---

---

1. What is the Difference Between HTTP and HTTPS?

• HTTP - stands for Hypertext Transfer Protocol. This protocol is used to send data between your web browser and a website.
• HTTPS - stands for Hypertext Transfer Protocol Secure. This protocol is used to encrypt the data sent between your web browser and a website.
• Sensitive information (financial, member info, login credentials) should only be entered or accessed using HTTPS websites.
• A website using HTTPS does NOT mean it is legitimate and safe to use! It only indicates the website employs encryption to protect any sensitive information you send or receive from the website. HTTPS can be easily implemented by any website - this includes malicious sites..
• Most web browsers today will provide you with a visual aid, such as a padlock icon in the address bar, to indicate if the website you are connected to is using HTTPS. The URL will also begin with https://

 Back to Top

---

2. What are SSL Certificates?

An SSL certificate is the mechanism used by a website to encrypt sensitive information that you send or receive. Sensitive information includes your login credentials, bank account numbers, and you home address. Additionally, SSL certificates help verify the identity of a website, as well as provide the unique encryption keys used to encrypt and decrypt information sent between your computer and the website.

• SSL Certificates are issued by a Certification Authority to a specific entity.
• Verifies the identity of the website it is issued to.
• An SSL Certificate issued to Microsoft cannot be used by Apple. Attempting to use another entities certificate would produce an error saying the website is "Untrusted" or "Unsecure".
• A valid SSL Certificate only proves the entities is who they say they say they are. This does NOT prove their legitimacy!

You can view information about an SSL Certificate by clicking on the padlock in your web browser.

 Back to Top

---

3. What is Encryption?

Encryption is the process of modifying information to make it human unreadable, until the encryption process is reversed to make it readable again.

• Encryption is used to send information securely over the Internet.
• Encryption can also be used to store sensitive information.
  • If an encrypted document is stolen, it is rendered useless unless the person has the key or password to decrypt its content.
• Information and file validation is also a primary use of encryption.
  • A cryptographic "hash" (digital fingerprint) is used to check the integrity of data. It helps determine if a file is a legitimate, unmodified version of the original file.
  • Hashes can also be used for authentication, such as verifying passwords
  • Online Hash Generator Tool - https://www.miraclesalad.com/webtools/md5.php

 Back to Top

---

---

4. What is Malware?

Malware is software that is intended to perform malicious actions on a device. The word 'malware' is derived from the words 'malicious' and 'software.' There are many different classifications of malware:

• Virus - Malware that replicates itself when executed by modifying code in other computer programs on your system. Used to bring systems offline by corrupting data and causing system failure.
• Worms - Similar to a virus, spreads throughout devices corrupting data and bringing network systems offline. Unlike a virus, worms can be spread without being executed by the user.
• Spyware - Malware that is used to spy on the user. It can record your keystrokes and activities and use this information to steal passwords and sensitive files.
• Ransomware - Malware that encrypts all of your personal files and holds them hostage. The password to unencrypt your files may be provided to you after you have paid a ransom. The ransom payment is usually demanded in the form of cryptocurrency, such as Bitcoin. Unlikely wire transfers or checks that leaves a documented trail, cryptocurrency cannot be traced.
• Adware - Malware designed to expose you to unwanted, potentially malicious advertising. Adware can also redirect your browser searches to product promotions or even phishing websites.
• Fake/Virus Alert Scam - Malicious websites or advertisements may redirect your web browser to a fake "virus alert" page. This page produces warnings saying your computer is infected, and gives you a number to call. If called they will attempt to have you give them control of your device, as well as send them money for their virus removal "services".

Common Sources of Malware

Malware can be present on any website or software that contains malicious code or downloads. There are a few common sources where malware is the most prevalent:

• Spam emails
• Gambling websites
• Sites offering free games and software
  • Adware is the most common type of malware from these sites
• Adult websites
• Embedded advertisements (banner ads, popups)
• Unpatched software vulnerabilities
  • Ensure your software and operating system have the most up to date patches installed.

Example of Ransomware

If you happen to suffer a ransomware attack, your pictures, documents, spreadsheets, and many other important files will be encrypted by the perpetrator rendering them inaccessible to you. A ransom note, such as the example illustrated below, is presented to you demanding payment in exchange for the decryption key (i.e., password) to decrypt your files.

Real-World Ransomware Incidents

In January 2018, Hancock Health suffered a ransomware attack and had to paid hackers 4 Bitcoins (totaling $55,000 at the time) to unlock their computer systems. Read more about this ransomware attack at https://www.zdnet.com/article/us-hospital-pays-55000-to-ransomware-operators/

A Dallas police department was infected with a ransomware that encrypted over 8 years of digital evidence, including one active criminal case. They were able to recover much of their data, without paying the $4,000 ransom, using data backups they had created. Read more about this ransomware attack at https://www.bankinfosecurity.com/ransomware-freezes-eight-years-police-evidence-a-9664

Example of Virus Alert Scam

A common type of an virus alert scam is a web browser under guise of Microsoft Support. This notification attempts to fool people into thinking that Microsoft has detected a virus on their computer and can offer assistance in removing it. In reality, it is just a scam - there is no virus - it is using scare-tactic to lure you into calling the scammer's toll-free number. A screenshot example of this virus alert scam is shown below.

