Cybersecurity for your personal computer

Context

Cyber criminals spend their days trying to deceive us into giving up our information, tamper with our devices and even steal our identities. When cyberattacks like phishing are successful, they can ruin our days, to put it lightly. That’s why, this Cybersecurity Awareness Month, we’re encouraging Members of the Alliance and the Federation to ruin a cybercriminal’s day!

For October Cybersecurity Awareness Month, the National Security Council’s Cybersecurity Training and Awareness Team is sharing resources and planning a series of workshops to help Members of the Alliance and the Federation improve their security knowledge and awareness.

Our Four Topics

We have selected four topics this year:

• Basic Computer Hygiene
• Password Hygiene Habits
• Safe Browsing and MFA
• Linux Permissions

Basic Computer Hygiene

Don’t know how to keep your computer secure at home? Want to review the security level of your computer?
In this section, we have a few tips for you to enhance your computer’s security, and a short quiz for a health check on your computer.

Security Updates

Enable “Install Update Automatically” to allow timely installation of security updates on your operating system and software.

For more information, please visit Software updates: Why they matter for cybersecurity.

Passwords

Strong passwords are essential to keep your computer and your accounts secured. Refer to Password Hygiene Habits for more tips.

Antivirus

To prevent your computer from malware infection, install an antivirus software on your computer and keep it updated.

Phishing

Pay attention to the hyperlinks attached in emails or search engine results before you click on them, a hyperlink containing a weird domain name is a strong signal of malicious activities.
For more information, please visit Signs of a phishing campaign: How to keep yourself safe.

Wi-Fi security

To protect the Wi-Fi network at your home, set a strong Wi-Fi password and update your router’s firmware regularly.

Avoid using public Wi-Fi as much as possible. If you need to use it , consider installing a trustworthy VPN solution and enable it when you connect to a public Wi-Fi spot.

For more information, please visit Private networks and Public Wi-Fi.

Important notes

The advice above is mainly for individuals to refresh their cybersecurity awareness and improve cyber defense on their personal computers.
Computers at the workplace are typically managed and protected by the organization’s IT services team, different sets of security measures may be applied. You should follow your organization’s policy to protect computers at the workplace.

Health Check

The following questions are designed to assess the cybersecurity posture of your computer. Let’s answer the questions to check whether your computer is secured.

1. What is the software update setting on your personal computer?

a. My personal computer is out of support, there is no software update.

b. I check and install software updates and security patches manually.

c. Notify me about software updates but don't automatically install them.

d. Software updates of the Operating System are automatically downloaded and installed.

e. In addition to the software updates of the Operating System, other software applications are also set to install updates automatically.

If your answer is:

a. Out of support software does not have security updates, leaving your computer with a number of severe security weaknesses. You should consider upgrading your computer to a supported version.

b. There is a high chance that you may miss checking and installing software updates on your computer. You should consider installing software updates automatically.

c. Installing software updates manually may leave security weaknesses on your computer for a significant timeframe. You should consider installing software updates automatically.

d. Well done! You have done a great job in updating your operating system, now it’s time to check the software update setting for other software applications.

e. Awesome! You have done a great job in updating your computer, keep your good work!

2. How do you manage your passwords for accessing Internet services, such as emails, Internet banking, online shopping, etc.?

a. I use the same password on multiple Internet services and never change it.

b. I follow a pattern (e.g. Tech0001, Tech0002, Tech0003) to create passwords and use them on multiple Internet services.

c. I create unique passwords for accessing Internet services and record them in a text file, sticky notes, etc.

d. I create unique passphrases for accessing Internet services.

e. I use a reputable password manager to create, store and change my passwords regularly.

If your answer is:

a. Having the same password on multiple Internet services means that a single compromised password will affect all of the services. You should set unique passwords on Internet services.

b. Using a pattern to create passwords is not a secure way as attackers can guess other passwords from a single compromised password.

c. It’s generally not a good idea to record passwords in a text file or sticky notes as others may be able to read your passwords. If you really need to drop something down for memorizing your passwords, try writing password hints that only make sense to yourself.

d. Good job! Passphrases have a good length and make it difficult to break.

e. Well done! Password managers create random and complex passwords which are strong enough to withstand password breaking.

3. Is there any Antivirus software installed on your personal computer?

a. No, there is no Antivirus software installed on my personal computer

b. Yes, an Antivirus software is installed on my personal computer but I am not sure whether it’s trustworthy.

c. Yes, a reputable Antivirus software is installed on my personal computer.

d. Yes, a reputable Antivirus software is installed on my personal computer and it’s configured to update automatically.

If your answer is:

a. You should check the availability of Antivirus software for your operating system and consider installing one if it is available. The most popular operating system needs an Antivirus software to keep it safe from malware attacks.

b. Installing a questionable Antivirus software is as bad as no Antivirus installed. Some Antivirus are not effective in catching malwares, and some others are developed by hackers and act as a malware. You should uninstall the questionable Antivirus software and install a reputable one.

c. It’s nice to have a reputable Antivirus software installed. The next step is to set it to update automatically.

d. Excellent! The Antivirus software will significantly reduce the risk of malware infection on your computer.

4. How do you configure the Wi-Fi router at your home?

a. I haven’t changed the default password on my home’s Wi-Fi router.

b. The default password has been modified on my home’s Wi-Fi router.

c. The default password has been modified, and firmware updates are installed on my home’s Wi-Fi router regularly.

If your answer is:

a. Using default password on Wi-Fi router may leave your home network wide open to attackers. You should change the default password at your earliest.

b. Good work! Changing the default password is the first step to protect your home network. Now you can check and update the router’s firmware to the latest version to make it more secure.

c. Excellent! You have done a great job in protecting your home network.

