2018-08-10 Information Security Practice

Christina asked a question on her blog, Infosec and Data Privacy:

  1. On a scale of 1 to 10, where do you rate your personal infosec practices? Name three practices you do to define that level.
  2. If you rated yourself above 6, name two practices someone at levels 2 through 5 could do to raise her level.
  3. If you rated yourself below 6, name two practices of yours that most people should do but don’t. What would you like to learn.

I guess I rate myself above average, so... 7? I am tragically aware of Illusory superiority. Specially now that I know Christina rated herself a 4. 😢

Here are three things that I do which most people don’t do:

  1. My laptop disk is encrypted. My backup disks are encrypted.
  2. I have two sets of backup disks and one set is always at the office.
  3. I deleted my Facebook account, got rid of Messenger and I’ve moved nearly all my friends and family away from WhatsApp to either Signal or Threema.

Here are two simple things you can do to raise your security level:

  1. Make backups and keep one set of backups outside your home in case of fire, flooding or break in.
  2. Use a password manager with a long, unique, randomly generated password for every service you use.

I think it’s important to look at your threat level. What is most likely to cause you harm in the near future? I’ve heard a lot of people complain about lost pictures and documents because they didn’t do backups. That’s why deleting Facebook is not as important as making backups. It’s also why encrypting disks is not as important as making backups in the first place.

Same with your accounts being hacked because you used simple to guess passwords, or hard to guess but popular passwords. Remember that there are enormous lists of passwords out there with all the passwords other people have used: thus crackers start with those passwords because chances are, somebody will have thought of the same password.



One more - Use 2fa (not SMS based), especially where password restrictions make strong passwords painful...

– Kristopher Browne 2018-08-10 18:48 UTC

Yeah, that’s true. I use the Google Authenticator app for a few things but I hardly ever get asked for it so it didn’t seem like a big deal in my life. But yeah:

Authenticator app for the big service providers would be a good idea. Using it for your mail provider is specially important as mail is the universal password reset mechanism these days.

  1. Google
  2. Amazon
  3. Facebook
  4. Apple
  5. Dropbox
  6. Domain Name Registrar

– Alex Schroeder 2018-08-10 18:54 UTC

Now that I’ve seen Christina’s list, let me see whether I can find things that are easy to improve upon.

Looking at all the points where I failed, which one would be the easiest to fix. I guess getting rid of Gmail and moving to Protonmail? Or a better browser setup, I guess?

– Alex Schroeder 2018-08-10 21:22

Great list!

Ynas Midgard 2018-08-17 13:59 UTC

Please make sure you contribute only your own work, or work licensed under the GNU Free Documentation License. Note: in order to facilitate peer review and fight vandalism, we will store your IP number for a number of days. See Privacy Policy for more information. See Info for text formatting rules. You can edit the comment page if you need to fix typos. You can subscribe to new comments by email without leaving a comment.

To save this page you must answer this question:

Please say HELLO.