Secure your personal secrets

In this digital world and internet era, personal sensitive information is a synonym for personal secrets. Everything that you are not supposed to share with others, that includes your browsing trends, habits, passwords, credit/debit cards details, PINs, OTPs, emails, personal or official files on your computer and so on. The list is long.

How to Secure yourself on the internet is a pressing question many ask or think these days especially after seeing the current trend of cyber attacks. Here are most definitive precautions one must take to keep their personal sensitive information secure. 

To generalize it is essential to protect both Physical secrets and Digital secrets. As anyone would guess, Physical secrets are secured with a lock and key. The challenge is securing digital secrets due to its shareable and easy reachable nature in the cyber world.

Digital secrets are to be secured during storage, transmission, revoking access after use and finally secure deletion when they expire or no longer required. With the advancements of internet-based utility applications in our society, the number of layman handling secrets increased exponentially in the last few years. This trend opened doors for hackers and social companies to exploit these vulnerable people to loot money, sell their habits, trends, thoughts, and opinions without their knowledge.

Understanding the digital information from the time a person starts touching a digital device is very important. Sometimes even the legal full name of a person could be classified as a secret and should not be disclosed. One might think that by completely isolating from the cyber world they could secure themselves, but that is not true. Governments, friends, colleague and other entities in social & personal life are injecting your information into the cyber world without your knowledge. Therefore it is mandatory to understand how to secure digital secrets than struggling to isolate them. 

