We all know some simple, common-sense ways to protect our cars and homes: Lights, locks, barking dogs, and other measures like that. Experts will tell you that you can’t make your property crime-proof, but you can make it less attractive to the opportunistic criminal.
It’s the same with your computers, your phones, your smart devices, and your networks.
A firewall, of course, is a system that stops attacks on your stuff. It’s been said that there’s only one perfect firewall, and it’s a pair of wire-cutters. It’s true: if you want perfect security, you’d have to cut all connections to the outside world – but most of us need to be connected to the public internet to do our work, to manage our households, to live our lives. So how can we make our IT assets less attractive to bad actors?
In cybersecurity there’s a concept called the attack surface. Think of the attack surface as the exterior of your home. You have a door and some windows. In order to secure your home, you have to make sure these points of entry (or attack) are locked tight. Then you should review the rest of your home’s exterior. What about that pet door? That basement window that looks too small for an adult, but what about a child? The goal in any kind of security – home security or cybersecurity – is to reduce the size of the attack surface, so that bad actors have as few points of weakness to attack as possible.
And what’s the threat? You may think you have nothing worth stealing. Years ago I lived in a high-rise apartment with a balcony. For some reason it was the only unit with a balcony on that side of the building. My wife used to ask me to lock the sliding door to the balcony every night before bed. I did it, of course, but I always thought Why? Who’s going to come through that door? A professional cat burglar? We don’t have anything such a thief would want. Today, cybercriminals aren’t just looking for valuable, sensitive information. They’re looking for devices that they can take over and control to attack their real targets, which are usually elsewhere. Your home network and the devices connected to it are easy targets unless you take measures.
That’s simple enough when we’re talking about a house, but the attack surface for electronic devices, like laptops and phones, is harder to manage. There are a few obvious things, like passwords. Think of passwords as lights and locks for your laptop – simple and effective, but just the beginning.
By now we’re all familiar with strong passwords, and none of us are using (we hope!) our children’s names or our birthdays as passwords. And we should never, never, never write down a password – or should we? These days, with dozens or even hundreds of passwords to keep track of, passwords that are long and complicated, how on earth are you supposed to keep track of them?
The answer is a Password Manager. This is software that keeps track of all your passwords, and keeps them encrypted and secure. It usually depends on a master password or passphrase, which is the only thing you really no-kidding need to remember. There are many systems on the market. Most are free or have a “freemium” option where the basic function is free and you pay for more options. I use LastPass, but plenty of people use 1Password, Bitwarden, Dashlane, NordPass, and others. Find one you like and commit to using it. These systems can even help you set up new passwords and change them automatically, every 30 days or whatever interval you set. It might take some getting used to, but it’s the single most effective thing you can do to improve your cybersecurity.
Patches and Updates. How many times have you seen a system message that says something like An update is available! Install now? and then you’ve clicked “Install Later”? As a rule, you should always install the update right away. These updates often contain important security details. They plug holes that bad guys have found and exploited. The complete health of your system depends on you installing patches and new versions as soon as you can.
Two-Factor Authentication (2FA) is the feature where you have to receive a code by text or by email in order to proceed. Not using it is like putting a chain on your door but not locking the deadbolt. Using it helps, so enable it for as many things as you can. Beware, though: Bad guys have figured out ways around it, of course, so the best way to use 2FA is not by text or email but by using a special app like Authenticator or Authy. That way, even if a bad guy steals your phone number (something called “SIM swapping”), he won’t be able to get your 2FA messages, and that means he won’t get the keys to the kingdom. Setting it up can be tricky, so ask for help if you need it.
VPN. This is a way of encrypting your data while it’s moving across the internet, so even if someone intercepts it, they won’t be able to read it. VPNs have other benefits but that’s the main one. If you decide for whatever reason not to use one in your daily life, then for the sake of everything that is good and sane, absolutely without fail use one when traveling, especially internationally. During the 2014 Winter Olympics in Sochi, Russia, some journalists were seeing their phones hacked at the airport, before they even got off the plane – and that was eleven years ago. If they’d been running strong VPNs it probably wouldn’t have happened. Be aware that not every website and app works and plays well with an active VPN. Ironically, that’s because bad guys and hackers often use VPNs to disguise their location and identity, and some websites and apps have decided to simply block them. You will have to learn which is which – but most VPNs have settings that will make it a bit easier.
Hard Disk Encryption. Whether you’re an Apple user or a Windows user, there’s something for you here. The idea is that if the contents of your hard drive are encrypted, then they’re useless to bad guys. It’s FileVault for Apple users and Bitlocker for Windows. There are plenty of YouTubes out there explaining how to use them, but for goodness’ sake, use them. It doesn’t slow anything down, except the bad guys.
Your Home Network. Most people use the equipment their service provider installed exactly the way it comes out of the box, exactly as the technician left it. Bad guys know that, and it’s a major vulnerability. At the very least you should change the master administrative password on the router, and there are many other things you can do to make your home network more secure. If this is beyond you, any competent IT professional should be able to help.
Cybersecurity is a game, a game of risk management. The goal is to reduce your attack surface to such a small size that the bad guy skips right over you on their way to the easier targets. It requires continual attention, but luckily, once the heavy work is done – getting the passwords straightened out, installing updates, getting your VPN running, and so on – it gets easier.
If you’d like an assessment of your attack surface and recommendations for improving your cybersecurity posture, let me know. There’s always a way to improve – unless you use the perfect firewall!
James Therry, CISSP, is a cybersecurity professional who spent 38 years consulting for the Federal Government, mostly in the defense space. He and his wife have lived on the Hill since 1991. jtherry@gmail.com
