Practical Cyber Hygiene Tips for Families and Individuals During Cybersecurity Awareness Month

Aaron Crow (0:1.594): Hey, welcome to Protect It All podcast. I'm your host, Aaron Crow. This time is, this is a cybersecurity awareness month, October here in the States, and wanted to do a couple of episodes focusing on that. I know that folks that listen are gonna be varying different experience around cybersecurity, but we all need cybersecurity and cybersecurity for.

Aaron Crow (0:27.092): work in enterprise and OT and critical infrastructure is different than maybe what you do at home. so being a father, having three kids that use technology, a wife that is not in the cybersecurity space, in-laws and parents and grandparents and all that type of stuff, right? It's, get a lot of questions on, how do I, how do I secure my stuff? Right? How do I make sure I'm, doing things safely? so wanted to really focus on that. So.

Aaron Crow (0:56.130): This being Cybersecurity Awareness Month, I figured it'd be great. So this one is gonna just focus on cyber hygiene, covering practical steps to protect yourself in this digital world where we use our technology for everything from phones and email and banking and purchasing things online, you name it, right? So let's dive into that. What is cyber hygiene?

Aaron Crow (1:24.356): Cyber hygiene, like personal hygiene, right? It's doing routine things to make sure that you're maintaining health in your cyberspace, right? So maintaining your devices, accounts, passwords, making sure that your systems are patched and updated, that you're not using insecure platforms, whether that be your browser, your phone is updated, your...

Aaron Crow (1:53.382): laptop or computer, whether it's a Mac or a Windows or Linux is updated. know, and those things are constant, like you're constantly having to look at those things. Every year, cyber attacks become more and more frequent. You see them in the news. They're more and more sophisticated. And sophisticated does not mean that it's always a nation state or really sophisticated attacker. But the attack itself is getting more sophisticated. Some of that is going to be because, you know, A.I. is going to

Aaron Crow (2:22.170): to lead to the complexity and sophistication being increased, whereas the knowledge of the attacker can be less because they can just copy and paste. They can very easily take an attack created by somebody else and pivot that in. As they become more and more, you see more and more of them.

Aaron Crow (2:46.882): Small mistakes like weak passwords, ignoring software updates. They really opened the door to being attacked, being vulnerable, identity theft, financial loss, being locked out of your Twitter account. One of my customers is a celebrity and right after releasing an album, their Twitter account got hacked and overtaken and they got it back. But the problem is,

Aaron Crow (3:16.006): You know, that happens. It happens with everyone, whether you're a celebrity or you're just a normal person. your, your account can and will be taken over if you use the same password across all of your devices. Right? So passwords are hard and, but they're also really easy to manage. You can have password vaults. and we'll, we'll dive into that as the next, the next kind of topic we're going to talk through. But, according to a recent study, human error is involved in 90 % of cyber attacks.

Aaron Crow (3:44.250): Good cyber hygiene helps reduce those. So most attacks are because of people making mistakes. You click on the phishing email, use the same password at multiple places. You give somebody your account login and credentials, that kind of thing, right? So all of those things are problems and they will impact your, your cyber hygiene. So essential cyber hygiene practices use strong and unique passwords. That's hard, right? You have to remember it. How am I going to remember a strong

Aaron Crow (4:14.136): and unique password for every device. I've got literally thousands of accounts and passwords from email and all the different things. So it's really hard. What is a strong password? Strong password, it's avoid using the same password across different accounts. It's using complex random characters. It's using uppercase and lowercase, it's numbers, it's special characters. It's making sure it's long.

Aaron Crow (4:44.258): long being relative, you know, when every, every account that you create, there are some password requirements and, and you have to fit within them. So maybe they can only be a max of 15 characters or maybe they can be 25. it's really hard to remember a 25 character unique password. It's impossible to remember. if you, unless you have idetic memory, which I do not. so how do you, how do you manage that? And that's, that's using a password manager. There's a lot of free ones out there.

Aaron Crow (5:13.638): I'm not gonna name names of them, go look up Search Password Manager. Depending on your platform, Chrome has one built in. Even Apple now has a password vault built into their iOS and their Mac OS. But I recommend getting a third party. That way it can transfer between non-Apple devices, even if you are in an Apple ecosystem. It's something that is, you have to remember the password to the vault.

