5 Basic Digital Privacy Tips for the Average Person

As interconnectedness and personalized browsing experiences have become the norm in today’s society, our lives – increasingly impacted by our digital footprint – have become less private.

The right to digital privacy has been a slow growing movement, and its biggest marker was the General Data Protection Regulation that affected the EU. It was a legislation that marked digital privacy as a right, not a privilege, and companies all over the world scrambled to make sure they met compliance requirements. Now, for users in the EU, the internet has become a more transparent place for how information can be used or accessed. But, of course, it is still a work in progress.

Digital privacy is a massive topic that can be very easy to get lost in, especially if you’re new to to it. However, you don’t need to be a security expert nor do you need any particular reason to bolster your privacy on the internet. So, here are some simple security pointers for the average web user:

1. Keep your OS updated

The first thing you will want to do on any device is to make sure that it’s updated. As annoying as the notifications can be, they’re there for a reason– updating is important, and not staying on top of them could mean your device has a critical security vulnerability. So whether it’s installing the new macOS update, iOS 12, or Windows update, etc. just make sure that you take the time to do it, or set up your device to update automatically (usually configurable in settings).

2. Be mindful of Public WiFi networks

Public WiFi and open networks are notorious for security vulnerabilities, and connecting to one could pose a risk to your information. While it’s better to avoid connecting to them at all, sometimes you need to, so if you do, here’s some steps you can take. First, you’ll want to make sure that you turn off network sharing (usually preferences can be found in wifi settings on your computer). On Windows devices, you can also make sure you have Windows Firewall enabled.

When browsing connected to a public network, it’s best to avoid anything sensitive, such as banking. You should check to make sure that what websites you navigate begin their web address with HTTPS, as well.

3. Use a secure web browser

Make sure that you are using a secure web browser. Mozilla Firefox and Google Chrome are some good choices depending on what you want. If your priority is maintaining as much privacy as possible online, Firefox is better as it has more options for privacy and security. It is also the more lightweight program of the two, which would run more smoothly on computers with less RAM.

Google Chrome is also a comparatively secure option in terms of protecting you from malicious websites, however it is less private as a lot of data about your internet usage goes to Google. That may be a positive or a drawback to you depending on your priorities – if you want privacy, it’s not so great, but if that’s not extremely important to you and your computer is equipped to handle Chrome’s resource demands, then it’s a solid choice as well for speed and reliability.

In either browser, make sure you take the time to navigate to the Privacy and Security settings and adjust them to your preference. Some of the settings you can choose are to clear your browsing data/history, unselect the option to send usage statistics to the company, enable Do Not Track requests, etc.

Additionally, you can install an ad blocker extension/addon, such as uBlock Origin, in both browsers that serve as an additional line of defense against unwanted scripts running on websites that you visit. This can be easily obtained for free through the Chrome Web Store or Firefox Addons.

4. Secure your social media profiles

One common mistake that people make on social media platforms like Facebook and Instagram is that they have their profiles set to public. This means that anyone, anywhere can view your profile and all the content on it. This is great for a business page, but maybe not so much for your personal profile.

Every big social platform has privacy and security options. These can usually be found in the settings menu, where you can navigate to the relevant sections to adjust what you want to be seen. On Facebook, you have full control over who can see your posts and friends lists, as well as whether you can be searched by your email address or phone number.

Location settings – especially in mobile apps – are important to adjust as well. Snapchat is a big one for this, as people on your friends list can observe your location in real time through the Discover function unless you have disabled this feature and turned on “Ghost Mode.”

5. Consider using a VPN

Finally, if you want to take your security one step further, you can look into getting a VPN — that is, a virtual private network. VPNs have significant privacy advantages by encrypting your connection and acting basically as an intermediary between your device and the internet. They mask your IP address, which is basically as telling in the digital world as your home address is otherwise. The VPN works by routing your traffic through its own servers, and gives you the option to appear to be from any location of your choosing.

But since you are relying on the VPN in this way, it’s important that you get a trustworthy one, such as F-Secure Freedome. Most free VPNs are unreliable at best or actively malicious at worst.

Overall, online security and privacy is what you make of it. But these simple steps will at least ensure that you’re going in the right direction. For more in-depth information on the topic, be sure to follow @CentryCyber on Twitter.

This article was written by Kristina Weber of Centry Global. If you would like help or have questions, feel free to contact us via email at info@centry.global! Be sure to subscribe to Centry Blog for original bi-weekly articles relevant to the security industry.

Finding a Due Diligence Provider for your Business and Why it Matters

Company risk manifests in a myriad of ways, some seemingly easy to overlook and others more obvious. One of the biggest risks in day to day operations for companies comes from third parties – distributors, potential employees, suppliers, service providers, contracts, clients, vendors, etc. Basically, anyone on the outside who encounters your business can potentially become a threat.

Many security providers cannot address the risks and complex environment in hostile and emerging markets. They lack the needed infrastructure and cultural understanding to be able to provide services of high quality in locations outside of their area of familiarity, as majority of them are based in Europe or the USA.

The security provider should be a key to success, helping companies in business growth, finding new markets and mitigating potential risks.

