Month: June 2018

Take Care of the Basics

updated: September 25, 2026

Let's cover some fundamentals of cybersecurity. By understanding a few concepts and taking a few simple steps, you can make your system much more secure.

Here, the 80/20 rule applies in a big way. By expending 20% of the total effort to make your system ultra-secure, you can greatly improve your security. That's to say it only takes a little time and effort to make huge strides in security!

The rank and file PC/tablet/phone user isn't protecting national security, so these first simple steps go a long way towards making you the kind of target a hacker will pass up to move on to easier systems.

First you should understand one fundamental principle that applies to all cybersecurity efforts.

The Cybersecurity Triangle

There is a long-standing precept in cybersecurity illustrated by this image. The triangle represents a continuum with three points: security, functionality, and convenience (or ease of use). The red ball represents where the focus of the system's design falls.

So the system developer strives to meet the requirements they're given which focus on aspects of these three vertices. If the developer is directed to choose:

1. Highly Secure: the system will be less convenient and contain only essential functions. More functionality provides more attack surface, i.e., places where hackers can find a foothold. Security measures require more effort, e.g., longer, more complex passwords and multifactor authentication.
2. Very Easy to Use: the system will work with fewer security constraints and contain only essential functions.
3. Highly Capable: the system will be larger, having more options and functions, but won't be as easy to use or be as secure.

Why is this concept important?

The crux of the matter is that the emphasis during system development will determine how secure, capable, and easy it is to use. If you make changes to improve your security, you can expect you'll have to make your system less convenient (more cumbersome), and perhaps less capable.

Most Common Exposures

So what are the ways we commonly expose ourselves to hackers?

Phishing (pronounced fishing)

Estimates vary, but somewhere around 90% of successful cyber attacks on personal or corporate systems are by phishing.

What is phishing? It's including a deceptive component in email that entices the user to activate it. Most often, it's a link that downloads malware if clicked, or an attachment containing malware that launches if the user opens it. Once the user activates the component, the malware executes, completing the infection and giving the hacker access to your system.

The perpetrator will do everything he can to make the infection invisible to you. Often, the infecting page won't display anything, but will quickly redirect you to a legitimate page. If you're watching closely, you might see a brief flash of the infecting page before the legitimate page is loaded.

Solution: Don't trust email, even if it seems to be from someone you know.

1. Even opening email can lead to trouble. Email consists of a text message encapsulated in code—code which executes when the message is opened and can compromise your system. Anti-malware systems are constantly improving their ability to identify malware in unopened email, but you can't rely on this to protect you. The best answer is to examine the encoding contained in the message first, or configure your system to present all email as text only.
2. Don't fall for frightening schemes. The hacker's secret weapon is your own fear. Often phishing emails will tell you to take immediate action to avoid dire consequences. For example, Your account is closed due to a billing problem with your payment on file. Or, (this is one I see a lot) This is Microsoft. We've identified an infection on your system and have locked it. Call this 800 number so we can fix it. Calling the 800 number will put you in touch with hackers who will do what they can to access your system remotely (to deposit malware) and/or get your credit card info, which they'll then use to rack up charges.

The best protection against phishing is prevention. Avoid malware downloads that come as attachments or are downloaded if you click a link.

How do you avoid the bad links? The simplest way is to never click links included in emails at all. Of course, this is hardly a workable solution. We rely on email links to get things done--to see a friend's Facebook post, correct account details, make payments, etc.

So what can you do to avoid trouble?

Secure Your Passwords

You've heard it before. There's a reason it's important. Passwords are often cracked by use of brute force algorithm. A program is run which repeatedly tries common password variations and word combinations to break into a system.

Generally, the classic guidelines for passwords still apply. They are more secure if they:

Test your password creativity by using a website like How Secure Is My Password. Enter a password like the ones you like to use, and it will tell you how long it would take to crack using a brute force attack. (Note: don't enter actual passwords you use, only passwords similar to the ones you like to use.)

Because passwords should be changed regularly and should be unique for each login, employing these guidelines can still be daunting unless you use a password database like Keepass.

For more information about things you can do to protect yourself online, check out this list of top 10 things you can do to harden your systems!