Protect Yourself By Understanding Risk

Publish 2024-12-25

One of the first steps to protecting yourself online is understanding your own risk. Security experts call this "Threat Modeling", but the good news is, it's not difficult to get started!

Don't have a lot of time?

Here are our top recommendations:

  1. Use a password manager such as 1Password. The greatest risk to most people's security is using the same password for multiple sites. Password managers make it easy to have strong, unique passwords for all of your accounts and dramatically cut your risk.
  2. Backup your personal data. The usual recommendation is the 3-2-1 rule. Have 3 copies of important data, stored on different types of storage, and one of them should be remote.
  3. Enable automatic updates for your operating system, and browsers. This is likely on by default, but take the time to restart your computer for pending updates or you aren't receiving the benefits.
  4. Use multi-factor authentication (MFA / 2FA) when available, and use anything except text-message (SMS) MFA to avoid the additional risk of SIM-card jacking.

What is threat modeling?

Threat modeling is a scary sounding word for taking an inventory of your risks. Security professionals work with companies to understand where their weaknesses are, in terms of security, and as normal people, we can do the same.

These inventories will typically include:

  • A list of public profiles and websites
  • The devices used in the company
  • What software is being used, and how often is it being updated
  • The controls that are in place to prevent employees from doing or seeing things they shouldn't see

Your average internet user has a lot in common with corporations in this regard!

What are the most common risks?

In 2024, we saw lots of news about companies being hacked. You most likely know someone who's had an account hacked, fallen for an Internet scam, or had malware infect one of their devices. While there are an endless number of threats, and variations. The reality is that you can never be 100% secure, but you can definitely lower your risk.

Account hijacking

Hackers have lots of tools in their toolbox for getting access to your accounts. Some of these attacks are targeted, but most of these attacks are from hackers around the world for financial gain.

The best case is that these accounts are stolen to sell them or incorporate them into bot nets to send SPAM.

In the worst case, your data can be used for blackmail, ransomed, or used as a starting point to hack your friends and family.

How to lower your risk of account hijacking
  • Use a password manager to create strong, unique passwords for every site that you use.
  • Enabling multi-factor authentication (MFA/2FA) when offered by a service. This means someone needs your password, and some other piece of information to log in, and can be a great way to stop most attempts in their tracks.
  • When enabling multi-factor authentication, prefer options that don't rely on the same account email or your phone in some way. Text message MFA, for example, is susceptible to SIM-card jacking, where an attacker has your phone number transferred to a new SIM card.
  • If your email provider or password manager offers it, use unique email addresses for every service. This is a little more on the extreme side, but if a hacker doesn't know your email address, they can't take advantage of problems with authentication in a service.

Ransomware

When hackers gain access to your device, they have the opportunity to encrypt all of your files using a password that they'll try to sell to you. They typically accept payment in cryptocurrencies which are more difficult for law enforcement to prevent.

Unfortunately, these attacks are not always reversible and paying the ransom provides more resources for the hackers to go after more people.

How to lower your risk of ransomware
  • Create regular backups on a second device or a cloud service. For things like USB drives, it's best if they're disconnected after you've created your backup
  • Keep your computer and browser updated. Don't delay restarting too long!
  • Think twice before clicking that link, or opening that document you received.
    • If the email is especially urgent, and unexpected, be extra vigilant.
    • If possible, don't click the link at all, and instead go to the website directly.
  • Use antivirus on your computer, tablet, and phone

Malware

When your devices are infected with viruses, hackers can use them for nefarious purposes. If the hackers don't want to steal your data, spy on you, mine cryptocurrency, or show you advertisements, they can use infected devices to attack other devices or services. So-called botnets, can be used in denial of service attacks against businesses, and over recent years, we've seen huge increases in the power of these attacks.

Did you notice we used the word devices? They include, not just your computer, but also your smart-home devices, home security cameras, routers, and even TVs!

How to protect yourself from malware

  • The same recommendations for ransomware apply here
  • Enable automatic updates on your smart devices and routers. Unfortunately, this is easier said than done! Not all devices continue receiving updates for their useful life span, but if you are in the market for new devices, stick to brands that you trust.
  • If you have, or can purchase, an extra wireless router, it can act as a barrier between your untrusted smart-home devices and your trusted devices (with all your precious data).

Data Leaks

When hackers gain access to a service that you use, they'll often try to sell your information on the Darknet. On the Darknet, marketplaces exist to buy and sell stolen data to other hackers who use it to try and attack the users of that service.

When corporations delay notifying users, either because they don't know they've been hacked, or because they don't want you (and regulators) to know, it increases the damage that can be done.

How to protect yourself from data leaks
  • Never re-use passwords across different services. Password managers make this very easy.
  • If your bank supports it, use one-time credit cards for online shopping
  • Share minimal, or fake information with companies to limit the impact of a data leak. For example, if filling out new security questions online, make it up and save it to your password manager

It's a marathon, not a race

This is just a short list of many possible threats and mitigations that you may want to consider. The world, and your own situation are constantly changing, so it's important to regularly review the security and privacy measures that you put in place.