Aaron Crow (5:43.038): It is encrypted. You can have multi-factor authentication, which we'll also get into next, but these are all things that'll help. The thing that people don't think about is some of the passwords like password to your email. If you look at your banking, your Facebook, your all those things, they all use the fallback method to gain access to those accounts will have that email. So if somebody gets access to your email, they can reset your password.

Aaron Crow (6:10.146): on your banking, on all these different things, and they're the ones that are going to respond to that authentication. So your email password is super critical to maintain control of, and the way that you maintain control of those things are A, setting up multi-factor and B, having a unique password and making sure that you lock that down and you're monitoring that, right? So Google and others do a really good job of

Aaron Crow (6:36.312): you're logging in from a unique or a place we've never seen or a browser we've never seen. Is this really you and making sure that you're validating those. so strong passwords, leads to enabling multifactor authentication. What is multifactor? a password is something that you know, and multifactor that that is something that you have. if you go back to the definition, right, it's, it's, you know, I've got a,

Aaron Crow (7:5.702): I don't have it around with me, it's in my bag, but I've got a YubiKey. YubiKey is a physical token that you can have that you can plug in. It also has NFC that you can use to click. And it is a unique encrypted key that with the password and this key, then I can authenticate that I physically have the thing that I'm supposed to have. So if somebody got my email, for instance, they don't have my key.

Aaron Crow (7:32.496): they would have to have my email and my password and this key, right? So it's another thing. Like you see biometrics a lot with your phone. It's using your face, which I don't love. I actually preferred the fingerprint back in the day, but that's a whole nother conversation. So like my Mac, I have the fingerprint, but again, even biometrics can be faked with pretty simple.

Aaron Crow (7:58.618): capabilities, but it's still better. None of these things are supposed to be perfect. A lot of these things are just supposed to be make it a little bit harder, right? So when you get that notification from Google, you're having to put in that thing. You should also get it. So you're saying, Hey, what's going on? making sure you're turning on MFA, multi-factor authentication, all your important accounts, banking, email, social media, like you should have all of those so that if something happens or somebody's trying to get in, they'll be

Aaron Crow (8:26.818): And guessing a password is not that hard. with, with products out there, it's very easy and you can put your email in. there's a lot of systems, which I'll put some in the link on the show notes that you can put your email in and see if it's been a part of a breach. And if it has, then more than likely that password is, and if you use that password anywhere else, then that other account.

Aaron Crow (8:50.914): is very easy to be hacked. Cause what these hackers do is they do the same search and they see your email is used in all these different places. And there was an attack at this one. So they grabbed that password and they tried it every place else. They try every bank, they try every email system, all that kind of stuff. Right. It's very easy to do. Tip three is keeping your software up to date. Kind of talked about that in beginning, but it's super simple making sure you're turning on, on a software updates.

Aaron Crow (9:18.608): that you're updating those things very frequently, you're looking to automatically do those things. The key thing I'll show into that is, or talk to is making sure that you have backups. Patches are great, they're needed because they fix vulnerabilities that were unknown. Like as a software provider, whether it's Mac, Apple, Windows, Linux, or whatever application that you're using, when they find a vulnerability,

Aaron Crow (9:47.770): they release an update. So that update is pushed out. You see it all the time when you update your apps on your phone. Also Windows updates and again, Mac updates as well. But the problem is that sometimes they break things. Apple's usually pretty good where very infrequently does an Apple update break my phone or cause a blue screen or reboot or issue rebooting. Whereas Windows, it happens a lot. I don't want to dive into that, but there's a lot of reasons for that.

Aaron Crow (10:17.124): That's why Apple controls their ecosystem. so software updates often include patches for security vulnerabilities. and then by delaying those updates, you're leaving your devices exposed. in, in the spaces I use, I work in, a lot of times there's really old systems that aren't patched. It's not the only attack factor that you can, or only mitigation you can do to fix those things, but it definitely helps. And especially as an end user at home, you got to make sure you're updating your, your, your wifi, your

Aaron Crow (10:46.692): your router, your devices that are connected to it, your TVs and everything has software on it and making those things can be vulnerabilities that people can pivot into. Tip four is be wary of phishing attacks. Phishing is when attackers trick you to give personal information, passwords, et cetera, and they're pretending to be a legit entity.

