A big list of IT Security Podcasts
An OPML file of RSS feeds from sites dedicated to IT Security
10. Staying Current In The Field
9. 15 tips for social media security in libraries
6. Integrating IT Security In Your Library
3. Passwords
2. Privacy
This is part Nine in my many part series on IT Security In Libraries.
Part 8 was the first half of this post, Social Media Security In Libraries
In Part 7 I listed many lists full of practical advice that covered just about everything dealing with IT security in libraries.
Part Six was really the first part of this post. I dealt with security in libraries, mostly theory, while this post is more practical, and is mostly lists.
In part 5 I covered 20 Common Security Myths, and how to defeat them.
Part 4 was a general “How To Stay Safe Online” post that covered topics like patching/updating, watching links and downloads, and using good passwords.
In Part Three I covered passwords.
In part 2 we talked privacy.
In Part One I tried to lay the foundation for security.
It is important all users understand there are real threats posed by social media sites. I’m not trying to scare you into hiding in a cave here, but you should know places like Facebook and twitter are infected with bad guys who are working hard to cause trouble for all of us. Those bad guys will try to connect with as many people as possible, creating a sense of trust that makes it easier to use people to carry out their plans. Common schemes include things like social media identity theft, taking over of a brand’s social media presence, phishing, viruses, worms, and just about any other common online risk. I’ve collected 15 common and easy tips to make your social media sites as secure as possible.
This is part Eight in my many part series on IT Security In Libraries.
In Part 7 I listed many lists full of practical advice that covered just about everything dealing with IT security in libraries.
Part Six was really the first part of this post. I dealt with security in libraries, mostly theory, while this post is more practical, and is mostly lists.
In part 5 I covered 20 Common Security Myths, and how to defeat them.
Part 4 was a general “How To Stay Safe Online” post that covered topics like patching/updating, watching links and downloads, and using good passwords.
In Part Three I covered passwords.
In part 2 we talked privacy.
In Part One I tried to lay the foundation for security.
Libraries and librarians are fully embracing social media sites like Twitter, LinkedIN and Facebook. Our libraries use them to connect with and engage our patrons, increase library visibility and communicate information. We each use them to connect with old friends, sell ourselves, stay up to date with the world around us, and keep in touch with family. There are serious security risks involved with most social sites that can be avoided by following some very simple rules. The bad guys are finding it very easy to use these sites to cause trouble. Scammers, stalkers, phishers, spammers, hackers and every other kind of evil doer on the internet are finding new ways to get into our social networks every day. They are using links to spread malware and spam, and they’re always one step ahead. They’re using it to fill social media sites with evil, e.g. chat bots, captcha crackers, malware, spam, control botnets, blackhat SEO, etc…
Bad Guys Run Wild
People are more trusting on social sites because it is assumed those we are connected with are our friends. The bad guys take advantage of this. Using social media sites allow evil doers to hide in plain site because their posts are but one or two of billions. Social media sites are full of trusting people and the sites don’t yet have the rather effective spam/evil filters now found in most email systems. Things are spread easily here because most people use these sites for sharing links and other things and people tend to assume what is being shared is safe. It’s the one on one communication that looks innocent, but may not be. They’re also stealing logins and asking for money from friends. They can use people or bots to chat up friends and ask for money or get them to click on things that will cause trouble. As we all use these sites more, the bad guys will target us in new and inventive ways. It will be largely up to the administrators at the sites to shut them down.
Social Media Policy
Your library should have a social media policy. Make sure the people who are running your social media accounts have a clear understanding of the goals. Who is allowed to use social media on behalf of the organization and what they’re allowed to say are the two most obvious questions that must be addressed in a social media policy. You need to make all this clear or employees will make decisions on their own, on the fly. It’s easy to imagine how this could go very wrong. Be sure to conduct proper training for employees, if only to clear up issues regarding official social media policies. Your library should have a coordinator(s) and champion(s). Your library should have a social media manager, or a team that has part of their time at work dedicated to managing your social media presence. You should have privacy settings configured appropriately for your library information and photo albums. Also, be sure you all monitor the official library social media accounts so you’ll be the first to notice when trouble starts. Check things like Google Maps, Google Places, Yelp and other places to know what people are saying.
