How to safe guard our personal and financial data?

Nowadays, privacy and security of personal data are often beyond your ability to control. However, there are many professional online safeguarding agencies which provide us severa ways to protect our data from being hacked. Here are some steps which you can take to safeguard your data.

Firstly, we have to know what data is required for a certain transaction and set limits accordingly. For example, a check cashing company may ask for your phone number, but you should question the need to supply your Social Security number. Then, we should recognize the “status” with the financial institution. Are we a “customer” with a continuing relationship, or a “consumer” with no data security protections? We have to be sure with the status.

Next, we should ask the financial institution about its data security program. We may not get an in-depth response or a copy of the company’s written policy, but we are entitled to be assured that the company takes data security seriously. Security is often important on a company’s web site along with its privacy policy.

Moreover, we have to keep up with the news. A financial institution has a single publicized instance of a security breach does not mean it’s a bad company. An important indicator is what that company does to help its customers after a reported breach. For example, does the company offer to provide free credit monitoring services to limit the threat of identity theft? This would definately help in safeguarding our personal and finacial data.

Then, we have to shop for good security programs. In Fact Sheet 24c, we are on provided on some tips how to shop for companies with a good privacy policy. We can refer to How to Shop for Financial Privacy, www.privacyrights.org/fs/fs24c-ShopFin.htm. If a company does not seem serious about protecting your privacy, you might question its commitment to security as well. Take your business elsewhere.

Next, we should protect the information that we keep especially in business. Limit access to employees with a legitimate business need. Control who has a key, the number of keys and know when information is being accessed. Besides that, Use antivirus and antispyware software, as well as a firewall, and update them all regularly. Also, use a password activated screen saver to lock your screen whenever you are not in front of it. The longer the password, the better. Use passwords with a mix of letters, numbers & characters and frequently change your password. Moreover, do not use the same password for all of the various accounts you access with a password.

I hope these safeguarding techniques would help in protectin our personal and financial data.

Phishing: Examples and its prevention methods

In computing, phishing is a form of criminal activity using social engineering techniques. It is characterized by attempts to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business in an apparently official electronic communication. Phishing is typically done using email or an instant message. The term phishing arises from the use of increasingly sophisticated lures to "fish" for users' financial information and passwords. [Defined at Wikipedia, the free encyclopedia]

The following is an example of what a phishing website might look like.

1.0 Fake Maybank 2U Portal

Figure 1: Phishing Site

2.0 Real Maybank 2U Portal

Figure 2: MayBank 2U Portal

The real portal is using “http://www.maybank2u.com.my” [Refer Figure 2] instead of “http://www.mayb2u.com” [Refer Figure 1] . So, all the users must make sure the correct website that they are looking for before logging in. If not the personal account information such as username and password are obtained by phishers through phishing site.

Website forgery / Spoofing

Some phishing scams use JavaScript to alter the address bar to make it seem legitimate. This is done by placing a picture of the legitimate company's URL over the addresbar, or by closing the original address bar and opening a new one containing the legitimate URL.

In another method of phishing that is quite popular, an attacker uses a trusted website's own scripts against the victim. These types of attacks (cross-site scripting) are particularly nasty, because they direct the user to sign in at their bank or service's own web page, where everything from the web address to the security certificates appears correct. This attack is very hard to spot as it is the link to the website is crafted to carry out the attack.

Visit the real site http://www.paypal.com/ and check for yourself how similar they look.

Prevention Methods:

Secure HTTP

Learn the difference between http:// and https:// (note the ‘s’ among the alphabetic characters. The https:// is a scheme used to indicate that the website employs a security method. In technical terms, http:// allows access to resources using a protocol that transfers contents into your browser. In https:// however, there is an extra encryption and authentication layer standing between your protocol and the Internet provider. The layer allows secured communication between the user and a service provider. And https:// stands for Hypertext Transfer Protocol over Secure Socket Layer. Having an https:// should mean that you are doing a sensitive transaction, so also check the certificate of the website using such security scheme.

Password Protection

Although a lot of phishers are good at knowing details and facts about you, you are still the master of your virtual household. Learn to use several passwords instead of just one. By that, if a phisher gains access to, say, your blogging account and get a hold of your e-mail address, if you have different passwords between your blog account and your e-mail account, they cannot access your more sensitive account with your blog account password simply because the phisher knows the wrong password to the right account.

Use your anti-phishing toolbar. If they are identified as spoof websites, anti-phishing toolbars are still not efficient. That is because you just let your toolbar sit on your computer while you wait for it to react. Not all automatic things are secured, so use your anti-phishing toolbar. Get the ones that display the real address of the website along with a few details regarding the website. To use it, compare the address you visited from the data the toolbar gave you. If somehow some details didn’t match, doubt the website immediately. Just by that, you can avoid being phished 80 per cent of the time.

DNS

If you are the techie type of person, then you might know a lot about how things go within the Internet world that you can employ advanced technical measures than the previous two above. If you have heard of specialized Domain Name System (DNS) service, then use it. DNS service acts like a firewall when it filters phishing sites from the ones you visits or have visited already. It works with any type of browsers too. Further security measures require outsiders to monitor and check around if the company is a likely to be the target of phishers. Such stand-alone security groups give out analysis and assistance for a company to avoid being phished, as it would be a grave financial damage if a company fell for a phishing scam. Moreover, individuals who know anti-phishing measures can be hired to check and report any loopholes that the company has. Better have an expert around!

