Cycber Security Awareness Month

October is National Cyber Security Awareness Month (NCSAM).  The 2017 Cyber Security Awareness Month marks the seventh anniversary of the campaign.  It is also European Cyber Security Awareness Month (ECSM) https://cybersecuritymonth.eu/  and in Canada, https://www.getcybersafe.gc.ca/index-eng.aspx 

  Stop | Think | Connect

With that in mind, consider the following suggestions not only during Cyber Security Awareness month but every day:

    Stop:  Before you click that formatted link in your email, search results or social media account, mouse over the link to ensure the URL matches the description.

    Think:  Whether it is email, Facebook, Twitter, an online forum or other online media, instead of spouting off the first reply that comes to mind when you disagree, think before you click the send button.  Remember that your online reputation can follow you in "real life".

    Connect:  When you connect to the Internet, ensure your device software as well as any apps or third-party software are up to date.

Each week, Malwarebytes Labs will focus on a theme and provide helpful articles, useful tips, and valuable analysis so that you can increase awareness and spread the word. This week’s theme: simple steps to online safety. The first:  National cybersecurity awareness month: simple steps to online safety | Malwarebytes Labs

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Data Privacy Day #PrivacyAware

January 28 is recognized as Data Privacy Day, a day established annually to promote information on privacy awareness.  However, we all need to be concerned with protecting their privacy not only on Data Privacy Day but every day.

I have posted about Data Privacy Day since 2011, covering a variety of suggestions to protect privacy.  This year, let's consider privacy and Windows 10.

With the release of Windows 10, there were people who didn't take advantage of the free update due to scaremonger articles about privacy and "reporting back" to Microsoft. 

One of the first things people hear about is "telemetry".  What is telemetry?  From Wikipedia:

"Telemetry is an automated communications process by which measurements are made and other data collected at remote or inaccessible points and transmitted to receiving equipment for monitoring. The word is derived from Greek roots: tele = remote, and metron = measure. Systems that need external instructions and data to operate require the counterpart of telemetry, telecommand."

It is important to realize that the use of telemetry is not unique to Microsoft and is employed by other companies as well to identify and analyze issues that need to be fixed.  If this really bothers you, it can be set in Settings under Feedback and diagnostics to Basic.

More importantly, Microsoft has heard users' requests for more control over privacy in Windows 10.  As a result, the next update to Windows 10, referred to as the "Creators Update" will include the changes to privacy outlined by Terry Myerson, Executive Vice President, Windows and Devices Group, in Our continuing commitment to your privacy with Windows 10.

In the meantime, there are numerous journalists who have written about privacy settings in Windows 10.  One of my favorites is Ed Bott.  If you have concerns about the information you may be sharing, I suggest you read Ed Bott's recent article, Take control of your privacy in Windows 10 and Microsoft tries to soothe regulators and critics with new privacy controls.

For previous Security Garden articles about Privacy, check the Privacy label.

_______________

Data Privacy Day Information and Resources:

• National Cyber Security Alliance | StaySafeOnline.org
• Stop.Think.Connect.
• https://twitter.com/STOPTHNKCONNECT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

October -- Cyber Security Awareness Month

Each year additional organizations join in the effort to spread information on cyber security awareness.

The 2015 Cyber Security Awareness Month marks the fifth anniversary of the campaign

  Stop | Think | Connect


With that in mind, consider the following suggestions not only during Cyber Security Awareness month but every day:

Stop:  Before you click that formatted link in your email, search results or social media account, mouse over the link to ensure the URL matches the description.

Think:  Whether it is email, Facebook, Twitter, an online forum or other online media, instead of spouting off the first reply that comes to mind when you disagree, think before you click the send button.  Remember that your online reputation can follow you in "real life".

Connect:  When you connect to the Internet, ensure your device software as well as any apps or third-party software are up to date.

Cyber Security Awareness Month Resources

The United States isn't the only country supporting cyber security awareness.  Canada and the European Union are also involved in promoting cyber security awareness month.  Visit their sites along with the others listed.

