You can't wrap it... but it makes sense to give online safety tips to your loved ones.


I have a strange tradition which started a few years ago. On December 26 I change my passwords on my various accounts.

This tradition has meant that at least once a year, key services I rely on, be it internet banking, email accounts, social networks, blogs and others get refreshed. This year I intend to encourage my family to do likewise at our festive social gatherings.

Identity theft is a serious problem, in 2010 the ABS identified that almost half a million Australians were victims of identity fraud. Most of these victims (77 per cent) experienced some form of credit or banking account abuse. Some 124,000 Australians over the age of 15 reported some kind of identity theft. Unfortunately I am sure that number will be higher in 2011. The Australian Federal Police are stepping up their public awareness campaigns.

I am sure that there were many incidents there were never reported.

This year has had some spectacular security breaches even in big name companies. Some the result of black hat crackers exploiting loopholes (Steam) others, self-inflicted acts of carelessness (See Telstra). Almost weekly there are reports of intrusions and blunders to keep the security consultants blissfully in demand and network admins awake at night.

2012 has to be the year where we expect more from our online service providers in the security and privacy stakes. The Government needs to get privacy breach disclosure laws on the agenda. Corporations need to get serious about ensuring that they are following best practice and that they give their network security full consideration as integral to their brand and reputation.

Somehow in the boardrooms and PR departments, having a degree of separation between your customer data and some third party providing outsourced security services is an acceptable position for brand protecting blame sleight of hand. It is not good enough! You reap the cost benefits of outsourcing, you wear the shortcomings of your partner selection as well.

We, as individuals, can do our part by firstly selecting reputable companies to provide us our services. Check their privacy policy: does it include a disclosure statement? Are there warranties and protections if a breach occurs?

I’d love to see an independently maintained security index that ranks companies by various best practice profiles and response to threats.

Secondly, commit to good password practices. Have several levels of passwords and don’t reuse passwords across different accounts. For accounts that you need to use on the go, for example webmail or cloud storage, use a memorable password but make it as long as you can. One technique is to use the first letter of a favourite quote, song lyric or movie title that is significant to you. An example may be Hamlet’s soliloquy “What a piece of work is man! How noble in reason”  which I studied in 1993 which gives me WapowiM!HniR93 (No, I don't use that one!).

If you often use webmail on machines in networks that you don’t trust such as internet cafes or public libraries, then you should be changing this password every other month.

For accounts that you rarely need to log into, generate a password and store it in a password keeper such as the opensource KeePassX tool. Remember to back up the encrypted key store!

It takes some discipline, but after a while you will develop your own scheme for creating classes of passwords. When combined with a strategy of using multiple email inboxes for discrete purposes, you can create a silo-ed structure that minimises the impact of a compromised account.

Finally, email is not a secure or guaranteed protocol. Don’t disclose anything sensitive on it. In principle, especially with banks, requests for information via email should be ignored. If in doubt walk into a branch and take it from there. If your accountant is sending private financial documents via email in the open (ie. plain attachments not encrypted) pull them up on it, it is simply not acceptable and potentially disastrous.

Ultimately maintain a skeptical and suspicious attitude. No amount of technical safeguards can protect you against a successful socially engineered attack (acts of fraud that trick you into divulging your own personal information). Social engineering loses its effectiveness if people are educated about the various techniques, so please report it to the authorities if you suspect a con.

Keep up basic computer hygiene such as regularly updating your software, virus protections, web browser and run a firewall.

Stay vigilant, stay safe and help your family do the same this Christmas.

Have you had your identity stolen or your privacy compromised? Did you report it or keep it secret?

What online security techniques would you recommend to your loved ones?

This author is on Google+

twitter  Follow IT Pro on Twitter