Let us look at various entities of cybersecurity from a layman’s perspective

• Basic ethics - Before we jump into more detailed aspects of security lets look into some essential items to remember. Always update your digital device software to the latest and greatest version that offers full protection from virus and malware. Buy phones/systems/OS that promises security updates, never install software from an unknown source. All electronic devices should have all endpoints scanned automatically for any virus or malware or adware, detected and removed. All endpoints mean, network (both wired and wireless), CD drives, USB ports, cloud drives and so on. Experts believe that following these high ethics would eliminate the requirement of installing  Anti-virus software.
• Password - One of the most common entity that even a layman know these days. However, this is the most miss understood entity as well. Passwords should be very long, easy to remember and tough to guess, should not have any words from the dictionary, should contain special characters, should not use the same password for multiple websites/services, should be changed every 60 days and so on. All electronic devices/services need a password, not shared with ANYONE. If multiple people share a device, configure multiple login credentials for exclusive access. Sharing a password could expose the general password creation pattern, opening the options to guess more sensitive passwords like bank accounts.
• Password Manager - Secure passwords are hard to maintain as today average number of services a person uses in his lifetime are more than 100. So it is essential to get a password manager to store, update passwords of all the services. There are different kinds of password managers available in the market. A recommended password manager is KeyPass (http://keepass.info)  which is a free non-cloud based password manager. It can store, username, passwords, individual notes like secret questions and answers used for a website, bank account numbers, mobile app PINs, debit/credit card numbers, CVVs and so on. Setup one powerful password for the password manager and should never forget because losing this could jeopardize all passwords stored in there. KeyPass creates an encrypted file with extension "kdbx" that could be decrypted only with the master password. So it is safe to keep this file on any electronic device or cloud storage without having a fear of someone reading your secrets. A user has to download this file to his local device (computer/tab/phone) open with the application (keypass/macpass/keypassDroid), use the master password and read your secrets before using them. Yes, there is a bit of inconvenience of using multiple apps before accessing but this is a worthy price to pay for security.  
• Encryption -
• • Encrypting data stored on electronic devices - Digital information stored on computers, tabs and phones should be encrypted. Turn on Android and Apple phones disk encryption option; this would make the data on the phone unreadable when accessed directly without unlocking the phone using the correct password. On the similar lines, there is FileVault software for Mac user, BitLocker for Windows and man open source tools for linux. It is must to encrypt all devices a person uses.
  • Encrypting data stored in cloud services - This would protect your information stored in cloud services like Dropbox, Google Drive, and so on. Cloud data would be secure, even if the provider's security breached. One such service is boxcryptor.com it would keep your data on cloud safe from everyone - google, boxcryptor and even any third party cannot read your content.
  • Encrypting emails - Emails stored in providers server have to be kept safe as they contain many secrets - reset passwords, PINs, banking transactions, bank account statements. Even if hackers break the email provider's security, your data that is encrypted would be safe as it could be decrypted only by you who is the owner, who encrypted it can read it. Many tools/ services proved this facility, but the one recommended is protonmail.com . It has zero-access encryption that means the emails sent, received and stored in their servers are encrypted during transmission when originated from protonMail and also encrypted and stored in the mailbox so that even the company themselves cannot decrypt/read them.
• Multi-Factor Authentication - Having a strong password is single-factor authentication. Someone steals it, can gain access to your account. However, securing your account with an additional factor could enhance the security, this is called 2FA (2 Factor Authentication) and its provided by the service provider like Google, Amazon, Twitter, ProtonMail and so on. Mostly, you need to key-in your password and a PIN/ Code that is sent to your mobile or accessed via a mobile app like Google Authenticator, to gain access to your account.  
• Protecting your devices against snooping - First, let’s understand few facts. It is very much possible for someone to snoop into your electronic device or network traffic while you browse the internet. Imagine someone trying to look into your network packets that are transferred from your device to your bank while you are trying to perform a transaction. Many argue that all banking sites and many others use https which is secure. Snooping happens at various intensity, some hackers snoop to steal bank card details to perform financial crimes, some snoop to know browsing/buying habits. Big online shopping players like Amazon uses HTTPS right from its first page till you pay. However, still, remember Amazon collects your browsing habits for analysis and push ads. So HTTPS, in this case, is protecting you from external interference only. Many small players leverage HTTPS only while paying online so all other traffic like selecting your products can be snooped in clear text by anyone. HTTPS is controlled by the website that offers a service (like a bank/shopping site) there are cases where a lot of information other than HTTPS leaked which contributes to the overall corpus that a hacker builds over time and uses it for attacks. Special care should be taking while connecting to a public WIFI; it is very much possible that someone is always watching the traffic. So avoid transacting secrets on public WIFI. Now, the question is, how do we access the internet securely without exposing our secrets - passwords, browsing habits? Fortunately, there is a solution to secure everything between a device and a service endpoint (like a bank/shopping site). That is called VPN - Virtual Private Network, it encrypts all traffic, detects & stops intrusion dynamically. Is VPN the magic bullet? May not be, but they make it harder to associate online data to a particular user/computer. VPN creates a secure pipe from the start to the end in which encrypted data transfer. The moment a hacker tries to breach this pipe, it dismantles and recreates the pipe using a different route. Therefore, it is safe to use public WIFI via VPN.  Even ISP (Internet Service Providers like BSNL, Airtel, etc.,) cannot collect your browsing habits, and it also allows a user to connect to the internet from a different geo-location (other than his physical location). One trusted VPN service that is free (also can be bought) is protonvpn.com it can be installed on computers/tabs/smartphones, the free VPN has only 1 VPN server out of 3 to choose for one device at a time. If you pay, you can connect to the unlimited number of VPN servers across the world with fast internet speeds. One might argue that the VPN servers themselves can access the content. That is not true as Proton VPN uses a zero-knowledge protocol which means the data is encrypted with the user's password (proton mail password) as the key so that neither the company nor the third-party could decrypt. There are few countries where using VPN is illegal please do your research before subscribing/installing in your device. 

To conclude, there are various steps to follow to secure digital secrets

1. Update your device software to the latest.

2. Exclusive password protect your device, user and services

3. Install Password Manager (like KeyPass) and follow password ethics

4. Enable 2FA on all accounts that support it.

5. Encrypt all your devices local data (like FileVault)

6. Encrypt your cloud storage (like boxcryptor)

7. Use encrypted inbox (like ProtonMail) for all bank/debit/credit card/wallet emails

8. Always use VPN (like protonVPN) while accessing financial transactions

9. Never give your phone number/email ID associated with your bank accounts to anyone who should not know it.

10. Never share secrets - Passwords, PINs, card numbers, dates and so on

Remember, enhancing security would only make it difficult for hackers to gain control of your secrets. It is just like, locking your home secures your valuables but cannot guarantee absolute safety.