Managing your passwords

I am continuing my series of posts on security topics of primary interest to businesses, as I mentioned in my first post on this blog. In this post, I focus on making sure you manage your online passwords carefully.

If you spend any time online, you will probably encounter many websites that require some kind of username and password in order to log into the website. This includes websites for e-commerce, financial institutions, social media, blogs, and other websites that require credentials in order to protect the data contained within and/or identify you in order to complete some kind of transaction. 

Your username is usually pretty easy to determine:  most websites use your email address as the username. What's not so easy, or at least it shouldn't be, is determining your password. If someone else knows your password with your username / email address, they can gain access to a website and potentially cause havoc. So, managing passwords carefully is one of the most important things we can do for personal and business security.

What's your password?

For several years, reports have been published each year about the worst passwords of the previous year. This data is mostly collected from data breaches and other leaked password information. The amount of this leaked data now totals around 2 million passwords. Out of this data, the top 25 common and insecure passwords are noted. As you might imagine, the top two bad passwords of the list for many years have been "123456" and "password". These are obviously not very secure as anyone can guess these passwords. You can read of the reports yourself: top 25 worst passwords of 2015.

Obviously, if any of your passwords are similar to what's on the list, you need to change them immediately. We understand passwords are necessary, but there are complaints about using them as well.

One of the biggest complaints about passwords is they are not easy to remember if we try to make them secure. Easy passwords are easy to guess or look up in dictionaries or online encyclopedia articles (think Wikipedia). This includes passwords with substituted numbers for letters (think "passw0rd" or "s3cr3t" (instead of "secret"), for example) or well known sentences or phrases from books or articles. Many books and articles are online now so it would be easy for an attacker to check possible passwords and password sentences from those resources.

Another complaint is because it is hard to remember a lot of passwords, most people use one password in many places. This introduces the problem that if one website is compromised and passwords are obtained, the attacker would know your password (and probably username = email) at all of your other websites, including, perhaps, your bank. So, what can we do?

Managing your passwords

There are a couple of good recommendations for managing passwords. One recommendation is to use what's called a "passphrase" that is made up of mixed words not usually found together. This kind of password provides enough characters in order not to be easily guessed and it is not easily found in dictionaries or online encyclopedia articles. Here are some examples:

FishWearsBrownShoes3%

or

ElephantJumpsBluePaper#5

Here, I take words you would never suspect or imagine to be together and put them together in something easy enough to remember (mainly because they are silly - we tend to remember the silly things!). I included the "3%" and "#5" to match a password policy you may see sometimes that require passwords to contain: a capital letter, a lower case letter, a symbol, and a number. You could come up with several of these pass phrases with variations of words and symbols and numbers - the possibilities are nearly endless! Be creative!

Another recommendation is to use what's called a "password manager". These are applications allowing you to create one password which in turn unlocks all the generated passwords you may have and can use with different websites. All the generated passwords are considered to be secure - all you need to do is remember the original one password to unlock the password manager vault of passwords. Generally, this method is considered to be the safest way to keep track of the many passwords you may use. There are lots of options for password managers. You have to evaluate each company to determine how they are storing your passwords (on your machine or somewhere in the "cloud"), how or if they track when you are re-using passwords or keeping the same password for a long time, and price (most passwords managers are not free). One example of a password manager is 1Password.

Next steps

Whatever method you use, think carefully about how you manage passwords. They really are one of the most important security tools you use on the internet today. Give it some thought and consider one of the recommendations above to better secure your own passwords and password usage. 

Next month, I will continue to talk about the kinds of policies your company should use for passwords as well as how two-factor authentication can be used for further increased password security. If I can be of help in setting up your own password policy, or evaluating it, please get in touch. If you have any general questions about passwords, please let me know below.


About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

Watch out for social engineering

I am continuing my series of posts on security topics of primary interest to businesses, as I mentioned in my first post on this blog. In this post, I focus on making sure you watch out for one of the most serious security threats facing businesses.

The news seems to mention a new data breach or a set of compromised identities affecting businesses almost on a monthly or weekly basis. We all know we should pick good passwords, make sure we use secure websites for transactions (i.e. see my article on HTTPS), and other important security guidelines. But, one of the main reasons for the data breaches happening is because of an initial social engineering attack.

What's Wrong With Being Social?

The term social engineering refers to the technique of getting around security systems, not by breaking through or exploiting vulnerabilities in a system, but instead by exploiting the vulnerabilities in humans using the systems. Generally, humans trust other humans.  And attackers will use that trust in order to circumvent our boundaries.

There are plenty of examples of social engineering. The most common is when you receive an email that seems legitimate but it is isn't. For example, the email says it is from your bank (something you trust) and there seems to be a problem with your account. The email wants you to click on the link in the email to login into your account, provide your username and password, and help resolve this issue. The link is usually a link to an attacker website that looks like the legitimate website. It is waiting for you to enter your username and password, and now the attacker has your bank information, in this case.

