We all do it at this time of the year: We make resolutions to do things better in the New Year. And why not? It’s a great thing to do, starting with fresh goals and a resolve to do better. Here are some ideas for you choose from with a security twist:
I will change my critical passwords.
I will finally start using a password manager (such as LastPass or KeePass).
I will adopt an algorithm for generating strong passwords (at least 12 characters).
Besides being careful what information you post, be sure that your privacy settings are up to date and only allow those people you trust to see your posts. Anything that is visible to the public should consist only of information that does not reveal things that could be used in any of the above.
Every year, I take a look at the published list of worst passwords. I gave you this list back in October, but it occurred to me that there is something you can do about it if, heaven forbid, you are using any password on this list. Surprisingly, the list changes little from year to year, usually with just a few new ones being added. I guess people don’t change their passwords very often, if at all.Here is an excerpt from a TIME report posted at CNN Tech:
SplashData, which makes password management applications, has released its annual “Worst Passwords” list compiled from common passwords that are posted by hackers. The top three — “password,” “123456,” and “12345678″ — have not changed since last year. New ones include “jesus,” “ninja,” “mustang,” “password1,” and “welcome.” Other passwords have moved up and down on the list.
So, what can you do about it if you are using any of these passwords? There is a simple fix: Append or prepend a pattern of characters that you will remember. I call this a Personal Password Pad and discussed it in “A simple password recycling method” back on January 16, 2012. You don’t have to come up with a bunch of different ones as that article suggests, though. You could use the method I suggest in “Another way to create easy-to-remember complex passwords.”
You will want to use a minimum of four characters for your pad. For example, let’s say you choose a year: 1988. Your pad could be !(** or 1(8* or !9*8. You get the idea. Now, just stick that on the front or back or both of the worst password, e.g., !9*8password1, and you have a strong, easily remembered password that will probably never show up on any such list.
More than 2000 years ago, Sun Wu wrote Sun Tzu – The Principles of Warfare (The Art of War), a book that has been used by military generals and other savvy leaders ever since. While I don’t know if our modern techno-generals are applying this to the new cyber-warfare theater, I have to assume that savvy cyber-warriors have their own interpretation. I am in the process of writing a book that applies my interpretation of the principles of The Art of War to cyber-warfare and combat. Granted, I won’t be the first one to look at this, but there’s always room for a fresh viewpoint. I will be posting key excerpts here as the book progresses.
Here is more information from sonshi.com, who claim to have the most accurate translation from the original Chinese text, the reference I will be using as source material. :
Sun-tzu ping-fa (Sun Tzu The Art of War) is one of those rare texts that transcends time. Though it was written more than 2,000 years ago, it is arguably still the most important work on the subject of strategy today.
Written by a brilliant and experienced Chinese general named Sun Wu, The Art of War was intended only for the military elite of his time period. However, this treatise would later be absorbed by others of influence — from the fearless samurai in feudal Japan to the shrewd business leaders of the 21st century.
The new title will be: Sun Tzu Sai Bo: The Art of Cyber War
Well, yeah, but I still recommend it to friends, family and students as one of the best free AV tools. It maintains the VB100 rating. Besides, absolutely NOTHING prevents against malware installing on the PCs of those ID-10-T users who click on links and agree to be infected.
Me, I don’t even run AV on any of my personal computers at home and haven’t for at least 5 years. I have had zero infections of any kind. On the other hand, I have cleaned PCs that were positively toxic with malware and were members of every known botnet despite their running fully updated versions of commercial AV software.
Naturally, I question the efficacy of AV software for the savvy amongst us.
What do YOU think? Hit the comments and let me know.
If you receive any email with a subject line similar to “Re: Changlog 10.2011,” or something similar, delete it immediately: it’s malware. This isn’t a new one, it just seems to be going through a resurgence at the moment. Sophos identified it and wrote about it in February 2012:
Internet users are receiving emails claiming to contain a changelog – but the files attached are really designed to infect computers.
Here’s what a typical email looks like, although the precise wording can vary.
Subject:Re: Your Changelog
Message body: Good day, as promised chnglog attached (Open with Internet Explorer)
The subject lines and attachment names can also be different from email to email – here’s a small selection.
Make sure your anti-malware software is up to date and you should be OK. Just don’t click the link (but you already knew that, eh?)
Ken "The Geek" Harthun takes the mystery out of computer security. You’ll find valuable advice, tips, and news on how to keep your PCs, network, and data safe from attack by crackers and cybercriminals.