Protect Your Data With Good Old Common Sense

I grew up during the Cold War. Back then, global threats were physical, ominous, and downright apocalyptic. Technology lurked in the background as the bad guy in some of the movies I’ve seen, but for the most part, our day-to-day lives remained focused on the physical implications of international conflict.

I watched missiles and drones get most of the attention during the recent standoff between the U.S. and Iran, but I would make the case that cyberattacks – either by nation-states or individual bad actors – pose a much bigger threat due to our growing reliance on technology.

Every day, our team at Black Lotus Labs works in a complex world of forensics and machine learning as we identify, monitor, and address millions of threats across CenturyLink’s global network. Our philosophical approach is a simple one—intercept the bad guys before they reach our customers.

Remember in school when you learned about ancient times and wondered how it would ever be relevant? Even with all this modern technology at our disposal, here’s a valuable lesson: When traditional military tactics failed to breach the walls surrounding Troy, the Greek army turned to trickery. They pretended to retreat and left a wooden horse outside the city’s gates as a parting gift. The Trojans brought it inside without a second thought, and the rest is history. They let their curiosity and vanity get the best of them, clearly demonstrating that often our biggest security risk is simply our own human nature.

Human nature makes us vulnerable to a wide variety of infiltration methods that remain popular for government-sponsored attackers and other actor groups, which Black Lotus Labs tracks every day. And, while the methods may change, what hasn’t changed is human nature. That’s why those old lessons still are relevant. Here are four things I suggest you do right now to protect yourself and your data from attacks:

• Don’t blindly open email attachments. Granted, there are a lot of amazing attack methodologies out there and plenty of malicious code just waiting to take down corporate or government networks. But, like the Greeks, the bad guys need modern “Trojan Horses” to gain access. Authentic looking emails containing dangerous attachments or hyperlinks often do the trick. I once received a shipping notification for an iPhone purchase that looked perfect. The tipoff was that I never use my business account to buy personal items online (and neither should you). It’s a good habit to always hover your mouse over messages with links or attachments to ensure the safety of your interactions. If anything looks odd, delete it (or better yet, forward it to your security people if you have a system in place for collecting malicious emails).
• Don’t be lazy about passwords. No one likes to memorize a series of complicated passwords. Attackers know this, and they use a very effective technique known as “password spraying” to access your corporate network. Essentially, they build lists of user accounts (usually by scraping sites like LinkedIn and using corporate email formats as a guide), and then they test popular passwords, like “Winter2020”, to find a match. The solution? Practice a little “password hygiene.” Create memorable passphrases (I just randomly generated “textiles-peach-townsman-boxful” as an example) that are tough for an attacker to crack. Another option is to use a password manager to create completely random passwords for you. Also consider implementing difficult-to-predict user accounts across your organization that have no connection to an employee’s actual name.
• Don’t ignore security patches. Attackers are not sympathetic to the fact that many IT departments are overworked and under-staffed. They will take whatever advantage presents itself when carrying out their objectives. So, when a software bug is publicly acknowledged and software patches are distributed to fix it, attackers pounce – ready to use their victim’s slow response against them. Time is of the essence, so ensuring the speed of patching corresponds to the level of a threat should be a top IT priority (that includes your personal computer as well).
• Don’t assume your online “contacts” have your best interest in mind. Attackers are very good at creating comfortable environments to make it easy for you to fall into their net. Because social media and digital communications eliminate physical contact and geographical boundaries, attackers can pretend they live nearby as a way to earn your trust, when they are actually located halfway around the globe. Never assume people who try to connect with you online are who they say they are and be careful about what information you share.

Nobody is perfect. We all have that moment when we wish we had thought before we clicked (even those of us who give the advice!). When it comes to protecting our data, I believe a healthy dose of skepticism goes a long way. At Black Lotus Labs, we’ll worry about the things we can do to help keep the Internet clean, while you can take comfort that you still have a pretty simple weapon at your disposal to blunt even the most sophisticated cybercriminal—your common sense. Keeping close watch on the hygiene of our digital environment may be the strongest defense of all.

Learn more about how Black Lotus Labs helps defend the internet every day.

This blog is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided “as is” without any warranty or condition of any kind, either express or implied. Use of this information is at the end user’s own risk. CenturyLink does not warrant that the information will meet the end user’s requirements or that the implementation or usage of this information will result in the desired outcome of the end user.