Chapter 19
Developing Safe Practices for Secure Email

This chap­ter touch­es on a num­ber of things you can do to enhance your over­all cyber­se­cu­ri­ty and specif­i­cal­ly your email secu­ri­ty. These are sim­ple things that any­one can do. Still, the pri­ma­ry rec­om­men­da­tion and the pur­pose for this book is to use RMail and its secu­ri­ty ser­vices to estab­lish hack­proof email. As has been not­ed sev­er­al oth­er places in this book, email is the cor­ner­stone of your cyber­se­cu­ri­ty and by estab­lish­ing hack­proof email, you go a long way towards mak­ing your entire com­put­er sys­tem secure.

Law Enforce­ment  What hap­pens when you do become the vic­tim of a hack­er? Like­ly noth­ing. The FBI has a thresh­old of $100,000 (or what­ev­er the cur­rent guide­line is) under which they don’t have the resources to inves­ti­gate unless your case is relat­ed to oth­er cas­es. Your state attor­ney gen­er­al also has lim­it­ed resources and a thresh­old guide­line for ini­ti­at­ing inves­ti­ga­tion that may be high­er than your loss. And your state is only inter­est­ed in crim­i­nals in your state. It doesn’t have juris­dic­tion else­where. Your local police will polite­ly take notes on your com­plaint, but most of even the largest cities do not have the resources or will to effec­tive­ly inves­ti­gate cyber­crime by hack­ers out­side their juris­dic­tion. For all prac­ti­cal pur­pos­es, hack­ers from oth­er coun­tries oper­ate beyond the reach of Amer­i­can law enforce­ment. Hack­ers from Rus­sia, Nige­ria, Roma­nia, Chi­na, and oth­er for­eign states com­mit more than their share of the cyber­crime in the US but def­i­nite­ly con­duct their crim­i­nal activ­i­ties out­side the juris­dic­tion of Amer­i­can law enforce­ment. In most cas­es, you’re strict­ly on your own.

Protect Email Content

Your first step in devel­op­ing a strat­e­gy for secure email is to ana­lyze your email prac­tices and decide which of your email mes­sages require max­i­mum pro­tec­tion and which of your mes­sages require less­er pro­tec­tion. For most peo­ple, it does not make sense to send RMail Mes­sage-Lev­el encrypt­ed emails to every­one. But for many peo­ple it does make sense to send such encrypt­ed emails:

• To cer­tain peo­ple
• To cer­tain orga­ni­za­tions
• For high val­ue con­tent
• For sen­si­tive infor­ma­tion
• You name it

Like­wise, regard­ing agree­ments for instance, it makes sense to get a con­firm­ing email from the oth­er par­ty as to the agree­ment. But for impor­tant agree­ments, where a lot is at stake, it makes more sense to get a dig­i­tal sig­na­ture from the oth­er par­ty. Thus, for each RMail secu­ri­ty ser­vice, it’s com­mon sense to decide when to use that ser­vice and when not to do so.

Selecting Email Account Names

Chap­ter 14 give guid­ance on choos­ing a name for your email account.  But what’s the effect of peo­ple hav­ing mul­ti­ple email accounts? The effect is sim­ply that mul­ti­ple email accounts per per­son may pro­vide a greater oppor­tu­ni­ty for hack­ers.

If the tar­get per­son has mul­ti­ple email accounts, the hack­er may be able to hack into one account eas­i­er and quick­er than the oth­ers. If so, the hack­er may be able to get a good start on break­ing into all of the target’s account. At the least, a hack­er may be able to get addi­tion­al infor­ma­tion that enables more pro­duc­tive hack­ing of the next account.

Yet, when each email account is ful­ly pro­tect­ed with appro­pri­ate secu­ri­ty prac­tices includ­ing sep­a­rate pass­words, mul­ti­ple accounts are not nec­es­sar­i­ly risky. But each email account must have its own sep­a­rate and strong secu­ri­ty set­up.

When you have online accounts with valu­able assets, how­ev­er, the con­sid­er­a­tions change. The pri­or infor­ma­tion on email names is great for per­son­al mat­ters and ordi­nary busi­ness. But what about your finan­cial mat­ters and oth­er high-val­ue mat­ters or even secret mat­ters?

1. You don’t want to use the same name for finan­cial affairs as you use for nor­mal email. That pro­vides poten­tial hack­ers with a large play­ing ground to find your email and hijack it. To reduce your risk, you need to have anoth­er name (a secret name) that you use only for your bro­ker­age, bank, and oth­er accounts where your valu­able assets reside.
2. You don’t want any­thing in your secret email name to reflect who you are or what accounts you use the name for. For exam­ple, smith-​etrade@​rmail.​com is a ter­ri­ble name, if your name is Smith and it’s for an account at E*TRADE. It’s much bet­ter to use a name that reveals noth­ing. How about boatfever@​rmail.​com. This is a good name, par­tic­u­lar­ly for some­body who has noth­ing to do with boats.
3. This risk-reduc­ing idea is real­ly based on how much are will­ing to lose. If you have $3,000 in your bro­ker­age account and some­body man­ages to hijack your email and steal it, that’s prob­a­bly not the end of the world for you. But if you have $30,000 in your bro­ker­age account, it seems like it’s worth tak­ing the extra step to pro­tect it with a secret email account.
4. If you have $30,000 in your bank account, anoth­er $30,000 in your bro­ker­age account, and anoth­er $30,000 in your bank sav­ings account, it seems to me that you might be will­ing to use a dif­fer­ent secret email account for each of your asset accounts.

