Knocked into a cocked (Panama) hat

11 04 2016

Unless you’ve been living under a rock for the past week you can’t have failed to be aware of the ‘Panama Papers’. 2.6Tb of data, 11.5m documents, 30,000 lorries worth if you printed then out and so on and so forth.

Information relating to offshore companies, tax avoidance and (possibly) tax evasion, dodgy art deals, alleged money laundering activities, corrupt country leaders and multi millionaires.

So what has this to do with my reader base? Well unless you’ve been keeping something from me and you’re actually an international bad guy, up there with Scaramanga and Blofeld, not a lot on the face of it.

But, let’s just take a step back and look at this from a slightly different angle.

Here we have a law firm, Mossack Fonseca, who prided themselves on guaranteeing confidentiality, indeed on their web site under data security they say “Your information has never been safer than with Mossack Fonseca’s secure Client Portal”. The people they dealt with chose them because they didn’t want their activities to be under public scrutiny, they designed company structures to be obscure and obtuse, everything was geared towards secrecy.

And yet, based on reviews carried out by various security firms, they were running software that was not only out of date, but which had well publicised (and exploited) vulnerabilities. Their servers were not protected by firewalls, the secret data was unencrypted, and it appears their monitoring was so poor (or maybe non-existent) that they failed to notice the exfiltration of vast amounts of data over many months.

So, just to repeat, this company existed in a world where secrecy and confidentiality was everything. Where their customers made fundamental assumptions that their activities would remain hidden from public gaze, and that they could trust their lawyers to protect their interests at all times.

Despite all of that, this organisation appears to have disregarded pretty much every rule of information security.

So if a firm operating in that environment could be so bad at looking after their customer’s data, what about the thousands of other companies with an internet presence who are holding YOUR data. The small (and not so small) organisations you share your details with on a daily basis, the ones you order from online, send emails to with personal details included, upload files of photos, documents or whatever. How confident can you be that they are any better prepared than Mossack Fonseca?

And that’s why this story is relevant to my readers. Poor information security practices are endemic across all industries and all sizes of organisation. We put up with it because we are not big enough to make the difference on our own, and not rich enough to organise the campaigns necessary to force changes through.

Mossack Fonseca is the 4th biggest player in this field, you can bet the clients of numbers 1,2 and 3 have been asking some very pointed questions over the past few days.

Maybe, just maybe, the exposure of the personal details of the richest, most powerful (and let’s be honest, most scary) people on the planet might be the trigger that pushes achieving real information security to the forefront of the thinking of governments and other influential bodies. Could this incident be the tipping point that’s always eluded us, because as sure as eggs are eggs the hundreds of millions of personal records of ‘ordinary’ people that have been leaked over the past year were not seen as important enough.

Fingers crossed.

David

 

Advertisements




Stand and deliver – your money or your (computer) life

28 03 2016

Ransomware. It’s been around for a few years now but in the last 6 months or so it’s really hit the mainstream press, and therefore entered the consciousness of the ‘ordinary person’. Recent high profile cases include a couple of hospitals in the US, a police station and a local authority in the UK.

Before I go into the details and explore what you can, or more likely can’t, do to protect yourself, I think it’s worth taking a step back and looking at the so called ‘underground economy’ of cyber crime.

Back in the day, the bad guys in the computer world were generally loners who did what they did for kicks and credibility amongst their peers. Very irritating, occasionally brilliant and generally disorganised.

That changed once it became clear that there was money to be made from what has come to be known as cybercrime. The professionals moved in as organised crime saw it as another lucrative string to their bow, promising low risk and high returns. Along with the increased organisation and the massive amounts of money, came demands for structure, specialists, quality control and co-ordination as well as the incessant demand for more and better products.

Nowadays a complete ecosystem is in place that is at least as organised as the mainstream legitimate economy. There are market places for the sale and exchange of everything from software to stolen credit cards. Code comes with money back guarantees, free trials, help manuals and even help desks. Every aspect of the economy has specialists who only focus on what they do best and hand on to the next person in the chain when their part is complete.

Into this mix comes ransomware.

Ransomware is, to put it in simple terms, a piece of computer code that you inadvertantly download to your PC. It might infect your PC via an email attachment, a website or even from an advert you click on. However it gets in, it has one purpose, to encrypt your files, and once those files are encrypted they will stay encrypted unless you can obtain the decryption key. And here’s the clever bit, in exchange for a fee usually in bit coins the bad guys will send you the decryption key.

