The more research I've done on security, the more worried I've become about our ability to keep up with the bad guys
What are your risks in this era of surveillance, hacking and sloppy software coding? It depends. So what precautions should you be taking? Same answer: it depends.
That's a pretty unsatisfying bit of advice, isn't it? Yet it's a core truth of digital security. You should be concerned, very concerned, but in order to make decisions about your own security measures you should first figure out which threats you're likely to face.
Over the next several months I'll be posting a number of pieces here about how you can do a better job of protecting your privacy and staying secure. Understanding what's at risk – and that not all threats are equally daunting – is a key to how you should respond.
Here's an example: every summer, thousands of computer hackers and security experts flock to a sweltering Las Vegas. They assemble at two of the most important annual conferences in the field, DEF CON and Black Hat, where they compare notes about their increasingly complex and worrisome fields.
DEF CON bills itself as the largest hacker gathering in the world. I've attended several times as a member of the press. Before I departed for Las Vegas last week, the organizers sent me a pre-conference email with a long list of cautionary measures I, as a journalist, should take before arriving, during the gathering and after I get home. It's a sobering document. Here are several of the many useful suggestions (I'll be posting the entire thing on my personal blog soon):
Beware of public Wi-Fi. Do not use any wireless networks at DEF CON or the airport unless you want to be hacked aggressively.
Conferences are a whirlwind of information and events so be sure to keep all of your accounts secure and within your control. Create and use a password strategy to ensure that confidential emails containing breaking news are not compromised. A few tips to creating your strategy:
– Use a pattern on the keyword instead of words from the dictionary.
– Rotate this pattern regularly. Change your passwords after each conference.
– Use a unique password for each important account.
– Be careful when selecting password hints or security questions as the answers can often be easily guessed using information you've posted to social sites.
– Do not send passwords in clear text.
– Change your passwords before you leave and as soon as you get home.Shield RFIDs. Keep your RFID credit cards, keys and IDs at home or in a special wallet. They can be legally scanned from over 200ft away.
Leave important data and devices at home. The safest way to protect your data and devices is to leave them at home. Assume all information and devices you bring to the event may be compromised. Many attendees bring a burner laptop and phone just for this event. If you delete data from your devices, make sure to shred the data so it really is gone. You could also bring a paper and pen. There are no known remote access attacks for this measure.
I don't want to suggest that you need to take all of these precautions at all times – unless you are worried, and have good reason to worry, that you are a specific target of highly trained surveillance experts and/or hackers. You probably aren't on a routine basis.
But you do need to consider what security experts call your personal "threat model" – what you, based on reality and not paranoia, believe are the likely threats to your own computing and communications on a day-to-day basis. So if you are a political activist or revolutionary working for regime change in a dictatorship, your threat model is among the most severe: you should assume that you are the target of concerted efforts by your government to find out what you are doing, where you're doing it, and what you are discussing with others.
But if you are a typical American holding a typical job, you should not make the assumption that the US government has specifically targeted you for surveillance – though, as we've learned from the Edward Snowden leaks about the National Security Agency and other federal bodies, you've been included in a dragnet surveillance of all Americans' communications to one degree or another.
The advice I received from the DEF CON folks was specific to that event, and daunting. I left my regular laptop at home, bringing instead an older one on which I'd installed a fresh operating system and zero personal documents. When I got home I reinstalled the operating system, wiping the previous files away. I didn't use the conference Wi-Fi at all, and paid cash for everything instead of using credit cards. And so on.
I'm less worried when I'm on regular business trips, though, some of the conference discussions gave me the shivers – the state of computer and communications security is iffy at best and horrendously porous at worst. (See this story about the ridiculous insecurity of Wi-Fi routers, for example.) With too few exceptions, the technology industry has done, overall, an abysmal job in this area.
The more research I've done on security and privacy, as I work on a new book, the more worried I've become about our ability to keep up with the bad guys. The news isn't all bad, however. Example: one thing I always do when I'm on a network I trust is update my software. You should, too; it appears to be an essential part of staying (relatively) safe. I'll explain why in an upcoming column.