Of course, $30,000 as an arbi­trary amount strict­ly for the dis­cus­sion in this chap­ter. You have to decide what is valu­able enough for you to get a sep­a­rate secret email account to low­er the risk of a hack­er hijack­ing your email and using it to steal from you.

In regard to your secret accounts, you may not want to use the same email ser­vice provider for each of them. You might want to dis­trib­ute your secret email accounts between dif­fer­ent email ser­vice providers. In any event, I hope goes with­out say­ing at this point in the book that what­ev­er email ser­vice provider you choose for your secret accounts, it should be a secure email ser­vice provider.

It’s impor­tant for you to keep in mind that if some­body steals your cred­it card, the cred­it card com­pa­ny will reim­burse you for any loss­es assum­ing you report it in a time­ly man­ner. That’s not so when some­body hijacks your email account and uses it to hack their way in to your finan­cial or oth­er high-val­ue accounts. If you lose some­thing, it’s lost for­ev­er. As men­tioned at the begin­ning of this chap­ter, you’re not like­ly to get much help from local, state, or fed­er­al law enforce­ment author­i­ties, unless you have a six-fig­ure loss.

Passwords

Fre­quent­ly, your email name is also your login ID. In such cas­es, pass­words are impor­tant because they are the guards stand­ing at the gate that’s the entry to your net­work, accounts, online ser­vices, web­sites, and even your email sys­tem. It used to be that if you had a ran­dom eight-char­ac­ter pass­word that includes let­ters, num­bers and punc­tu­a­tion marks, you had ade­quate secu­ri­ty. That’s no longer the case. You need more ran­dom char­ac­ters in a pass­word today to avoid a breach of secu­ri­ty. How many char­ac­ters you need depends on who’s telling you, but eight char­ac­ters are no longer enough. A min­i­mum of four­teen ran­dom char­ac­ters will like­ly stop any hack­ing attempt.

The oth­er prob­lem with pass­words is that peo­ple will sim­ply use an eight-char­ac­ter word or oth­er easy-to-remem­ber group of char­ac­ters as their pass­word. Such pass­words are easy to crack by hack­ers.

What’s the solu­tion? The solu­tion is sim­ply to use many-char­ac­ter ran­dom pass­words that you keep in a pass­word data­base (wal­let). You might be able to remem­ber one ran­dom four­teen-char­ac­ter pass­word for one account, but most peo­ple have mul­ti­ple accounts rep­re­sent­ing mul­ti­ple net­works, online ser­vices, and web­sites. Remem­ber­ing a ran­dom four­teen-char­ac­ter pass­word for each account is not prac­ti­cal. And using the same pass­word for all accounts is an invi­ta­tion to dis­as­ter.

Cur­rent­ly, there’s new think­ing about pass­words as set forth in the Nation­al Insti­tute for Stan­dards and Tech­nol­o­gy (NIST) Tech­ni­cal Pub­li­ca­tion 800–63-1 (June 2017). The think­ing now is that you do not need ran­dom-char­ac­ter pass­words. What may be prefer­able is mul­ti­ple-word pass­words oth­er­wise known as passphras­es. Four- or five-word passphras­es that you have cre­at­ed your­self (not a famous quo­ta­tion) may suf­fice for max­i­mum secu­ri­ty. Keep in mind, how­ev­er, that you want the words also to exceed four­teen char­ac­ters.

For instance, The­Quick­Brown­FoxJumped is not a secure passphrase (i.e., it’s part of a well-known phrase). How­ev­er, MyJump­ing­Fox­NamedQuick­Brown is secure.

