping up with friends and relations.	Use a password manager People often worry that to use a password manager is to put all their eggs in one basket. Well, it is, and don't use an obscure one, but with a really good master password the benefit is overwhelming. Never again struggle to remember a website's password or be tempted to choose a weak one or one shared among different sites, and let the password manager choose totally random and completely unguessable passwords for you.

Additional tips

• Reduce your attack surface
• Unsolicited attachments/phishing
• Backups - 3 copies, 2 media types, 1 offsite
• Data destruction
• Encryption
• Public networks
• Physical security

Reduce your attack surface

Each piece of software on your system could contain security vulnerabilities so it makes sense to uninstall things you don't need. This is critically important when it comes to browser plug-ins as these can often be directly invoked by websites you might visit.

In particular, uninstall the Java plugin if you have it. This is required by a tiny number of websites and has a poor security record.

Likewise, Flash has been plagued by problems, often exploited by malicious Flash-based adverts. Google for instructions for setting it to click-to play in your favourite browser.

Unsolicited emails

If you receive an unsolicited email, clicking a link in it or opening an attachment can really spoil your day. This is probably the commonest way to get infected with something bad.

Such emails are normally part of a "phishing" campaigns in which malicious emails are sent to large numbers of email addresses. Sometimes they are very crude, simply containing a link you may be tempted to click, just out of curiosity. Other times they may be quite cunning, e.g. making out there is a package addressed to you awaiting delivery. The email may even appear to come from someone you know, if their contacts list has been compromised, since forging the sender's address in an email is trivially easy.

To avoid getting caught, you should treat all emails you weren't expecting with the greatest of suspicion unless you are quite certain the sender is genuine.

Also, make sure your system is fully patched and updated to eliminate, as far as possible, the vulnerabilities a malicious email might try to exploit.

External links

• External links (if any) as bullet points.
• If non, delete this section.