• APWG:  The Anti-Phishing Working Group
• Canada: GetCyberSafe
• Europe: European Cyber Safety Month
• Homeland Security: National Cyber Security Awareness Month
• Microsoft on the Issues: Cyber Security Awareness Month goes international
• Stay Save Online.org: National Cyber Security Awareness Month
• U.S. Government:   OnGuard Online

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Month

With the release of the Windows 10 Technical Preview, Cyber Security Awareness Month almost lost focus.  Well, I've set Windows 10 Technical Preview aside for now to share some of the many security resources available not only during October but year round.

First, however, let's focus on protecting your digital life.

Two-Factor Authentication

Two-factor Authentication (2FA) or Multi-factor Authentication (MVA) is a method of providing two forms of identification in order to obtain access.  It is comprised of something you know (password, passphrase, pin) and something you have (SMF code, RSA SecurID).  A third means is something you are such as your fingerprint or other biometric.

Why the concern?  It isn't only your email, Facebook or Twitter account that you need to be concerned about protecting.  A more grave concern is protection from identity theft which can occur when someone steals your personal information and uses it without your permission.  Identity theft can result in loss of finances and destroy both your credit history and reputation and is not easy to recover from.

It is the very information that is accessible from in your email account and shared in social media sites that, if compromised, can result in identity theft.  Two-factor authentication is a means protecting that information.

1. Although you've heard this before, it bears repeating.  Start with a strong password and use a different password for each site.  (See Tips for creating a strong password.)  This becomes the something you know.
   
   
2. The next step in enabling two-factor authentication requires setting up your account for the something you have, a code sent to your cell phone or to an alternate email address. 
   
   With your Microsoft Account used not only for email but also other Microsoft apps and services, it is one of the first places to start.  Fortunately, setting up two-factor authentication for your Microsoft Account is easy.Numerous references are available from my earlier blog post here.  

For sites that still use the archaic "challenge question" method to verify your identity, please see this advice in Bits from Bill, Your Email Password is a Target.

It is equally important to protect any files stored in the cloud.  If you use a Microsoft or Google account, Office 365, Dropbox, Facebook, or Twitter, see Ed Bott's step-by-step instructions in Make your cloud safer: How to enable two-factor authentication for the most popular cloud services.  Also check the Two Factor Auth List to find out which sites support two-factor authentication.

Cyber Security Awareness Month Resources

The United States isn't the only country supporting cyber security awareness.   Canada and the European Union are also involved in promoting cyber security awareness month.  Visit their sites along with the others listed below and

Stop | Think | Connect.

• Canada: GetCyberSafe
• Europe: European Cyber Safety Month
• Homeland Security: National Cyber Security Awareness Month 2014
• Microsoft on the Issues: October kicks off cybersecurity awareness month - Microsoft on the Issues
• Stay Save Online.org: National Cyber Security Awareness Month
• U.S. Government:   OnGuard Online

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

2013 U.S. and Canadian Cyber Security Awareness Month #NCSAM

Cyber Security Awareness Month is observed in the United States and Canada.  The purpose is to increase public awareness of cyber security.  The theme for the 2013 National Cyber Security Awareness Month (NCSAM) is Our Shared Responsibility.

There are many areas to consider when discussing cyber security.  The area I consider most dangerous is Identity Theft.  Identity Theft occurs when someone uses your personal information without your knowledge.  With your personal information, thieves are able to open credit cards and bank accounts, set up mobile service, make online purchases and more, destroying your credit in the process.

Let's examine what we can do to protect ourselves from Identity Theft.

Prevent Identity Theft

A few items to consider to protect your personal information include:

• Only provide your Social Security Number when absolutely necessary.  
• Never publicly post your address, phone number, driver’s license number, social security number (SSN) or student ID number.
• Shred documents that contain personal information.
• Use a strong password to protect your banking, credit card as well as accounts where you make online purchases or make payments.
• Use a unique password at each site.
• Don’t give out personal information on the phone, through the mail or over the Internet unless you initiated the contact.
• Keep your computer updated with both Microsoft Security Updates as well as third-party software such as Adobe and Oracle Java products.

What cyber security tips do you have?  Share your favorites in the comments and be sure to check the additional resources provided below.