Another example is the phone scam when someone calls you to say you have a problem with your company and they are calling to help. We like when people are friendly and willing to help, and many will automatically trust this scam. The attackers want you to give them access to your computer so they can install some software on it to "fix it". Unfortunately, what is happening is they may be installing malware on your computer which is compromising your system, or worse stealing your username and password entered at sensitive sites like bank websites, etc.

What Can I Do?

There are several things you can do to protect yourself:

1. Always check the email address to make sure it is legitimate. Even then, check the contents of the email, because many emails will use a generic form of salutation rather that address you by name. And by the way, even legitimate looking emails (say from a friend) may not be legitimate because attackers will also send emails that look like they are from our friends.

2. Don't click on links in the email. Instead, go to the website directly and enter the URL by hand. Be careful of hovering over the link because some emails have scripts in them that even hovering over the link could cause the link to execute.

3. Don't open any email attachments you receive from someone unless it was agreed upon ahead of time. By opening the document, you could be installing malware on your computer.

4. If you get one of these scam calls from someone who wants to fix your computer, ask them who they represent and say you will call the company directly to verify. Or, better yet, hang up. You should be in charge of fixing your computer and taking it to someone reputable, not someone who cold calls you.

5. Be careful of people wanting you to copy or print a file from a USB drive. Don't ever put a USB drive in your computer you don't know its origin. These USB drives could have malware on them. This is another form of social engineering. Many companies have been compromised by an employee picking up a USB drive in the parking lot and putting it in their work computer "just to see what's on it".

These are a few recommendations to keep you safe, but the best advice I think is from the Russian Proverb "trust, but verify". Be very careful and make sure your business staff are also watching out for the above issues.

About Robert Hurlbut

Robert Hurlbut, owner of Robert Hurlbut Consulting Services, based in Enfield, CT, provides software security consulting, architecture, and training. This includes software development, threat modeling, secure code reviews, and other kinds of security audits for your company. If Robert can be of assistance to your company, please get in touch through the below contacts.

Web: https://roberthurlbut.com
LinkedIn: https://www.linkedin.com/in/roberthurlbut
Twitter: @RobertHurlbut

10 Ways to Simplify your Social Media Strategy

"What type of social media platform are you?" Honestly, I suspect those Facebook personality quizzes are purposely created to waste other people’s precious time. 

Do I need to know what type of politician I would have been if I was one? Hmm, I hope none of them, and frankly I don’t express my political views publicly.  

Another, even more useless discovery: “What kind of horror movie teen star are you?” The last time I watched a horror movie was on Halloween night during that infamous snowstorm that left most of the Northeast without power for weeks. The moment I realized it wasn't my smartest move, while “Scream” characters were being merciless sliced and diced on a blue screen, my lights started to flicker and eventually went off completely… Suddenly, the Halloween “spirit” felt uncomfortably close in the dark. 

Why do we want to know what kind of celebrities, rock bands, songs, or Harry Potter characters we would have been? How does it feel to find out that you are  #7F7F7F HTMX Hex color out of all 50 shades of gray? I bet it feels amazing!  What kind of car or, better yet, plane are you? If I was a plane I would be a Concorde—loud, and deadly. 

I read my Facebook friends’ quiz result posts with—declaring them to be dead presidents, rare minerals, instinct animals, etc.—with one thought in my mind: “Are you that confused about who you are?” 

Confusion is a Goliath of social media. It is THE main reason why people hate, fear and don't use social media to its fullest potential either for personal or especially business purposes. Social media with its millions of platforms, constantly changing at the speed of light, reminds me of my ADHD brain. It never rests. 

Flickr lost its followers and the market share to Instagram in photo sharing. Apple just came up with a new iPhone 6S and iPhone 6S Plus. Who knows what Android has in the store? I think the new product should be called “Google Brain.” I can see a big demand for that type of technology in today’s market. 

The most common mistake people make about social media is profiling channels and their audiences: 

Pinterest is for middle-aged women; 

Snapchat is for kids; 

LinkedIn is for professional use only (wishful thinking—trolls love this site!);

Ello is for communists, who also believe in a “money free” society; 

Brigade is for politicians (Here’s your chance, guys! This beta site is ready for you to rumble. Bring your boxing gloves when you to sign on!);
Periscope and Meerkat are for people who can use selfie sticks; 

Blab is for playing Hollywood Squares; 

Wordpress is for bloggers;

Instagram is for selfie addicts (Kim Kardashian should start an “Instagram Anonymous” 12-step program); 

Reddit is for engineers; 

Youtube is for those who finally figured out how to use their camera phones;

Twitter is for people who find it challenging to type more than 140 characters. and finally, 

Facebook is for changing the status of your personal relationship from “Happily ever after” to “It’s cheaper to kill that B$tch!” 

Unfortunately, this far-from-complete list of social media platforms will continue to grow and evolve more rapidly as time goes by. People will always feel the need for another, better and unique, one-of-a-kind idea for attracting today’s consumers and their precious 8 seconds of attention. 

The unfortunate reality is that you will never catch up. I repeat: You will never be equally successful on ALL existing social media platforms—even if you are Donald Trump, and one day wake up with the strange urge to become the U.S. President. 