What About Those Pesky Secu­ri­ty Ques­tions?  You lived in Camp­bellsville, Ken­tucky when you were a senior in high school. Yes­ter­day you picked a secu­ri­ty ques­tion for a login that ask: What town did you live in when you were a senior in high school? Nat­u­ral­ly, you type in “Camp­bellsville.” Wrong! Why would you do that? The secu­ri­ty ques­tion is an oppor­tu­ni­ty to make your login safer. Using the cor­rect answer cer­tain­ly isn’t safe. You nev­er know if a hack­er will be able to find out that par­tic­u­lar infor­ma­tion about you. If you don’t put that infor­ma­tion up on a social media web­site, per­haps your sis­ter will put it up or maybe your best friend, cousin, school, or anoth­er source. How can you be sure that a hack­er can­not get that infor­ma­tion? What is the best way to han­dle a secu­ri­ty ques­tion? If you use a ran­dom set of char­ac­ters, it might be dif­fi­cult to express those to some­body ask­ing the ques­tion over the phone. And that hap­pens occa­sion­al­ly. It’s bet­ter to use one word unre­lat­ed to the ques­tion. For instance, instead of “Camp­bellsville” you could enter the word “ref­er­en­dum.” That word has no rela­tion to the ques­tion asked, and a hack­er could nev­er guess it. Nat­u­ral­ly, this word is dif­fi­cult to remem­ber, but you can include it in the data­base in which you keep your login pass­words. Use the secu­ri­ty ques­tion as an oppor­tu­ni­ty for addi­tion­al secu­ri­ty not as an easy-to-remem­ber word that a would-be hack­er can eas­i­ly dis­cov­er. Regard­less of what your pass­word strat­e­gy is, you will want to have unique pass­words for every account that you use, and unique secu­ri­ty answers too. And that still requires a data­base to remem­ber them all (and a secure pass­word that you do remem­ber in order to access your pass­word data­base).

In your pass­word data­base, you plug-in the URL of the login page, the login name (user­name), and the pass­word. When you need to login you sim­ply open the data­base pro­gram that con­tains your pass­words, find the pass­word you need, and copy and paste it into the login input.

Since your pass­word data­base pro­gram is pass­word pro­tect­ed itself, you can­not rely on the pro­gram to remem­ber it. That’s one pass­word you’ll have to remem­ber.

Review pass­word pro­grams such as Dash­lane, Last Pass Pre­mi­um, Sticky Pass­word Pre­mi­um, Log­Me­Once Pass­word Man­age­ment Suite Ulti­mate, and the like to under­stand what fea­tures are avail­able. And then choose one to use.

Key­stroke Log­ging and a Data­base  >Key­stroke log­ging is the process of record­ing the key­strokes you use on your key­board. It can be done with hard­ware, soft­ware, or acousti­cal record­ing. It’s a secu­ri­ty con­cern if a hack­er employs it in mal­ware to obtain pass­words. If you have your pass­words stored in a data­base, you sim­ply click (tap) on a pass­word to copy and paste it into a login. There is no typ­ing involved. So key­stroke log­ging doesn’t work. This is anoth­er rea­son to use a pass­word data­base.

Some pro­grams such as a Google’s Chrome brows­er have pass­word data­bas­es that will serve you auto­mat­i­cal­ly. In oth­er words, when you log into a cer­tain account, the brows­er itself will auto­mat­i­cal­ly insert your pass­word. This is the ulti­mate con­ve­nience. Unfor­tu­nate­ly, large sys­tems like Google with large data­bas­es are sus­cep­ti­ble to hack­ing, and they are big tar­gets. And even if the pass­words are stored by Chrome on your com­put­er, the pass­words are not them­selves pass­word pro­tect­ed. With that in mind, I don’t trust any­one else man­ag­ing my pass­word data­base. Note that if some­one breaks into your com­put­ing device, they can use the auto­mat­ic pass­word brows­er fea­ture to access all of your accounts.

A pass­word data­base pro­gram gives you total con­trol of your pass­words, and nobody can access this data­base with­out know­ing the access pass­word (that you have mem­o­rized) to the pass­word data­base itself. It seems to me that this is the ulti­mate pro­tec­tion, and you should set­tle for noth­ing less.

Mem­o­rized Pass­words  Keep­ing your pass­words in a pass­word data­base does not pre­vent you from mem­o­riz­ing the ones you use most often. But be care­ful. I have mem­o­rized pass­words I’ve used a lot for cer­tain accounts for many months, only to have lit­tle need to access such accounts again for many months or even years. At the end of that time, when I have occa­sion to access such an account again, I have undoubt­ed­ly for­got­ten the pass­word that I’d once mem­o­rized. That’s why it’s impor­tant to keep all your pass­words in your pass­word data­base, even the ones you’ve mem­o­rized.

A full expla­na­tion of pass­words and how to use them is beyond the scope of this book. You may need to learn more. But the use of secure pass­words (or passphras­es) is very impor­tant for your cyber­se­cu­ri­ty, and it’s par­tic­u­lar­ly impor­tant in using your email sys­tem. Remem­ber, your email sys­tem is a cor­ner­stone of your cyber­se­cu­ri­ty, and if you expe­ri­ence a breach in the secu­ri­ty of your email, it can lead to all sorts of hack­er han­ky-panky that is guar­an­teed to be detri­men­tal to you.