Resources:

• Canadian Twitter Accounts:
  -- Public Safety Canada, @Safety_Canada
  -- Get Cyber Safe, @getcybersafe   
• Get Cyber Safe
• Microsoft Safety and Security Center
• Stay Safe on Line:  National Cyber Security Awareness Month
• Stop | Think | Connect
• U.S. Department of Homeland Security: National Cyber Security Awareness Month 
• U.S. Twitter Accounts:
  -- NatlCyberSecAlliance @StaySafeOnline
  -- Identity Theft Resource Center, @ITRCSD
  -- STOP THINK CONNECT, @STOPTHINKCONNECT

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

FTC Action Against Fake Tech Support Scams

Since early in 2009, people have been harassed by telephone scams by telemarketers claiming to represent Microsoft and other vendors such as Dell, McAfee and Norton.  The telemarketing scammers attempt to convince the call recipient that malware has been detected on their computer which they can, of course, remove for a hefty fee.

The attempted "proof of infection" is normal and generally harmless error messages in the Event Log, completely unrelated to any indication of infection.


With October being National Cyber Security Awareness Month, the timing of the announcement by the Federal Trade Commission (FTC) yesterday that, at FTC request, a U.S. District Court Judge ordered a halt to six alleged tech support scams pending further hearings and has frozen their assets (see October 3, 2012 List of Commission Actions) was ideal.

The United States has not been alone in being harassed by fake tech support scammers.  Australian, Canadian and U.K. citizens have also been targets as has New Zealand and Ireland  It was through the combined efforts of the Australian Communications Authority, Canadian Radio-television and Telecommunications Commission and United Kingdom’s Serious Organised Crime Agency that the FCC was able to take this action.

Knowledge is Key

Although the action by the FCC will most certainly help, the problem is not eliminated.  Should you receive an unsolicited telephone all from someone purporting to be from Microsoft (or any other vendor), the best advice is to just hang up! Microsoft does not make this type telephone call.

In the event you have been tricked by one of these fake tech support scammers and logged on to a third-party website so they could remotely access your computer, malware may have been installed on your computer to allow remote access.  This could have provided the scammers with access to steal personal and financial details from your computer.  Update your antivirus software and complete a full system scan.

If you supplied credit card information, in addition to contacting your credit card company, notify the appropriate government agency:

Australia:  scamwatch.gov.au
Canada:  http://www.crtc.gc.ca/eng/info_sht/g9.htm
New Zealand:  http://www.theorb.org.nz/
U.K.:  http://www.actionfraud.police.uk/
U.S.:  ftc.gov/complaint

Not only during National Cyber Security Awareness Month, but every day Stop | Think | Connect.

References

• Australian Communications Authority (ACMA): ACMA media release 71/2012 – 4 October
• Canadian Radio-television and Telecommunications Commission (CRTC): The CRTC takes action against telemarketers offering anti-virus software
• FTC Halts Massive Tech Support Scams
• FTC Combats Tech Support Scams | OnGuard Online
• Microsoft Imposter Scam
• Microsoft Security: Fraudulent Emails and Credit Card Scam Tips
• Microsoft Security: Avoid Phone Scams | Cybercriminal Tech Support Scam | Security Threats
• Tech Support Scams | OnGuard Online
• United Kingdom’s Serious Organised Crime Agency (SOCA): SOCA
• Microsoft Community:  Who are my tech gurus? Are they bone fide Microsoft support

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

2012 National Cyber Security Awareness Month

Once again October is dedicated as National Cyber Security Awareness Month in both the United States and Canada.  Although the National Cyber Security Alliance is celebrating its 10th anniversary, 2012 marks the ninth year of the National Cyber Security Awareness Month.

The most important message home computer users can get from National Security Awareness Month is Stop | Think | Connect:

"STOP: Before you use the Internet, take time to understand the risks and learn how to spot potential problems.

THINK: Take a moment to be certain the path ahead is clear. Watch for warning signs and consider how your actions online could impact your safety, or your family’s.

CONNECT: Enjoy the Internet with greater confidence, knowing you’ve taken the right steps to safeguard yourself and your computer.