Aaron Crow (11:14.346): They may send texts or emails. They may look like they're coming from your organization, your spouse, your kid, your boss, the CEO. You'll see these texts come across. You'll see emails come across and they look legit and they're getting better and better. Years ago, they were really bad English and you could really tell because they didn't look real at all. But now they've gotten more and more sophisticated. So it's hard to see. So the good rule of thumb is, is if you didn't expect an email from someone,

Aaron Crow (11:43.366): or from an organization, don't click the link. Like I've seen them come in, hey, you want a $250 gift certificate to Walmart, just click this link to fill out your registration. I didn't sign up for anything. So why should I be getting this? It's not worth it, right? So there's all sorts of ways to prove the validity. The biggest piece is as they get more more sophisticated and more and more realistic looking, you're going to likely...

Aaron Crow (12:11.984): probability says you'll probably click on one at some point. As soon as you do, you need to make sure that you take actions, right? If you do click on things, you need to reach, if it's a corporate asset, you need to make sure that you're reporting that to your IT organization that they can know if it's your personal device, you need to make sure that you get it scrubbed. You probably need to change passwords. if it's malware, they could be monitoring and actually key logging everything.

Aaron Crow (12:40.730): There's a lot of danger that goes into that once you've clicked on those, those bad links. tip five is securing your home network. A lot of folks don't think about it from, from an IT perspective or corporate perspective, you know, corporate puts products on your, on your device and the corporate network is secured by firewalls and all that. They've got teams that are monitoring and, but it's your home. A lot of people use the router that came from their provider. and they just create a wifi, you know, SS ID and they connect all their devices to it.

Aaron Crow (13:9.592): especially nowadays with all of these smart devices from phones to your stinking coffee machine, your TVs, your refrigerator, everything is connecting wifi and is, you know, internet of things. And all of those things have vulnerabilities. So in my home network, I'm probably more extreme than most are willing or able to do.

Aaron Crow (13:37.624): I have the router that was provided by my provider and then I have a firewall behind that. that I don't have access, nothing that has access to nothing on my network. There's a whole nother layer that I control that they have no access to. And then I have multiple wireless networks split up. I have one for my kids, one for me and my wife, one for all OT devices. So I never put a TV on the same network as my devices, for instance.

Aaron Crow (14:6.210): and there's a couple of reasons behind that. Some of those is not to do with security. Like the reason I have my kids separate than my, my, mine and my wife's a lot of reasons. it's a way that I can limit internet access. I can make sure they're restricted, you know, on certain sites. I can also turn off that network at certain times. their friends come over all the time. So they're giving out that password, even though I have a guest password, a guest network. there there's just a lot of benefits in those things.

Aaron Crow (14:35.450): And obviously the, the, why I have a dedicated, you know, IOT network is because I don't want all these other devices that are more than likely going to have vulnerabilities that may or may not get patched ever. don't want them being able to pivot to, you know, my critical assets like my laptop and my, my other devices. So, so having those things segmented reduces the attack footprint. They can get into those devices potentially, but they won't be able to get to my.

Aaron Crow (15:3.214): you know, personal information on my laptop or my network storage and things like that. make sure you basic things that you can do beyond that is just changing the default password. You know, when you get a device from your AT &T or T-Mobile or whomever provides your home internet service, they came with the default router. It's usually printed on the back of it. Change that. Make sure you're using the most

Aaron Crow (15:29.028): the highest level of encryption that the wifi allows usually like WPA3. And then when you're traveling and traveling doesn't mean on a plane, it just means when you're out and about. Don't connect to the wifi any place if you don't need to. If you do need to make sure that you have a VPN. A VPN will help segment kind of like I was just talking about our home network.

Aaron Crow (15:53.860): It'll segment your device so that people can't get to it locally. So if you think about it, when you join that wifi, you're on the same network with whomever else is on that free network, which could be, you know, the pastor of the local church. It could also be the hacker that's taken a cybersecurity course and wants to see what they can do with the devices that pop up on the network and they could own you, right? So make sure you're really careful when you're out and about and connecting to hotel wifi's or Starbucks or McDonald's or

Aaron Crow (16:23.234): any of those types of things only connect when you actually need to. Like I just got back from Canada and my internet service, because it's a US plan, I have a very limited amount of data that I can use over, you know, in another country. So I was definitely connecting to Wi-Fi, but I was making sure to connect with a VPN so that my data or my device was secure. Okay. So what are...

