{"id":88310,"date":"2024-02-07T13:45:00","date_gmt":"2024-02-07T19:45:00","guid":{"rendered":"https:\/\/eshop.macsales.com\/blog\/?p=88310"},"modified":"2024-06-17T15:36:54","modified_gmt":"2024-06-17T20:36:54","slug":"computer-security-7-rules-to-keep-hackers-at-bay","status":"publish","type":"post","link":"https:\/\/eshop.macsales.com\/blog\/88310-computer-security-7-rules-to-keep-hackers-at-bay\/","title":{"rendered":"Computer Security: 7 Rules to Keep Hackers at Bay"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

This post builds on my previous post: How Corporate Security Sloppiness Threatens Your Online Life and How You Can Reduce Your Risk<\/a>.<\/p>\n\n\n\n

A fact of life is that security is extremely hard\u2014not for technical reasons, but for people reasons.<\/p>\n\n\n\n

When I was working as an engineering manager in the computer security field, the top issue was never the security itself, but how to make things as secure as possible while keeping things usable<\/em>. Endless discussions lasting hours. Security is as weak as its weakest link, and today that is almost always the people involved<\/strong>.<\/p>\n\n\n\n

Thus any approach that is \u201cbest\u201d is ludicrous<\/em> when people cannot use it and\/or understand it and\/or make mistakes<\/em> with it. People start doing seriously risky things when security is too hard to use. Security always<\/em> involves some kind of tradeoff vs. complexity.<\/p>\n\n\n\n

Risk management<\/h3>\n\n\n\n

Bad to terrible outcomes<\/strong>: too many people have been subject to security hacks that have cost them dearly, with problems that take years to clean up. Some breaches are irreversible<\/strong> (eg. financial loss), some are longterm headaches<\/strong> (e.g. ruined credit rating), some are embarrassing<\/strong> (e.g. blackmail), some are life threatening<\/strong> (e.g. false arrest due to stolen identity). Don\u2019t join this unlucky club!<\/p>\n\n\n\n

Risk management starts with understanding the simplest things you<\/strong> can do to protect yourself with your own best practices<\/strong>. Just as with walking down a city street, it\u2019s on you to have situational awareness<\/strong>. Even big companies with strict policies have problems with security, which means individuals absolutely have them as well. <\/p>\n\n\n\n

After all, it\u2019s a mine field out there. Legislative uselessness driven by corporate disinterest is to blame for much of the danger because their priorities are not your security. This dangerous ground is not likely to change any time soon, in spite of lip service given to it. There are of course islands of good practices here and there, but the total environment remains risky. And security rests on the weakest link.<\/p>\n\n\n\n

And not just from hackers, but also from the reckless practices even today of many big companies<\/a>, who have little to lose when security breaches happen. You will not<\/em> be compensated for their mistakes. You may be blameless, but you will pay the price, not<\/em> that company whose failings led to it.<\/p>\n\n\n\n

Can\u2019t a password manager just fix it all?<\/h3>\n\n\n\n

Password managers are all the rage and for good reason, but they are no panacea. And IMO, among other problems, they have become overburdened with complexity and frequently fail to work with some web sites. The overall recommendation is solid, but it is the most glib and context-free recommendation you\u2019ll hear today. Yes, use one<\/em>, but not everyone can grok one, and it is not without risk itself.<\/p>\n\n\n\n

For example, my own father finds a password manager too complicated\/confusing, and that is not going to improve as he ages. Can you<\/em> teach grandma how to use one? <\/p>\n\n\n\n

Here in 2024, my favorite password manager has become such a hassle to setup on a new computer that I have to revisit the directions and jump through multiple hoops and compromise a required secret code<\/em> (eg. store it on my computer) for fear of losing everything. A terrible<\/em> design for a password manager. All because that vendor forced a move to cloud-only and their new architecture prioritizes their<\/em> needs, not mine.<\/p>\n\n\n\n

Before, it was far simpler and without that secret key risk\u2014far better for me. Just not for the vendor. That vendor will surely argue otherwise, but as a software engineer writing code for 40 years, I beg to differ. <\/p>\n\n\n\n

So, where does this all leave a non-engineer when it comes to protecting themselves?<\/p>\n\n\n\n

Rules<\/h2>\n\n\n\n

Let\u2019s look at the basics of protecting yourself. This is not a complete list, but it is a start down the right path. And to my regret, it\u2019s not all that simple. Alas, that is digital life today.<\/p>\n\n\n\n

Security Rule #0: Trust is the opposite of security<\/h3>\n\n\n\n

All the other rules that follow become useless if you willingly give up sensitive information. Whether it is by phone call or text or email or in person, giving up sensitive information is your ticket to disaster. Always independently verify the identity of every request for information, and provide as little information as possible.<\/p>\n\n\n\n