The most important security advice for home users!

[Make backups of your important information. Totally erase all devices with storage before you give them away]

So, because I manage Information Security for a large organization people ask me for advice on how to protect themselves.

The first thing I tell them (stuck record time) is to do backups.

The most important thing that home users can do is backup their information. That includes photographs.

Its like smokers - the people in a restaurant most likely to complain about smoke are the ex-smokers. The people who are most likely to make good backups are those that have lost information.

Except for the fact that my wife does scrapbooking, we would have precious few printed pictures of my younger daughter. They all reside digitally. If my wife's harddrive had to crash then we (potentially) would lose every photograph of our daughter ever taken.

The thing is that hard-drives are built like everything else - to fail. So, all your precious information (and every household has some) is sitting on a device built to fail. (Read that sentence again and again until you totally understand the implication.

Now, consider that most modern PCs have CD/DVD writers and the disks can be bought quite cheaply. What are you waiting for? Disaster?

Having said all of that, my SD card in my phone was corrupted. There was nothing really important on it (and what is important has been backed up) but I thought I'd try recover what I could from the device. I found a tool called PC inspector File Recovery. It is freeware and will analyse a drive and try to restore files which can be saved onto another drive. It is very easy to use and the price is right (free).

It managed to restore files that non-free software was not able to. I highly recommend this tool.

So, yes, it is possible to get files after a drive has crashed but it is not 100% and Murphy will come to the party by making all files restorable except the one you really want. Backup!

On the other hand, delete is not as permanent as it sounds. So, if you have private information on any device (including PCs, cellphones, USBs etc) assume that the information on them is readable by whoever you sell/give the device to when you are done with it. Another good free tool is Eraser .This tool will erase everything on the disk so it can't be undeleted.

One last thing on this topic. Some malicious software (eg viruses) puts fake file recovery software on your PC, encrypts files and tells you that the files are corrupted, asking you to buy the software so it can "repair" the files. Don't fall for this trick, you will just be making the cyber-criminals rich.

Quick Tought - The Pelzman Effect

I was reading about Ralph Nader on Wikipedia, and came across something called the Pelzman Effect.

This is something I see a lot and I spend a lot of time in my induction meetings trying to work against.

The Pelzman Effect (named after Sam Peltzman, a professor of Economics) is when you are aware of safety controls.

Knowing that you are fairly well protected, you take more risky behavior. This essentially makes all the controls less valuable, worthless or actually creates more risk than if the controls were not in place.

Two of these controls (Firewalls and Antivirus) are important but they do not cover 100% of all risk and users need to know that they must not assume total protection but need to take some of their own precautions.

Backups are even worse.. they are not magical but they are assumed to be.

Backups are like parachutes

..you only realize that you need them when its too late.

This morning there was a story in the Pretoria News about a rapper from the US who had his laptop stolen. Welcome to Joburg.

He is now offering a R50 000 ($7000) reward for the return of his laptop because according to him he has lost 12 years of his work. R50 000 is not a lot of money for 12 years of work but assuming that his laptop is insured against theft then the R50 000 is basically how much the information is worth to him.

Now most of what you find on a laptop hard drive is junk - downloaded jokes, movies, etc etc. and also software which is either very easy to replace or comes bundled with the laptop anyhow. Just how big is your My Documents folder anyhow.. so lets assume that the rapper had just under 12 Gigs of vitally important, irreplaceable stuff on his laptop - that is 3 DVDs worth.

An external CD writer is just under R800. Add on a box of 50 DVDs for just over R130 and you are looking at a backup solution costing about R1000 ($140).

This sounds like a better deal than R50 000. Of course the technology is not going to save you on its own.. you need to actually use the technology. It takes about 5 minutes to burn a DVD but maybe 30 minutes to set the burn image up.

But it is very worth it, yo.

Information Security - its for Small Businesses too!

I am (about) number 30 in the Business section on Amatomu. For those of you who don't know what it is - it is a list of South African blogs, ranked and indexed.

I have read some of the blogs and am impressed at the quality of them and most of them (the business ones) seem to be aimed at small businesses, which is great.

But I am an Information Security blogger and from what I have seen - small businesses don't seem to take Information Security seriously.

For example, I went to a business the other day and they have me listed on their database. But they had my password on their system in plain text. Thank goodness I use a different password for each online service I use but I know some people that use their pin number as a password and some use the same password for every service. Sorry friend, your password is no longer secure.

When you sign up for a movie contract, where does the information go? Who has access to it? Are your credit card details listed, your ID number? If you have to fill in a piece of paper first, where does that go? You probably fill in enough stuff when taking out a movie contract to allow the young kid behind the counter to be able to impersonate you and mess you around.

When you had over your credit card in a restaurant, does the waiter take down all the numbers? More to the point - is this something the manager will look out for?

Does your lawyer, who works from home, keep all your information on his laptop? Or any of it? Is it encrypted? What if the laptop gets stolen? What if all the documents he is busy with for you get wiped out in a fire/virus attack/mistake? Does he do backups? Do you?

Its not like me to sow some fear, uncertainty and doubt but I think that small businesses need to play along.

For their clients and for themselves.

Just tell yourself, Duckie, You're Really Quite Lucky!

When I was quite young and quite small for my size, I had a favourite book by Dr Seuss called "Did I Ever Tell You How Lucky You Are?".

I begins: "When I was quite young and quite small for my size, I met an old man in the Desert of Drize." This man tells the narrator (a small boy) and the reader to "[s]uppose, just suppose, you were poor Herbie Hart, who has taken his Throm-dim-bu-lator apart!" and other strange ways you could be worse off, in the hope that it cheers you up.

It always did for me.

The modern, Information Security version of this I found in my mail box today. It comes from the Melbourne newspaper The Age. It is an article with the amusing title - How to ctrl, alt, delete $48 billion.

Briefly- Someone at the Alaska Department of Revenue formatted a disk with information on it on how $38 Billion (US Dollars) should be divided. The format was perfect - the information could not be retrieved. The backup tapes failed. The only other backup was paperwork in 300 cardboard boxes. To make matters worse there was a deadline on the payment.

None of the actual money was lost but the department had to hire 12 new full time staff and pay 70 staff overtime to recapture all the information again.

So, in the words of Dr Seuss, and the old man in the Desert of Drize:

Some people are much more
Oh, ever so much more
Oh, muchly much-much more
Unlucky than you!"