Bio­met­ric Pass­words  Your face, your fin­ger prints, and your reti­na pat­tern are unique and can be used as pass­words for online iden­ti­fi­ca­tion and authen­ti­ca­tion. The tech­nol­o­gy is here, and many orga­ni­za­tions (pub­lic, pri­vate, prof­it, and non­prof­it) are using it. Smart phones also enable this tech­nol­o­gy, and it will come into greater use soon. The ques­tion is, can these bio­met­ric pass­words be stolen? The answer is: sure they can. Once they’re stolen, you can’t change them. You’re screwed for life. But if your passphrase is stolen, you just change it, clean up the mess, rethink your secu­ri­ty prac­tices, and con­tin­ue on with your nor­mal cyber life. In oth­er words, the loss of a passphrase is not a life-long tragedy.

Let’s get very spe­cif­ic in regard to pass­words and email. The two impor­tant con­cerns are: the pass­word to your email ser­vice web­site and the pass­word to your email pro­gram. You need to treat these pass­words like any oth­er pass­word, that is, very secure­ly.

Do not have your email pro­gram open auto­mat­i­cal­ly with­out pass­word pro­tec­tion. If some­one steals your com­put­ing device and can open it, your last pro­tec­tion for your email is the email program’s pass­word. This is not very con­ve­nient. Every time you open your email pro­gram, you have to pro­vide the pass­word. Nonethe­less, it’s good secu­ri­ty. Like­wise, the pass­word to your email provider’s web­site where you admin­is­ter your email account should be very secure.

Beyond Passwords

There are addi­tion­al secu­ri­ty schemes that go beyond just the use of pass­words. They might involve the use of tokens, ver­i­fi­ca­tion num­bers, and the like (two-fac­tor authen­ti­ca­tion, aka 2FA). They are beyond the scope of this book, but where avail­able you may want to con­sid­er using them. Typ­i­cal­ly, they are more incon­ve­nient and com­plex than nor­mal secu­ri­ty pro­ce­dures, but for strong secure access to online accounts, the incon­ve­nience is worth­while.

Computer Security

Your gen­er­al cyber­se­cu­ri­ty is also rel­e­vant to your email secu­ri­ty. You need to insti­tute soft­ware secu­ri­ty pro­tec­tion for your com­put­er. That’s fire­wall, antivirus, mal­ware, spy­ware, and oth­er secu­ri­ty soft­ware. There’s a lot of com­pet­ing secu­ri­ty soft­ware avail­able. Symantec’s Nor­ton Secu­ri­ty is an exam­ple for desk­tops and lap­tops. Norton’s pro­vides fire­wall, antivirus, anti­spam, antiphish­ing, email, iden­ti­ty pro­tec­tion, and oth­er secu­ri­ty soft­ware updat­ed dai­ly via the inter­net.

All these Nor­ton apps are gen­er­al secu­ri­ty pro­grams that you need on your com­put­er before you even start think­ing specif­i­cal­ly about email secu­ri­ty. It’s beyond the scope of this book to lunge into gen­er­al cyber­se­cu­ri­ty prob­lems and reme­dies. Yet you need to cov­er the basics before you can imple­ment email secu­ri­ty. Nor­ton and its com­peti­tors enable you to do so. And don’t for­get your phone and tablet. They require secu­ri­ty soft­ware too.

Let this advice be clear. You can­not expect to use secure email until first you make your com­put­ing device and net­work secure.

Anoth­er impor­tant prac­tice is to pro­tect all your com­put­ers with a pass­word: desk­top, lap­top, tablet, and smart phone. The longer the pass­word, the bet­ter. You can lose your phone, have your tablet or lap­top stolen, or lose your desk­top by bur­glary. A thief may sell your stolen device to a hack­er, and with­out ade­quate pass­word pro­tec­tion a hack­er will make big trou­ble for you.

One of my secure prac­tices is to use email only on my lap­top, which sel­dom leaves home. I don’t use email on my smart phone or tablet. That cuts the risk of hav­ing my email hijacked con­sid­er­ably. Yes, some­times I go the whole day with­out check­ing my email, although I sel­dom miss check­ing it in the morn­ing and evening. I know this tac­tic isn’t for every­one. But if you find it prac­ti­cal, do it.

Software Updates

I’m mad at Microsoft. One of their auto­mat­i­cal­ly-installed updates to Win­dows 10 crashed my com­put­er and caused me some incon­ve­nience. Alas, you can’t live with the updates, and you can’t live with­out them; that is to say, the updates can be dis­rup­tive some­times, but it’s sui­ci­dal to do with­out them.

Many soft­ware updates are patch­es to secu­ri­ty holes that hack­ers have found and exploit­ed or that a soft­ware com­pa­ny has found before the hack­ers. It’s essen­tial for your email secu­ri­ty that you install them imme­di­ate­ly upon issue. The best way to be safe is to elect auto­mat­ic updates. That way you get the secu­ri­ty patch as soon as it’s issued. This is par­tic­u­lar­ly impor­tant for your oper­at­ing sys­tem, email pro­gram, and brows­er. More­over, it’s impor­tant for any soft­ware that you rou­tine­ly use.