A review on a post on Internet Security from My E-Commerce blog-JohnCow.com was hacked! and Unhacked!

I read with interest on the post titled 'JohnCow.com was hacked! and Unhacked!' which touches on issues of the security that we have on the internet. Therefore, I would like to do a review on this post to tell you more about how drastic is the consequence you have to bear should your account be hacked and also to give you a better understanding of how to prevent your accounts on internet from being intruded illegally by the hackers.

On securityfocus.com, it was reported that a 20 year old hacker hacked into the famous search engine on the internet, called http://www.yahoo.com/ and could change and alter the contents of a news on Yahoo! News. Now imagine what if a hacker hacked into Yahoo on September 11, 2000 and changes lists of people who were on the planes, or reported missing, or all kinds of things that could cause a lot of grief and anxiety to the family or next of kins.

On blogwired.com, it was reported that the then vice-presidential candidate Sarah Palin's private Yahoo e-mail account was hacked, and had some of its confidential mails being made public. Now this is a serious situation, imagine if a top ranked government officer or even the president's email account being hacked, then the top secret missions or policies would have been known to public and this could endanger the country or even the lives of the officials that are involved in the top secret missions.

On itsecurity.com, it was reported that a hacker by the name of Jonathan James cracked into NASA computers and stole softwares worth about $1.7million. Now, this is alot of money, what if Jonathan was not caught, then they would have lost the amount of money because of the vulnerability of the internet security. Another question is, if a software developed by a software programmer which he has not gained a copywright rights to it being hacked and retrieved illegally by the hacker, then he would have lost the piece of work he had been working hard on and could not cash in on the programme even if it is widely used in the world.

On a chinese entertainment tabloid, it was reported that illicit and compromising photos of a popular taiwanese celebrity was exposed. According to the story, she had stored her photos on a online in a private album and had it password protected. A hacker somehow managed to obtain her password and hacked in and shared the photos to the world. Now this raises a concern and everyone should be careful with passwords as this episode could spell an end to her career in the entertainment industry and this has certainly ruined her image and reputation in the public.

On the prevention side, according to dailyautocad.com, we could use a special add-ons on our mozilla firefox or internet explorer to protect ourselves from hackers. It is called the McAfee's site advisor. It establishes the fake sites that could be trying to steal our passwords and prevent them from doing it.

Other than that, If you are afraid of losing all your messenger contacts should your account be hacked, try to back-up your messenger contact list. You can export instant message contact list to a file and also copy your registration information that you have edit before to a word file and burn both of them into a disc.

You should also keep your passwords private and not to share among your friends, even to your closest friends as they could just blurt out your passwords to other people.

Another way is to make sure that you use 'alpha-numeric' password because a combination of both makes it very hard for hackers to hack into the account. For example , avoid using the password related to your name like Marrylim. Instead, try to combine with some numbers that are not related to your birthdates. For example, try using numbers that are only known to you like your exam IDs or your handphone serial number's last 4 digits. So you could use Marlim0042. This really makes it very hard for the hackers.

Lastly, try to use anti viruses such as McAfee or even Avg because at least they can provide some form of protection to you. They could filter off the threats that have already been identified in their databases and will already have solutions to overcome them.

The threat of online security : How safe is our data?

Today, computer users are facing the threats of :

• cybercrime

• phishing

• internet and network attacks

• back doors

Cybercrime is defined as online or internet-based illegal acts. Hackers, crackers and corporate spies who have advanced computer and network skills access computers and networks illegally with the intent of destroying data, stealing proprietary data and information.

Phishing is a scam in which a perpetrator sends an official looking e-mail that attempts to obtain your personal information and financial information. For example, some phishing e-mail messages ask you to reply with your information, or a pop up window that looks like a website, that collects the information. The damages caused by phishing can be crucial. The following case illustrates potential threat caused by phishing.

Internet and network attacks that jeopardize security include virus, worm, and Trojan horse. Virus is a piece of code that is secretly introduced into a system in order to corrupt it or destroy data, it can damage the operating system, causing the loss of data and other possible losses. Worm is a program that copies itself repeatedly, this will use up the available space and slow down a computer operating speed. On the other hand, Trojan horse is a program that hides within or looks like a legitimate program. Although they seem to be harmless, they may however be triggered if certain condition is certified.

Back doors is a set of instructions in a program that allow users to bypass security control when accessing a program, computer, or network. Once perpetrators gain access to unsecured computers, they often install a back door or modify an existing program to include a back door, enabling them to continue to access the computers remotely without the user’s knowledge.

In conclusion, risk exposed by computer users is increasing with the increasing developed technology. Therefore, safeguards developed must be always up to date to enhance the defenses against online security threats. In the same time, users must be educated and informed about the crucial damages and loss caused by imposing online security threats.

References:

http://www.govexec.com/story_page.cfmarticleid=39456

http://en.wikipedia.org/wiki/Timeline_of_computer_security_hacker_history