Protect yourself and help keep the web a safer place for everyone."

Identity theft is a serious issue and is a major reason why it is important to Stop | Think | Connect.  With the popularity of social networking sites (i.e., Facebook and Twitter), it is all the more important to be cautious about the personal information shared in those and other venues.

If you shop online, conduct online banking, use public computers or a mobile phone, please take some time to review the recommendations on the Microsoft Online Safety & Privacy pages.


Although not particularly sophisticated, the information and tips provided with the Online Identity Risk Calculator are spot on.  All it takes to calculate your personal identity risk score, is to answer 10 questions about your online activity and how it can make you more vulnerable to identity theft as well as fraud.

I took the test and am pleased that my risk level is low. 

See how you do with the Online Identity Risk Calculator.

Additional Resources:

• Microsoft Safety and Security Center
• Stay Safe on Line:  National Cyber Security Awareness Month
• Stop | Think | Connect
• Trustworthy Computing:  TwC and NCSA - 10 Years of Online Safety & Security 

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Month 2011

For the eighth consecutive year, October has been declared Cyber Security Awareness Month. 

The purpose of Cyber Security Awareness Month is to provide both awareness and education for all digital citizens, whether using a desktop PC, laptop, tablet, smart phone, or multiple devices.

The official declaration was made in the United States in an official proclamation by The President. Again this year, the theme is "Our Shared Responsibility", with Stay Safe Online continuing as the official sponsor site. 


The United States is not alone in declaring October as Cyber Security Awareness Month.  Canada’s Minister of Public Safety kicked off Cyber Security Awareness Month in Canada with the launch of Get Cyber Safe.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Online Safety Calendar for Cyber Security Awareness Month

This year marks the seventh annual National Cyber Security Awareness (NCSA) month.  Officially, the National Cyber Security Awareness Month launch will take place tomorrow, October 4, 2010, in Seattle, Washington at the Seattle Public Library.

NCSA provides an opportunity for teachers, businesses, government entities, libraries, as well as bloggers like me to provide tips to help you stay safe and secure online.

With acknowledgment to a tip by fellow Microsoft MVP, Richard Hay, at his website, WindowsObserver.com, I am going to tell you about the Online Safety Calendar, a great new add-on available for Internet Explorer.  The add-on is an ideal tool to enhance your cyber security awareness.

Although it is not yet available for Internet Explorer 9 (Beta) or alternate browsers, with the installed Online Safety Calendar add-on, Internet safety tips such as "How to protect yourself from identity theft", "Online shopping safety tips", and more are available at your fingertips.  Of particular interest is the wealth of information available to parents for teaching children how they can stay safe online.

Installation of the add-on is easy.  Simply go to the download link provided below and save the file.  When you run the installer, you will need to agree to the Terms and Conditions of Service.  If you are running Windows Vista or Windows 7, accept the UAC elevation prompt for the installation.  (Note:  The calendar is not currently compatible with IE 9 Beta.)

Restart Internet Explorer when instructed during installation and at the beginning of each month, you will receive a calendar reminder to help you take action on important online safety issues.

It is not necessary to wait for the monthly reminder to get safety tips.  You can also access the calendar whenever you want. Simply launch Internet Explorer, click Tools, and then click Online Safety Calendar.  Alternatively, click on the Online Safety Calendar icon from the Internet Explorer Command Bar.

Below is a partial screen copy of the calendar information for National Cyber Security Awareness Month:

The Online Safety Calendar was sponsored by Microsoft and developed by ILookBothWays.com.  Before starting I Look Both Ways, president and founder Linda Criddle was a 13-year employee of Microsoft where she was a pioneer in online safety for the MSN division. 

While I still have your attention, I want to encourage everyone, but particularly parents, to check the helpful information available at iLookBothWays.  Under the "Learn Safety" tab are links to articles with advice on how to steer clear of Internet hazards including topics on sending e-mail, dating online, or protecting your children.  There are brochures that can be downloaded and educational videos on topics such as "Talking to Kids About Online Safety" and "Protecting Kids on Social Networks".