Let me give you some helpful tips, or “hacks,” as they’re called nowadays, on how to simplify your social media initiatives and make this experience enjoyable, meaningful and profitable.

First of all. 

• Relax. You are not the only one who’s confused. 
• Follow 10 people who are successful on their social media platforms. Out of those, choose five you like and then cut down to the three who make the most sense in their presentations to YOUR Business. 
• Start building your first “out of the box “ tool kit, with LinkedIn, Facebook, Twitter and Youtube channels
• Be a true leader. Meaning a leader who has followers (we are all VIPs in our own minds). If you are the CEO of a big corporation, at least create a Twitter account. By the way, Michael Dell and John Legere (T-Mobile CEO) are avid Twitter users. Do you think you are busier than Michael Dell? 
• Give it some time and expect at least 6-9 months of a ramp up for your social media initiatives. 
• Don’t scale too soon by buying the latest and the greatest social media and marketing automation tools in the beginning. Wait, and enjoy your learning process…slowly. Constant Contact (emailing software) can handle all of your first mass emailing campaigns. 
• Start in your own backyard. Build your fan club inside your company.  Make asking questions a part of your clarity tactic. Be aware that some people don't like to comment publicly.  Generate conversations in private messages. Just don't stalk them. 
• Please, do all of us a huge favor and get a professional photographer’s help on creating your social media avatar. I know, smiling can be challenging sometimes, but you can do it. 
• Blog about things that matter. Tell your fans a story about how your product and services changed someone’s life . Try to write something compelling and fun. 
• While trying different things and marketing on all those platforms, just follow this formula  Clarity = Customer (where all of your focus should be) + Content (what they like to read) x Common Sense (remember, Google Brain is not coming out anytime soon.)   

In reality, social media selling is a very simple concept: It is a buying not a selling process.

And not to forget our quiz subject, my answer to the question “What type of Social Media platform are you?” is:  “The clearest one—the one that makes sense to your audience.”

If you like to learn more on how to simplify your social media strategy follow me on Twitter @natashajuhasz and LinkedIn - Natalia Juhasz

“The force that pushes human race forward.”

I have always wondered what separates greatness from goodness, a genius from a knowledgeable person, a masterpiece from well-done material. Talent? Persistence? Passion? Luck? Chance? Vision? All of it? 

In his 2009 TED talk, “How great leaders inspire action,” Simon Sinek explains that the distinct difference is in our reasons, our “Whys,” because people care more about your beliefs than your products, services and deliverables. That is why Apple is more innovative than other computer manufacturers, why Martin Luther King was the one who led the Civil Rights movement, and why the Wright Brothers were the first ones who made history with a controlled manned flight before anyone else, even those who were seemingly more qualified and better funded. 

Sinek concluded that the greatest leaders and organizations in the world think, act and communicate the same exact way, a way that is completely different from the average person. Their marketing messages are based on WHY they do what they do and not how great their products or how innovative their technologies are. Per Sinek’s theory of The Golden Circle, Apple’s success lies in their beliefs—paraphrasing their message: “We believe in challenging the status quo and thinking differently”—not how well-designed and user-friendly their computers are. 

Although I am not completely sold on his “WHY” theory, it has a lot of valuable points. 
I agree that profit is only a result of what you are doing, and should never be a reason for it. Money was never a motive or a driver for greatness. Talent, passion and persistence are way above monetary incentives. 

I agree that an inspirational message is more effective than a sales pitch in marketing.
But can we lead others and affect their buying decisions simply based on our beliefs? 
So if I believe that my theory of clarity in social media is the Holy Grail of social selling, I would not only get innovators’ (2.5%) and early adopters’ (13.5 %) business but also a desirable 15-18% market penetration, which is defined by the Law of Diffusion of Innovations as a tipping point of success? Hmm, I don’t think so.

Don’t get me wrong. I believe that my idea is brilliant and can help millions of people to look at social media differently. But just believing in it is not enough to inspire others.
We all believe in different things: some of us still believe in innovation and cutting-edge technologies; some think they can live without smart phones and computers; some of us believe that happiness is measured in material possessions. Some of us just take things as they are—the sky is blue, the grass is green and only gray has 50 ridiculous shades. 

I believe that the missing piece in understanding the strong link between greatness and the qualities of great people—Talent, Persistence, Passion, Sense of Purpose, and Innovating thinking—is the unique desire to change the world. 

All of the great people, geniuses and masterminds have always been and will always be crazy—crazy enough to think they can change the world. 

Steve Jobs was more than just a computer genius. He knew that his products would change this world forever. Michelangelo, painting the ceiling of the Sistine Chapel, knew that it would be a masterpiece. Albert Einstein envisioned universal transformation in his theory of relativity, and Thomas Edison saw this world as a brighter and warmer place, harnessing electricity. 

In this 1997 Apple commercial, Steve Jobs solves the mystery of greatness, rightfully naming it “The crazy ones.”
Are you crazy enough to change the world? I know I am.


Find more compelling stories about social media and digital marketing on my 
LinkedIn Natalia Juhasz 
Twitter @natashajuhasz