Why use Password Manager?

No matter how many walls are placed around your machine, there is always a key for complete access: your password. There are countless programs that attempt to determine passwords, both by guessing common ones and by randomly generating possibilities and trying them all, or a combination of the two.

The best defense is a “strong password”. A strong password is a combination of numbers, uppercase letters, lowercase letters, and, if possible, other characters. This makes the password nearly impossible to guess in a reasonable amount of time, and ensures that all the hard work you put into keeping your machine well-defended does not go to waste. The longer the password, the harder it is to guess.

password_1

Of course, as passwords get closer to random numbers and letters, they also get harder to remember. That doesn’t mean that you have to fall back on a weaker password, though. You can m15peLL w0Rdz intentionally, or use a Password manager/Password Vault software.

A password manager will take a load off your mind, freeing up brain power for doing productive things rather than remembering a long list of passwords.

A dedicated password manager will store your passwords in an encrypted form, help you generate secure random passwords, offer a more powerful interface, and allow you to easily access your passwords across all the different computers, smartphones, and tablets you use.

Some of the best Password Managers are:

1)1Password 4.0

2)Dashlane 2.4.1

3)KeePass 2.26

4)LastPass 3.1.2

5)PasswordBox 1.3

6)SplashID Safe 7.2.3

References:

http://www.infoworld.com/article/2607798/security/review–the-best-password-managers-for-pcs–macs–and-mobile-devices.html

http://en.wikipedia.org/wiki/Password_manager#Online_password_manager

http://www.pcmag.com/article2/0,2817,2407168,00.asp

http://www.columbia.edu/acis/security/users/passwords.html

http://www.techrepublic.com/blog/it-security/how-to-get-people-to-use-strong-passwords/

Advertisements

How to spot, avoid and report phishing attacks?

Phishing is essentially an online con game and phishers are nothing more than tech-savvy con artists and identity thieves.  They use SPAM, malicious Web sites, email messages and instant messages to trick people into divulging sensitive information, such as bank and credit card accounts. Phishing is the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.

What does a phishing email message look like?

phishing_email_example

 

  • Spelling and bad grammar. Cybercriminals are not known for their grammar and spelling. Professional companies or organizations usually have a staff of copy editors that will not allow a mass email like this to go out to its users. If you notice mistakes in an email, it might be a scam.
  • Beware of links in email. If you see a link in a suspicious email message, don’t click on it. Rest your mouse (but don’t click) on the link to see if the address matches the link that was typed in the message. In the example below the link reveals the real web address, as shown in the box with the yellow background. The string of cryptic numbers looks nothing like the company’s web address.
  • Threats. Have you ever received a threat that your account would be closed if you didn’t respond to an email message? The email message shown above is an example of the same trick. Cybercriminals often use threats that your security has been compromised.
  • Spoofing popular websites or companies. Scam artists use graphics in email that appear to be connected to legitimate websites but actually take you to phony scam sites or legitimate-looking pop-up windows.

 

How do you know?

  • Phishers, pretending to be legitimate companies, may use email to request personal information and direct recipients to respond through malicious web sites.
  • Phishers tend to use emotional language using scare tactics or urgent requests to entice recipients to respond.
  • The phish sites can look remarkably like legitimate sites because they tend to use the copyrighted images from legitimate sites.
  • Requests for confidential information via email or Instant Message tend to not be legitimate.
  • Fraudulent messages are often not personalized and may share similar properties like details in the header and footer.

How do you avoid being a victim?

  • Don’t reveal personal or financial information in an email, and do not respond to email solicitations for this information. This includes following links sent in email.
  • Before sending sensitive information over the Internet, check the security of the website.
  • Pay attention to the website’s URL. Malicious websites may look identical to a legitimate site, but the URL may use a variation in spelling or a different domain (e.g., .com versus .net).
  • If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Contact the company using information provided on an account statement, not information provided in an email. Information about known phishing attacks is available online from groups such as the Anti-Phishing Working Group. Report phishing to the Anti-Phishing Working Group (APWG)
  • Keep a clean machine. Having the latest operating system, software, web browsers, anti-virus protection and apps are the best defenses against viruses, malware, and other online threats.

What to do if you think you are a victim?

  • Report it to the appropriate people within the organization, including network administrators. They can be alert for any suspicious or unusual activity.
  • If you believe your financial accounts may be compromised, contact your financial institution immediately and close the account(s).
  • Watch for any unauthorized charges to your account.

Some tips:

  • When in doubt, throw it out: Links in email, tweets, posts, and online advertising are often the way cybercriminals compromise your computer. If it looks suspicious, even if you know the source, it’s best to delete or, if appropriate, mark it as junk email.
  • Think before you act: Be wary of communications that implores you to act immediately, offers something that sounds too good to be true, or asks for personal information.
  • Secure your accounts: Ask for protection beyond passwords. Many account providers now offer additional ways for you verify who you are before you conduct business on that site.
  • Make passwords long and strong: Combine capital and lowercase letters with numbers and symbols to create a more secure password.
  • Unique account, unique password: Separate passwords for every account helps to thwart cybercriminals

Examples of Phishing Scams:

2003 saw the proliferation of a phishing scam in which users received emails supposedly from eBay claiming that the user’s account was about to be suspended unless he clicked on the provided email link and updated the credit card information that the genuine eBay already had. Because it is relatively simple to make a website look like a legitimate organization’s site by mimicking the HTML code, the scam counted on people being tricked into thinking they were actually being contacted by eBay and were subsequently going to eBay’s site to update their account information.

References:

  1. http://us.norton.com/security_response/phishing.jsp
  2. http://en.wikipedia.org/wiki/Phishing
  3. http://www.staysafeonline.org/stay-safe-online/keep-a-clean-machine/spam-and-phishing
  4. http://www.webopedia.com/TERM/P/phishing.html
  5. http://www.microsoft.com/security/online-privacy/phishing-symptoms.aspx
  6. https://www.onguardonline.gov/phishing

 

 

How to know if an online transaction is secure?

The Internet has made banking, shopping, and conducting other on-line financial transactions quite convenient. But when it comes to our money, we definitely want to make sure our transactions are safe.

In this post, I will show you the steps you need to take to make on-line shopping a safe and enjoyable experience. Before sending any sensitive or financial information on-line, you want to know that you are communicating with a secure site. Secure sites make sure all information you send is encrypted, or protected, as it travels across the Internet. The HTTPS address heading and your browser’s security symbol are two signs indicating you are on a secure site.

Security Symbol

Web addresses either begin with HTTP or HTTPS. If the address is HTTPS, the information you send to it is encrypted and will look like gibberish if intercepted by cybercriminals. Your browser will use a security symbol or a lock to indicate that the browser verifies the website is a secure site.

IS_financial_chrome_edit

IS_financial_firefox_edit

IS_financial_IE9_2_edit

SSL Certificate

Secure sites have an SSL certificate. It does two things. First, it acts like a driver’s license. It means, “I am who I say I am”. Second, it enables encryption. This is what you should look for on an SSL Certificate:

certificate_markup2

1.Check that the website you are doing transactions with matches the website on the certificate.

2.Check that the certificate authority that issued the SSL Certificate is trustworthy.

3.Check if the certificate is not expired.

References:

1. http://windows.microsoft.com/en-us/windows/know-online-transaction-secure#1TC=windows-7

2.http://www.gcflearnfree.org/internetsafety/6/print