The first you will probably know about it is a screen that will pop up on your computer looking something like this which is from Cryptolocker,

blog-cryptolocker

but they are all pretty much the same. At that point you have three choices:

  1. Restore your files from the backup (you do have backups don’t you?)
  2. Pay the fee
  3. Accept you have lost the files for ever and just move on.

Option 1 is fine as long as the backups are not accessible from the PC and the ransomware has not already found them and encrypted them as well. Assuming they are OK you simply need to disinfect your PC by running up to date antivirus software (the av software usually runs a day or so behind new ransomware so it might not work immediately – check online), delete the encrypted files and restore from your backups.

Option 2 is not ideal for a couple of reasons. Firstly the current fee is around 4 Bit Coins, which at time of press is about $700. For a company, that might be a small price to pay, for the audience of this blog it’s a not inconsiderable amount. Secondly, whilst it’s in the interest of the bad guys to make the process work, there are a number of reasons why it could fail. There might be an error in their code, there might be a problem with their use of encryption or law enforcement may have found them and taken the website down that’s hosting the decryption key. But as I said previously, this is a business and they are keen to maintain their reputation, and anecdotal evidence suggests that paying the fee will result in you receiving the decryption key.

Option 3 depends on you knowing what’s on your PC and whether you care about it. You still need to disinfect your PC but that’s about it.

So what can you do to protect yourself from ransomware? To be honest, beyond the normal good practice of regularly applying security updates and running up to date antivirus software not a lot. The age old advice of avoiding ‘dodgy’ websites, whilst still valid is not sufficient as many mainstream websites are infected these days (often via their advertisers’ sites). Not clicking on unexpected email attachments or following unknown links in emails is also fundamental good practice but is no guarantee that you’ll be safe.

One thing you might want to consider is to remove the admin rights from your normal account and create a separate account that you only use for admin type things (such as installing software). Some of the ransomware relies on being the Administrator on the box, so if you are logged in as a ‘normal’ user then it won’t work, or at least will only work on those files you control. Not perfect, but something.

The bottom line is that you are in the same position as the rest of us in the Commercial world. You have to expect the attack and then plan your response and try and mitigate the impact.

What stuff on your PC do you care about? Unless you are running a business, it probably boils down to photos and music, with a few personal letters thrown in.

You should make sure that you have backup copies of these important things. My previous blog about the Cloud gives some suggestions, but you could also consider offline backups on USB drives, SD cards or whatever. The main thing is to have them somewhere that is not immediately accessible from your PC, so that if bad stuff happens you’ve still got those photos of great aunt Daisy’s 100th birthday.

So that’s it I’m afraid. Ransomware is here to stay and will get more effective and more prevalent as time passes. Using the Internet gets more like Russian roulette every day, bad stuff is out there and it’s likely to get you at some point. All you can do is do the basics right (many of which I’ve covered in previous blog entries), and know what you are going to do when it’s your turn to get hit.

Depressing? Probably, but like everything else, until the general public really cares about something, governments and business won’t pay attention and get the problems fixed. Internet security is bubbling to the surface but at the moment there is more lip service than customer service being paid to solving the problem. Whilst software companies can get away with writing poor code, ISPs can get away with not caring about what they are hosting and Joe Public continues to do stupid things Internet crime will continue on an upwards tick that shows no sign of flattening out anytime soon.

 

Safe surfing

 

David

 

 

 

 





Cloudy security

24 02 2016

“Cloud computing” two words guaranteed to generate a multitude of reactions, from confusion to fear and much in between. Most have heard of it, many talk about it and some even understand it, but what has it got to do with Joe or Jane Public and should you care?

In this post I’m going to try to blow away some of the fog about Cloud, but as it’s only a blog entry and not a book I’m not going to have the space to address all of the issues, opportunities and plain BS that the topic encompasses.

This is not written for the expert, although I welcome your feedback and comments, it’s written for the man or woman in the street who is wittingly or unwittingly putting their personal information and precious photos out there in Cloud Land. Why write a blog post on something that has been around for years? Well I’m finding that as people become more adept at using technology the less they understand it. This is for those people.

So first things first, what (or even where) is the Cloud?

As is so often the case there is no simple answer, or even total agreement on what the answer is. One thing you can be sure about is that it’s not a cloud, or even ‘the internet’.

The Cloud can best be thought of as computing infrastructure that is run by other people where you can store your electronic files or do computing stuff.

