Cybersecurity for your personal computer

Basics of Cybersecurity at the Alliance

• Basic Computer Hygiene
• Password Hygiene Habits
• Safe Browsing and MFA
• Linux Permissions

Basic Computer Hygiene

Don’t know how to keep your computer secure at home? Want to review the security level of your computer?
In this section, we have a few tips for you to enhance your computer’s security, and a short quiz for a health check on your computer.

Security Updates

Enable “Install Update Automatically” to allow timely installation of security updates on your operating system and software.

For more information, please visit Software updates: Why they matter for cybersecurity.

Passwords

Strong passwords are essential to keep your computer and your accounts secured. Refer to Password Hygiene Habits for more tips.

Antivirus

To prevent your computer from malware infection, install an antivirus software on your computer and keep it updated.

Phishing

Pay attention to the hyperlinks attached in emails or search engine results before you click on them, a hyperlink containing a weird domain name is a strong signal of malicious activities.
For more information, please visit Signs of a phishing campaign: How to keep yourself safe.

Wi-Fi security

To protect the Wi-Fi network at your home, set a strong Wi-Fi password and update your router’s firmware regularly.

Avoid using public Wi-Fi as much as possible. If you need to use it , consider installing a trustworthy VPN solution and enable it when you connect to a public Wi-Fi spot.

For more information, please visit Private networks and Public Wi-Fi.

Important notes

The advice above is mainly for individuals to refresh their cybersecurity awareness and improve cyber defense on their personal computers.
Computers at the workplace are typically managed and protected by the organization’s IT services team, different sets of security measures may be applied. You should follow your organization’s policy to protect computers at the workplace.

Check out our Self-assessment of your cybersecurity practices!

Password Hygiene Habits

Despite many solutions that protect information and systems, stolen usernames and passwords (credentials) are still the most common way attackers gain unauthorized access. While this might be through social engineering or phishing, it is frequently the result of weak, guessable passwords and re-used credentials that have been exposed.

Which is most important for keeping your password secure?

1. Change it frequently
2. Use a mix of cases and characters
3. Make it long and unique

The correct answer is that long and especially unique passwords are the most secure. Password complexity can help, but length is much more important than the characters used. Despite this, many systems still enforce outdated complexity rules, but password length is what’s critical. The most important is that a different password is used for every different service. Why? because breaches happen, eventually some service will mishandle your credentials and they will get exposed. Just have a look at https://haveibeenpwned.com/ - for most people, it's already happened. IF you password isn't unique, and is exposed, it can be used to access any system where that same credential is used. This process (called password stuffing) is usually automated and can happen as quickly as 12 hours after the initial exposure.

Changing passwords frequently, without cause, can actually degrade security. When forced to change their password frequently, many people choose an easy to remember password based on predictable patterns.

So how can you best protect yourself?

• Use a password manager
  • Regardless if you choose one that is standalone or integrated into your web browser, open source or a commercial product/service. A password manager is essential when it comes to all the other steps below.
• Use a different password for everything - every service, every system;
  • This is quite easy, if you’re using a password manager.
• Make it long - 15 characters or longer is a good size;
  • Again, easy with a password manager when you allow it to generate the passwords for you. 20-32 characters is easy since you don’t need to remember them anyway.
• Never share it with anyone; really, no one, ever;
  • Your credentials belong to you, they identify you, sharing them not only compromises your identity but is also usually a violation of the policies of the service or system they are used to access.
• Change only if there is a reason.
  • If you believe the password may have been compromised, may be reused, or is weak, you should change it. There is no good reason to change passwords based on a time schedule.

If this is not your current situation: Don’t Panic! just start making changes today. Every little bit helps. If you have hundreds of passwords you need to change, start with a few of them, do a couple every day at lunch. Every time you make even one set of credentials more secure you’re doing yourself a big favour.

Safe Browsing and MFA

We rely on a variety of online resources and accounts to help us in our work and to tackle tasks effectively. How we access these tools and how we behave online can have a significant impact on our personal security and the security of the resources we share as members of the Alliance.

Taking control of the information we share with online service providers, limiting the extent to which commercial entities can track our activity, and thinking about how we authenticate to online accounts can all have a security benefit.

We can start where we are and start today. We can choose to share less personal information voluntarily when responding to requests, signing up for services, posting on social media, and make the task of connecting the dots about who we are and what we do on and off line more challenging for attackers.

We can choose to use privacy-enhancing search tools like DuckDuckGo (duckduckgo.com), install browser extensions like Privacy Badger (privacybadger.org), HTTPS Everywhere (eff.org/https-everywhere), uBlock Origin (ublockorigin.com). We can limit the use of cookies via browser settings, and turn on features that sandbox the links and tracking tools of social media companies (mozilla.org/en-US/firefox/facebookcontainer).

When authenticating to online accounts, we can use different identities/usernames/emails for different services; separate work and personal accounts; practice good password hygiene (see our password tips above); and enroll in the MFA schemes provided by online service providers.

Doing even some of these things will make it more challenging for attackers to target us and our colleagues in phishing attacks, to engage in credential stuffing or password guessing.

Linux Permissions

Audience: the content below is intended for a technical audience such as users of our supercomputers.

Linux permissions are one layer of protection to safeguard your research. Here are three common mistakes to avoid:

Mistake 1: Granting access to a file to the world via the command ‘’chmod 777 name_of_file’’.

Make sure you understand how Linux permissions work, and restrict access to your files in our supercomputers to only those who need access to them.

Mistake 2: Not using sticky bit, leading to the deletion of your files by someone else.

When dealing with a shared directory where multiple users have read, write and execute permission, the issue of ensuring that an individual cannot delete the files or directories of another can arise. Make sure you are familiar with the notion of sticky bit and use it when appropriate.

Mistake 3: Granting access to multiple individuals rather than groups.

Managing ACLs (Access Control Lists) can quickly become complex. It is best practice to use groups rather than multiple individual accounts to grant permissions when possible.