In
cybersecurity
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
, cyber self-defense refers to
self-defense
Self-defense (self-defence primarily in Commonwealth English) is a countermeasure that involves defending the health and well-being of oneself from harm. The use of the right of self-defense as a legal justification for the use of force in ...
against
cyberattack
A cyberattack is any offensive maneuver that targets computer information systems, computer networks, infrastructures, or personal computer devices. An attacker is a person or process that attempts to access data, functions, or other restricted ...
. While it generally emphasizes active cybersecurity measures by computer users themselves, cyber self-defense is sometimes used to refer to the self-defense of organizations as a whole, such as corporate entities or entire
nation
A nation is a community of people formed on the basis of a combination of shared features such as language, history, ethnicity, culture and/or society. A nation is thus the collective identity of a group of people understood as defined by those ...
s.
Surveillance self-defense is a variant of cyber self-defense and largely overlaps with it. Active and passive
cybersecurity measures provide defenders with higher levels of
cybersecurity
Computer security, cybersecurity (cyber security), or information technology security (IT security) is the protection of computer systems and networks from attack by malicious actors that may result in unauthorized information disclosure, the ...
,
intrusion detection
An intrusion detection system (IDS; also intrusion prevention system or IPS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically rep ...
,
incident handling and remediation capabilities. Various sectors and organizations are legally obligated to adhere to
cyber security standards
IT security standards or cyber security standards are techniques generally outlined in published materials that attempt to protect the cyber environment of a user or organization. This environment includes users themselves, networks, devices, all ...
.
Background
Organizations may conduct a
penetration test
A penetration test, colloquially known as a pen test or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system; this is not to be confused with a vulnerability assessment. T ...
via internal team or hire a third-party organization to audit the organization's systems. Larger organizations may conduct internal attacker-defender scenarios with a "
red team
A red team or team red are a group that plays the role of an enemy or competitor to provide security feedback from that perspective. Red teams are used in many fields, especially in cybersecurity, airport security, law enforcement, the military a ...
" attacking and a
"blue team" defending. The defenders, namely
threat hunters,
system administrators
A system administrator, or sysadmin, or admin is a person who is responsible for the upkeep, configuration, and reliable operation of computer systems, especially multi-user computers, such as servers. The system administrator seeks to ensu ...
, and
programmers
A computer programmer, sometimes referred to as a software developer, a software engineer, a programmer or a coder, is a person who creates computer programs — often for larger computer software.
A programmer is someone who writes/creates ...
, proactively manage
information systems
An information system (IS) is a formal, sociotechnical, organizational system designed to collect, process, information storage, store, and information distribution, distribute information. From a sociotechnical perspective, information systems a ...
, remediate
vulnerabilities
Vulnerability refers to "the quality or state of being exposed to the possibility of being attacked or harmed, either physically or emotionally."
A window of vulnerability (WOV) is a time frame within which defensive measures are diminished, com ...
, gather
cyber threat intelligence
Cyber threat intelligence (CTI) is knowledge, skills and experience-based information concerning the occurrence and assessment of both cyber and physical threats and threat actors that is intended to help mitigate potential attacks and harmful eve ...
, and
harden their
operating systems
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also inc ...
,
code
In communications and information processing, code is a system of rules to convert information—such as a letter, word, sound, image, or gesture—into another form, sometimes shortened or secret, for communication through a communication ...
,
connected devices, and
networks
Network, networking and networked may refer to:
Science and technology
* Network theory, the study of graphs as a representation of relations between discrete objects
* Network science, an academic field that studies complex networks
Mathematics
...
. Blue teams may include all information and physical security personnel employed by the organization.
Physical security
Physical security describes security measures that are designed to deny unauthorized access to facilities, equipment and resources and to protect personnel and property from damage or harm (such as espionage, theft, or terrorist attacks). Physica ...
may be tested for weaknesses, and all employees may be the target of
social engineering attacks and
IT security audits. Digital and physical systems may be audited with varying degrees of knowledge of relevant systems to simulate realistic conditions for attackers and for employees, who are frequently trained in security practices and measures. In full-knowledge test scenarios, known as
white box tests, the attacking party knows all available information regarding the client's systems. In
black box tests, the attacking party is provided with no information regarding the client's systems.