Aaron Crow (16:51.044): some good tools that can help you, you know, maintain good cyber hygiene. I talked about a few of those, but password managers is one of those. LastPass, Keeper, Bitwarden, Apple even has one built in. Those things store your passwords. They can generate passwords for you. when I have a new, I've got a plugin on my Chrome browser for I use Keeper.

Aaron Crow (17:20.230): when I log into a website or I'm creating a new account, it creates the password for me and it stores it. So it's completely unique. I've never used it anywhere else. I can say the complexity that I want it to be. I want it be 25 characters long. I want to use uppercase, lowercase numbers and special characters. Again, using whatever credential or whatever requirements the website or the site that I'm trying to do this has.

Aaron Crow (17:47.044): And then I don't have to remember multiple websites or multiple passwords. I can keep everything in one secure location. I've got it on my phone. So I've got the app here. The actual database with all my passwords is stored in the cloud, but I have the encryption or the decryption key. it is encrypted and I have to provide those things. The thing to remember with that is if you lose it, they have no, no one has access to your vault, right? So you lose the key. There's no getting it.

Aaron Crow (18:16.718): throwing away and you're creating all new passwords for everything. So it's really important. I even have a keeper plan that is a family plan. So all of my kids have their own keeper account. So all of their accounts and their email passwords and all the things for their credentials are stored there and I can share them things like Netflix and whatever other common things that we need to share.

Aaron Crow (18:43.172): I'm not sending them in a text in raw text. I'm not sending them an email. I'm not writing down the password. I can share that with them. They open it and I can restrict how frequently they have it or I can put it in their profile so they can see it every time they open the app. That's another way that you can share it inside and outside without having to send the password clear text. That's a struggle that a lot of folks have and they don't think about how do I share credentials if I need somebody to log into something? Which really

Aaron Crow (19:13.014): you need to be careful, like never share your credentials for your email, your banking, that kind of thing. You should always create an additional account for your spouse, your significant others, et cetera, instead of sharing the same account for critical systems like that email, banking, that kind of thing. Netflix is Netflix, right? So that's completely up to you how you want to do it. There's not a whole lot of risk there other than just somebody having access to your Netflix account, which you can always get changed.

Aaron Crow (19:42.522): The next is going to be antivirus and anti-malware. Even the most careful users can get malware on your device without any knowledge of you downloading an application, installing something, clicking on something, things happen, right? So having virus software on your device is super important and it's not super expensive. Like I've got, again, I've got a family plan of the product that I use.

Aaron Crow (20:11.942): And it goes on every computer that we have, everybody's phone. It provides a VPN service. Like it's, you know, a couple hundred dollars a year to provide that for my family of five, to have all of that access. So it's super important and valuable. But it's not a silver bullet. It's not going to protect you from everything. It's not invincible, but it is another protection in depth that you can help provide.

Aaron Crow (20:39.332): I mentioned earlier, to double down on it, another tool would be backups. Make sure that you're regularly backing up your devices, your photos, your applications, your documents, all those things can be lost. If malware hits your device and they encrypt your device and you can't get it, and you're not willing to pay their ransom, then you're going to lose access to your system, right? And you can rebuild it from scratch, but you lose all of your data.

Aaron Crow (21:9.562): Whereas if you have a backup, you're not, you don't have to pay the ransom because you, maybe you lose a day's worth of data. Like whenever the last time you took your backup worst case scenario, let's say that you do a full backup every week. you, you lose a week's worth of So be it. Right. It's better than losing everything. so think about it. Like back in the day, you had physical pictures. You wanted to make sure you kept some of those in a, in a safe or something. If your house burns down, this is, this is that,

Aaron Crow (21:38.618): The other one is, it's gonna be the privacy settings on your social media. And I'm not a good example for this because I have a very public social media presence intentionally. But my kids and my wife have private ones. Review your privacy settings on your social media accounts and make sure that you limit the amount of personal information that you share publicly. You see this a lot.