Own Your Name On The Web
Do you own your social identity? Do you know what the web thinks of you? Be sure you search your (either YOUR name or your library) name regularly, and know what comes up. Work hard to take ownership of those results either by doing good work, or by doing your own SEO. If you’re really dedicated to keeping your name safe, you can work to OWN it yourself on ALL sites. Sign up for an account on every new thing that comes along! The easiest thing to do is set up a website for yourself. Registering a domain and setting up a simple vanity site to show off your hard work is easy, and very inexpensive.
Remember What’s Being Sold
As Jaron Lanier points out:
“You think you’re the user, but you’re the used, or you’re the product, and then you end up doing all this stuff to control your online presence, and your online reputation, and people become obsessed with that. But the real representation of you is the one you can’t access, which is the one that’s used to sell access to you to third parties. … When [users] contribute to services like Google+, or Facebook, or other social networks, what’s happening is they’re working for the benefit of someone else’s fortune by creating data that can be used to grant or deny access based on pay to these third parties, the tawdry third parties… “
To put that another way, if you’re not the customer; you’re the product being sold [Source]
Next week I’ll have 15 tips for social media security in libraries!
This is part Seven in my many part series on IT Security In Libraries.
Part Six was really the first part of this post. I dealt with security in libraries, mostly theory, while this post is more practical, and is mostly lists.
In part 5 I covered 20 Common Security Myths, and how to defeat them.
Part 4 was a general “How To Stay Safe Online” post that covered topics like patching/updating, watching links and downloads, and using good passwords.
In Part Three I covered passwords.
In part 2 we talked privacy.
In Part One I tried to lay the foundation for security.
Let’s face it, security is tough in libraries. We have no shortage of access points. We deal with any number of vendors, who may or may not be secure. Threats come from within the libraries (patrons), and from external sites anywhere in the world. Our patrons are bringing in all sorts of Wi-Fi enabled things. And any new security stuff we want to add will get push back from our coworkers, and cost money that’s not in the budget. In this post I’ve created a bunch of random, though related, lists that can be used to help get started with security in your library. It’s a follow up and companion to Integrating IT Security In Your Library and should help put some of that theory into practice. You probably won’t need every point from every list, but I’m hoping presenting them in this way will save you time, and start you on the path to increasing security. I hope to expand each list into a full length post in the future.
What are the biggest mistakes you can make in your library?
Not preparing
Not training
Ignoring it and thinking you’re safe
Not having a good understanding of what keeps you safe
Not knowing what your vendors are doing or will do when something goes wrong
In general, your security preparations should…
Help prevent or detect an intrusion
Help stop nefarious code from being executed
Help stop trouble from spreading
Helps stop data from being stolen
Build in accountability (Everyone should have a defined role, and this should include both staff and patrons)
Be specific and practical when presented to help ensure buy in
Clearly explain consequences to help ensure buy in
Cover what to do when things go wrong, how to handle specific troubles, who to call, etc..
Include behavior and acceptable use policies for both staff and patrons
Security training for both staff and patrons should answer WHY
Remember, Bad security policies cost time, money, reputation and trust
Make sure you can at least answer some of these:
What does it cost us if this system goes down?
Who uses this system?
What do you do if the entire thing is stolen?
How easy are the assets to replace?
Do you have a security policy in place?
Do you have a disaster recovery plan in place?
Do you have funding and time for this?
Do you have funding for the trouble this will cause if you do NOTHING?
Library staff and information systems personnel should work together to complete…
A thorough Risk Assessment covering threats & vulnerabilities on the library’s computers and networks
Create a Security Policy which includes specific protection strategies.
— http://www.zdnet.com/news/seven-elements-of-highly-effective-security-policies/297286
— http://www.worldcat.org/title/securing-library-technology-a-how-to-do-it-manual/oclc/221148712
Evault the ease of attacking these critical assets. Like the asset side, you focus relative ease of attack and the associated threat models. You can use categories like: Swiss cheese, home safe, bank vault, and Fort Knox. Defining ‘Risk’
If nothing else you need to be prepared for a crises:
Expect to have a crisis event
Have a predefined crisis communication plan in place
Acknowledge the problem immediately
Go public with serious incidents ASAP
Use social media to communicate with any interested parties
Show full accountability
Get back up as soon as possible
Make right everything that was wrong
Some common policies to have in place.