Gray box tests provide limited information to the attacking party.
Cybersecurity researcher
Jeffrey Carr Jeffrey Carr is a cybersecurity author, researcher, entrepreneur and consultant, who focuses on cyberwarfare, cyber warfare.
Career
In 2008, Carr founded Project Grey Goose, a crowd-sourced open-source intelligence effort to attribute major cyber a ...
compares cyber self-defense to
martial arts
Martial arts are codified systems and traditions of combat practiced for a number of reasons such as self-defense; military and law enforcement applications; combat sport, competition; physical, mental, and spiritual development; entertainment; a ...
as one's computer and network attack surface may be shrunk to reduce the risk of
exploitation
Exploitation may refer to:
*Exploitation of natural resources
*Exploitation of labour
** Forced labour
*Exploitation colonialism
*Slavery
** Sexual slavery and other forms
*Oppression
*Psychological manipulation
In arts and entertainment
*Exploi ...
.
Measures
Authentication
* Enable
multi-factor authentication
Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...
.
* Minimize
authentication
Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicati ...
risk by limiting the number of people who know one's
three common authentication factors, such as "something you are, something you know, or something you have." Unique information is characterized as possessing a particular degree of usefulness to a threat actor in gaining unauthorized access to a person's information.
* Reduce one's
social media
Social media are interactive media technologies that facilitate the creation and sharing of information, ideas, interests, and other forms of expression through virtual communities and networks. While challenges to the definition of ''social medi ...
footprint
Footprints are the impressions or images left behind by a person walking or running. Hoofprints and pawprints are those left by animals with hooves or paws rather than feet, while "shoeprints" is the specific term for prints made by shoes. They ...
[ to mitigate risk profile.
* Regularly check one's social media security and ]privacy settings
ByPrivacy settings are "the part of a social networking website, internet browser, piece of software, etc. that allows you to control who sees information about you". With the growing prevalence of social networking services, opportunities for pri ...
.
* Create strong and unique password
A password, sometimes called a passcode (for example in Apple devices), is secret data, typically a string of characters, usually used to confirm a user's identity. Traditionally, passwords were expected to be memorized, but the large number of ...
s for each user account
A user is a person who utilizes a computer or network service.
A user often has a user account and is identified to the system by a username (or user name). Other terms for username include login name, screenname (or screen name), accoun ...
and change passwords frequently and after any security incident.
* Use a password manager
A password manager is a computer program that allows users to store and manage their passwords for local applications and online services. In many cases software used to manage passwords allow also generate strong passwords and fill forms. Pas ...
to avoid storing passwords in physical form. This incurs a greater software risk profile due to potential vulnerabilities in the password management software, but mitigates the risk of breaches if one's password list were stolen or lost and in the case keyloggers
Keystroke logging, often referred to as keylogging or keyboard capturing, is the action of recording (logging) the keys struck on a keyboard, typically covertly, so that a person using the keyboard is unaware that their actions are being monitored ...
were present on machine.
* Pay attention to what information one might accidentally reveal in online posts.[
* Change default passwords to programs and services to prevent ]default credential vulnerability A Default Credential vulnerability is a type of vulnerability in a computing device that most commonly affects devices having some pre-set (default) administrative credentials to access all configuration settings. The vendor or manufacturer of such ...
exploitation
Exploitation may refer to:
*Exploitation of natural resources
*Exploitation of labour
** Forced labour
*Exploitation colonialism
*Slavery
** Sexual slavery and other forms
*Oppression
*Psychological manipulation
In arts and entertainment
*Exploi ...
techniques.