Aaron Crow (22:4.538): Bad actors will watch your social media as you're getting on a plane. Hey, we're going to Florida, we're going to Hawaii, wherever. And they know you're not home. So many will use that as an opportunity to break into your house, to steal your car, to whatever that may be, right? So just think about that as you share things and post things. I have friends that they don't post where they're going until they get back. And then they're like, hey, we just went to Hawaii, right? And they do it when they're back. So that way they're not actually sharing their

Aaron Crow (22:34.138): that the fact that there's nobody home at their place.

Aaron Crow (22:41.446): Next is kind of the future of cyber hygiene. Not exactly future, because a lot of it is here. But as we see in the future more and more things, the rise of the internet of things. What is the internet of things? It's the devices that have an IP address that can get on the internet, right? Again, I talked about it before, everything from your toaster oven to your microwave to your refrigerator, your TV, your Wi-Fi, your cameras, you know.

Aaron Crow (23:9.638): your smart thermostats, everything is now connected, right? All of those things being connected are a potential vulnerability, right? So keeping those things updated as you can, many of them don't update very frequently because, you know, maybe they don't care about them, maybe they're from China, whatever that may be, but definitely work on segmenting those things on a separate network. AI and automation in cyber hygiene.

Aaron Crow (23:37.026): AI based security tools are becoming more popular. they can help detect anomalies, automate updates, other things that you can do. I'm not exactly sure how beneficial that is in a, in your personal world, just because it's a stretch AI is still just not there. but the future I see AI kind of stepping in to kind of help monitor those types of things. I envision a place where everybody has a firewall in their home.

Aaron Crow (24:5.094): If you don't have a firewall, I highly recommend looking at one. They're not super complex or super expensive and they get you a lot of benefit. And if you're just depending on the router that came with your home internet service, you're putting yourself at risk because those are the same routers that everybody with that provider has. They're probably at the same thing and many people haven't changed their password. There may be back doors to get in. Like there's just too many things that you can't control in those. it's again, it's not a super expensive

Aaron Crow (24:34.590): mitigation to add in a firewall, a different router, different wifi, etc. Right? So my network, I've got multiple access points. I've got a firewall and all that is controlled by me. It's not my internet provider has no access to it. The router that your internet provider provides you, they have access to it. So they can see, should they be looking at your data? Should they be pivoting? No, but they have access and I don't like anybody having access to my environment.

Aaron Crow (25:4.280): So, all in all that, just to recap, you know, talking about the cover, we covered the basics of cyber hygiene, using strong passwords, using MFA, updating your software, staying vigilant, about emails and texts that come in, phishing attacks that come in these small habits, make a huge difference. The other thing is to teach your kids this, teach your wife this, to, you know, have these conversations, give examples. Like these are things that we don't naturally understand.

Aaron Crow (25:33.222): So as a kid, may see an email come in and just, well, that's cool. Let me click on it, right? Teaching your kids this is a good thing because maybe you're the best at it and you've never clicked on a phishing email in your life, but your kids are connected to the same network that you are at home. And if they click on it, then they are now the vulnerability in your environment. So their device is now rooted. It has malware and now the bad actors are in your network and you didn't know about it, right? The kid didn't recognize that they did anything.

Aaron Crow (26:1.720): and now your environment is impacted, right? So my challenge to everyone today is take one step, whether it's updating your password, implementing a password vault, enabling MFA specifically on your most critical assets like banking, email, that type of social media, and then also review your privacy settings on those platforms as well.

Aaron Crow (26:26.458): Definitely share this episode if you think friends and family would benefit from some cyber hygiene knowledge. And next week we'll dive into another topic around maybe phishing scams or something else. Not exactly sure yet, but anyways, thank you for tuning in. Make sure that you follow Protect It All podcast on social media. Make sure you subscribe and like, and definitely look forward to reviews. Definitely read all those.

Aaron Crow (26:54.874): Thank you all for everyone. If you have any questions, definitely submit your cybersecurity questions. I can address them in future episodes. And if you'd like to be focused in spotlight on an episode, shoot me an email info at protectedall.co and love to have you guys come out on the podcast. Thanks a lot and until next time.

Transcript lightly edited for readability.