Strictly enforce laws, regulations, policies, and standards with severe negative consequences for those not adhering to the rules as a strong deterrent.
Avoid giving access to sensitive and valuable assets to those who have no need-to-know
Monitor access and use by those who do need to know
Patching and updates of the OS and applications on a regular basis
Make sure you’re checking the internets for usernames/passwords for your library
Is your domain going to expire? Don’t let squatters get it!
Design for uncertainty. You don’t know how people will attack.
The biggest threat to everything is people downloading stuff they shouldn’t
Default installations are frequently insecure
Backups? Is everything backed up, and do you know how to restore?
Consider application white listing (e.g. AppLocker, McAdee Application Control
Include security responsibilities in all job descriptions. (impossible?)
Tie security performance into employee performance reviews. (impossible?)
Include disciplinary actions for all security incidents. (impossible?)
Dedicated staff? At least assign staff to certain areas (impossible?)
At the very least someone needs to have this as a part-time permanent assignment
If possible to take away rights and decisions and save people from themselves, and each other.
Encrypt you valuable data
Build in training on a regular basis
Separate duties, if you can, to make things more secure
Know as much as you can about who you’re hiring
Don’t share ADMIN or root accounts
Make it clear which staff members have specific privileges and responsibilities
Create and maintain good documentation
Make sure user accounts are gone when employees are gone
Think like a bad guy and try and see what you can do
Your website and OPAC
A web environment has four layers that need protection: the Network level, the Application level, the Operating System level and the Database level. Most people think of these layers as being one within the other, like concentric circles. They reason that if they protect the outermost level, the inner levels are automatically protected.
Enforce good passwords
Keep things patched
Use a good IDS
Training – Your staff needs basics
Do they even know what anti-virus program looks like?
Is someone penalized for failure?
Do they know to be careful of phone calls from strangers?
Be sure staff is regularly trained on common threats they will face
Thinking of moving to a SaaS (Cloud, hosted, whatever) model of hosting whatever? What do you ask?
What happens if that gets hacked?
How does that provider handle security?
How often do they do audits & Updates?
What the provider considers to be critical service and information security success factors
How do they handle security?
Do they at least use Open Web Application Security Project (OWASP) list of top 10 vulnerabilities of Web applications
Do they user any standards or certifications?
Before signing any a contract, your data will be protected as much as possible by that vendor. It’s also important to know what you’ll do when things go wrong.
So what should you do when you discover your library records or something has been breached?
Admit your mistake
Figure out what happened as soon as possible
Fix anything that needs to be fixed
Be proactive in the future
Visa has a nice guide Identifying and Detecting Security Breaches [PDF]. The outline the important points as:
Preparation
Detection
Containment
Eradication
Recovery
Follow-up / Lessons learned
They also list the top challenges:
Failure to report or ask for help
Incomplete / non-existent notes
Mishandling / destroying evidence
Failure to create working backups
Failure to contain or eradicate
Failure to prevent re-infection
Failure to apply lessons learned
This is part Six in my many part series on IT Security In Libraries.
In part 5 I covered 20 Common Security Myths, and how to defeat them.
Part 4 was a general “How To Stay Safe Online” post that covered topics like patching/updating, watching links and downloads, and using good passwords.
In Part Three I covered passwords.
In part 2 we talked privacy.
In Part One I tried to lay the foundation for security.
Today’s post is long on theory. I’ll argue that most any library can be a target, and present some ideas on how to make things more secure in your library.
Libraries Are Targets
Chances are your library is now, or will be at some point, a target. Don’t think you’re safe just because you’re just a small library because when it comes to getting hacked, size doesn’t matter. The average web-based application (small or large) is hit by some type of attack once every two minutes (says security firm Imperva, but anyone with access to web server logs will agree). Automated tools make it easy for bad guys to target everything and anything regardless of what might be inside. These tools can easily scan thousands of sites looking for anything with a security hole (and we all have them). There’s a seemingly infinite number of things they’re after. They may want to host cracked software. They may want to send spam. They may be doing blackhat SEO. They may want your patron’s personal information. They may want to use your site as a way to get elsewhere. This is just a small fraction of what they can do with little time or effort.
