Guide: How To Protect Your Data Online?
Securing devices:
Make it harder for hackers to breach your data/device by keeping your software up to date. If you have your web browser, operating system and other software kept up to date, then you can prevent hackers from massively using publicly known exploits to attack your computer.
- Install good AntiVirus software capable of scanning also HTTPS traffic to protect you against some phishing attacks. AntiVirus scanning your encrypted web communication will analyze the content of websites you visit and try to match them to signatures of behavioral patterns of potentially malicious websites. This will protect you from downloading files from unknown sources. Modern AntiVirus software is also capable of defending you against some types of ransomware attacks, so keeping this software up to date and using a renowned vendor is highly important.
- Use common sense while browsing the Internet or plugging something into your computer, because AntiVirus and other defensive software is just an additional layer of protection to your sanity. This includes being cautious while following links in unexpectedly received emails, not downloading pirated software, accessing only those e-commerce websites that support HTTPS, and so on. Learn how to use strong passwords (Password Strength) and use a password manager that allows you to create very strong passwords without the need to remember them all.
- Use Two-Factor Authentication wherever possible, so in case your password somehow leaks or gets guessed you still have a second layer of protection. This significantly increases the effort of a successful attack when an attacker must steal your mobile device or a YubiKey to access the service.
- Encrypt your hard drive, so when your laptop is stolen thieves can not access the data inside. All modern operating systems and hardware support have some sort of default and safe encryption mechanisms that no longer slow down your computer. So feel free to use it anywhere you can, including your mobile devices.
- Backup your data, and test your backups. This will save you a lot of stress and anxiety when you’re hit by a possible ransomware attack, which makes all your data encrypted immediately unusable, or your hard drive simply dies.
- Don’t connect to untrusted networks because those can perform middleman attacks against you by intercepting the sensitive data you transfer online.
- Don’t let anyone near your devices if you’re not watching. It takes only a couple of seconds to plug in a malicious USB device which will compromise the security of your computer. Remember to always lock your devices when you leave them alone, so no one can jump in front of the screen and look into your emails or stored passwords.
- You should constantly educate yourself and people around you on novel security risks by reading security blogs or news magazines. Any information attained is better than no information at all, so don’t worry that you need to learn a ton. 1% is better than zero.
In terms of keeping your online data safe, the security hygiene practices mentioned above are some of the fundamentals to consider. You should govern access to your online data by a strong password with enabled Two-Factor Authentication as well as connect to data repositories only from secured devices you control and can trust. You must also look at this challenge not only by securing yourself but making sure everyone who collaborates with you on the data is aware of best security practices as well.
It’s great if you have it all safe and sound, but if your collaborator is performing risky activities like downloading pirated games, and not using some sort of Antivirus software and their password is “password1234”, then all bets are off. Your personal investments in safety have vastly disappeared.
It is very important to wisely choose the appropriate platform used to store your data, because we have many of them, and some of them may not provide the security protections you expected them to be. You want to be smart about who you delegate the responsibility of handling the safety and privacy of your data, because once it’s gone from your computer, you’re putting your trust with the third party to deliver what they had promised you.
This doesn’t mean your computer is the safest place to store your data, because in the case of most Internet users, it is not. However, there are things you should be aware of while sharing your data, so let me share with you my top requirements and concerns I personally have and follow:
• Is this company known in the market and has it been stable for at least 5 years? You’re better off passing your data to a company that has been battle tested for years, rather then go with a new startup with shiny features that appear to be exactly what you always wanted.
• Has the company processing my data experienced any security breaches in the past? And if so, how did they handle it? Security breaches may happen, but that’s not really how we judge security maturity of companies. The most important part is how a company responds to the breach, how it was communicated to customers, how much time it took them to recognize the breach, how much data was lost, was it properly secured, and what’s the scale and severity of the damage?
• Is the vendor compliant with relevant industry standards such as HIPAA or GDPR?
You want to make sure that they comply with industry best practices and invest in continuous security improvements that had been actually verified by an external auditing entity.
• Does the platform have relevant security features? You want to know if granular permissions are allowed and if there are: 2-factor authentication supported, cases are well documented, and support to use the product safely, etc?
• How is my data processed and stored by the company? If a vendor can’t answer these questions in a clear form, then I don’t trust them, because they must know what they’re doing internally with my data. If they can’t answer it, then it’s a good indicator they don’t have sufficient protective parameters in place. This type of compliance will be also regulated by GDPR.
• How many other people use this solution? Although it may not be the best predictor of how good the product actually is, in general you’re better off using a solution used by a few hundred of known companies rather than a software created in your neighbors garage.
• Does this company have a dedicated security team? With the amount of risks and demands companies are facing nowadays, there is no chance they are secure without investing in internal or outsourced security operations.
• Common sense - do you like this company? Do you have any concerns that make you feel insecure? Contact the vendor and have them answer all your doubts, or do plenty of research on your own searching for opinion via online forums.
Data privacy and safety are hard to get right, so once you’ve found a company you trust and you’ve learned how to use their product — don’t get easily deluded into switching to another small company that claims they’re doing it all better.