What you don’t know can hurt you

Companies need to make informed decisions. The initial analysis of potential ventures and associated risks will show you the situation at hand and how to move forward.

Due diligence is an important part of every process at a business, from mergers and acquisitions to finding the right suppliers and clients.

Comprehensive due diligence is extremely important to getting the whole picture of an applicant or a third-party business relationship. Without going through this process, you expose your business to countless threats.

Making an assumption based on surface-level information could lead to difficulty conducting business, or at worst, breaching sanctions.

It is true that financial losses can be offset by insurance when damage has already taken place, but the stains on the company’s image and reputation are not covered by insurance policies.

Due Diligence makes it possible to secure the business environment before the incident occurs. In the case of cost structure, this can be found to be more of an investment as opposed to an expenditure.

What kind of provider do you need? The most suitable provider will be the one who has already dealt with the same or similar case in the market you want to operate and has built their network. They can aid you in determining potential risks as well as creating a mitigation agenda and budget through their local resources.

Field agents can provide insight into the environment you will be operating. They have years of professional experience and know the details of the potential uphill battle with the dangers and risks. There is no substitute for local knowledge.

It can be invaluable to know the backgrounds and affinities of the stakeholders that influence the company’s operations. Even if the investigated entity is perfectly compliant and lawful, these types of reports can be helpful simply on a level of benefitting the business relationship with information and perspective. The best results with Due Diligence investigations are often achieved when the process is outlined and integrated into the company’s entire business strategy.

Finding the security provider you need is not an easy task. Seek references and assess the capabilities of each provider. Look for companies who work on the ground and know the environment. The ideal partner has developed their network in the location you want to operate in and they possess local knowledge and expertise.

No one has all the answers, but you can find most of them by choosing the right security provider.

This article was written by Daniel Dadikozyan of Centry Global. It has been cross-published in the CIISCM magazine. For more content like this, be sure to subscribe to Centry Blog. If you have any questions or comments about due diligence services, feel free to reach out to us at info@centry.global!

 

Common Security Dos and Don’ts

internet screen security protection

Photo by Pixabay on Pexels.com

Security vulnerabilities pose a major threat to organizations. Breaches can be costly both in terms of finances and reputation. So what are some ways that businesses can take initiative in protecting themselves against some of the most common security threats?

Do screen job applicants and third parties

Comprehensive background checks and due diligence are extremely important to getting the whole picture of an applicant or a third-party business relationship. Without going through this process, you expose your business to countless threats.

Typical background checks may verify an applicant’s residence and professional history, where a comprehensive investigation including social media can identify more subtle connections that would alter the risk recommendation. If your business does not have the resources to do this on its own, we can help you with our team of professional investigators. Don’t hesitate to reach out!

For more on this subject, be sure to read our article on The Significance of Background Checks in Business.

Do come up with a robust security policy

Your organization’s security policy should cover procedures for preventing, detecting, and acting upon misuse, as well as guidelines for conducting due diligence. These should be crafted with a plan for investigating insider breaches as well.

A good security policy also contains risk management processes. Check out our guide here on the basics of forming a risk management plan.

Don’t overlook the threat of malicious emails

Your organization might go to extremes to secure their email system, and yet it remains one of the most vulnerable links in the chain. All it takes is for one person to inadvertently click on an malicious link or attachment to infect all the computers in the office.

A good rule of thumb is to never open a link or attachment if you don’t recognize the sender, and ensure that your employees are trained in recognizing this type of scamming/phishing behaviour. For help in training your employees on this, don’t hesitate to reach out to our cyber security team.

For more content like this, subscribe to our blog for regular updates in the security industry. If you have any questions or comments, feel free to reach out to us on Twitter @CentryLTD

Centry Opens New Office in Mexico City!

el-angel-de-independencia--mexican-landmark-552812595-59863bb2519de2001116a0d0

We are pleased to announce the expansion of Centry Global to Mexico!

Our new office is now open, located on the 17th Floor Torre Magenta, Paseo de la Reforma 284, Colonia Juarez, Distrito Federal, Mexico CP 06600.

new office.PNG

As an international security company, our work takes us across the world. With the opening of this office, we are now able to better serve our clients in the region.

At Centry, our focus is to develop long-term, communicative working relationships to provide you with the best resolutions to your security challenges. While our combined expertise primarily revolves around security and risk management, you will find among our ranks professionals in corporate and private investigations, fraud control, and experts in programming, software development, and more.

We look forward to meeting and working with more clients across Mexico. Please don’t hesitate to contact us!

📧 info@centry.global 📱 +52 55 4739 2665

 

Typosquatters

Man typing

Of all the myriad of ways that we can be duped, scammed, or otherwise taken advantage of on the internet, “typosquatting” remains one of the easiest to stumble into.

Perpetrators of this scam will purchase site domain names that are very similar to popular pages that people visit, usually by changing the .com part of the web address to .cm. This preys on people who make typos, which is, suffice to say it – all of us.

These duped sites can range from being pop-up laden cesspools riddled with viruses or malware, to near-replicas designed to fool users into inputting login information that can be manipulated later.