Why Security Is Hard
IT Security isn’t always easy. When it comes to securing your IT resources it’s very easy to make a mistake, or overlook something small. In every library it feels like there are a million things to worry about. It’s NOT only the fools who are getting hacked, it’s everyone and anyone. The best of us miss things and make mistakes that can lead to security breaches. Most libraries don’t have the money, time, or people to secure even the small number of resources they have. Larger libraries may be able to afford to spend more time/money on security, but then they also have more things to secure. Unfortunately, security doesn’t scale up very easily. This doesn’t mean you should give up and hope for the best! Everyone in your library has some small part to play in keeping things secure. We can talk all day about how we should integrate security into our daily routine more, and how vendors need to simplify, consolidate, and improve functionality. But in the end those problems are every bit as hard as everything else I’m talking about and won’t be solved anytime soon. Especially since the economics or security aren’t overly favorable. The costs are very low for the bad guys, and very high for those of us trying make things more secure.
The malware your computers are subject to now is very sophisticated. It’s highly evolved and many times will be able to run totally undetected. It has automated installers, updaters, and a sophisticated command and control center that puts every infected machine to good use. It’s easy for the writers of these tools to stay one step ahead of those who work to keep us safe. It’s very easy for your computers to spy on your users, or become part of a botnet used to cause trouble anywhere in the world.
Understand The Threats To Make Things Safer
You don’t need to be an expert on every aspect of security, but it doesn’t hurt to have a good understanding of the threats. Having this knowledge should help you to devise a practical and relevant defense
With so many trouble makers out there we need to have some idea of what we’re up against to know how to best formulate our response. Spam, Phishing, Spear Phishing, even Phone Calls! It feels like the bad guys are coming at us from every side. When looking at what you have, you need to think like an attacker. You need to think about what they’ll be trying to get, and how easy it will be for them to take things from you. If you make it easy, you’ll increase the likelihood of an attack. They may want usernames and passwords. They may want to sql inject some malware. They may want to deface your site. They may want your ILS. They may want to hide pages on your site to do phishing. They may want your server to send spam.
Defending against every possible attack is probably NOT possible, so it’s important to know how the most common attacks happen so you can focus on some easily defendable areas. I’ll expand on this a bit in another post, but here’s a quick summary of how an attacker will likely operate. Once they find a way in, they’ll need to know what’s around. They’ll first look around and see how things work. When choosing your defense, try to focus your energy on what the easiest/cheapest attacks will be. The hardest part for them is to figure out what you have, where things are, what OS you’re running. These are all things that make your system unique, and it’s the part that will take the most time for the bad guys to figure out. Your best bet is to begin by denying access to as much as possible. You should also hide things as much as possible. I don’t mean using “security through obscurity”, but rather keep important data off of the network entirely. You should also automate systems to watch for trouble. Make sure to use detection methods so at least you’ll know when someone gets in. I’ll talk about what to do when you spot an intruder, just keep in mind you should never assume you know what they’re after, how they got in, or that you’ve successfully kicked them out.
It’s important we take a realistic view at our assets that are at risk and protect them as effectively as we can. We can’t all have someone devoted to security full time. Heck, I don’t know that any of us can. The sooner we start seeing information security as something to do well because it adds value, rather than merely as a cost or something that gets in the way which we need to minimize, the better! Your users are assuming some level of competence with security. They’re assuming you web sites are safe, and their personal information won’t get sold to the highest bidder after its been stolen from your servers.
Make Staff Part Of The Solution
People will always be part of the problem. Most people don’t care much for security. They just want to get some work done. It is important all library staff be aware of and incorporate security in their everyday work. It’s critical they full accept and are part of any training plans. Without buy-in from everyone any security training will fail. They need to understand that what they do can have consequences. They need to change certain work practices, they need to become part of the solution, rather than part of the problem. They need to know how to recognize malware on a public PC, they need to know common risks, and they should know who to contact when these things come up. Good policies can help, though people will find ways around policies that get in the way. Training and awareness might help with some, but for the most part people don’t give darn. And I don’t mean to discount the value of training. Security training should be required for everyone to help them not just at work, but at home and anywhere else. 3 Reasons Why Computer Security Fails outlines 3 things to focus on when brining your staff into more secure behaviors. Lack of Awareness, Misunderstanding Computer Security, and Neglecting the Human Factor.
