YouTubers are getting their channels hacked.
Password managers are leaking user data.
Phishing emails often outnumber legitimate emails in your inbox.
There are some big changes happening with online security, and here’s what you need
to know.
For years most of us have relied on security strategies that have served us well in the
past.
Strong passwords, some form of 2-factor authentication, don’t click on unknown links.
Boom!
You’re good!
Unfortunately, as the world continues to evolve, we’re starting to see a bunch of changes
- and I believe there’s even more coming - that mean these simple strategies are no
longer enough.
It’s not that we need to move away from these tried and true strategies, but we need
to modify the way that we secure our accounts, protect ourselves from phishing attacks, and
handle our publicly available data.
In this video, I’m going to walk through four very specific strategies that most of
us would say is the foundation of our online security and then explain the slight change
that is going to turn these simply good strategies into threat-adjusted protection measures that
will future proof you against the latest threats we’re all facing.
Before I get started, let me share with you the biggest mistake I see people make when
it comes to their online security - and it’s the very reason that this video even exists.
I come across far too many people who tell me “I’m secure because I use fill-in-the-blank
strategy”.
When anybody says that to me, alarms go off in my head.
Sometimes that blank is as simple as a really long passwords and I have other people who
explain their complex virtual machine setup using only Linux operating systems.
It doesn’t matter.
They’re both wrong.
You want to know the truth?
The truth is that nothing in the world of security is foolproof.
Nothing.
Now you can react to this in one of two ways.
First, you could throw up your hands and say it’s not worth the trouble, we’re all
screwed anyway so what’s the point.
That’s what most people do, whether they say it out loud or not.
Or, you can recognize where things are headed and adjust along the way.
That’s why All Things Secured exists in the first place.
I’m constantly learning and adjusting my own security and sharing what I learn with
you.
It’s for your own benefit to follow along with me as I do.
So you have strong passwords.
That’s great.
I hope you’re using a password manager to create and store them.
The next step here is to start masking as much additional data as you can within your
online accounts.
The best story that comes to mind here for me is Twitter.
Let’s say you had an account on their platform with the strongest possible password that
would have taken centuries to crack.
Congratulations.
Just as you take a moment to pat yourself on the back, you read news that hackers are
now selling data stolen from 400 million Twitter uses, which included the email address and
phone number associated with your Twitter account.
In this case, it didn’t matter how strong your password was, you were at the mercy of
the security measures put in place by the company itself.
And these kinds of corporate hacks are happening all.
the.
time.
And I predict that this trend will continue for a while.
So again, don’t just create strong passwords and be content with that, start thinking about
how you can mask or hide other pieces of personal data.
You can mask your email address that you use to sign up online account with unique aliases.
Don’t give away your actual phone number, use a burner number.
And for goodness sake, stop giving out your home address, one of the hardest pieces of
personal data to change, and start using a virtual address.
I’ve got videos explaining how to do all of this in the description below.
It’s not as hard as you might think.
Strong passwords combined with masked data makes for much better security.
Ok, I’m about to say something and I need you to promise that you’re not going to
over-react, ok?
This is a difficult truth that a lot of people are having to learn the hard way.
And here it is.
2-factor authentication is hackable.
Just this past year, major YouTube channels from smart creators like Jim Browning or even
IT professionals like David Bombal have been hacked despite being protected by 2FA.
Now how this happened is a topic I want to save for another video.
The point here is that, again, no security measure is ever 100% safe.
So what’s the adjustment we need to make here.
First, if you’re serious about security, please invest in physical security keys as
opposed to SMS text verification or even authenticator apps.
That doesn’t solve all of the problems here, but it’s a good start.
The biggest shift you need to consider here is something I’m going to call sandboxing.
A sandbox could mean maintaining an entirely separate email account for banking, financial
or sensitive emails.
It could mean logging into certain accounts only on one device, let’s say you’ve got
a specific computer in your home that is the only one you use for banking and not your
mobile device or anything else.
I know some people who go as far as creating a virtual machine environment for certain
activities.
At this point, that’s a little out of my league, but the idea here is to think through
how and even when you might want to create a metaphorical walled garden for some accounts.
This doesn’t always apply to everybody, but if you’re a high value target or you’re
into crypto, this is something I suggest you start working on now.
My hope is that you either don’t have unnecessary social media accounts or if you do, you’ve
made them all private.
We can be our own worst enemy when it comes to sharing too much personal information.
Minimizing what you share publicly is a good start, but sadly we’re not the only ones
who leak our information.
Out government does it all the time with public records.
Companies routinely sell your data and it’s scary easy to rent email lists that you’ve
been placed on because of some targeted attribute like your political views or spending habits.
The next step here is to erase as much data online as you have control to do so.
Google your name and address and see what comes up.
Do it in a private browser and see if there are any old social accounts that come up that
you forgot about.
What you’re probably going to find is that there are a number of data brokers that are
quietly selling or licensing access to your phone number, home address, court records,
family relationships and more.
You can go through the process to opt out of having your data publicly available - which
is possible but time consuming- or you can use a service like DeleteMe to do it for you.
You’ve probably heard me talk about DeleteMe before.
It’s a service I’ve used for more than a year now and have done a couple of reviews.
The thing I love is that they continually monitor all of these data brokers for any
of my personal information and every month they’re finding new brokers and new pieces
of data that pop up and making more opt out requests.
It’s a pretty set it and forget it solution, which I appreciate, but if I do ever find
my data somewhere else on the internet, I just send it to them and they work to take
care of it.
I don’t want people to know the value of my property I own or which of my family members
they can harass if they don’t like something I say here.
That’s why I use and recommend DeleteMe and if it’s something you want to try, visit
their website and use the code ATS to get 20% off their service.
Don’t click links!
Don’t open email attachments from unknown senders!
Again, these are helpful, fundamental pillars of good online security, but as things change,
the way you win is to recognize that security is not a solitary effort.
There is a direct network effect associated with risk that extends to your family, friends
and even co-workers.
Last week I received an email from my mom who thankfully was asking me whether or not
a message she had received was a scam.
Now to my experienced eyes, it was absolutely clearly, unmistakably a scam, but in her words,
“It makes sense in some ways…”
My mom is a smart woman, and so is my wife, my dad, my sister and even the people that
I hire in my company.
But they all share one thing in common - each of them represent a direct link in my security
chain and the weakest link is still a threat, regardless of how strong I make my own.
For the longest time, security has been an individual undertaking.
But individuals and companies, both big and small, are realizing more and more that your
spouse or that virtual assistant that you gave access to your account have made them
vulnerable.
One easy solution is to train your network through force of habit.
Be predictable in your methods of communication so that when something weird happens, let’s
say they get a message from you on a different platform or it’s a request that you would
never make through an email, that they naturally become suspicious.
I’ve talked about the one security habit you must teach your family, and I still think
that it’s worth watching that and sharing with your loved ones.
Now I’m no idiot.
I’m not going to tell you how to nag your spouse to use a password manager or 2FA.
Just know that as long as they don’t, it’s an open door for problems in the future.
For employees or contractors, that’s a different story.
You can and should mandate certain security measures.
So what are the key takeaways?
Create strong passwords, but then start masking your data.
Definitely use 2FA, particularly 2FA keys, but then determine when and where you need
to sandbox for greater security.
Make all your social accounts private, but then go through and scrub your publicly available
data.
Don’t click links in emails or attachments, but then find ways to do the same for your
family.
What else would you add to this list?
I know there’s more here and I’d love to learn from you as well.
Leave a comment with your ideas and then watch this video next about that one security habit
I referenced earlier.
It’s a good one, I promise, so click here.