In a recent blog post “5 Good Security Habits for 2020”, we offered some ideas to make you and your organisation more cyber-safe. The tips included things such as being security aware of scams and how to achieve good password hygiene. In this latest post, we look at more specific areas that we must tighten our security grip on, i.e., security systems such as routers, mobiles devices, and broadband connections.
– Engage your staff with scenario-based security awareness training or “In-the-Moment” training.
5 Security Tips – The Network and Beyond
The tips shown here are not exhaustive, but they should give you a flavour of where some of the key threat security threats are in the extended networks, we use every day.
The dangers of the default password
Many routers and Internet-connected (IoT) devices are sent from the manufacturer with a default password set. This has been done, historically, to allow the remote update of firmware. Attackers focus on this vulnerability. For example, the Mirai botnet attack was a massive Distributed Denial of Service (DDoS) attack that happened in late 2016; the attack took down many Internet sites. The cybercriminals carried out the attack by using known default passwords used on IoT devices.
Always change a default password that has been set on IoT and other devices like routers. Your device or router should allow you to do this in the setup instructions.
Port control
All manner of cyber-threats are enabled by the exploitation of open ports. The internet is replete with free scanners, such as nmap, which allow you to search across the internet for these open ports. The scanners are easily accessible and are often used legitimately by ‘What-Hat Hackers’ to check for system vulnerabilities. However, cybercriminals also use tools like this to look for open ports that they then exploit.
The ransomware, WannaCry, used open ports to infect PC’s, but internet routers are also at risk. Malware, such as VPNFilter, has been found to target small offices and home routers using this method. Once infected, the router is controlled by the cybercriminal and all traffic intercepted.
When you configure your router, only have essential ports set to open.
Use a VPN
A Virtual Private Network (VPN) is a secured (encrypted) pipe between your device and a VPN server which connects you, securely, to the internet. It is used often for private internet surfing, i.e., to stop tracking of internet use. However, it is also a way to secure your internet traffic.
Use a VPN to provide better privacy and secure network traffic when outside a secure network.
Avoid free Wi-Fi
Man-in-the-Middle (MitM) attacks on public free Wi-Fi take advantage of the fact that the connection is unlikely to be secured using encryption. A MitM attack, allows the cybercriminal to intercept any traffic between your device and the internet. Sometimes, cybercriminals will set up a ‘rogue hotspot’ which is entirely under their control. It will have the name of the local shopping mall or pub, etc. to trick you into using it.
The best way to avoid a MitM attack or a rogue Wi-Fi threat is to avoid using free Wi-Fi for anything that is sensitive, such as logging in to a bank or email account. Alternatively, you could install a VPN and use that to connect to the internet.
SMShing
Phishing, in general, is continuously on the increase. In Q3 2019, the Anti-Phishing Working Group (APWG) report stated that phishing was at “a level not seen since 2016”. Mobile devices are being increasingly targeted as a method to deliver phishing. Mobile phishing or SMShing uses SMS texts or a mobile app (e.g. WhatsApp) to deliver messages containing malicious content. The content of the phishing message uses the same tactics as email phishing, e.g., it will look like it is from a known brand such as a bank or company like Uber. Typically, the message contains a link. The link will take the recipient to a spoof site that will attempt to gather personal and/or financial information. Sometimes, the text will ask you to call a number. Further still, the message may encourage a malicious app download.
To avoid SMShing campaigns, ensure that you are aware of the types of scams that are doing the rounds. As fraudsters continuously change tactics, you will need to be prepared to keep on top of the threat and learn how the fraudsters trick you into clicking links, etc., in mobile messages.
Whack-a-Cybercriminal
Tackling cybercrime may seem like an uphill struggle. Just as you understand how to close one attack route off, another pops up like the proverbial ‘Whack-a-Mole’. But by being vigilant and security aware, you can make a difference in the success rate of cyber-attacks. Keep up to date with Security Awareness Training and use our ‘security tips’ and Breaking Scams weekly update, to know what is happening in the world of cybercrime and how to prevent becoming a victim of a cyber-attack.
Interested in learning more about how security awareness training can help your organisation? Sign up for a free demo of the world’s most interactive security awareness training.
Subscribe to the Proofpoint Blog