Cloud breaks down into three main types, public (anyone can use it), private (only you can use it) or hybrid (a bit of both), and the services offered break down into PaaS (Platform as a Service), SaaS (Software as a Service) or IaaS (Infrastructure as a Service). There is also FOaaS but I’ll let you Google that one.

For most of us we could not care less if it’s a P an I or an S, or even if it’s public or private (but trust me it will usually be public), all we care about is that we have somewhere to store our pictures or music or whatever and we can access them from our phone, tablet or desktop from anywhere in the world, and share them with anyone we want to at any time, ideally with the minimum of fuss.

I’m not not going to touch on Office 365 or Dropbox, or how those of you running your own businesses might want to make use of the Cloud (maybe that’s a topic for another blog), just the ‘in your face’ ones that almost everyone is using by default.

iCloud (Apple), OneDrive (Microsoft), Google Drive (Google) to name but a few, all give you free storage ranging from 5Gb to 25Gb with the option to buy more if you want it, and they are all linked to your vendor account (Apple-id, Outlook or Google etc) so are (theoretically) secure. These are all public clouds in that it’s a ‘one size fits all’ model – no tailoring of the service allowed, with access available to anyone who wants it (albeit with access to your bit restricted to you and (hopefully) blocked to everyone else (apart from those people listed below and those you’ve chosen to share it with)).

So far so hunky dory. Loads of storage, easily accessible and free, what’s not to love?

Well, to  be honest, if you don’t care where your stuff is stored (Europe, America, Asia, under the Atlantic (well maybe not yet but watch this space)), and you don’t care how many employees, contractors, third parties or other relations of your chosen supplier can access your stuff in the spirit of ‘system management’, and you don’t know or care who they can share it with, then not much. But therein lies the rub, with most of the free cloud storage, and quite a bit of the not so free, you have no control over any of this. When you sign up for your cloud storage you agree to all manner of things in the Terms and Conditions (Apple’s runs to over 20,000 words), and unless you hit “I Agree” you can’t use the service. No discussion, no negotiation just a simple “accept or go elsewhere”.

When you put your music collection, precious photos or critical documents “into the Cloud”, what are you actually expecting to happen? How long do you think they will be there, are they backed up, can you transfer them somewhere else (such as if you decide to move from Apple to Android)? The bottom line is you don’t know because you never asked. You just blindly went with the flow because it was there and it was free.

Will Apple stop offering i-Cloud or Microsoft OneDrive? Will they change the T&C and start to charge you for the storage? Will they decide that as part of the free deal they can use your stuff for their own purposes (as Instagram tried to do when they suddenly announced they were going to sell YOUR photos for THEIR benefit – and only backed down after they started to lose market share)? The bottom line is you don’t know, and you can’t know because you don’t have any say in the infrastructure. You’ve given everything to someone else to store in their datacentres and you aren’t even paying them for the privilege.

I’m not saying don’t use the Cloud, what I am saying though use it with your eyes open and consider spreading the risk. Think about what you are uploading and how much it matters to you. If it’s your photo collection then upload them to more than one Cloud provider after all they’re free and it would be rude not to take advantage (I have mine in both Google and OneDrive, just in case one of them has a problem, and there’s always the copy on my own devices).

The same for documents that are not sensitive. But if they are sensitive (for whatever reason) just remember that whilst your strong password (see a previous blog) will stop miscreants cracking into your account and reading your stuff, the Cloud provider’s staff will have access for perfectly valid reasons such as keeping the systems running, and unless the data is encrypted (which is unlikely) they will be able to read it. Now, are they going to target your files out of the Petabytes of data they are holding, well it depends on who you are, but the fact is they could, and if that bothers you, maybe the Cloud is not the right place for you and your data.

So in summary. The Cloud is the perfect Martini solution (Google it if you’re under 35) for your electronic information. But in exchange for the ease of use and free storage you are giving control over the security of your stuff to someone else. If you don’t care, then fill your boots as they say. If you do then maybe you need to be more selective.

As Mr Wordsworth said “I wandered lonely as a cloud, That floats on high o’er vales and hills” it’s just that you have no idea where those vales and hills may be.

Happy surfing

David





Encryption and back doors

21 02 2016

A lot has been written over the past few months about demands that the providers of encryption software provide ‘backdoors’ so that law enforcement can decrypt information that the ‘bad guys’ want to hide. So I thought I’d add my h’app’enth worth into the debate.

As is so often the case in technical matters, much of what has been written is biased or just plain wrong, with vested interests (on both sides of the debate) trying to promote their angle though misinformation and the spread of FUD (fear, uncertainty and doubt).