* Appropriately use password brute force attack
In cryptography, a brute-force attack consists of an attacker submitting many passwords or passphrases with the hope of eventually guessing correctly. The attacker systematically checks all possible passwords and passphrases until the correct ...
prevention software such as Fail2ban
Fail2ban is an intrusion prevention software framework. Written in the Python programming language, it is designed to prevent against brute-force attacks. It is able to run on POSIX systems that have an interface to a packet-control system or fir ...
or an effective equivalent.
* Never give out logins or passwords to anyone unless absolutely necessary and if so, change them immediately thereafter.
* Use security question
A security question is form of shared secret used as an authenticator. It is commonly used by banks, cable companies and wireless providers as an extra security layer.
History
Financial institutions have used questions to authenticate customers ...
s and answers that are impossible for anybody else to answer even if they have access to one's social media posts or engage in social engineering.
Anti-social engineering measures
* Do not plug in found external storage devices, such as external hard drives, USB flash drive
A USB flash drive (also called a thumb drive) is a data storage device that includes flash memory with an integrated USB interface. It is typically removable, rewritable and much smaller than an optical disc. Most weigh less than . Since firs ...
s, and other digital media
Digital media is any communication media that operate in conjunction with various encoded machine-readable data formats. Digital media can be created, viewed, distributed, modified, listened to, and preserved on a digital electronics device. ' ...
.
* Beware of social engineering techniques and the six key principles, reciprocity, commitment and consistency, social proof, authority, liking, and scarcity.
* Beware of shoulder surfing, wherein threat actors collect passwords and authentication information by physically observing the target user.
* Beware of piggybacking (tailgating) wherein a threat actor closely follows an authorized personnel into a secure facility.
* Beware of wardriving
Wardriving is the act of searching for Wi-Fi wireless networks, usually from a moving vehicle, using a laptop or smartphone. Software for wardriving is freely available on the internet.
Warbiking, warcycling, warwalking and similar use the sam ...
, wherein threat actors use mobile hacking stations to gain unauthorized access to WiFi. Wardriving might also consist of the use of parabolic microphones to gather acoustic data, such as passwords and personally identifiable data.
* Be cautious when browsing and opening email attachments
An email attachment is a computer file sent along with an email message. One or more files can be attached to any email message, and be sent along with it to the recipient. This is typically used as a simple method to share documents and images.
H ...
or links in emails, known as phishing
Phishing is a type of social engineering where an attacker sends a fraudulent (e.g., spoofed, fake, or otherwise deceptive) message designed to trick a person into revealing sensitive information to the attacker or to deploy malicious softwar ...
.
* Refrain from interacting with fake phone calls voice fishing, also known as "vishing".
* Scan links to malicious websites with Google Transparency Report to check for known malware.
Preventative software measures
* Use, but do not rely solely on antivirus software
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the nam ...
, as evading it is trivial for threat actors. This is due to its reliance on an easily altered digital signature
A digital signature is a mathematical scheme for verifying the authenticity of digital messages or documents. A valid digital signature, where the prerequisites are satisfied, gives a recipient very high confidence that the message was created b ...
, a form of applied hash, of the previously known malicious code.
* Use an antimalware product, such as Malwarebytes Anti-Malware
Malwarebytes (formerly Malwarebytes Anti-Malware, abbreviated as MBAM) is an antivirus software, anti-malware software for Microsoft Windows, macOS, ChromeOS, Android (operating system), Android, and iOS that finds and removes malware. Made by ...
, in conjunction with an antivirus with vulnerability scanning features.
* Update and upgrade
Upgrading is the process of replacing a product with a newer version of the same product. In computing and consumer electronics an upgrade is generally a replacement of hardware, software or firmware with a newer or better version, in order to ...
all of one's software and programs — including, but not limited to a user's operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
, firmware
In computing, firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. Firmware, such as the BIOS of a personal computer, may contain basic functions of a device, and may provide h ...
, software drivers, and device drivers
In computing, a device driver is a computer program that operates or controls a particular type of device that is attached to a computer or automaton. A driver provides a software interface to hardware devices, enabling operating systems and ot ...
