Top 10 CyberSecurity Tips from Rana Kory, Director of IT with Worley Erhart-Graves

10. Use an Anti-Virus/Malware Software on your computer AND phone. Be sure to keep up with Updates! - Hackers are coming up with new ways to breach our systems every day. You want to make sure you keep your anti-virus software updated and on an automatic schedule to scan your computer. Do not forget to put one on your phone. There’s Sophos Intercept X for IOS which highlights important operating system updates and detects malicious Wi-Fi connections. It also provides a secure QR code scanner to read URLs, a password safe, and an authenticator to generate one-time passwords to sign into your accounts that use multi-factor authentication. You have McAfee Mobile Security for Android. Sophos is free and McAfee has a lot of security options for free, including anti-theft and mobile security, Free antivirus cleaner and removal, safe Wi-Fi access and Wi-Fi Scanner and more. It is best to put all your software on automatic updates. Otherwise you are putting yourself at risk for malware or other types of infections.

9. Backup your data! – Use the 3-2-1 rule. Make three copies. Use two unique medias and keep one off site. You should always use storage devices that encrypt your data. This will protect data from being stolen. My recommendation is an encrypted external hard drive and an online service such as iDrive.

8. Think before you click and do not open emails from people you don’t know! This is the number one way that people get hacked or get a virus or malware. If you open an email and click on a link or open an attachment, even if you think you know the person, can lead to malware or worse, ransomware or taking over your entire computer. What you want to do is scroll over the sender’s email address, you will be able to see the actual email address it was sent from. Check for urgency in the email. Check the email for unusual language or misspellings. Does it sound like something that your friend or relative would say? Are you expecting the email with the link or attachment? Better to call your friend first to verify they sent it. Do not click on links coming from companies you have accounts with, such as your bank or anything where you must log in. Go directly to a browser and open your account directly. If it is a unique link you need to open in the email, scroll over the link and make sure that the domain name is exactly from the company. Also scroll over the sender to make sure the domain of the sender is from the company. For example, if it is from Chase, make sure the long link ends with chase.com. If it does not, call Chase to verify the email. Many hackers can almost duplicate a company’s email down to when you click the link, it will look like the company’s website and ask you to log in. Some may go as far as asking for your 2-Step verification code. As soon as you give them that, they can get into your account and wreak havoc.

7. Get a password manager! – The main reason I suggest a password manager besides so you won’t forget them, is because once you do, I suggest you go through each one of your passwords and change them to the following standards: 12-20 characters, 3 symbols minimum, 3 number minimum, 3 minimum uppercase letters, 3 minimum lowercase letters. I recommend LastPass. You can put LassPass on your computer AND your phone and use the same login. Your login credentials will go with you wherever you go. You only have one password to remember and that is the LastPass password. Do not make that one easy. Use the same standards as above and do not use a word or phrase. My suggestion is to use a sentence then use the first letter of each word but change some of the letters into symbols. Change your LastPass password every 3-6 months preferably and put multifactor authentication on for a second layer of protection. Finally, NEVER use the same password for multiple sites.

6. Use a VPN! – A VPN is a Virtual Private Network. It enables users to send and receive data securely across shared or public networks as if their computer devices were directly connected to the private network. VPN’s can be used to secure your browsing activity from prying eyes on public Wi-Fi, and more. Using a VPN is one way to protect your privacy online and keep your information safe from hackers, internet service providers and other 3rd parties. If you are someone who travels a lot, uses public Wi-Fi or someone who just really cares about security, then a VPN is for you. There are free VPNs, however my recommendation is NordVPN. You can put it on up to 5 devices, including your phone. It is very easy to use. Using a VPN is a must when handling sensitive information such as banking or shopping, using public Wi-Fi or using a remote connection.

5. Check all your settings on your phone and in your apps! – Don’t let me scare you when I tell you that your phone is being infested by advertisers who are getting your information! It took me hours to go through and remove all the advertisers who were getting my information. My advice go through every one of your phone settings and remove anything that is giving information to anyone. Facebook is the worst. There is a place where you must click “Don’t allow” access to around 50 or more 3rd party advertisers. So, make sure you go into each app and go through EACH setting, especially the privacy, security and ads settings and turn off anything that is giving access to someone. I also suggest using Duck Duck Go as your browser, as they emphasize protecting searchers privacy. They do not profile their users, do not store IP addresses, and do not collect or share personal information. They do not track you…ever!

4. Change your default SSID and password of your home router!
SSID is the name given for your Wi-Fi when you get it from your service provider. It uniquely names a wireless local area network. So, when you connect to wireless on your phone and other devices, you choose the SSID (name of your Wi-Fi), then you put your password in, and you are connected. For security reasons, you should not use the default name and password your service provider gives you. You need to come up with a strong password. To change it, log into your account with your service provider. For example, for Spectrum, you create an account. Once you are logged in, you go to Manage Account then Services. Other service providers have their own way of doing it. Do a search on the Internet for your service provider and how to change your SSID and password. Remember to use a minimum of 12 characters, include symbols, uppercase letters, and lowercase letters for the password. You will then need to go and update all your Wi-Fi devices. However, you will be able to sleep better at night knowing you are becoming tech savvy.

3. Always use Multi-factor authentication when available!
Sometimes called 2-Step Verifications or 2-Step Authentication, it’s when you have an online account and after you log in, you have a 2nd method, such as a text message with a code, or an app that gives a code, that you also have to put in before you can get into your account. Many, if not most, offer this. My recommendation is to ALWAYS set this up on all your accounts where it’s available, including your social media accounts. Just to give you an idea, some passwords can be hacked within minutes (of course not if you use my guidelines). It usually only takes a few minutes to set it up. Just go to your settings in your app and look for “Login” or “Security and Login/Sign in”, then look for “Touch ID”. Bank apps usually have it, Facebook, LinkedIn, Twitter, Instagram, etc.

2. When doing sensitive browsing, always use your own device and on a trusted network!
If you are doing any sort of banking, shopping or anything where you are putting in sensitive information, you should never do it on someone else’s device such as a public computer, or a friend’s phone. You should also never do it on a public Wi-Fi. It should always be done on a network that you trust and on your own device. (Having a VPN on when you’re on public Wi-Fi is actually the safest way to be on it. It can keep your sensitive information away from hackers and prying eyes. However, choose a reputable VPN provider such as NordVPN, ProtonVPN and TunnelBear VPN).

1. Do not send account numbers or personal information through email! – I have seen it time and time again, people sending their routing number and their account numbers in the same email. All it takes is a hacker to get a hold of that email and they can empty out that persons bank account and sell that person’s information on the dark web. Email is not safe unless it is encrypted and even then, it’s only encrypted from point A to point B. If someone were to hack into your email account, they could just do a search for “account” and find that email. If you did send this information on accident, delete it from your sent folder, your trash and everywhere else you can find it in your email. Also, make sure the recipient does the same. If you need to send sensitive information, ask the recipient if they have a secure portal so you can upload the information securely.

Although this seems like a long list and some steps might seem difficult, taking one step at a time until you finish the list will get you one step closer to keeping your data safe from prying eyes. Many people do not realize how much they need to do to keep their personal information safe. Not doing enough leaves you vulnerable to malware, ransomware, and/or a loss of your personal data and sometimes even your money. Stay safe out there!

-Rana Kory, Director of Information Technology