Imagine the first time you receive a e-bill as an email from some service provider. It's an unfamiliar address, the reply-to and the sender emails don't match. This could be because it's a group mail, like a club or civic organization. One example is an alumni group which might only contact you once per year, asking for contributions. There may be a google warning associated with this contact.
Another example is the malicious link. In the past these were obvious: you can hover over the text to see which domain it points to and if that domain seems to have anything related to the stated purpose. Many websites have similar names. Or simmilar names [sic].
If in doubt, ask a friend right ? Google could have associations with your question, but more often than not, it won't display the actual answer in a cybersecurity related question. So you are on your own. Also, fraudsters and scammers target the people whom they believe will be most vulnerable. They are extortionists, preying on your lack of knowledge to harm your finances. Any new vendor that contacts you is a potential scammer. Buyer be ware. Ask up front if that vendor will give you a receipt. Local service businesses are required to have licenses. Ask for the license number and whether a permit is involved.
The scammer may have found your information randomly or they may have purchased it on the Dark Web or some malicious group may have published your information publicly. Every day it seems there is less privacy on the web and your home address and phone number is only a click away. Even deleting your social media accounts might be a bad idea. If you own your online presence and check it regularly that's better than having a zombie online presence. Check your family's presence periodically to ensure that they haven't been scammed. There's an online trend in doxxing, which is publishing another person's info without their knowledge or permissions. There's also a growing trend of malicious slander online. That negative information may be from someone who thinks that your opinions or even your geographic area is cause for slander. Formerly known as "oppo" research, in political groups there is now a trend of fabricating associations to unrelated events or people. In recent events, having the same name as someone else may result in negative attention to your media profile. "Opposition Research" has its origins in "friendly" competition among potential rivals. However, you as an unsuspecting non-candidate may be shocked to discover that you're being profiled and potential blackmail file is being compiled to use against you if you do raise your public profile. This information and misinformation can even be sold to others.
There are many examples of online misinformation, and you should think twice about joining a group which you know little about in advance. Groups which previously seemed innocuous may now be the targets of scammers or misinformation. Joining that group will also make you a target.
Do you really need a store-credit finance account ? Do you really need to transfer a balance to get a better rate? Each of these will alter your credit rating. You can also have permanent issues related to cyber breach disclosures of your Personal Information. If someone stole a database of credit information would you know about it before the criminals put that information to use?
Google has some good warnings to change your passwords to strong, difficult to guess, combinations of numbers, letters, and punctuation marks. You don't have to change your password often if it's secure and you don't reuse passwords across multiple sites.
Educate your self by taking a short course in cyber security. Search Security on Vendor Sites.
FB started inserting suggestions for "donate" button if you re-post some article for sale or vendor information to your timeline. Another new suggestion template is the "marketplace" where FB might interpret keywords as a personal sales pitch and ask if you want a wider audience or a listing in "marketplace".
Anytime you sell something on social media it's caveat emptor, except also caveat venditor
You just became a seller due to a social media suggestion. It's up to you to decide how to conduct the entire transaction. I would suggest a daytime local-only exchange in a busy location if it's a small item. Maybe not worth the hassle to deal with strangers for a few dollars. FB doesn't seem to illustrate who can see your marketplace item. Look into any new "commercial" that you see on social media. "Look Into" with a healthy dose of skepticism.
Facebook also let's you know which of your friends have "liked" or used a service. That is just one way in which your small listing becomes part of a permanent record.
Speaking of FB, do you really need the apps on your phone ? Most of those sites can be browsed through Chrome or another web browser. The App seems more user-friendly, but is more intrusive on your personal space than the same website in a browser.
Anything you post on social media is permanently available to future employers and internet sleuths.
Some people are joiners, and they only join groups that they know are "safe spaces" where all the opinions will be similar and there will be a lot of puppy and kitten pictures. There's nothing wrong with this, however it's unlikely that this type of group will contain all the information that you need to make informed decisions on local events or whatever topic is stated to be.
Any type of attachment can include bad links or bad macros or bad OLE. Only open attachments after you've thought about whether the attachment has any value to you personally. If it's from a local business, check the sender email and verify that it's actually identical to their previous email address.
Be suspicious ! Be Alert ! Don't engage the Trolls ! Value your data and protect it.
DISTRUST 08-05-2021
The #1 principle of Defense is Distrust
#2 Defend by Disengaging
#3 If it's a Stranger, RUN !
#4. Cyber Defense is A LOT like parenting. Supervision IS Essential
#5. Engage with Your Coworkers and Share BEST PRACTICES
#6. READ !!!
#7. Take a Class, sign up for Learning, somedays you plod, other days you fly
#8. Brian Krebs krebs on security follow this blog
#9. Get a Degree
#10. Have a spare computer that you don't use for Financial transactions and leave this one on, while disconnecting and placing your primary laptop in a safe place.
#11. change your passwords and don't reuse them
DISTRUST 08-06-2021
Know your PD, example, save this info on your local non-emergency PD number, someone will get back to you.
The phone system is currently down for incoming calls to Police Headquarters. If you need to contact the police station, please call 215-348-4200 and an officer will return your call. Once the phone system is back up this message will be updated.
SAFETY 02-08-2022
Fire up your Wi-Fi, VPNs, and firewalls galore—it’s #SaferInternetDay! These days you can do almost anything on the Internet. But, so too can malicious cyber actors. Stay vigilant, but if you do fall victim, report it to http://ic3.gov.
02-17-2022
Test your colleagues with new information.
2-20-2022
There are free tools to help with cybersecurity, I'm going to check them and see what's useful https://www.cisa.gov/
https://thehackernews.com/2022/02/us-cybersecurity-agency-publishes-list.html
https://www.cisa.gov/free-cybersecurity-services-and-tools
101 tools to learn about cybersecurity
ALERT>
malware alert in Feb 2022 regarding
https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
This joint Cybersecurity Advisory (CSA) between the Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) provides information on WhisperGate and HermeticWiper malware as well as open-source indicators of compromise (IOCs) for organizations to detect and prevent the malware. Additionally, this joint CSA provides recommended guidance and considerations for organizations to address as part of network architecture, security baseline, continuous monitoring, and incident response practices.
This is a personal blog with no official affiliation or employer affiliation. It's updated periodically with useful information. Reminder it's in no way associated with any employer and if you notice any reference to actual companies or services it's not intentional. Links may have expired and are only suggestions.