“Just like computers, people must be patched at least every month. Awareness programs (should be on) a continuous life-cycle where employees must constantly be updated, trained and reinforced,” he says. “Yet, most awareness programs are nothing more than a onetime event, and then people wonder why nothing happens.” – Ericka Chickowski
Security doesn’t have to be all technical, all the time. If your staff (and maybe patrons?) struggles with basic security principles, pick a couple of topics each week to work into an email or meeting. You can start creating awareness by continually using covering small simple topics that will help increase awareness. For years we’ve been champions of information literacy, now it’s time to start pushing security as well.
Integrating Security For Patrons
Your patrons don’t care much for security. They just want to get some work done. Or worse, they are actively trying to break it. This is why it’s important to build security in, make it a part of everything from the start. Security needs to be an integrated process in everything your library does, and everyone needs to play a part. Sometimes your security policies will get in the way. Of course this will make people angry, Your users don’t want to be saved. They want to do what they want to do, when they want to do it. Somehow you’ll need to define a set of acceptable behaviors and then put the hammer down on everything else. Do you allow everyone to install anything on their workstations? Companies are essentially split on whether to allow users to install applications — 51 percent yes, 49 percent no, according to a survey of 765 professionals by security vendor Bit9. Do you block access to Flash and PDFs (frequently attacked programs)? Probably not, even though they are both a very common attack vector. Do you switch to a different PDF reader with fewer features that may be more secure? Perhaps. This is just one decision, among many, that should be made at the policy level to help make things safer. Look for ways to make things safer in ways that don’t interfere with people’s everyday tasks as much as possible. People will always find a way around policies if those policies get in the way.
The Best Defense…
As the defender, our job is far far more difficult than those on the other side. The bad guys typically have the luxury of time and resources. They can sit and try different things until they find a way in, they have time on their side. They know that we forgot to protect something, and they will sit and keep trying until they find a hole someplace. And that thing is connected to something else that is connected to something else that contains something critical. It’s critical to know what’s hooked into what to understand risks, and form a defensive strategy. Nothing on your network is unimportant. With so much random stuff on your network breaking in is easier than keeping the bad guys out. Our job is also tougher because the people we try to protect will fight us. And we can’t forget cost, these things are expensive. Your library’s security operations need to focus on reducing vulnerabilities. Closing as many holes as possible will close the doors to everyone but the most talented hackers. I liked the view presented in This Post. Richard Bejtlich argues Security consists of three areas of interest:
He says when those three tings line up, then your security policies are working. “Obviously you want to make all three circles overlap as much as possible, such that you plan and defend what the threat intends to attack.”
Does your library have a Security Mantra?
I’m a big fan of simple lists, mantras and mission or vision statements. I’m not quite sure they actually make any difference, but I think they’re a great way to clearly communicate complex and hard to understand topics. Why not work on developing something for security in your library? Can you write security into your libraries mission statement?
I adapted this a bit from oneonta.edu:
Privacy
Confidentiality
Integrity
Availability
Access
What Should Your Security Goals Be?
To protect confidentiality & privacy by ensuring private information is kept private
To ensure data integrity by preventing data from being inappropriately changed or deleted
To ensure data availability by making sure services are available and uninterrupted
That data can be accessed whenever it is needed, and that data can be restored quickly
All available resources should be safe & secure for every user
What does your library have to lose?
Positive feelings
Angry users
Bad publicity
Embarrassment
Investigations
Lawsuits
Money
Time
Hopefully this post served as a starting point, a way to get you thinking about security in your library. If security has always been an after though at your library, I hope this will convince you now is the time to start putting better policies and procedures to work. I have a good collection of practical tips and tricks almost finished. I’ll be posting those lists very soon, so keep your eyes open!
This is part five in my many part series on IT Security In Libraries. Part 4 was a general “How To Stay Safe Online” post that covered topics like patching/updating, watching links and downloads, and using good passwords. In Part Three I covered passwords. In part 2 we talked privacy. In Part One I tried to lay the foundation for security.
Today’s post is short and sweet, 20 myths I’ve run across while working on the series. I’ve tried to include a link on most of them that explains why something is wrong.
This is part four in my many part series on IT Security In Libraries. In Part Three I covered passwords. In part 2 we talked privacy. In Part One I tried to lay the foundation for security.
