Top 10: To-Do's to Harden Against Internet Intruders

First, Some Observations

Click wherever and whenever you want - after verifying the link.

1. Think before you click!
2. Never click on an email link to go to your bank or other locations that use personal information. Instead, go to the site by using your password database application or manually enter the address in your browser.
3. Hyperlinks often don't show the actual domain your browser will open, only what the sender wants you to see. Use hover to see where you'll be taken.
4. Use a review source client to see where hyperlinks will go - learn how to scan through/ignore the imbedded code.

5. Use WOT or other similar products to see the safety rating of sites before you visit them.
   1. Hover over links before clicking on them to see the domain name you'd be going to.
   2. Allow WOT to provide feedback
   3. Use website scanning sites like Web Inspector to quickly scan a website.

Treat applications like tomato varieties.

1. Investigate an application's reputation before downloading.
2. Remove all unnecessary programs, including apps and extensions.
3. Keep all apps and programs updated - preferably automatically.
4. Routine backups are essential to survival in the event of ransomware!!!
   1. Keep your backups current and offline.
   2. Test your backups through trial restore cycles.
5. Obtain, maintain, and schedule daily runs of good anti-malware.
   1. Look at the options. Microsoft comes with their own flavor, there are lots of free and paid alternatives. Be sure if you install and activate another one to turn off and deactivate Microsoft.
   2. Assure it automatically runs daily - at LEAST every other day.
      1. Physically unplug the network cable or turn off Wi-Fi for best protection, otherwise use the control panel settings to disable the network interface.
      2. It's not uncommon to leave your computer running overnight to run a scheduled backup and/or anti-mailware scan. If you do, before leaving it for the night, refresh the antivirus definitions, then disable the network interface (if you're not backing up to network location).

Your Passwords are locks on your valuables. Don't leave your diamonds in a shoebox.
(More secure usually means less convenient - get used to it.)

1. ALWAYS change default/preset passwords immediately
2. Longer passwords are safer. 12 characters is good, 16 better, 20 strong.
3. Mix upper/lowercase, numbers, special characters.
4. Don't rely solely on common cheats - they're easily predictable - 1 (one) for the letter L, 0 (zero) for the letter O, etc. These do help protect against shoulder surfers (if someone sees your password on your screen), but cracking programs that guess by brute force know to try these alternatives.
5. NEVER use password iforgot or other simple common-word combinations.
6. Use an online password complexity checker to teach yourself how to generate strong passwords manually (BUT NEVER ENTER PASSWORDS YOU INTEND TO ACTUALLY USE INTO SITES LIKE THIS - only similarly structured ones).
7. Use a password management program like Keepass.

There are bargains online - if that CD doesn't end up costing $3000!

1. Use credit cards instead of debit cards
2. Don't wait until you're ready to submit:
   Javascript can forward your information before you click submit!
   1. Always assure you're on the right site by checking the domain or watching closely for notices indicating you'll be redirected.
   2. Always check for a secure connection (logging in as well as when you enter your cc information).
3. Consider a service like Blur that will issue one-time credit card numbers for your purchases.

Speak LAN?

LAN = Local Area Network

1. Keep your home/office LAN safe.
   1. Don't think you have a LAN? Think again! All computers attached to the Internet (other than devices using the cellular network, e.g., cellphones) get their connection through Wi-Fi, which is provieded by a local router. Other devices in that same location use the same router for Wi-Fi and are on a common network, a.k.a., the LAN.
   2. Change your default router and Wi-Fi passwords - hackers can often find the default password on the dark web and log in.
   3. See recommendations for strong passwords
2. Avoid Free Wi-Fi or use VPN
   1. Set your phone and laptop when out and about to disable Wi-Fi until you need it.
   2. Set your default network settings to NOT attach to known networks automatically.
   3. Verify the name of the Wi-Fi hotspot with the enterprise before attaching (hackers often provide a hotspot, route your traffic, but in the process see what you send)
   4. Be aware that while some companies like AT&T provide automated connection to their free Wi-Fi in partnered locations (e.g., McDonalds), it is NOT a secured or firewalled access.
3. Use a DNS server that examines and blocks malicious sites and offers additional control.
   1. Cloudflare & OpenDNS are examples.
   2. Some, like OpenDNS, provide the means to filter what content gets served to the browser. For instance, you can prevent access to religious or pornographic content.

Don't become the little dutch boy.

1. Microsoft isn't the only one providing Windows firewalls, e.g., Comodo.
2. For mobile phones, you have firewall options, too. For example, load a firewall such as Lostnet Noroot Firewall or CIA Firewall on your Android.

TMI!!!

1. Your friends already have your birthday. Putting it online just gives it to hackers.
2. Turn off GPS-associated postings, such as where you are at any given time, or where pictures are taken.
3. No one needs to know where you graduated from high school or college. If you think they should, limit your audience to friends.
4. Never use this kind of information to answer security questions. Instead, use a unique password-like string (upper, lower, numbers, special characters) for each site which you store in your password database. That way, when the hacker breaches the site and downloads your credential data, they won't have your personal data like your mother's maiden name.

Suspect the baker!

Apps, extension, and plugins you might download are prime targets for hackers. Sometimes hackers are able to hijack a perfectly good program and bake in their own code to compromise your system, so assure your anti-malware checks all downloads.

Join the party.

Signing up for membership or a login for a new site can be risky, since some site owners will sell your email address to spammers. You could just make up some email address, but most of the time, the site will send an email to the address you provide to verify your entry and complete your registration.

So What do you do? When required by a site to provide an email address that must be validated, use a catch-all email or a service like Blur.

Catch-all email can be set up on your website server if you have your own domain. For instance, if you own bobsauto.com, you have the ability to specify a default email that will receive all email addressed to unknown addresses at bobsauto.com. So even if you haven't set up info@bobsauto.com, email sent to that address would be routed to the default inbox.

A major advantage of this approach is that it provides a simple verification function as to the legitimacy of email you receive. If you sign up as a user on the Frontier airline website, you can use a fabricated address like frontier@bobsauto.com as your email address. Then, when Frontier sends you email, you can see the To email address is correctly frontier@bobsauto.com, whereas if a hacker were to send you an invasive email supposedly from Frontier, they would use an email address they bought from someone or downloaded from the dark web.

Another advantage is that if that fabricated email gets sold and begins to flood your inbox with spam, you can filter out all email received using that address.

The downside of this approach is that it makes spammers' job easier. Any email they send will be accepted by your server and presented to you.

Blur provides you with random email addresses that receive email and forward it to you. You can then use the random email for signup and still receive it in your inbox. Plug in that email address for your registration. Then the Blur service will receive the email sent from the site and forward it to your inbox. If you start getting spammed, you can simply go to the Blur website and turn off email forwarding for that email address.

One downside of Blur is that it requires you to log onto Blur and request the fabricated email address—an extra step which takes time.

Another downside of a service like Blur is that it puts the service between you and your sender. This forwarding service is going to take some amount of time to receive the email, look up your actual email address, and send it to you. If the service goes down, you won't receive that email until the service is up again.

Why are states being forced to adopt no texting while driving laws? (Shameless plug/PSA)

Because people will do the wrong thing and feel they're right to do so. Don't make the mistake of smugly ignoring these safe practices!

Appendix

---