There are a lot of rea­sons to avoid soft­ware updates. We’ve all expe­ri­enced updates that we haven’t liked for one rea­son or anoth­er. And that’s unfor­tu­nate. But it’s not an excuse to risk your entire per­son­al cyber enter­prise by avoid­ing the updates. Some­times the updates are peri­od­ic, expen­sive, and intro­duce many new fea­tures, all of which you can do with­out. In that case, you might safe­ly avoid the update so long as the soft­ware com­pa­ny updates the old soft­ware with secu­ri­ty updates. When the secu­ri­ty updates stop for your soft­ware ver­sion, it time to buy the new ver­sion.

So, I’m mad at the occa­sion­al Microsoft update that caus­es a glitch. I’m not the first, and I won’t be the last. But the alter­na­tive (get­ting hacked because I don’t install the updates) is not very attrac­tive.

On-Off

Note one sig­nif­i­cant obser­va­tion on gen­er­al cyber­se­cu­ri­ty. There was a time in the his­to­ry of per­son­al com­put­ers when you left your com­put­er on 24/7 with the idea that it didn’t use much elec­tric­i­ty and you would not have to go through a long boot­ing pro­ce­dure each time you turned it on. Those days are long gone.

The com­put­ers and periph­er­als today use more elec­tric­i­ty than ever, although that is some­what mit­i­gat­ed by com­put­ers going into low-ener­gy-con­sump­tion mode or going to sleep. But there’s anoth­er more impor­tant con­sid­er­a­tion that did not exist when per­son­al com­put­ers were new to the world in the 1980s. Vir­tu­al­ly every com­put­er is now hooked up to the inter­net, which means that lit­er­al­ly bil­lions of peo­ple around the world have poten­tial access your com­put­er.

An anti-hack­ing tech­nique that is over­looked is sim­ply turn­ing off your com­put­er. A hack­er can­not hack into your com­put­er when it’s turned off. So if a hack­er uses a lengthy hack­ing pro­ce­dure to break into your com­put­er, you may be able to foil the attempt just by the act of turn­ing off your com­put­er at the end of the day and not turn­ing it on until the next morn­ing. In any event, hav­ing your com­put­er offline for a third of the day also low­ers your risk sta­tis­ti­cal­ly of being hacked.

Today with fast boot­ing enabled by sol­id state dri­ves (SSD), you can turn off your com­put­er every time you leave home or leave the office and not have to wor­ry about a slow boot when you return.

Just how effec­tive does this rou­tine pro­ce­dure work against bad things hap­pen­ing? It’s dif­fi­cult to know. Nonethe­less, the pro­ce­dure is nat­ur­al, easy, and saves elec­tric­i­ty.

Router Security

Routers are filled with all kinds of secu­ri­ty hard­ware and soft­ware, and it’s well beyond the scope of this book to teach you how to take full advan­tage of the secu­ri­ty avail­able in routers. The default set­tings for most routers are like­ly to be ade­quate for your use, unless you have some spe­cial­ty use that requires spe­cial set­tings.

Nonethe­less, there are cer­tain basic secu­ri­ty mea­sures you can take to sub­stan­tial­ly decrease the like­li­hood that your router (your net­work) can be hacked.

If your ISP fur­nish­es you only a modem, you need to buy a router to hook up to the modem. If your ISP gives you a com­bi­na­tion modem-router, you need to use the router pro­vid­ed by the ISP rather than buy one sep­a­rate­ly.

If you have your choice, how­ev­er, you will want to use a router that fits your needs. For instance, if it’s a router for your home, it doesn’t need to have a long-range. The longer the range, the eas­i­er some­one far­ther away will be able to access your router. You cer­tain­ly want the range to cov­er your home or office, but any range beyond that will just enable some­one near­by in the neigh­bor­hood to poten­tial­ly access your net­work.

Administrator’s Password

Routers that you buy usu­al­ly come with a stan­dard pass­word (e.g., admin) for admin­is­tra­tive access that every­one knows because it’s pub­lished in the owner’s man­u­al. For that rea­son, the first thing you want to do is change the pass­word for admin­is­tra­tive access. Only the per­son man­ag­ing the router should have admin­is­tra­tive access to the router’s soft­ware. If that’s you, guard the pass­word well.

If you get a modem-router from your ISP, you will prob­a­bly be giv­en a unique pass­word. That’s prob­a­bly safe, at least for a while, but you’ll want to change the ini­tial pass­word, as soon as prac­ti­cal, if pos­si­ble, to be a pass­word that only you know as the router’s admin­is­tra­tor.

Router Name

You should change the name (SID) of your router (net­work) too. Change it to some­thing that doesn’t indi­cate your ISP, your router brand, or your per­son­al infor­ma­tion. For instance, Seattle62 is a good exam­ple of a local net­work name, espe­cial­ly if it’s not locat­ed in Seat­tle. It doesn’t relate to any­thing dig­i­tal, and you can remem­ber it as the 1962 World’s Fair. But don’t use it. Make up your own name.