Today’s post is a big bunch of tips (in convenient list form) on how to keep yourself safe while surfing the web. A bundle of easy practical tips you can take anywhere to make your computers safer. This is a pretty long list that can be boiled down to three important bullet points:
On your computer:
Keep that OS patched and updated. Related: Don’t use Windows XP
Disable hidden filename extensions
Make sure ALL those programs are updated. Especially don’t miss anything made by Adobe (e.g. Flash & Acrobat)
Never install things you’re not sure are safe. Especially don’t trust anything from Torrents or P2P sites. Avoid downloading programs from unknown sources
If you’re not using something, just remove it. Every program installed on your computer opens a potential new hole.
Make sure your firewall is turned on
Make sure file sharing is turned off
Use a reputable virus & malware protection software program, keep it up to date and run it often
Make sure that the Macro Virus Protection feature is enabled in all Microsoft applications
Never trust any links, attachments, short links, or anything else from anywhere or anyone unless you are SURE what’s inside
Have a recovery plan – Is your stuff backed up?
If it’s a laptop, use something like Prey Project
Advanced: Consider changing up your hosts file and/or using something like OPEN DNS.
Your Wi-Fi At Home:
Make sure you set a good password and use WPA or WPA2
Be sure to change the default Administrator Passwords (and Usernames)
Change the Default SSID and also disable SSID Broadcast
Turn off DHCP and set a fixed IP address range instead
Use MAC Address Filtering
When you’re not using it, just turn it off
Be sure to keep the firmware upgraded
Change your passwords every so often
Your Email:
Never open email attachments unless you know for sure what that file contains
Never click a link unless you know for sure where it leads is safe
Check your mail filters and forwards for things you didn’t add
Use good passwords
Sign out when you’re done
Use two factor authentication when possible (e.g. Google Authenticator for Gmail)
Be sure to use https when on public Wi-Fi
Consider using 2 separate email accounts to keep important things separate from everyday stuff
Watch out for short links, it’s hard to know where they’ll lead you
Your Browser:
Keep your browsers updated to the latest secure releases
Keep ALL Plugins updated to the latest secure releases, especially anything from Adobe
Don’t install things from sources you don’t trust
Block cookies, flash, and JavaScript (use with caution, will cause you trouble)
Use a password manager to store all your many passwords
Watch out for short links
A Few Recommended Plugins:
Your Social Media Stuff
Double check your apps. Make sure you know which applications have access to your profiles
Use two factor authentication when possible
Read the Facebook’s Guides in the Safety Center
Monitor and adjust your privacy & security settings
Use good passwords
Get more selective about sending and accepting friend requests. Don’t friend everyone.
Show “limited friends” a cut-down version of your profile
Facebook, Twitter and Gmail all offer help if you do in fact lose your accounts.
What about if you’re traveling?
Don’t do online banking or other financial transactions while away from home
Do not set your phone to automatically join any unlocked hotspot
Consider public computers in hotels and elsewhere dangerous
If you leave a laptop or other device in your hotel room, lock them up
Don’t post travel photos and writings on social network sites until you get home
What do you do AFTER you learned you’ve been hacked?
Change Your Passwords
Take that computer/server offline
Take as much time as you can to figure out what happened
Was it a password? Old program that had a hole in it?
If you can’t figure it out, you should probably format everything. Chances are good you can’t just patch things and keep on going. You may miss a backdoor or another open door, and the bad guys will still be around. Hopefully you had all the important stuff backed up and can start over from scratch.
Firesheep
Last but not least… make sure you’re familiar with something called Firesheep. I touched on this already in my post on privacy. It’s important for you to know just how easy it is for anyone to login as you on common sites you might be using every day. This is the number one reason you should never use an unsecured Wi-Fi connection when you’re out at someplace like Starbucks or Panera Bread, or anywhere else someone might be listening in. Firesheep makes it trivial for anyone to take over your online social life. It’s a simple little extension for Firefox that allows someone to grab your login to just about any website you’re using on your computer. See Also: Faceniff for Android mobile phones
On Pseudonymity, Privacy and Responsibility on Google+
Persistent pseudonyms aren’t ways to hide who you are. They provide a way to be who you are. You can finally talk about what you really believe; your real politics, your real problems, your real sexuality, your real family, your real self. Much of the support for “real names” comes from people who don’t want to hear about controversy, but controversy is only a small part of the need for pseudonyms. For most of us, it’s simply the desire to be able to talk openly about the things that matter to every one of us who uses the Internet. The desire to be judged—not by our birth, not by our sex, and not by who we work for—but by what we say.
