How Systematic Lying Can Improve Your Security

How Systematic Lying Can Improve Your SecurityNo, you don’t have to tell websites your mother’s actual maiden name. After any major breach, the entire security community clamors to weigh in. The headlines are filled with advice and suggestions as vendors advocate for their solutions and consultants push training. The response of breached companies is almost always the same: they offer free credit monitoring. I have plenty of thoughts on why that is ineffective, but the short version is that this approach is like putting up a sign saying that a bridge is out… behind you.
Predictably, the usual advice is offered about strengthening passwords, utilizing two-factor authentication, and the like. But what you really need to do to protect yourself from the effects of a breach depends on what information was revealed. Whether password lists, account names, credit card information, personal identifiers, financial information, or personal information, each of these can lead to different kinds of attacks that require different defenses. In light of this, I suggest a change that anyone can make, which is particularly relevant to the Equifax breach but is also generally effective. So, in addition to the methods listed above, I suggest taking advantage of one of the most effective and durable tactics: lying.
我们很重视商业机密数据的保护,因为这些机密数据和我们的成功密切相关,如果它们被竞争者窃取或者被非法曝光,我们的业务将受到严重的损失,所以在不断地挖掘客户需求和开发新产品的同时,我们注意保护这些机密数据的安全。
信息安全意识考试测试系统
There are three kinds of attacks enabled by the Equifax breach. First, the financial and personal information can be used to open fraudulent lines of credit. The best defense for this is a credit freeze at all three credit reporting bureaus. Second, the financial information can help attackers target high-value individuals for other kinds of scams or attacks. For targeting, a combination of anonymity and paranoia are your best bet. Finally, the information exposed reveals details about the victims that are often used in security questions. This brings me to my point about lying — to avoid losing personal information via security questions, lie about the answers.
The fundamental problem with the security questions on websites is that they are asking for discoverable biographical questions. They might ask the name of the street where you grew up. Using the Equifax data, attackers can probably connect you to your parents. They will know the addresses where both you and they lived, and what your age was at the time, so they know all the likely answers. We also reveal many other answers directly through our social media posts, pet names, relatives, etc.
If you lie in your answers to these questions, your answer becomes much harder to guess. Saying I grew up on 3rd Street instead of 5th is a good start, but it is still a common street name. Saying my favorite color is “Saint Bernard” is much better. These answers are just free-form text fields — you can put in anything at all, including a pure random string.
Of course, the answers to these questions can be exposed as well. As with passwords, it is important not to reuse the same answers over multiple websites. On one website, my mother’s maiden name could be “Blue Dyspeptic Wallaby,” while on another it might be “Invisible Orange Planets Laugh Silently.”
Now, if you think it is unreasonable to be asked to keep track of unique passwords for each account, you may be reaching for torches and pitchforks about now. The solution here is to use a password vault. There are many available with strong security and the ability to sync between all of your devices. My two favorites are 1Password and Dashlane. And no, I don’t own stock in, or work at, either of them.
The trick is to take advantage of the notes field available in these applications. When you save a username/password, you can also put the security questions and answers in the notes field to make sure you keep track of all the different lies you have told. If you are asked for new answers to additional questions, simply add those to the note. With the vault syncing, you will have all the answers at your fingertips whenever you need them.
Like adopting strong unique passwords, this can seem like a monumental undertaking. After all, how many different accounts do you have? A quick glance at my vault suggests that I have about 1,000 of them. Don’t worry — you don’t need to change them all at once. A good practice is to start with just your most critical accounts: financial institutions and your password recovery email account.
Once you have those accounts protected, just make a point of using unique strong fake answers for each new account you create, and updating existing ones when you’re prompted to change your password. From time to time, take a few minutes more to change some of your other important or frequently used accounts. After a short while, your security will be substantially improved. All through the ancient technique of lying.
Related Content:
7 Takeaways From The Equifax Data Breach
Why Your Business Must Care about Privacy
How Apple’s New Facial Recognition Technology Will Change Enterprise Security
GoT & the Inside Threat: Compromised Insiders Make Powerful Adversaries
Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.
需要对培训的结果进行考核或者验证,逐步开展,坚持不懈,才能取得阶段性的成果。现在很多组织试图通过几次培训就达到安全意识的普遍提高,这是不切实际的。好入手的未必就有好效果,好效果的却不容易入手,这是现实的矛盾。

猜您喜欢

环境、职业健康安全管理体系在线学习课程
如何改变员工的信息安全行为
Cyber Security Law 网络安全法宣传视频《网络安全法》背景知识
这100个关键词 十九大前一定要知道
EPIDM MYPARENTSOPENCARRY
自带计算设备BYOD带来的安全问题探讨