If you do fall victim to this scam, a number of potential things can happen:

1. You lose money paying the scammer to "remove" a non-existence virus.
2. You potentially can give the scammer remote access to your computer.
3. Scammer can install a remote access tool that can give them persistent covert access to your computer.
4. Scammer can remotely stream screenshots of your computer activities.
5. Your sensitive and important files can be stolen (potential identity theft).
6. Ransomware can be implanted onto your computer.
7. Keylogger tool can be installed to capture your keystrokes (such as when you log in to your bank websites).

To learn more about this Microsoft virus alert scam, please visit www.bleepingcomputer.com.

Example of Fake Alert Popups and Messages

Protecting Yourself from Malware

 Back to Top

---

5. Types of Hackers

Hackers typically have a negative connotation is people's minds. What comes to mind is someone who illegally breaks into systems to steal information. However, there are many classifications of hackers, some good and some bad.

 Back to Top

---

6. Public Wi-Fi Networks

Public wireless networks such as those found in coffee shops, hotels, airports and other public places are often not secure. They are set up with ease-of-use and convenience in mind, but not security.

There is an increased risk of your information being intercepted by someone else. Extra precaution should be used when connecting to a public network.

• Ensure the Wi-Fi has password protection using WPA2 encryption. Never connect to an unsecured, open, public Wi-Fi.
• Avoid connecting to networks using WEP or WPA encryption. These have been compromised and are easily cracked.
• Use a reliable VPN service as soon as you join a public network. This further encrypts the data sent from your device.
• Send sensitive data over secure (HTTPS) websites.

 Back to Top

---

7. Two-Factor Authentication (2FA)

• Two-Factor Authentication (2FA), also known as multi-factor authentication, provides an extra layer of authentication.
• It combines the security of "what you know" (e.g., your password) with "what you have" (e.g., smartphone).
• If your user ID and password are stolen, the perpetrator will not be able to access your account without your smartphone.
• Two-factor is enabled on many of our systems, or other company systems that we use, for added security.

 Back to Top

---

---

8. Complex Password

Passwords are key component to restrict access to your systems and data. It's important to ensure you follow best practices when creating your password. This includes employing password complexity, length, change cycle, and history. You may consider creating a 'passphrase' instead of a password to help make remembering it easier. Follow these recommendations to help ensure you have a strong password so that a cyber bad guy cannot easily guess or hack.

The amount of time to crack a password using a typical household computer, as reported by https://howsecureismypassword.net:

• "password" = seconds
• "MyStrongPa$$w0rd!" = 93 trillion years

Between 1960 and 1977 the secret code allowing U.S. Presidents to launch nuclear missiles was 00000000, as reported by http://qi.com/infocloud/passwords

 Back to Top

---

9. USB Hacking

 Back to Top

---

10. Juice Jacking

 Back to Top

---

---

11. SIM Swapping/Hi-jacking

A type of fraudulent account takeover exploiting a mobile phone carrier's weak internal processes of moving your telephone number to another device.

Criminal gathers enough personal information about a you to create a false identity. They impersonate you and call your provider and claim your SIM card is lost/damaged. Your phone number then is transferred to the perpetrator's SIM card.

Perpetrator can then receive your calls, emails, and text messages.

 Back to Top

---

12. Summary

Cyber criminals are constanting trying to scam people of their money, their identity, and their personal data. For businesses and government agencies, cyber criminals also go after their money. But more importantly, it is proprietary research data, state secrets, and other information that can hurt a business or a national that's often the most sought after. Some say it's not "if" I get hack, it is "when." Everyday, people's private data are breached. Some make it to the news, many don't. You can make it harder for scammers and hackers to target you by following these simple and cost effective measures:

1. Make sure websites you access is secure with HTTPS when accessing personal data (e.g., bank, emails, payment gateways).
2. Encrypt sensitive data when possible.
3. Install an reliable antivirus software.
4. Avoid clicking on attachments and links in emails you are not expecting.
5. Scrutinize popup message and email alerts to identify their legitimacy.
6. With a reliable VPN service when on public Wi-Fi.
7. Enable two-factor authentication when available on systems and websites you access (e.g., banking, stock trading)
8. Create strong passwords or passphrases.
9. Don't plug into your computer USB cables, thumb drives, or other devices from unknown sources, such as a USB cable or drives you may find in an airport waiting lounge.
10. Don't charge your smartphone using public USB charging stations.
11. Call your mobile phone service provider to add extra security to your account by enabling a secret or card password.

 Back to Top

---

13. External Reference

• Never forget a password with LastPass Online Password Manager
• Learn more about ransomware at McAfee
• Microsoft virus alert scam - https://www.bleepingcomputer.com/virus-removal/remove-virus-alert-from-microsoft-tech-support-scam
• Online hash generator tool - http://www.miraclesalad.com/webtools/md5.php
• How secure is my password? - https://howsecureismypassword.net/
• Florida Man Arrested in SIM Swap Conspiracy - https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/
• Hancock Health suffered a ransomware attack - https://www.zdnet.com/article/us-hospital-pays-55000-to-ransomware-operators/
• Ransomware Freezes Eight Years of Police Evidence - https://www.bankinfosecurity.com/ransomware-freezes-eight-years-police-evidence-a-9664
• 10 Most Hacked Passwords Revealed in 2019 report - https://www.foxbusiness.com/technology/most-hacked-passwords-2019

 Back to Top

---