So, who is doing this? While these types of tricks can occasionally be tied down to lone actors (given how easy it is to obtain a domain name), KrebsOnSecurity identified the marketing firm Media Breakaway LLC to be behind more than 1500 of these false .cm domains. The company is headed by one Scott Richter – a convicted felon who has been the target of several successful lawsuits for illegal spamming. Other companies related to Richter include Dynamic Dolphin and affiliate[dot]com, also related to email spam.

Just how many people are falling victim to these scams? More than 12 million in a 3 month time frame – amounting to a potential of 50 million per year, according to an analysis conducted by Matthew Chambers. Several of these visitors additionally were found to be coming from .gov and .mil sites in the USA, which are the official federal government and military domains. Many popular news sites, social media, banking, and music streaming sites have these malicious doppelgangers.

The actionable item to protect yourself in this situation ultimately boils down to a matter of double-checking the web address before you hit enter, or bookmark your most commonly visited sites.

For more information on this subject, feel free to reach out to us @CentryLTD on Twitter or any of our other social platforms.

Valid Concern or Tap Anxiety? An Evaluation of Amazon’s Alexa Recording

406213-amazon-echo

Alexa’s Infamous Recording

A couple weeks ago, a family from Portland, Oregon reached out to Amazon to investigate after they said that their home assistant device, “Alexa”, had apparently recorded audio of a conversation the couple was having and sent it to an acquaintance of the family who’s phone number was in their contact list. The acquaintance, a work colleague, immediately contacted the family to let them know that he received the recording, and told them to turn off their devices.

This led to a media frenzy, where countless sources questioned the security of home assistant devices, likening them to Orwellian wire-taps.

So, how did this happen?

When the family contacted Amazon concerning the incident, an engineer investigated the logs of the device and was able to confirm the recording and subsequent sending. The engineer suggested that the entire issue was a result of the device misinterpreting the sounds of the distant conversation as commands to record and then send the message.

The company’s official statement was:

“Echo woke up due to a word in background conversation sounding like “Alexa.” Then, the subsequent conversation was heard as a “send message” request. At which point, Alexa said out loud “To whom?” At which point, the background conversation was interpreted as a name in the customer’s contact list. Alexa then asked out loud, “[contact name], right?” Alexa then interpreted background conversation as “right”. As unlikely as this string of events is, we are evaluating options to make this case even less likely.”

Is this something to be genuinely concerned about?

In short, not really: the coverage of this situation was greatly sensationalized.

If you have ever “butt-dialed” someone from your mobile phone, this is not very much different of a circumstance. Accidental activation leads to a call or command.

Anyone who has one of these devices has probably heard it pipe up unprompted, whether it was from a distant conversation, the TV, radio, computer, etc. It’s important to remember that home assistant devices like Amazon Echo and Google Home are still first generation pieces of technology – they are learning on the go, and there is bound to be a few hiccups along the way. Human speech interpretation is very hard.

Both devices have large, easy to see indicators of when they are listening for the keyword. Alexa has a bright blue circle that illuminates on the top, and Google Home also lights up.

However, if you are still worried, here are a few steps you can take:

  1. Turn on command tones in the app. This makes the device “ding” when it hears the keyword, letting you know that it’s actively listening.
  2. Don’t ignore it when it speaks– tell it to stop. Otherwise, it could continue mishearing commands.
  3. Protect your WiFi network. These devices are only as secure as the network they connect to.
  4. Check in the app to see if there are any stored recordings, and delete them.

If you have any questions or comments, feel free to reach out to us on any of our social media profiles. For more content like this, subscribe to Centry Blog for weekly articles!

GDPR: Day One

The European Union’s General Data Protection Regulation (GDPR) officially went into effect today. The new regulation exists to give citizens of the EU control over how their data is used. It’s extensive and comes with the promise of harsh fines if non-compliant companies experience a data breach.

Centry’s GDPR Guide, shown on the popular webcast This Week in Law, breaks down the who/what/when/where and why of GDPR for those who want a quick briefing of what this means and why it’s important.

Now, on day one, we are observing the first ripples in the pond of this new policy. Already, BBC has reported that some US-based news websites are unavailable in Europe as the new regulations have come into effect. Some of these include the New York Daily News, LA Times, Chicago Tribune, Orlando Sentinel, and Baltimore Sun.

The above news sites are part of the Tronc media publishing group. Others under Lee Enterprises have been similarly affected. Freelance developer Owen Williams created a blog called GDPR Hall of Shame to provide a tongue-in-cheek illustration of the blunders some companies have made as they have taken the first steps of navigating the ruling.

One of the worst offenders is the social media/micro-blogging platform Tumblr, which requires users to manually deselect more than 300 boxes to prevent each entity from utilizing their data. There is no available option currently for mass selection.

Others are taking the change to data regulation in full stride. Microsoft has expanded their GDPR-compliant policy to protect all of their users, not just the ones based out of the EU.

If you have any questions or comments about GDPR, feel free to contact us on any of our social platforms!

For more content like this, subscribe to Centry Blog for weekly updates related to the security industry, cyber security, risk management, compliance, and global affairs.