. Use dedicated updating-software and enable automated update features.
* Encrypt
In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can decip ...
one's computer and phone.
* Regularly create backup
In information technology, a backup, or data backup is a copy of computer data taken and stored elsewhere so that it may be used to restore the original after a data loss event. The verb form, referring to the process of doing so, is "back up", w ...
s of one's data.
* Uninstall insecure software such as Adobe Flash
Adobe Flash (formerly Macromedia Flash and FutureSplash) is a multimedia Computing platform, software platform used for production of Flash animation, animations, rich web applications, application software, desktop applications, mobile apps, mo ...
on one's operating system. Refrain from accessing web pages and related plugins within one's web browser
A web browser is application software for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's screen. Browsers are used on ...
.
* Only run software when necessary to reduce attack surface
The attack surface of a software environment is the sum of the different points (for "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment. Keeping the attack surface as small as ...
.
* Refrain from rooting one's phone or internet-facing device.[
]
Network and information security measures
* Using a firewall
Firewall may refer to:
* Firewall (computing), a technological barrier designed to prevent unauthorized or unwanted communications between computer networks or hosts
* Firewall (construction), a barrier inside a building, designed to limit the spre ...
on Internet-connected devices.
* Not running programs, services, or browsers with a super-user or privileged user account, such as root in Linux
Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...
and Unix
Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, and ot ...
) or as Administrator (Windows
Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...
), unless one understands the security risks of such an action.
* Avoiding free WiFi and not logging into any accounts while using it.
* Appropriately using privacy
Privacy (, ) is the ability of an individual or group to seclude themselves or information about themselves, and thereby express themselves selectively.
The domain of privacy partially overlaps with security, which can include the concepts of a ...
and anonymity software such as Tor (anonymity network)
Tor, short for The Onion Router, is free and open-source software for enabling anonymous communication. It directs Internet traffic through a free, worldwide, volunteer overlay network, consisting of more than seven thousand relays, to conc ...
for anonymous web browsing, given that this attracts some attention.
* Appropriately using HTTP
The Hypertext Transfer Protocol (HTTP) is an application layer protocol in the Internet protocol suite model for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, ...
and various Internet Protocol
The Internet Protocol (IP) is the network layer communications protocol in the Internet protocol suite for relaying datagrams across network boundaries. Its routing function enables internetworking, and essentially establishes the Internet.
IP h ...
proxies and security measures, such as disabling HTTP header fields, filtering, and relaying traffic with proxy servers
In computer networking, a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource.
Instead of connecting directly to a server that can fulfill a request ...
such as Squid Proxy, proxychains, socks4, and socks5.
* Publishing public keys for PGP
PGP or Pgp may refer to:
Science and technology
* P-glycoprotein, a type of protein
* Pelvic girdle pain, a pregnancy discomfort
* Personal Genome Project, to sequence genomes and medical records
* Pretty Good Privacy, a computer program for the ...
authentication
Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicati ...
for being able to prove one's identity.
* Using the strongest encryption method one's router offers and updating router firmware
In computing, firmware is a specific class of computer software that provides the low-level control for a device's specific hardware. Firmware, such as the BIOS of a personal computer, may contain basic functions of a device, and may provide h ...
.
* Using an intrusion detection system
An intrusion detection system (IDS; also intrusion prevention system or IPS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically rep ...
(IDS) or a SIEM (Security Information and Event Management System) to alert as to indicators of compromise, such as configuration changes in the operating system
An operating system (OS) is system software that manages computer hardware, software resources, and provides common services for computer programs.
Time-sharing operating systems schedule tasks for efficient use of the system and may also in ...
, privilege escalation
Privilege escalation is the act of exploiting a bug, a design flaw, or a configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user. The res ...
, network security breaches, and unauthorized remote logins.
* Using a demilitarized zone
A demilitarized zone (DMZ or DZ) is an area in which treaties or agreements between nations, military powers or contending groups forbid military installations, activities, or personnel. A DZ often lies along an established frontier or bounda ...
to reduce the number of systems and services openly facing the internet.