This is Part Three in my many part series on IT Security In Libraries. In Part One I tried to lay the foundation for security. Last time we talked privacy, and today it’s passwords.
A comment on an LISNews post from last week asked me about passwords. It seems like such simple, obvious topic, but when you stop and think about it, passwords are difficult, and a good answer does indeed take 1,399 words.
Do you always use unique passwords? Are those passwords always “strong”? Does your library’s web presence require strong passwords for all users? Do you have password recommendation clearly posted on your web resources for your users? What makes a good password? Are complex passwords the most secure? Is it uniqueness? Is length the most important thing in a password? I’ll start by saying the single most important thing is uniqueness, never reuse a password on everything.
Password Reuse
Using the same password for everything is THE WORST thing you can do. If you learn just one thing from this post make sure it’s password reuse is dangerous. Doing this will allow anyone who gets your password from an insecure site (and the chances of this happening are probably higher than you’d think) to use it elsewhere. Your password could have been taken from any number of large data breaches and you’d never know it. When these big hacks happen the only thing saving you from becoming an easy target is having a unique password. It’s easy for a hacker to use your email address and password taken from a site like Gawker and use it as a starting point to cause some serious trouble.
How Did They Get Those Passwords?
So you probably wonder about how people are going to get your passwords. It’s rather easy for a talented hacker, and even easier to use automated tools to scan thousands of sites looking for vulnerabilities that would allow anyone with time to get your password from a site with a hole. Those usernames/passwords can then be sold to the highest bidder.
1. Ask: aka. Social engineering. They’ll just call the helpdesk and ask to have it reset.
2. Guess. Have your birthday on Facebook, your pet’s first name? That may just be enough.
3. Bruteforce. It’s trivial to have something that can guess millions of possible passwords in no time. (Your websites should never allow brute force attacks.)
4. Dictionary. Passwords follow predictable patterns and those are always tried first.
5. SQL Injections and other common vulnerabilities in websites.
What Makes A Good Password?
So what makes a good password? In short, length and complexity. If you think about it, a password is really weak security. If you’re in charge of setting the password policy for your library, you have decisions to make. Should you force people to use complex and unique passwords? Anytime you change up security policies people will look for ways around it. Enforcing strong passwords is no exception. Even when your users are forced to use “good” passwords, they’ll do something like choose all the characters on the left side of the keyboard. They will turn the seemingly secure restrictions into EASY passwords and make your network even LESS secure. Somehow your new security policy just made everyone’s password easier to guess. Those passwords are not strong and can be easily bruteforced/rainbowed/dictionaried because they are commonly used and will be guessed first in an automated attack. A truly strong password is darn hard to remember and that’s the problem for all of use with more than a few passwords.
What makes a bad password?
We have interesting stats on passwords thanks to some major hacks. In short, people choose bad passwords. They choose passwords that are short, all lower case, not random, they’re in the dictionary, they have no special characters, they’re found in password dictionaries, and worst of all, they’ll reuse the same password again and again across sites. That stats link has 3 interesting conculsions:
1. Passwords are inspired by words of personal significance or other memorable patterns.
2. Attempts to obfuscate or strengthen passwords usually follow predictable patterns.
3. Truly random passwords are all but non-existent – they’re less than 1% of the data set.
Don’t use any part of your username in your password. Don’t use any members of your family’s names. Avoid keyboard sequences, any real words, any real words with just a number tacked on either end, or any real word, just reversed.
Should You Change All Your Passwords Every 3 Months?
Before I cover some recommendations, I’ll ask, how often do you change your password? Is changing your passwords every 3 months a good idea? Is forcing your users to change their password every so often a good idea? I’ll stick my neck out and say, in general, no, changing your passwords every so often isn’t going to help things, with one exception: network or server logins. Network and server passwords should probably be changed every so often. I’ll explain why by first explaining why other things probably won’t matter. Say for example your bank… Your money is gone if anyone gets your password, you’ll notice that right away. You’ll only need to be change that one if it’s taken along w/ all your money. Your email? Chances are good if someone gets your email password they’ll start causing trouble right away. Hopefully you’ll be able to change it back and lock them out. In general: you don’t need to regularly change the passwords you use, UNLESS it’s to something like a network or a web server. The bad guys can just sit and wait once they’ve gotten into your network or your web server. They don’t need to do anything that will be instantly obvious like an empty back account. It may be good practice to change those types of passwords on a regular basis.
