Many of the social threats we face 2
can be mitigated with the same type of security controls. 3
So the threats I’m referring to you here 4
are things like identity theft, 5
social engineering like, phishing, vishing, smishing, 6
scams and cons, 7
as well as things like doxing and spam. 8
In this video I’m going to talk through the security controls 9
that protect you from these social threats. 10
And these security controls can be split 11
into two categories. 12
The first we’ll cover is behavioral changes. 13
This is changing what you do 14
to doing something safer instead. 15
Such as not downloading and running 16
an executable from your email. 17
The problem with behavioral changes though 18
is it relies on us humans 19
and we are fallible and often forget to do the right things. 20
The second type of control 21
is technical security controls, 22
such as using sandboxing 23
on your email client or browser, 24
and of course we use defense in depth 25
so that we have layers 26
of both types of security controls to protect us. 27
So we will implement behavioral 28
and technical security controls to protect us 29
against these social threats. 30
So let's start with behavioral changes 31
in order to protect ourselves from these threats. 32
The number one defense 33
against social attacks is 34
if you didn't request it do not click on it. 35
Do not respond to it and be immediately suspicious. 36
This includes your emails, sms's, telephone calls, 37
messages, things that pop up on the screen, 38
messages within messaging apps. 39
If you didn't request anything, always be suspicious of it. 40
Some of the messages you can get 41
can be very enticing and seem legitimate, 42
but if you didn't request it, 43
or you weren't expecting it, 44
then it should always be considered suspicious. 45
If you have subscribed to an emailing list, 46
then you are expecting the emails and those are fine, 47
but if you suddenly get an email you never requested, 48
then it should be immediately considered suspicious. 49
So remember, 50
if you didn't request it, do not click on it. 51
Next is never download and run 52
any file you don't100% trust, 53
especially not if you’ve been sent it via a link 54
or via an attachment from an email 55
that you did not expect. 56
All email attachments should be 57
considered suspicious and should be 58
put through some technical security controls 59
that we’ll detail later, 60
so don't run attachments and files 61
that you don't % trust. 62
Never enter things like usernames and passwords 63
or personal information 64
after following a link or a pop up. 65
Always, always go to the site 66
by typing in the URL yourself into the browser. 67
In fact, these days, companies should not be sending out 68
links in emails asking you to log in 69
and enter personal information. 70
You will find that companies that understand security 71
don't do this anymore, 72
they ask you to go to the site, 73
and login without providing a link. 74
They tell their users that 75
they never send out links, 76
because they want to train their users 77
not to click on links sent in emails 78
to their site, 79
because they know that that very same tactic 80
is used in phishing attacks, 81
so they want to train their users 82
out of receiving links in emails 83
and clicking on them to their site. 84
So never enter usernames, passwords, or personal information 85
after following a link. 86
Go to the site itself, 87
enter the URL yourself within the browser. 88
You can attempt to validate the link. 89
In the section on know your enemy, 90
we talked through how links are manipulated, 91
so you can check to see whether it 92
conforms to any of the known attack types 93
and link manipulation techniques. 94
So are there any subdomains? 95
Like we can see here, 96
so we have a subdomain here, 97
so we know that that’s dodgy looking, 98
and that's the real domain. 99
Are there any subdirectories? 100
Here we can see some subdirectories, 101
so we know that that’s a dodgy URL. 102
That’s the real domain. 103
Are there any misspellings? 104
And here we go, misspellings, that's a dodgy domain. 105
So it may be tricky to understand, 106
as I’ve gone through this, 107
which are the real domains depending on your experience. 108
So the real domain is the one 109
that is to the left of the high level domain, 110
that’s the high level domain 111
and it has no slash to the left of it. 112
High level domains are things like 113
dot com, dot net, dot org, 114
and when we say that there is no slash to the left of it, 115
this does not include the slash in the http://. 116
Are they using IDN homographic attacks? 117
So here we can see them using 118
zero's instead of O's, and a one instead of an L. 119
With different fonts it can be impossible 120
to see the difference, so do note that. 121
Are they using hidden URLs using html a tags? 122
You can hover over the link, 123
and we can see there in the bottom left, 124
this is revealing the correct URL, 125
but it doesn't always reflect the correct URL, 126
it depends on your email client, your browser, 127
what Java script is being used, 128
but that's a good indicator of what the real URL is. 129
And also here, hovering over, 130
you can see what the real URL is. 131
You can try right clicking, 132
copying the link 133
and pasting it into notepad, or another text data. 134
This may reveal the correct link, 135
but not always, again because of Java Script 136
and depending on the client that you are using. 137
You may also find that 138
this is an image, but again, 139
if you hover over it, 140
it might show you the real URL, 141
but if you don't trust it, don't click on it. 142
You might see unsubscribe links like this one, 143
usually at the bottom of emails. 144
These can be used as attack URLs as well. 145
Don't click on the unsubscribe links. 146
You can copy and paste the link here 147
to see if it’s on a known bad URLs list, 148
but if it’s very new, it won't be on here, 149
so you can't rely on this 100%. 150
In fact, just use this as an indicator 151
as there are tens of thousands of 152
phishing URLs at any one time. 153
Now, if we look here, 154
it’s going to tell us 155
based on the various services 156
whether it’s been reported as a bad URL, 157
and as we can see, the BBC is safe for now. 158
This has already been discussed, 159
but in reference to these particular attacks, 160
a valid defense is minimizing 161
your personal information disclosure. 162
I’ve stated this in many parts of the course. 163
You need to limit the amount of information you give out. 164
Simply by doing this, you reduce your risk. 165
You are less likely to be a target 166
of these social attacks 167
and naturally remain more private. 168
We’ve just covered minimizing your registration 169
and alternatives to providing information on registration. 170
This, again, makes you more secure 171
and less likely to be a target of these attacks. 172
If they don't know you exist, 173
if your email, your phone numbers, 174
your messenger ids aren't available, 175
they can't know it 176
in order to send attacks to you. 177
Especially, do not post your email address, 178
your phone number, your messenger ids online, 179
like say in forums, on your blog, and those sorts of things, 180
because they will be picked up by automated scanners, 181
and then you’ll become an automatic target 182
of phishing attacks, scams, cons, 183
spam, and whatever else the latest social attack is.