References:

• iLookBothWays: Microsoft Sponsors New Internet Safety Calendar App by LOOKBOTHWAYS
• Internet Safety Calendar Download: Free Internet safety calendar « iLookBothWays
• Microsoft: October is National Cyber Security Awareness Month
• NCSA: http://www.staysafeonline.info/
• The White House: Presidential Proclamation--National Cybersecurity Awareness Month
• Windows Observer:   Look Both Ways Before Crossing The Internetm

Clubhouse Tags: Clubhouse, security, family, safety, information, Internet Explorer, IE, How-to

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

October is Cyber Security Awareness Month

Canada and the United States have set aside the month of October as Cyber Security Awareness Month. Where ever you may live, the tips provided by supporters of this endeavor are appropriate for all computer users.

To support the Cyber Security Awareness theme last year to "Protect Yourself Before You Connect Yourself", I scheduled a new "tip of the day" at Security Garden each day during October (Available in the Cyber Security label). Although it was a lot of fun, the theme this year is "Our Shared Responsibility".

With that in mind, where ever you may be, I challenge everyone who reads this to join in the endeavor – share the responsibility! As a home computer user or tech enthusiast, take responsibility for keeping yourself and your family safe online.

A starting point is ensuring that your family computer(s) have basic protection. Some months ago, I wrote a popular tutorial, Basic Computer Security for the Home User. If you are a “beginner”, that is a good place to start.

After your computer is protected with the basics, it is time to consider that the Internet is a virtual world with potential dangers and . . .

PROTECT YOUR FAMILY

As part of "Our Shared Responsibility", teach your children, grandchildren, cousins, nieces and nephews that “stranger danger” applies to the internet as well as on the street. This is especially important today with the wide usage of social networking sites by young adults. Be sure your children understand the importance of maintaining their privacy. If you are uncertain where or how to begin, Microsoft has published a number of articles, available from the Microsoft Family Safety webpage:

• AAP and Microsoft collaborate on online child safety
• Age-based safety tips for kids
• Sample family contract for house Internet rules
• 4 steps parents can take to help protect kids online
• Basics to teach kids about the Internet

For those members of your family who are mature enough to participate in social networking sites, additional guidance is available from the Microsoft Family Safety webpage:

• Practice cyberethics
• Teach kids about hate and misinformation on the Internet
• How to manage your online reputation
• Online gaming: Help kids play safely
• How to help your kids use social Web sites more safely
• 11 tips for social networking safety
• Safety tips for blogging
• Online predators: Minimize the risk
• 10 tips for dealing with cyberbullies
  
  

Particularly for younger children, I suggest child care-givers use Windows Live Family Safety or Windows Vista Parental Controls to create age-appropriate filters for internet usage of the children in your care.

Additional information on Cyber Security Awareness Month is available at the following locations:

• Canada: http://www.safecanada.ca/cybersecurity_e.asp
• SANS: Cyber Security Awareness Month
• Microsoft: http://www.microsoft.com/protect/promotions/us/cybersecuritymonth_us.mspx
• NCSA: http://www.staysafeonline.info/

Clubhouse Tags: Clubhouse, security, family, safety, information, Windows Vista, Windwos Live Family Safety, Parental Controls, How-to

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day Roundup

As my contribution to Cyber Security Awareness Month, I have been providing a new "tip of the day". Friends at Freedomlist and LandzDown forums provided some excellent tips that I shared. This "roundup" post provides the opportunity to extend my grateful appreciation to them for their contributions.


October 31, Tip of the Day Roundup:

A lot of information has been included this month on how to "Protect Yourself Before You Connect Yourself" by taking simple and effective steps. The information has been provided not only by me and my forum friends but also by educational, security and private organizations.

As a finale to the question I posed in September: "How can I protect myself before I connect?", the tip today is a roundup of tips. Of course, if I had discovered the other lists before beginning this project, I could have simplified this project considerably. ;)

To review the collection of tips provided this month at Security Garden, just click this link: Cyber Security Awareness Tip of the Day.

In addition to the tips provided by SANS and US-CERT, I thought you might enjoy the tips from Who's Watching Charlottesville even though they didn't seem to catch on that October has 31 days.