The current FBI vs Apple law suit is just another thread in this saga, and whilst it is not explicitly about the encryption on the device, the ‘backdoor’ argument is the same.

So lets strip this debate back to it’s bare bones, by posing a few very simple questions.

  1. Is encryption a fundamental necessity for the way we use computing in the 21st Century?
  2. Do we believe that, in the age of ubiquitous social media and the proliferation of computing devices and technologies across the globe, a secret (such as the backdoor key) can be kept out of the hands of those not meant to know it?
  3. Do we trust those in posession of the secret to only use it for the intended purpose, and that all of the checks and balances introduced to manage the use of the secret will be adhered to by all parties?

Starting with the first question, I believe the answer is “absolutely”. Trillions of £’s worth of transactions occur every day across the globe, ranging from international finance down to buying a book off Amazon. Personal details (medical, political, sexual orientation etc) of individuals are stored and shared by and between companies and the wider population to make our services function. Trade secrets are stored to provide long term security to companies and their employees, and so the list goes on. All of these require the information to be secure and trusted and encryption is the only way we can go anyways towards achieving this in the computer age.

The second one is even easier to answer. Edward Snowdon, Chelsea Manning and a host of other less well known whistleblowers have shown that Governments cannot keep their secrets safe, however hard they try. Companies lose hundreds of millions of customer records every year from within their boundaries, and people (who are what everything comes down to in the end) continue to do stupid things, sharing their passwords, downloading viruses and falling for social engineering scams. To my mind this proves that secrets cannot be kept. People will always make mistakes or leak information that they believe should be in the public domain. And that does not even begin to cover the likelihood of threats of violence or extortion to make people reveal information against their will.

The final one is slightly harder to answer. Conspiracy theorists and libertarians will answer with a resounding “No!”. Government spokespeople will offer all sorts of assurances, and the truth lies somewhere in between. To my mind the important point is that ‘governments’, ‘law enforcement’ and ‘secret services’ are not things. They are made up from the people who work there, the same people who do stupid or bad things, often for what they consider to be the right reasons. So in my view there will always be those who can find a justification for bypassing the rules which makes this control unreliable.

So, in summary.

In my opinion, the encryption that we rely on must be secure and effective; we can’t expect the secrets to remain secret; and we can’t reasonably expect all of those in possession of the secret to only use it when legally permitted. That means the argument for mandatory backdoors is fundamentally flawed, even before you consider the technical challenges of trying to create one.

Everything else just becomes noise around the edges. Yes, of course bad guys will use encryption, but as the totally failed attempt of the USA to ban the export of encryption tools a few years back demonstrated, they will always find a tool where the government does not have the backdoor key.

At the end of the day an old secruity truism comes to the fore. “The wall is not there to keep you out, it’s there to see how badly you want to come in”. We know that when law enforcement REALLY want to get something they will, and the absence of a backdoor won’t stop them, but that’s a discussion for another day.

Happy surfing, and remember, just because you’re paranoid it does not mean the bad guys are not out to get you.

If you agree with me or think I’m totally missing the point please feel free to share your thoughts in the commnets section.

David

 





The Internet of Things and security

7 06 2015

Like so much in the world of computing if you ask 5 people for a definition of the Internet of Things (IoT) you’ll get 10 slightly different answers. So for the sake of balance here’s an eleventh.

In my simplistic view, the IoT refers to those items that can be accessed over the internet but which you would not normally consider as being obvious candidates for internet access, nor indeed as being especially computerised. The examples often quoted are kettles, fridges, heating systems and lighting systems, but the list is literally endless.  Want to check on the charge left in your electric car, then look it up on your smart phone, want to record that television programme, then access your recorder from your office PC, want to turn on your oven, set it from the train on your way home. It was estimated that in 2014 there were 16 BILLION wirelessly connected devices and that by 2020 that number would exceed 40 billion.

So why am I writing about being able to turn your kettle on from your car in a security blog?

Let me take you back to those innocent days when the internet first entered the consciousness of the mainstream, when AOL sent you an endless stream of CDs, when you could either make a phone call OR use the internet and 56k was considered to be fast. Back then no-one really thought about security, no-one considered that bad guys might be able to do bad things over the internet and no-one cared.

Fast forward to 2015 and we are bombarded with stories about hackers, e-crime, government snooping and our personal details being on sale on Russian websites. We are encouraged to use strong passwords and to keep safe online (see my previous blogs) and many of us do take more care about using the internet.