Users’ Password

In addi­tion to the admin­is­tra­tive pass­word, there’s also a user pass­word. The user pass­word per­mits a com­put­ing device such as a desk­top, lap­top, tablet, or phone to con­nect to the router (net­work). All those who use your net­work will have to know the user pass­word in order to be able to con­nect to the net­work. Beware, though, such a pass­word should nev­er be giv­en out to any­one out­side your home or office. And, of course, leav­ing your net­work open with­out any pass­word is very inse­cure and invites a secu­ri­ty breach.

Open Net­work  You can go into almost any neigh­bor­hood in the coun­try and find five or six net­works that are avail­able close by. Typ­i­cal­ly, most will have pass­word access, and you will not be able to use such net­works. But there’s usu­al­ly at least one net­work that doesn’t have pass­word access, and you will be able to use such a net­work as if it were your own. In oth­er words, some­one else’s open net­work will pro­vide you access to the inter­net as well as to that Wi-Fi net­work itself. Of course you’re not going to hack some­one else’s open net­work or any of the com­put­ers on such a net­work. But you just might use such an open net­work to gain access to the inter­net, par­tic­u­lar­ly when you have some urgency and there’s no oth­er choice. Hack­ers, too, can access an open net­work and poten­tial­ly access all the com­put­ers on that net­work. So, beware of using someone’s open access net­work since it expos­es you to secu­ri­ty breach­es.

Setup

Anoth­er set­ting to change is WI-FI Pro­tect­ed Set­up (WPS). Dis­able it, if pos­si­ble. It’s an obso­lete secu­ri­ty pro­to­col that has proven to be inse­cure.

Encryption

A router has a set­ting that enables all trans­mis­sions between the router and all devices on the net­work to be encrypt­ed. This safe­guard is not usu­al­ly set as a default, and you have to change the set­ting via your administrator’s access to the router. The set­ting you want is the most up-to-date encryp­tion avail­able (e.g., WPA2). If all your wire­less trans­mis­sions between the devices on your net­work and the router are encrypt­ed, hack­ers who inter­cept such trans­mis­sions will find them use­less (unread­able).

MAC Numbers

Anoth­er safe­guard (and one that’s a must-do) requires a lit­tle work. It’s the use of MAC (Media Access Con­trol) address­es, which are 12-dig­it num­bers (e.g., a5:12:f2:c7:fb:d3). Each com­put­ing device whether it be a desk­top or phone has a unique MAC num­ber that iden­ti­fies it. You can pro­gram your router, via your administrator’s access, to admit to the net­work only those devices with the MAC num­bers you have list­ed.

You sim­ply get the MAC num­bers of everybody’s com­put­ing devices and add such num­bers to a list in the router soft­ware. (For any par­tic­u­lar com­put­ing device, you can go on the inter­net and find out how to find the MAC num­ber for that device.) Once you enter the MAC num­bers into your router, only those devices with MAC num­bers that have been entered onto the router list will be able to get on your net­work. This is a secu­ri­ty pre­cau­tion that few peo­ple use but tak­en togeth­er with all the oth­er safe­guards make your Wi-Fi net­work as hack­proof as pos­si­ble.

Firmware Update

The last safe­guard you can apply to your router is to install all the firmware updates. Firmware is the soft­ware that hard­ware uses to oper­ate itself. The firmware updates (free) for a router invari­ably include pro­gram­ming that improves secu­ri­ty. These are updates you don’t want to miss.

Followup

How do you man­age the router beyond the ini­tial set up?

• You need to change the administrator’s pass­word occa­sion­al­ly.
• You need to change the user’s pass­word occa­sion­al­ly, and pro­mul­gate the new pass­word to all the users.
• When a user gets a new com­put­ing device, you need to add the MAC num­ber to the list on the router, and sub­tract MAC num­bers for devices out of use.
• You need to install updates to the router firmware.

Pret­ty sim­ple stuff, yet it takes a lit­tle work. The router is one place where you can eas­i­ly enhance your over­all cyber­se­cu­ri­ty. Beyond what I’ve out­lined, it’s not clear what more you can do with your router to make it secure. But every mod­el of a router is dif­fer­ent, and in a last effort to make your router safe, I rec­om­mend read­ing the router user’s man­u­al.

Public Wi-Fi

When it comes to a pub­lic net­work, you have absolute­ly no con­trol over router secu­ri­ty. For that rea­son, you should be extreme­ly cau­tious about what you do over a pub­lic net­work con­nec­tion. Do not shop, par­tic­i­pate in finan­cial trans­ac­tions, access your cred­it card account, vis­it oth­er finan­cial accounts, or con­duct any secret, high-val­ue, or sen­si­tive com­mu­ni­ca­tions.