* Using a virtual private network
A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The be ...
with IPsec
In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in ...
to secure traffic at the transport layer
In computer networking, the transport layer is a conceptual division of methods in the layered architecture of protocols in the network stack in the Internet protocol suite and the OSI model. The protocols of this layer provide end-to-end ...
of the OSI model
The Open Systems Interconnection model (OSI model) is a conceptual model that 'provides a common basis for the coordination of SOstandards development for the purpose of systems interconnection'. In the OSI reference model, the communications ...
to harden the IP stack
The Internet protocol suite, commonly known as TCP/IP, is a framework for organizing the set of communication protocols used in the Internet and similar computer networks according to functional criteria. The foundational protocols in the suit ...
.
Reporting breaches and incidents
* Gather evidence and document security and data breaches (intrusions).
* Contact relevant authorities, administrators or organizations in the case of a cyberattack.
* Beware of website data breaches wherein stored passwords and personally identifiable information are publicized.
* Refer to a state's statute on security breach notification laws.
"Hacking back"
Legal theorists and policy makers are increasingly considering authorizing the private sector to take active measures by "hacking back" (also known as hackbacks). In contrast to active attack measures, passive defense measures present a reduced risk of cyberwarfare
Cyberwarfare is the use of cyber attacks against an enemy state, causing comparable harm to actual warfare and/or disrupting vital computer systems. Some intended outcomes could be espionage, sabotage, propaganda, manipulation or economic war ...
, legal, political, and economic fallout.
A contemporary topic in debate and research is the question of 'when does a cyber-attack, or the threat thereof, give rise to a right of self-defense?'
In March 2017, Tom Graves
John Thomas Graves Jr. (born February 3, 1970) is an American businessman and politician who served as the U.S. representative for from 2013 to 2020. Graves previously served one term as the U.S. representative for from 2010 to 2013, followin ...
proposed the Active Cyber Defense Certainty Act (ACDC) that would enhance the Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act of 1986 (CFAA) is a United States cybersecurity bill that was enacted in 1986 as an amendment to existing computer fraud law (), which had been included in the Comprehensive Crime Control Act of 1984. The law pr ...
(CFAA) to allow individuals and the private sector to use certain tools currently restricted under the CFAA to identify attackers and prevent attacks by hacking them. This presents a "chicken or the egg" problem, wherein if everyone were allowed to hack anyone, then everyone would hack everyone and only the most skilled and resourced would remain.
Brad Maryman warns of unintended consequences
In the social sciences, unintended consequences (sometimes unanticipated consequences or unforeseen consequences) are outcomes of a purposeful action that are not intended or foreseen. The term was popularised in the twentieth century by Ameri ...
, stating that in his view "the notion that we should legislate and accept a level of undocumented and unmonitored cyber actions by anyone who thinks they have been hacked is unfathomable".[
]
See also
* Proactive cyber defence
Proactive cyber defence means acting in anticipation to oppose an attack through cyber and cognitive domains. Proactive cyber defence can be understood as options between offensive and defensive measures. It includes interdicting, disrupting or d ...
* CryptoParty CryptoParty (Crypto-Party) is a grassroots global endeavour to introduce the basics of practical cryptography such as the Tor anonymity network, I2P, Freenet, key signing parties, disk encryption and virtual private networks to the general public. ...
* Information security
* Internet security
References
External links
Cybersecurity self-defense
''Slate''
* {{cite book, last1=Moore, first1=Alexis, last2=Edwards, first2=Laurie, title=Cyber Self-Defense: Expert Advice to Avoid Online Predators, Identity Theft, and Cyberbullying, year=2014, publisher=Rowman & Littlefield, isbn=9781493015429, url=https://archive.org/details/cyberselfdefense0000moor, url-access=registration
Surveillance Self-Defense
''Electronic Frontier Foundation, EFF''
Paul Carugati: Cyber Self-Defense
TED talk
Self-defense
Computer security