Our world is much more connected, and we are more connected, whether over social media, in our dealings with our employers or our banks, or in our day to day lives, and into this maelstrom comes the Internet of Things.

The problem is that the vast majority of devices that make up the IoT have security settings that hark back to those early days. The chips they use are not designed from a security perspective, the security settings (if they even have them) are weak and easily guessed or broken. They are commodities, produced in the millions and designed to be thrown away, not upgraded or patched, if an issue is found, and these devices are connected to your home networks, to your business networks, to our hospitals and the critical national infrastructure.

In the vast majority of cases we have no idea what can be done with these things above and beyond their advertised use. The same chipsets appear across a range of devices with the settings needed for your kettle enabled, but other possible uses still sitting there in the background. Smart meters for your electricity and gas use come with all of the capabilities on the chips, not just the few that you have decided to pay for, and all of this capability is connected to the internet available to anyone who can find their IP address.

So why should you care? Well in order for you to access your kettle from your train, it has to be connected to the internet. How does it do that? Well it’s sitting in your house, plugged in and raring to go, wirelessly connected to your home network and waiting for you to call. To be on your home network it must be authorised and enabled, which means it has to know about your network and vice versa, which would be fine if it looked after those very sensitive details, but generally speaking it doesn’t. So you have a kettle that is holding the keys to your home network, exposed to the internet with pretty much zero security, and if you can see it, so can the other billions of people with internet access.

That means that with relative ease and a bit of readily available kit, those billions of people can access your home network and the devices sitting on it, such as your PC on whch you do your internet banking, and have a wander around to see what they can find.

That is why your remote access kettle finds its way into  a security blog.

So what can you do about it?

Well, to be butally honest very little. If you want to use these devices you have to accept that you have as much chance of improving the security as you have of changing how a vacuum cleaner works. You buy it as a commodity, you take what the manufacturer offers and you live with it. You can’t go in and change the default password on a kettle any more than you can change the spin cycle on your washing machine.

Obviously not all of these devices have the appalling levels of security that I’ve highighted in this posting and I’m sure that much like the progression from the early days of the internet to today things will improve. Security will start to be considered at the design stage and many of the more obvious errors we see know will be resolved, but as we know it’s a jungle out there and at the moment the consumer is at the bottom of the food chain.

There is nothing that can be done to slow the pace at which these devices are being introduced, and to be honest I for one don’t think anything should be. The IoT presents fantastic opportuniites many of which we are only beginning to realise, and can take us down paths we’d never considered possible, but like any technological revolution it comes with risks and we need to go on the journey with our eyes open.

If you choose to embrace the IoT then you are at the vanguard of a brave new world. We have no idea what it will look like and we have no idea where it will lead us but what we do know is that if there is an opportunity to make an illegal buck out of security weaknesses the bad guys will be queueing up to take full advantage.

And on that happy note I’m going to walk through to the kitchen to put my kettle on for a cup of tea.

As always I’d love to hear your thoughts on what I’ve written so please share your comments below.

Keeps safe and happy surfing

David





Have we lost the war? Or are we just fighting the wrong battles?

24 10 2014

It’s October, and so far this year the ‘bad guys’ have obtained well over 100 million customer records and a similar number of credit card details from a variety of organisations ranging from banks to hardware stores. Every day it seems another bad news story appears in The Register or even on the BBC informing us of yet another breach of security, software vulnerability, internet scam or infected cat video on You Tube.

Each news story prompts the rolling out of the same faces, making the same statements and wringing the same hands AND NOTHING CHANGES.

Whilst those who have been paying attention understand that we are no longer up against spotty faced kids in their bedrooms who switch between Doom (showing my age here) and hacking a web site for their entertainment, the wider community does not seem to have caught on.

Our adversaries are running multi million dollar, global enterprises with levels of organisational sophistication and technical expertise that many of their target companies could only dream of. They don’t have to worry about setting up committees and focus groups before deciding whether to raise a project to scope out the work necessary to request a budget to carry out a feasibility study into the value of implementing a new product. They just get on and do it, and in many cases do it extremely well.

That means that we’re always going to be behind the curve playing catchup, and with the pace of technology change we’re dropping behind.

So what do I think we should be doing? Well to use Tony Blair’s famous phrase from 2001 “Education, education education”, but not just in schools and universities.

People write poor code that can be exploited, people click on links in emails and download viruses, people give away their security information to anyone who offers them a free app, people decide on what budgets should be spent on security improvements and only people can make the changes necessary to give us half a chance.