Does that mean that you can’t do any of these things in pub­lic net­work? In fact, you can do so safe­ly. You need to sub­scribe to a VPN (vir­tu­al pri­vate net­work) ser­vice. The VPN ser­vice installs pro­gram­ming gov­ern­ing your con­nec­tion to the pub­lic net­work. All your email and oth­er con­nec­tion trans­mis­sions over the Inter­net go to the VPN serv­er encrypt­ed so that no hack­er can hack into your online activ­i­ties. The VPN serv­er in effect becomes you.

 The VPN serv­er sends and receives all your trans­mis­sions on the Inter­net as if it were you. But all your com­mu­ni­ca­tion with the VPN serv­er are encrypt­ed and hack­proof. The local hack­er who is 50 yards away from your hotel or cof­fee shop is going to have a dif­fi­cult time hack­ing into the VPN serv­er, which is main­tained by IT pro­fes­sion­als and may be hun­dreds or thou­sands of miles away.

RMail Email Ser­vice  Can you use RMail Inbox or RMail Web while on a pub­lic net­work and be sure of secure email trans­mis­sion? Well, there is the risk of fatal flaws as out­lined in Chap­ter 5. And those risks are com­pound­ed by the risk of using an unse­cure con­nec­tion to a pub­lic router (hot spot). So I think the answer is clear­ly no, although using some encryp­tion func­tion is bet­ter than doing noth­ing for secu­ri­ty.

The down­side of using VPN when you’re on a pub­lic net­work is that it may slow down your inter­net activ­i­ties. Whether does or not depends on a lot of fac­tors, most of which are out of your con­trol. But you can turn VPN on and off as you need it, although I rec­om­mend that when on a pub­lic net­work you keep VPN on full-time just to be absolute­ly safe. Note that there are VPN ser­vices that you can use on a dai­ly, week­ly or month­ly basis only when you need to use VPN, such as on a busi­ness trip or while you’re on vaca­tion.

You might ask, why not use VPN at home or at the office so you don’t have to wor­ry about local net­works, routers, and all that? I sup­pose that’s a pos­si­bil­i­ty, but most peo­ple don’t like to have their inter­net activ­i­ties slow down or make them more com­pli­cat­ed than they are already. And most peo­ple don’t like to pay an extra fee for VPN ser­vice.

Fake Net­work  Be care­ful. Is the pub­lic Wi-Fi net­work that you access the cor­rect one? Get the name of the cor­rect net­work (hot spot) from the pro­pri­etor (of the hotel, cof­fee shop). Don’t make the mis­take of con­nect­ing to a fake hot spot oper­at­ed by a hack­er.

Anoth­er solu­tion, albeit a more expen­sive one, is to use your smart phone as a hot spot (a router). You can con­nect your com­put­er to the hot spot in order to access the inter­net. The smart phone’s con­nec­tion to the inter­net via the cell tow­er is encrypt­ed. Your con­cern is with your computer’s con­nec­tion to the hot spot.

Unfor­tu­nate­ly, the fea­tures and prac­tices for using phones as hot spots vary great­ly and are beyond the scope of this book. Some enable strong secu­ri­ty. Oth­ers offer only weak secu­ri­ty. Treat this scheme like any oth­er router con­nec­tion with all the req­ui­site pre­cau­tions.

Shared Com­put­er  Nev­er ever use your email on a shared com­put­er, such as a library com­put­er. This is an invi­ta­tion to dis­as­ter. Not only can you not pro­tect your­self with VPN, but you nev­er know what your soft­ware may leave on the com­put­er for some­one to come along and dis­cov­er. And, of course with a lot of peo­ple using it, a shared com­put­er could be loaded with lots of evil­ware.

Final­ly, when using your com­put­er in the vicin­i­ty of a pub­lic net­work, turn off auto join. You don’t want your com­put­er to auto­mat­i­cal­ly con­nect to a pub­lic net­work with­out you know­ing. With­out auto join turned on, you will have to man­u­al­ly con­nect to any net­work. It may not be con­ve­nient, but it’s safer. And by the way, for smart phones and oth­er com­put­ers, turn off Blue Tooth while in pub­lic when you’re not using it.

Business

What does busi­ness secu­ri­ty call for? It calls for a secu­ri­ty man­u­al. Whether you are one per­son or many, you need to devel­op a guide­line for when you will use a par­tic­u­lar email secu­ri­ty ser­vice and when you will not. Why is this impor­tant? Because you don’t want to keep in rein­vent­ing the wheel, and you want your part­ners, col­leagues, and employ­ees to use con­sis­tent secu­ri­ty prac­tices. A thought­ful secu­ri­ty man­u­al will dic­tate appro­pri­ate uses of email secu­ri­ty ser­vices, and it will be an ongo­ing reminder of what you’ve decid­ed to do.

For instance, you may not have request­ed a dig­i­tal sig­na­ture from any­one for sev­er­al months, and now you’re faced with the deci­sion as to whether to get a dig­i­tal sig­na­ture on a new con­tract. You refer to your secu­ri­ty man­u­al, which indi­cates that it’s pru­dent to get E-sign sig­na­tures for all con­tracts involv­ing $2,000 or more.

