We’ve just talked about behavioral security controls,
now we’re going to move onto
technical security controls,
and again, many of the social threats we face
can be mitigated by
the same type of technical security controls.
And again, the threats we’re referring to here
that we can mitigate are things like
identity theft, social engineering, like phishing, vishing,
smishing, scams, cons, doxing, spam, those sorts of threats.
In order to mitigate these sorts of threats,
consider using these sorts of
technical security controls.
The first is use an email provider
with security controls to mitigate these attacks.
When you’re selecting an email provider,
consider how well they protect you
from spam, phishing, malware, and those sorts of things.
Almost all email providers scan the email content
for these types of attacks.
This is a privacy concern, but is also a security control.
Sometimes security and privacy aren't compatible,
and you have to choose how to deal with that.
What is more important for you? Privacy or security?
You have to make the risk based decision.
But you can chooseto have
separate accounts for separate purposes.
So for example, for a more private conversation,
you could have a dedicated email
where you use GPG
which will give you the privacy that you need,
which we discuss later in full detail,
and for general emails, where you have
less of a need for privacy,
you could go for a provider
that offers security by scanning the email contents.
The big email providers are good with spam,
phishing and malware protection, as they have
lots of resources to throw at the problem,
Apple, Google, Microsoft, Yahoo, etc.
They are good for protecting you
from phishing and malware,
but they are not good privacy.
So you need to choose your provider
by weighing up these options
between privacy and security.
For security, you want a provider that
provides some filtering against these social attacks,
and we cover selecting an email provider
in more detail in the section on email security.
Another control to protect you
against these social threats
is to use a credit monitoring service
that notifies you of credit searches
and applications that will help you
particularly against identity theft.
In the US and other locations,
you can freeze credit checks.
This stops anyone from being able
to take out loans or credit cards in your name.
This is useful if you know you don't need
any loans or credit,
so you can freeze your credit.
You want to monitor the accounts you care about
where they provide this
monitoring and alerting functionality.
Enable the security notifications on your accounts
where they are available.
For example, when someone logs into your account,
and where, and on what device,
when money transfers are made,
when passwords are changed and so on.
You want alerts for those sorts of things.
As an example,
Gmail provides information like that on your devices that you log in,
many banks will send you notifications
when there are money transfers,
or where your account reaches a certain level.
You should enable those.
Now the rest of the technical security controls,
we’re going to discuss
throughout the course in detail.
You will learn more about them in their own sections.
But a quick summary here
of what will protect you against these social attacks.
So first is changing the email viewer
to be text instead of html.
Using the built-in Google Safe Browsing
used in Mozilla Firefox, Apple Safari, and Google Chrome.
Ublock origin for filtering,
using isolation and compartmentalization,
using a virtual machine
to open attachments and click links.
Using application and execution control,
sandboxes, opening attachments online
using tools like Google Docs and Etherpad,
using Live operating systems
to open attachments and click links.
Using OpenPGP signatures
to validate the sender is genuine,
and if you frequently send and receive files via email,
changing that to hosting these files
and sending links to these files instead of attachments.
And you can use services like SpiderOak,
Owncloud or Seafile,
enabling antivirus and endpoint protection.
But all of those things,
we go through on the course,
but they particularly do protect you
against these social attacks.
For useful information on protecting you
against phishing, vishing, smishing,
spam, scams and cons,
then have a look at this website here,
this is quite good, ActionFraud.
And also Scambusters.org is quite good as well.