• SANS Institute: Security Awareness Tip
• SANS Internet Storm Center: Cyber Security Awareness Daily Topics
• US-CERT: Cyber Security Tips
• Who's Watching Charlottesville: Cyber Security Tips: A tip a day for 30 days

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 30

Laptop usage is no longer restricted to the business person who travels frequently. Instead, laptops are rapidly replacing desktop computers not only in business and on college and university campuses but also for home use. With that in mind, the tip today is from Case Western Reserve University:

October 30 Tip of the Day:

"A few tips for protecting laptops and data include:

• Never leave your laptop unattended in a public area
• Buy a locking cable for your laptop. The cables are available for purchase at the bookstore, through Case Protective Services, or online.
• Make sure you have a screensaver password
• Don't keep sensitive data on a laptop. Instead, keep it on a central or department file server, and wipe your disk free space after you delete working copies from the hard drive.
• Back up data on a regular cycle, and practice recovery from backup"

The complete article is available at "Case offers tips, programs during Cyber Security Awareness Month"

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 29

As parents and other adults in a position of influence with children, we teach our children to follow the "Golden Rule" -- treat others as you would like to be treated.

Due to a feeling of anonymity sitting at a keyboard, both adults and children alike often forget about the "Golden Rule". Cyber Ethics is treating others online as you would like to be treated.

October 29 Tip of the Day:

Teach your children proper Cyber Ethics. Everyone needs to remember that words typed on the computer and post online can be more damaging than spoken words. You can apoligize for spoken words and in time the hurt will be forgotten. Written words, even though an apology is rendered, remain as a record for all to see. They attract a much larger audience than a traditional person-to-person confrontation.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 28

When purchasing a cell phone, PDA or computer accessories like keyboards, mice and other peripherals, many people look for models that are Bluetooth enabled. Bluetooth is a method of wireless networking these devices without wires or cables.

October 28 Tip of the Day:

Protect yourself before you connect your Bluetooth devices.

"How can you protect yourself?

• Disable Bluetooth when you are not using it - Unless you are actively transferring information from one device to another, disable the technology to prevent unauthorized people from accessing it.
  
  
• Use Bluetooth in "hidden" mode - When you do have Bluetooth enabled, make sure it is "hidden," not "discoverable." The hidden mode prevents other Bluetooth devices from recognizing your device. This does not prevent you from using your Bluetooth devices together. You can "pair" devices so that they can find each other even if they are in hidden mode. Although the devices (for example, a mobile phone and a headset) will need to be in discoverable mode to initially locate each other, once they are "paired" they will always recognize each other without needing to rediscover the connection.
  
  
• Be careful where you use Bluetooth - Be aware of your environment when pairing devices or operating in discoverable mode. For example, if you are in a public wireless "hotspot," there is a greater risk that someone else may be able to intercept the connection (see Securing Wireless Networks for more information) than if you are in your home or your car.
  
  
• Evaluate your security settings - Most devices offer a variety of features that you can tailor to meet your needs and requirements. However, enabling certain features may leave you more vulnerable to being attacked, so disable any unnecessary features or Bluetooth connections. Examine your settings, particularly the security settings, and select options that meet your needs without putting you at increased risk. Make sure that all of your Bluetooth connections are configured to require a secure connection.
  
  
• Take advantage of security options - Learn what security options your Bluetooth device offers, and take advantage of features like authentication and encryption."

From Understanding Bluetooth Technology

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 27

It is Monday morning and the weekend is already a distant memory. You either managed to take some deserved R&R time, avoiding even the most mundane of tasks or your weekend was packed with family activities, leaving no time for those same mundane tasks -- like checking your computer for needed security updates.

Although keeping your computer software updated has been included in previous posts, in view of the seriousness of the recent Out-of-Band Critical Update MS08-067, please consider this additional information.

The following is what has been reported that TrojanSpy:Win32/Gimmiv.A gathers from infected computers:

• User Name
  
• Computer Name
  
• Network Adapters / IP Addresses
  
• Installed com objects
  
• Installed programs and installed patches
  
• Recently opened documents
  
• Outlook Express and MSN Messenger credentials
  
• Protected Storage credentials
  

There is NO patch for operating systems that have reached "end of life" support. That means that only Windows 2000, XP, Windows Server 2003, Vista and Windows 7 (Beta) can be patched. Note further that on Windows 2000, XP, and Windows Server 2003 systems, the code can be run without authentication. This is not the case on Vista (or Windows 7 Beta) where authentication is needed.

There are no visual effects informing about the infection. It has been confirmed that the exploits can download a malicious .exe automatically. The most likely methods being used are drive-by downloads and fake codec Web sites.

October 27 Tip of the Day

Get the patch at Microsoft Update: http://update.microsoft.com/


References:

• Microsoft Support Lifecycle
• Securiteam

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 26

Do you "Google"? According to Security Garden blog analytics, over 90% of visitors who come here as a result of search results, arrived via Google search results. Such overwhelming results leads to the tip today being a two-for-one!

October 26 Tip(s) of the Day:

1) If you see a warning as illustrated below in Google search results, pay attention and, by all means, do not go there. Even if it is a site you have been too before and it was "perfectly safe" does not mean that it is now. It may be the site or the host server that has been infected.


Additional information is available in Malware? We don't need no stinking malware!

2) The second tip for today is to exercise caution with Google's "Sponsored Links" which can lead to malicious sites and infections. Microsoft MVP Mike Burgess demonstrates what he regularly finding in Is Security overwhelmed by Malware?


References:

• Is Security overwhelmed by Malware?
• Malware? We don't need no stinking malware!

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 25

At lunch the other day, I read an interesting story at SecureWorks, about an undercover FBI operation for tracing the identity and locations of cyber criminals involved in identity theft. (See DarkMarket: FBI Sting Closes E-Doors)

As frequently happens when reading one article, I followed a link from that article to the National Cyber Forensics Training Alliance where I eventually ended up at the Internet Crime Complaint Center (IC3), a partnership endeavor with the FBI.

I don't suppose that it surprises regular Security Garden readers that this path led to the . . .

October 25 Tip of the Day

As stated at IC3, "Internet crime schemes that steal millions of dollars each year from victims continue to plague the Internet through various methods." The IC3 resents a set of "preventative measures that will assist you in being informed prior to entering into transactions over the Internet."

See Internet Crime Prevention Tips

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 24

I received a link to another helpful document from my friend Eric the Red at LandzDown Forum. This is particularly timely for parents considering investing in a family gift for the approaching Holidays.

October 24 Tip of the Day

Follow the simple steps for configuring your Windows Vista computer accounts, updates and more in the SANS Reading Room document, Windows Vista: First Steps.

This illustrated guide is ideal for the home user.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 23

Over and over you hear the same thing -- be sure to keep your system updated with all security patches, have a software firewall and up-to-date anti-virus software. With so many vendors now providing "security suites", do you need an anti-malware software as well? As the saying goes, I don't like keeping all my eggs in one basket. It is the same with security software.

October 23 Tip of the Day:

Particularly if you use a security suite, have another vendor's software on board as part of your security package. There are a number of anti-malware software programs to chose from that are "free for personal use". Although there are others to select from, below are a few to select from:

• Malwarebytes Antimalware
• Spybot Search & Destroy
• Windows Defender

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Cyber Security Awareness Tip of the Day: October 22

While many people have been hurt financially during the recent unstable economic situation, I have heard other people considering investments in stocks that may have been out of their reach before but are affordable now.


October 22 Tip of the Day

In this electronic age, stock transactions can be conducted anytime and by anyone. Before you invest, investigate! Links below are provided for researching brokers, checking if the investment is registered, and more.

See Online Investing for tips on how too invest wisely online.


References:

Federal Trade Commission (FTC): Identity Theft
FINRA 's BrokerCheck
SEC: EDGAR database
SEC: Investor Information
SEC: Online Complaint Center
SEC: U.S. Securities and Exchange Commission
Securities Industry: Self-regulatory Organizations (including FINRA, Amex, and Nasdaq)
Your State: Securities Regulator

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...