Until most people ‘get it’ then the few of us in the security world who already ‘get it’ are just lone voices in the wilderness, seen as a bunch of geeks wheeled out for soundbites that are forgotten as soon as the next celeb leaves Big Brother.

Sure there are glimpses of change, initiatives such as the UK Governments Cyber Streetwise and Get Safe online (incidentally did you know that 20-26 October 2014 is Get safe online week? No, me neither), are baby steps in the right direction, as are moves by e-Skills UK to promote cyber security training, but none of them are really joined up, and very few make it into the public consciousness.

So how could we achieve effective education of those who really matter?

There is no magic bullet, no one panacea for all our ills, but one thing we do know about the western world is that if something has a celebrity angle, involves reality TV or appears in a soap opera, boy does it get discussed around the coffee machine. If people feel they are directly affected by something (even if they aren’t) then there is a clamour to ‘get something done’ about it. So if we can pique their interest about something that they are affected by then who knows what might happen.

Maybe, just maybe, if we were able to get the conversation going at the soap opera level, that would get the message to the masses. If the scripts were written in an interesting and accurate manner with real human interest about the victims, maybe that would provoke a reaction. If real solutions and suggestions were offered in a joined up way, maybe that would encourage people to find out more and create a demand for change, and change themselves.

We know that simple things like running an up to date operating system and browser, thinking before clicking, not sharing your personal information with the world at large will all help make you less of a target. The other 99% of the population don’t, and most of them don’t even know they don’t know. Until that changes no amount of firewalls, IDS, IPS, anti-malware or any other technical security will win the war for us. No burglar will waste their time picking the locks of the back door when the front door is wide open and the burglar alarm is turned off.

As a start we need to remind people why they have a lock on their front door, and that leaving the key on the doormat or not locking it at all is plain stupid. Once we get that message understood then we can start with the more sophisticated stuff.

That’s my two-penneth worth. Maybe you agree or maybe you think I’m being too simplistic, not clever enough or just dumb? Either way, I’d love to hear what you think so please leave me some comments and if you are a script writer on Coronation Street or Hollyoaks let me know and we can have a chat.

Keep safe

David





Of Passwords and PINS (3)

8 02 2013

In the final part of this series I’ll look at PINs and what you can do to make them easier to remember.

PIN numbers, generally 4 digits, and used to validate debit and credit cards, lock your i-phone, access buildings, secure safes and all manner of  other things have become one of those things we all have to remember. The 4 digit card PIN only offers 10,000 possible combinations, so it’s not really that secure, which is why so many systems operate the ‘3-strikes and you’re out’ control. But why only 4 digits? For the answer you have to ask John Shepherd-Barron the inventor of the ATM. It seems that Mr Shepherd-Barron favoured using 6 digits, but his wife preferred 4!

In the same way as there are commonly used passwords (see the previous post for more details), there are some PINs which appear on an all too frequent basis. A recent analysis by Data Genetics revealed how unimaginative people are.  Over 10% of the PIN codes analysed were 1234, and 6% were 1111. The least common PIN was 8068, but probably best not to use that now as the bad guys can also read the reports.

Maybe you need a different approach. In the same way as you can have a memorable password, why not have memorable PINs? No! Not your birthday, or your partners birthday, or your house number, too many people already know them. But why not use the letters A through J to reflect the numbers 1 to 0, and create a combination that is meaningful to you? First four words of a favourite tune, initials of four family members, first four letters of you home town.

Most organisations which require you to have a PIN allow you to change them, usually on-line or at the ATM, so that’s not much of a chore, BUT, don’t change them all to the same value. Like passwords, it makes sense to have a variety of PINs, and to he honest you’re unlikely to have as many PINs as you have passwords (unless you collect credit cards as a hobby).

The standard instruction (as with passwords) is not to write them down, but again, as with passwords, there are variations on a theme. Clearly no-one would write in their diary: Barclaycard 1234; Amex 3456; M&S 4567 would they (pause whilst some readers tear page out of diary), but it is possible to be more discreet and still record those which you use less often in the same way as you can record passwords.

The frequently used ones you will remember because you use them everyday, especially if you have made the memorable in the first place.

Anyway, that’s enough on Passwords and PINs, next time I’m going to start on Social Engineering and how the bad guys WILL obtain those carefully protected pieces of information you have created.

Until then, keep safe and keep aware

David








%d bloggers like this: