Many of the social threats we face
can be mitigated with the same type of security controls.
So the threats I’m referring to you here
are things like identity theft,
social engineering like, phishing, vishing, smishing,
scams and cons,
as well as things like doxing and spam.
In this video I’m going to talk through the security controls
that protect you from these social threats.
And these security controls can be split
into two categories.
The first we’ll cover is behavioral changes.
This is changing what you do
to doing something safer instead.
Such as not downloading and running
an executable from your email.
The problem with behavioral changes though
is it relies on us humans
and we are fallible and often forget to do the right things.
The second type of control
is technical security controls,
such as using sandboxing
on your email client or browser,
and of course we use defense in depth
so that we have layers
of both types of security controls to protect us.
So we will implement behavioral
and technical security controls to protect us
against these social threats.
So let's start with behavioral changes
in order to protect ourselves from these threats.
The number one defense
against social attacks is
if you didn't request it do not click on it.
Do not respond to it and be immediately suspicious.
This includes your emails, sms's, telephone calls,
messages, things that pop up on the screen,
messages within messaging apps.
If you didn't request anything, always be suspicious of it.
Some of the messages you can get
can be very enticing and seem legitimate,
but if you didn't request it,
or you weren't expecting it,
then it should always be considered suspicious.
If you have subscribed to an emailing list,
then you are expecting the emails and those are fine,
but if you suddenly get an email you never requested,
then it should be immediately considered suspicious.
So remember,
if you didn't request it, do not click on it.
Next is never download and run
any file you don't100% trust,
especially not if you’ve been sent it via a link
or via an attachment from an email
that you did not expect.
All email attachments should be
considered suspicious and should be
put through some technical security controls
that we’ll detail later,
so don't run attachments and files
that you don't % trust.
Never enter things like usernames and passwords
or personal information
after following a link or a pop up.
Always, always go to the site
by typing in the URL yourself into the browser.
In fact, these days, companies should not be sending out
links in emails asking you to log in
and enter personal information.
You will find that companies that understand security
don't do this anymore,
they ask you to go to the site,
and login without providing a link.
They tell their users that
they never send out links,
because they want to train their users
not to click on links sent in emails
to their site,
because they know that that very same tactic
is used in phishing attacks,
so they want to train their users
out of receiving links in emails
and clicking on them to their site.
So never enter usernames, passwords, or personal information
after following a link.
Go to the site itself,
enter the URL yourself within the browser.
You can attempt to validate the link.
In the section on know your enemy,
we talked through how links are manipulated,
so you can check to see whether it
conforms to any of the known attack types
and link manipulation techniques.
So are there any subdomains?
Like we can see here,
so we have a subdomain here,
so we know that that’s dodgy looking,
and that's the real domain.
Are there any subdirectories?
Here we can see some subdirectories,
so we know that that’s a dodgy URL.
That’s the real domain.
Are there any misspellings?
And here we go, misspellings, that's a dodgy domain.
So it may be tricky to understand,
as I’ve gone through this,
which are the real domains depending on your experience.
So the real domain is the one
that is to the left of the high level domain,
that’s the high level domain
and it has no slash to the left of it.
High level domains are things like
dot com, dot net, dot org,
and when we say that there is no slash to the left of it,
this does not include the slash in the http://.
Are they using IDN homographic attacks?
So here we can see them using
zero's instead of O's, and a one instead of an L.
With different fonts it can be impossible
to see the difference, so do note that.
Are they using hidden URLs using html a tags?
You can hover over the link,
and we can see there in the bottom left,
this is revealing the correct URL,
but it doesn't always reflect the correct URL,
it depends on your email client, your browser,
what Java script is being used,
but that's a good indicator of what the real URL is.
And also here, hovering over,
you can see what the real URL is.
You can try right clicking,
copying the link
and pasting it into notepad, or another text data.
This may reveal the correct link,
but not always, again because of Java Script
and depending on the client that you are using.
You may also find that
this is an image, but again,
if you hover over it,
it might show you the real URL,
but if you don't trust it, don't click on it.
You might see unsubscribe links like this one,
usually at the bottom of emails.
These can be used as attack URLs as well.
Don't click on the unsubscribe links.
You can copy and paste the link here
to see if it’s on a known bad URLs list,
but if it’s very new, it won't be on here,
so you can't rely on this 100%.
In fact, just use this as an indicator
as there are tens of thousands of
phishing URLs at any one time.
Now, if we look here,
it’s going to tell us
based on the various services
whether it’s been reported as a bad URL,
and as we can see, the BBC is safe for now.
This has already been discussed,
but in reference to these particular attacks,
a valid defense is minimizing
your personal information disclosure.
I’ve stated this in many parts of the course.
You need to limit the amount of information you give out.
Simply by doing this, you reduce your risk.
You are less likely to be a target
of these social attacks
and naturally remain more private.
We’ve just covered minimizing your registration
and alternatives to providing information on registration.
This, again, makes you more secure
and less likely to be a target of these attacks.
If they don't know you exist,
if your email, your phone numbers,
your messenger ids aren't available,
they can't know it
in order to send attacks to you.
Especially, do not post your email address,
your phone number, your messenger ids online,
like say in forums, on your blog, and those sorts of things,
because they will be picked up by automated scanners,
and then you’ll become an automatic target
of phishing attacks, scams, cons,
spam, and whatever else the latest social attack is.