We’ve just talked about behavioral security controls, 2
now we’re going to move onto 3
technical security controls, 4
and again, many of the social threats we face 5
can be mitigated by 6
the same type of technical security controls. 7
And again, the threats we’re referring to here 8
that we can mitigate are things like 9
identity theft, social engineering, like phishing, vishing, 10
smishing, scams, cons, doxing, spam, those sorts of threats. 11
In order to mitigate these sorts of threats, 12
consider using these sorts of 13
technical security controls. 14
The first is use an email provider 15
with security controls to mitigate these attacks. 16
When you’re selecting an email provider, 17
consider how well they protect you 18
from spam, phishing, malware, and those sorts of things. 19
Almost all email providers scan the email content 20
for these types of attacks. 21
This is a privacy concern, but is also a security control. 22
Sometimes security and privacy aren't compatible, 23
and you have to choose how to deal with that. 24
What is more important for you? Privacy or security? 25
You have to make the risk based decision. 26
But you can chooseto have 27
separate accounts for separate purposes. 28
So for example, for a more private conversation, 29
you could have a dedicated email 30
where you use GPG 31
which will give you the privacy that you need, 32
which we discuss later in full detail, 33
and for general emails, where you have 34
less of a need for privacy, 35
you could go for a provider 36
that offers security by scanning the email contents. 37
The big email providers are good with spam, 38
phishing and malware protection, as they have 39
lots of resources to throw at the problem, 40
Apple, Google, Microsoft, Yahoo, etc. 41
They are good for protecting you 42
from phishing and malware, 43
but they are not good privacy. 44
So you need to choose your provider 45
by weighing up these options 46
between privacy and security. 47
For security, you want a provider that 48
provides some filtering against these social attacks, 49
and we cover selecting an email provider 50
in more detail in the section on email security. 51
Another control to protect you 52
against these social threats 53
is to use a credit monitoring service 54
that notifies you of credit searches 55
and applications that will help you 56
particularly against identity theft. 57
In the US and other locations, 58
you can freeze credit checks. 59
This stops anyone from being able 60
to take out loans or credit cards in your name. 61
This is useful if you know you don't need 62
any loans or credit, 63
so you can freeze your credit. 64
You want to monitor the accounts you care about 65
where they provide this 66
monitoring and alerting functionality. 67
Enable the security notifications on your accounts 68
where they are available. 69
For example, when someone logs into your account, 70
and where, and on what device, 71
when money transfers are made, 72
when passwords are changed and so on. 73
You want alerts for those sorts of things. 74
As an example, 75
Gmail provides information like that on your devices that you log in, 76
many banks will send you notifications 77
when there are money transfers, 78
or where your account reaches a certain level. 79
You should enable those. 80
Now the rest of the technical security controls, 81
we’re going to discuss 82
throughout the course in detail. 83
You will learn more about them in their own sections. 84
But a quick summary here 85
of what will protect you against these social attacks. 86
So first is changing the email viewer 87
to be text instead of html. 88
Using the built-in Google Safe Browsing 89
used in Mozilla Firefox, Apple Safari, and Google Chrome. 90
Ublock origin for filtering, 91
using isolation and compartmentalization, 92
using a virtual machine 93
to open attachments and click links. 94
Using application and execution control, 95
sandboxes, opening attachments online 96
using tools like Google Docs and Etherpad, 97
using Live operating systems 98
to open attachments and click links. 99
Using OpenPGP signatures 100
to validate the sender is genuine, 101
and if you frequently send and receive files via email, 102
changing that to hosting these files 103
and sending links to these files instead of attachments. 104
And you can use services like SpiderOak, 105
Owncloud or Seafile, 106
enabling antivirus and endpoint protection. 107
But all of those things, 108
we go through on the course, 109
but they particularly do protect you 110
against these social attacks. 111
For useful information on protecting you 112
against phishing, vishing, smishing, 113
spam, scams and cons, 114
then have a look at this website here, 115
this is quite good, ActionFraud. 116
And also Scambusters.org is quite good as well.