But I Can’t Remember All My Passwords!
If you’re like most people you probably have user accounts on what seems like an infinite number of sites. This makes using a unique password for each site next to impossible. PC Magazine recently did a nice round up of some of the many tools that can help you with this. If all that seems like too much, at the very least, have one easy to remember password for most common and unimportant websites. Then have a second password for things like facebook and twitter or other somewhat more important sites. Then have a third good solid password for banks & other super important things. If you have the same password for your network login at work and your account on LISNews, you’re doing it wrong. There are entire classes of websites for which you should simply pretend that your password is already public because you just shouldn’t trust them. You may also want to use a passwordcard, another simple idea to help you remember your passwords. Also, check out Diceware, Diceware™ is a method for picking passphrases that uses dice to select words at random from a special list called the Diceware Word List. Something similar, “Off The Grid” (grc.com).
Choosing A Good Password
Passwords don’t necessarily need to be hard. Pick a good memorization strategy, pick a good password, and you’ll be on your way to being more secure.
Choose NON obvious, NON dictionary passwords. If we assume someone has time to just sit and guess your password on a system, they will check common passwords first, then they check a dictionary. Since they don’t know your passwords, they look for the easiest guesses first. Given enough time, and if they are persistent enough, they will just start throwing every possible combination of letters, and then numbers, and then letters and numbers, and so on. So after using things that aren’t common, the most important thing is length. There’s no different between a simple long password as a complex long one as far as guessing goes. So start with an easy to remember password, then pad it with something else easy to remember. So get your own password and pad it. But don’t just use Password1 as this is easily guessed, and don’t pad by easily guessed numbers. The password plus padding shouldn’t be easily guessed or obvious. E.g. most common (therefore easily guessed) padding is done by adding a 1,2,3,4 at the end of some word. This increase in length and complexity defends against Brute Forcing. We get protection by adding more digits because they need to guess every possible combination of everything up to that length, each digit adds A LOT of time required. If you use special characters and upper/lower case you add even more time because they know most passwords are all lower case numbers. Some places will allow the use of spaces in your password, which gives you the opportunity to use a pass phrase e.g. Correct Horse Battery Staple.
Simple Things Make a Good Strong Password
At least 1 Uppercase
At least 1 Lowercase
At least 1 Number (And don’t put those numbers on the end)
At least 1 Something else (*%$@!-+=)
Make it as long as you can
Are complex passwords better? Well, maybe. Longer passwords are better, no doubt. If we knew exactly what each password was defending against, we would know what kind of password to choose. You have no idea how your passwords are stored or shared. Given enough time any captured password can be broken. Remember, we don’t know HOW people are going to get your password. Given enough time and resources any password can be guessed. BUT, that is no excuse to not use a good password, because chances are good no one will have the time and resources to crack a good password.
One more random piece of password changing advice, if you break up with someone who knew your passwords, change them all.
Speaking Of Privacy, Did you know Facebook is giving your cell phone number to all your friends. Go there now and start grabbing cell phone numbers to drunk dial from Internet Librarian in Monterey! ‘Account’ -> ‘Edit friends’ -> ‘Contacts’ you’ll see any cell phone numbers people have entered. You should probably follow the steps given by Facebook to remove your cell number and to prevent others from seeing yours.
If you’re like me (and you know you want to be) you have a LinkedIn account, but you’re really not sure what to do with it, well good news, LinkedIn just found how to use YOU… Someplace in the 6000+ word “privacy” policy they’ve decided it’s ok for them to use your name and picture in social advertising. So LinkedIn will watch what you do, figure out what you might sell for them, and then use your name and picture in an endorsement they make for some crap they’ll stick on your friends pages. From the pulldown menu under your name at the top right of your LinkedIn pages, choose Settings. Then choose the Account tab at bottom left, and click Manage Social Advertising. While you’re there, check all the other settings, there’s some icky stuff in there.
Recent Comments