You thought this through when you wrote the secu­ri­ty man­u­al. Now you don’t have to think it through again. All you have to do is refer to your secu­ri­ty man­u­al. If the con­tract involves under $2,000, you won’t both­er to get an E-sign sig­na­ture and will set­tle for a return email acknowl­edge­ment. If the agree­ment involves over $2,000, you will take the trou­ble to get an E-sign sig­na­ture from the oth­er par­ty.

Your secu­ri­ty man­u­al does not have to be long and ver­bose. Indeed, it’s bet­ter for it to be short and to the point, maybe as short as one or two pages. It should be a quick ref­er­ence, not a ref­er­ence that requires a lot of read­ing. And it should not be lim­it­ed to using RMail ser­vices; it should also include every­day prac­tices to pro­tect your­self against social engi­neer­ing, as dis­cussed in Chap­ter 16.

Everyone’s secu­ri­ty man­u­al will be dif­fer­ent based on their pro­fes­sion, busi­ness, per­son­al activ­i­ties, secu­ri­ty ser­vices avail­able, and so forth. If you don’t like the idea of hav­ing a secu­ri­ty man­u­al, sim­ply think of it as what it real­ly is: a secu­ri­ty reminder.

A secu­ri­ty strat­e­gy does not begin and end with one per­son, how­ev­er. The devel­op­ment of the secu­ri­ty man­u­al should include all employ­ees and part­ners as part of the process of get­ting them to buy in to sound secu­ri­ty prac­tices. An added ben­e­fit is that cer­tain employ­ees and part­ners will come up with good ideas for the effi­cient and cost-effec­tive use of secu­ri­ty prac­tices.

The devel­op­ment process for cre­at­ing an email secu­ri­ty strat­e­gy and reduc­ing it to writ­ing does not have to be long. Maybe just a few meet­ings? How else are you going to ensure that your orga­ni­za­tion has ade­quate secu­ri­ty prac­tices to pro­tect employ­ees, clients, cus­tomers, part­ners, and your busi­ness rep­u­ta­tion?

Indeed, you may even want to request that those with whom you do busi­ness fol­low secure email prac­tices. For instance, if you’re a law firm han­dling high-val­ue real estate trans­ac­tions, you may want to require the title com­pa­ny with which you do ongo­ing busi­ness to insti­tute secure email prac­tices. That being so, your secu­ri­ty man­u­al may be some­thing that you will find help­ful to export to oth­ers.

Home

And yes! You should have a secu­ri­ty man­u­al or at least guide­lines for your fam­i­ly to use. A secu­ri­ty man­u­al can not only edu­cate mem­bers of the fam­i­ly but also remind mem­bers of the fam­i­ly that secu­ri­ty begins at home. In fact, secu­ri­ty aware­ness at home might be much more impor­tant to you than secu­ri­ty at your busi­ness.

For instance, if you have bank accounts or bro­ker­age accounts with large mon­e­tary val­ue, you will want to make sure that your per­son­al email and oth­er per­son­al online activ­i­ties have first rate secu­ri­ty. That holds true for cred­it cards with high max­i­mum amounts, and the like. Hence, secu­ri­ty prac­tices are not just up to you. In order to ful­ly pro­tect your­self you have to make sure that oth­ers on your home Wi-Fi net­work are also secu­ri­ty con­scious.

Enterprise Security

Dis­cussing enter­prise secu­ri­ty (large orga­ni­za­tion secu­ri­ty) is beyond the scope of this book. That spe­cial­ty falls to the IT depart­ment of your orga­ni­za­tion. If your orga­ni­za­tion doesn’t have writ­ten secu­ri­ty guide­lines and train­ing for secu­ri­ty prac­tices, how­ev­er, you may want to point out to man­age­ment that the lack of a secu­ri­ty man­u­al is endan­ger­ing the busi­ness, busi­ness rep­u­ta­tion, clients, cus­tomers, employ­ees, and oth­ers involved in the oper­a­tion of the busi­ness. In some places a secu­ri­ty man­u­al might be called a pol­i­cy state­ment.

Not the End of the Story

Secu­ri­ty is an ongo­ing con­cern. Be aware. Keep up on the lat­est secu­ri­ty threats and take pre­ven­tive mea­sures if nec­es­sary. Keep up on devel­op­ments for bet­ter secu­ri­ty. There is no sil­ver bul­let for secu­ri­ty threats, and there will nev­er be an end to secu­ri­ty prob­lems. One easy way to cope is to use RMail. RMail and its ser­vices will pro­vide you with use­ful secu­ri­ty tools, and RMail Tech Essen­tials (a week­ly brief­ing) and RPost Insights (a month­ly newslet­ter) will keep you up to date on what you need to know for max­i­mum cyber­se­cu­ri­ty, par­tic­u­lar­ly in regard to your email. See the RMail web­site for access to the RMail Tech Essen­tials and RPost Insights.