5. How do you connect your computer to Public Wi-Fi spots?

a. I connect my personal computer to Public Wi-Fi spots whenever it’s available.

b. I would not connect my personal computer to Public Wi-Fi spots without using a trustworthy VPN connection.

c. I do not connect my personal computer to Public Wi-Fi spots.

If your answer is:

a. Public Wi-Fi spots are open to everyone, including attackers. As a result, the network traffic via Public Wi-Fi spots is subject to eavesdropping attacks. You should consider using a trustworthy VPN solution to protect your network connection while using Public Wi-Fi spots.

b. Awesome! Your network traffic is well protected by the VPN solution. You may refer to Public Wi-Fi for other tips on using Public Wi-Fi spots.

c. Nice! It’s a good practice to avoid connecting Wi-Fi spots that may not be secure.

Password Hygiene Habits

Despite many solutions that protect information and systems, stolen usernames and passwords (credentials) are still the most common way attackers gain unauthorized access. While this might be through social engineering or phishing, it is frequently the result of weak, guessable passwords and re-used credentials that have been exposed.

Which is most important for keeping your password secure?

1. Change it frequently
2. Use a mix of cases and characters
3. Make it long and unique

The correct answer is that long and especially unique passwords are the most secure. Password complexity can help, but length is much more important than the characters used. Despite this, many systems still enforce outdated complexity rules, but password length is what’s critical. The most important is that a different password is used for every different service. Why? because breaches happen, eventually some service will mishandle your credentials and they will get exposed. Just have a look at https://haveibeenpwned.com/ - for most people, it's already happened. IF you password isn't unique, and is exposed, it can be used to access any system where that same credential is used. This process (called password stuffing) is usually automated and can happen as quickly as 12 hours after the initial exposure.

Changing passwords frequently, without cause, can actually degrade security. When forced to change their password frequently, many people choose an easy to remember password based on predictable patterns.

So how can you best protect yourself?

• Use a password manager
  • Regardless if you choose one that is standalone or integrated into your web browser, open source or a commercial product/service. A password manager is essential when it comes to all the other steps below.
• Use a different password for everything - every service, every system;
  • This is quite easy, if you’re using a password manager.
• Make it long - 15 characters or longer is a good size;
  • Again, easy with a password manager when you allow it to generate the passwords for you. 20-32 characters is easy since you don’t need to remember them anyway.
• Never share it with anyone; really, no one, ever;
  • Your credentials belong to you, they identify you, sharing them not only compromises your identity but is also usually a violation of the policies of the service or system they are used to access.
• Change only if there is a reason.
  • If you believe the password may have been compromised, may be reused, or is weak, you should change it. There is no good reason to change passwords based on a time schedule.

If this is not your current situation: Don’t Panic! just start making changes today. Every little bit helps. If you have hundreds of passwords you need to change, start with a few of them, do a couple every day at lunch. Every time you make even one set of credentials more secure you’re doing yourself a big favour.

Safe Browsing and MFA

We rely on a variety of online resources and accounts to help us in our work and to tackle tasks effectively. How we access these tools and how we behave online can have a significant impact on our personal security and the security of the resources we share as members of the Alliance Federation.

Taking control of the information we share with online service providers, limiting the extent to which commercial entities can track our activity, and thinking about how we authenticate to online accounts can all have a security benefit.

We can start where we are and start today. We can choose to share less personal information voluntarily when responding to requests, signing up for services, posting on social media, and make the task of connecting the dots about who we are and what we do on and off line more challenging for attackers.

We can choose to use privacy-enhancing search tools like DuckDuckGo (duckduckgo.com), install browser extensions like Privacy Badger (privacybadger.org), HTTPS Everywhere (eff.org/https-everywhere), uBlock Origin (ublockorigin.com). We can limit the use of cookies via browser settings, and turn on features that sandbox the links and tracking tools of social media companies (mozilla.org/en-US/firefox/facebookcontainer).

When authenticating to online accounts, we can use different identities/usernames/emails for different services; separate work and personal accounts; practice good password hygiene (see our password tips above); and enroll in the MFA schemes provided by online service providers (join the MFA presentation with Ryan and Pier-luc).

Doing even some of these things will make it more challenging for attackers to target us and our colleagues in phishing attacks, to engage in credential stuffing or password guessing.

Join our workshop on October, XXX where we will provide an overview of MFA project!

Session in English:
Session in French:

Linux Permissions

Audience: the content below is intended for a technical audience such as users of our supercomputers.

Linux permissions are one layer of protection to safeguard your research. Here are three common mistakes to avoid:

Mistake 1: Granting access to a file to the world via the command ‘’chmod 777 name_of_file’’.

Make sure you understand how Linux permissions work, and restrict access to your files in our supercomputers to only those who need access to them.

Mistake 2: Not using sticky bit, leading to the deletion of your files by someone else.

When dealing with a shared directory where multiple users have read, write and execute permission, the issue of ensuring that an individual cannot delete the files or directories of another can arise. Make sure you are familiar with the notion of sticky bit and use it when appropriate.

Mistake 3: Granting access to multiple individuals rather than groups.

Managing ACLs (Access Control Lists) can quickly become complex. It is best practice to use groups rather than multiple individual accounts to grant permissions when possible.

Interested in learning more on this topic? Join our workshop on October, 27 from 12 p.m. - 2 p.m. ET where we will take a deeper dive into Linux permissions!

Session in English:
Session in French: