8 ms·

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-0-January-

Here's a short, fairly practical guide that you might find helpful: https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-0-January-2022.pdf https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-.... It is aimed mostly at small businesses, but I find a lot of the guidance to be pretty relevant to my personal IT. My even shorter (and incomplete) summary of the document would be: configure your router and firewall; remove default passwords and crapware from your devices; use a lock screen; don't run as root; use a password manager and decent passwords; enable 2FA everywhere you can; enable anti-malware if your OS has it built it; don't run software from untrusted sources; patch regularly. There are also other controls that you can choose to impose on yourself. For example, I require full-disk encryption, and I will only use mobile devices which get regular updates. Would be interested in hearing other things that HN'ers do to limit risk.

amelius 4y ago
Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?
- greggyb 4y ago
  Yes. Why wouldn't you?
  - paulcole 4y ago
    Because you assess the risk as being low and don’t care that much about low risk things.
    - AnIdiotOnTheNet 4y ago
      Sure, but it is also a very low effort thing with little friction involved.
  - amelius 4y ago
    I have to physically go under my desk to see if my computer has been tampered with.
- k3liutZu 4y ago
  Yes (I don't bother when I'm working from home) I haven't used a use usb stick in +10 years.
  - dorfsmay 4y ago
    How do you install the OS?
- Semaphor 4y ago
  For me: No, and no. But as that would require someone breaking into my apartment, I don’t worry too much.
  - MonkeyMalarky 4y ago
    I work from home and still lock my screen because I have cats that will walk on my desk if I'm not looking. 4 paws and an open vim or slack window are a dangerous combination!
- mr90210 4y ago
  When I worked at an office, I used to, with a quick: CMD+CTRL+Q
- KineticLensman 4y ago
  > Do you lock your computer every time you leave your desk? This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.
  - friendlyHornet 4y ago
    When I was an intern at a company, I forgot to lock my screen once when I went to the toilet My colleagues edited my .bashrc to echo "lock your screen next time"
    - cozzyd 4y ago
      I like to alias emacs to vim or rm, depending on how charitable I'm feeling. (Kidding obviously, at least for the latter).
      - friendlyHornet 4y ago
        I would alias both vim and emacs to cat I think at first the colleague might assume it's a bug in the terminal not someone had replaced the command with an alias or just alias them to echo, so that it prints out the file name, not even the file content
  - throwawayprank 4y ago
    > unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't. Same here. The all time favorite is sending a resignation notice to the person's manager (the manager usually gets a fair warning first and plays along with it).
    - Marc_Bryan 4y ago
      Yep. I've sent a party mail and free lunch or snacks sponsor to the team. Have got them a couple of times as well. A lesson well learned...
    - 4y ago
- thr717272 4y ago
  Lock my computer: Always[1][2]. Check for keylogger thumbdrives: I use a laptop so it would be immediately obvious. But now that you say it I haven't checked the charger USB-outlet on the back of my cabled keyboard. [1]: it has happened I have failed. Once a year or something. [2]: I sometimes try to allow myself to go downstairs in my own house to fetch a cup coffe without locking when I am alone, but I find it so stressful in practice I always lock it. I don't need to know but it is a good habit. I'm otherwise normal :-)
  - hotpotamus 4y ago
    I've worked in places where that once a year slip-up would mean you sent an email offering to buy lunch for the team or get your background changed to a David Hasselhoff pinup picture from the 80's. I do feel weird locking my computer when I'm alone though.
    - francis-io 4y ago
      One place I worked, it was common practice to email something semi embarrassing into a public slack channel from the unlocked pc.
    - SargeDebian 4y ago
      Screenshot of the desktop, rotate that 180 degrees and set as background. Hide all icons and the taskbar, then rotate the whole screen 180 degrees. Maybe a bit of tape underneath the optical mouse.
  - nickjj 4y ago
    What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments. For example IT enforces that your screen becomes locked after 15 minutes of inactivity and also ties in your local computer 's user login password to your SSO login to access everything. It's a contradiction around password best practices. If you force people to input their password multiple times a day then naturally people will gravitate towards easier to type passwords. If the idea is "but what if you go AFK in a public place and forget to lock your screen?!?", that's not a valid reason. If you were working in a coffee shop and went to use the restroom for 4 minutes or turned your back for 2 minutes then your machine could be compromised (or even worse stolen). It's extremely reckless to leave your gear unattended in a public place. It can really break morale to input your password and MFA half a dozen times a day, especially when you're alone in a locked apartment where the laptop hasn't left that location in a year.
- Terretta 4y ago
  On MacOS, poke the TouchID key to Lock Screen. When back, poke it again to unlock. Make this rote. On Windows, Win-L to lock.
- thallosaurus 4y ago
  Yeah, colleagues have happened once, then never again. I use a Laptop with a Dockingstation for work and take the Laptop home with me every time I leave so I would have noticed if this would have happened. When home, I always have to lock or my cat would typeeeeeeeeawww
Silhouette 4y ago
Would be interested in hearing other things that HN'ers do to limit risk. Mostly the same basics as you. The document you linked is a good starting point. I'd add extensive use of virtualisation and sandboxing. I run less and less software as native, installed applications on any device I use personally or professionally. Instead it tends to run inside things like VMs or Docker containers or cloud-hosted platforms now. My basic policy is to try and make every device and installed application expendable/replaceable in case anything breaks or gets compromised and then focus on the data. I apply the principle of least privilege for access to any sensitive data, try to keep all important data in standardised formats and avoid lock-in effects as much as reasonably possible, and keep good back-ups under my own control with the ability to redeploy/restore anything quickly and as automatically as possible.
- BLKNSLVR 4y ago
  100% with you on the entirety of your last paragraph. I generally use a device as an access mechanism; a configured window into the data. This configuration is the only thing lost when a device is lost. No data, no function, no service. Configure the replacement device and continue as you were. Virtualisation and Docker-isation makes backups and restores almost enjoyable.
  - amelius 4y ago
    How do you deal with leaking of data?
    - BLKNSLVR 4y ago
      Not sure I fully understand the context of the question, but for a device to gain access it needs to be allowed into the local network by being in wifi range or authorised on the VPN, plus have username/password access to the service/data. If, however, there's a backdoor I don't know about, then I'm pwned.
ttctciyf 4y ago
> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additional step I take is to use several browser profiles for different purposes (mail, banking, shopping, default, to name four) so that Firefox always asks me to pick a profile on startup. As well as reducing the possibility of XSS, this lets me relax the settings for some profiles where I restrict myself to a small number of trusted sites. (This may well be overkill!) 0: uBlock Origin, that is, as per instructive commment below[1] 1: https://news.ycombinator.com/item?id=34389942 https://news.ycombinator.com/item?id=34389942
- paulryanrogers 4y ago
  Firefox multi-account containers can be a more convenient way to isolate things, especially now that the container can be limited to only the allowed sites. I also made an app and extensions to help me use multiple browsers, one per site. (Browsr Router)
  - ttctciyf 4y ago
    Regards the containers, I started my profile compartmentalization practice before they arrived, so I never explored them. But I'm curious as to whether each container comes with a complete set of browser permissions, like profiles do, which would enable you (for example) to have a location-enabled container specifically for google maps (in reference to[0]) while disabling it on the container used for search, as you could quite easily do with profile compartmentalization? (Which, tbf, is a privacy rather than a security concern.) 0: https://www.simpleanalytics.com/en/blog/google-changed-google-maps-url-your-location-data-is-no-longer-safe https://www.simpleanalytics.com/en/blog/google-changed-googl...
    - paulryanrogers 4y ago
      Add-ons cross over container boundaries, so I suspect other browser permissions do too. You're solution is more bullet proof. For similar reasons I am hoping to add better profile support to Browser Routr.
ghostpepper 4y ago
Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.
- nickjj 4y ago
  > Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik I was thinking about getting a Ubiquity router because it has good support for setting up wired VLANs without needing to go down the path of finding a solid OpenWrt router. Is it really true that you can't access the router's dashboard and configure things without associating an online account to your router?
  - Terretta 4y ago
    No
  - rolph 4y ago
    https://www.lifewire.com/ubiquiti-promised-premium-secure-routers-then-they-were-hacked-5121136 https://www.lifewire.com/ubiquiti-promised-premium-secure-ro... [2021]
  - Spooky23 4y ago
    That’s not true. You need to use the gui though. I think some folks preferred the cli in the past.
  - shamiln 4y ago
    My UDM and UDR aren’t connected to UI’s cloud services, so it’s not really cloud first.
  - ghostpepper 4y ago
    It's definitely still possible to use without cloud now, what I meant by "started down the path" is that it seems like the direction of the company is not aligned with what I want. I was in the market for more hardware and I had to decide whether to increase my investment in Ubiquity or make a change, and I chose the latter.
drpixie 4y ago
I like your shorter list - but I'd suggest concerned people also avoid the obvious attack surfaces: * Windows * storing data on other people's computers (cloud apps) (Yes, they're all safe under the right circumstances. But the right circumstances are far from universal.) And loosing access to important stuff can be worse than other people seeing the stuff - anything behind a google (etc) account can be lost in a moment, due their mechanised decision making and inability to meaningfully contact humans. If you can't always easily contact a helpful and authorised human, the continuing existence of your stuff is a gamble. And no, setting off a twitter storm and hoping that the company will be embarrassed into restoring your data is not a suitable contact method!
themadturk 4y ago
> Would be interested in hearing other things that HN'ers do to limit risk. We have a pretty standard setup at work: screen times out after 15 minutes, and co-workers teach you pretty fast to lock your machine. At home, where I use a MacBook Air, I work in a physically unstable situation...in a rocking chair, on my lap. Whenever I stand up, I close the machine, which locks it immediately. If not, I risk the machine sliding to the floor.

amelius 4y ago

Do you lock your computer every time you leave your desk? And do you always check for keylogger thumbdrives and such?

greggyb 4y ago
Yes. Why wouldn't you?
- paulcole 4y ago
  Because you assess the risk as being low and don’t care that much about low risk things.
  - AnIdiotOnTheNet 4y ago
    Sure, but it is also a very low effort thing with little friction involved.
- amelius 4y ago
  I have to physically go under my desk to see if my computer has been tampered with.
k3liutZu 4y ago
Yes (I don't bother when I'm working from home) I haven't used a use usb stick in +10 years.
- dorfsmay 4y ago
  How do you install the OS?
Semaphor 4y ago
For me: No, and no. But as that would require someone breaking into my apartment, I don’t worry too much.
- MonkeyMalarky 4y ago
  I work from home and still lock my screen because I have cats that will walk on my desk if I'm not looking. 4 paws and an open vim or slack window are a dangerous combination!
mr90210 4y ago
When I worked at an office, I used to, with a quick: CMD+CTRL+Q
KineticLensman 4y ago
> Do you lock your computer every time you leave your desk? This was a corporate requirement where I used to work, unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't.
- friendlyHornet 4y ago
  When I was an intern at a company, I forgot to lock my screen once when I went to the toilet My colleagues edited my .bashrc to echo "lock your screen next time"
  - cozzyd 4y ago
    I like to alias emacs to vim or rm, depending on how charitable I'm feeling. (Kidding obviously, at least for the latter).
    - friendlyHornet 4y ago
      I would alias both vim and emacs to cat I think at first the colleague might assume it's a bug in the terminal not someone had replaced the command with an alias or just alias them to echo, so that it prints out the file name, not even the file content
- throwawayprank 4y ago
  > unofficially reinforced by the local jokers who would rotate the screen and / or send prank messages if you didn't. Same here. The all time favorite is sending a resignation notice to the person's manager (the manager usually gets a fair warning first and plays along with it).
  - Marc_Bryan 4y ago
    Yep. I've sent a party mail and free lunch or snacks sponsor to the team. Have got them a couple of times as well. A lesson well learned...
  - 4y ago
thr717272 4y ago
Lock my computer: Always[1][2]. Check for keylogger thumbdrives: I use a laptop so it would be immediately obvious. But now that you say it I haven't checked the charger USB-outlet on the back of my cabled keyboard. [1]: it has happened I have failed. Once a year or something. [2]: I sometimes try to allow myself to go downstairs in my own house to fetch a cup coffe without locking when I am alone, but I find it so stressful in practice I always lock it. I don't need to know but it is a good habit. I'm otherwise normal :-)
- hotpotamus 4y ago
  I've worked in places where that once a year slip-up would mean you sent an email offering to buy lunch for the team or get your background changed to a David Hasselhoff pinup picture from the 80's. I do feel weird locking my computer when I'm alone though.
  - francis-io 4y ago
    One place I worked, it was common practice to email something semi embarrassing into a public slack channel from the unlocked pc.
  - SargeDebian 4y ago
    Screenshot of the desktop, rotate that 180 degrees and set as background. Hide all icons and the taskbar, then rotate the whole screen 180 degrees. Maybe a bit of tape underneath the optical mouse.
- nickjj 4y ago
  What bugs me is when this is applied to remote workers in a way that seems optimized for in-office environments. For example IT enforces that your screen becomes locked after 15 minutes of inactivity and also ties in your local computer 's user login password to your SSO login to access everything. It's a contradiction around password best practices. If you force people to input their password multiple times a day then naturally people will gravitate towards easier to type passwords. If the idea is "but what if you go AFK in a public place and forget to lock your screen?!?", that's not a valid reason. If you were working in a coffee shop and went to use the restroom for 4 minutes or turned your back for 2 minutes then your machine could be compromised (or even worse stolen). It's extremely reckless to leave your gear unattended in a public place. It can really break morale to input your password and MFA half a dozen times a day, especially when you're alone in a locked apartment where the laptop hasn't left that location in a year.
Terretta 4y ago
On MacOS, poke the TouchID key to Lock Screen. When back, poke it again to unlock. Make this rote. On Windows, Win-L to lock.
thallosaurus 4y ago
Yeah, colleagues have happened once, then never again. I use a Laptop with a Dockingstation for work and take the Laptop home with me every time I leave so I would have noticed if this would have happened. When home, I always have to lock or my cat would typeeeeeeeeawww

Silhouette 4y ago

Would be interested in hearing other things that HN'ers do to limit risk. Mostly the same basics as you. The document you linked is a good starting point. I'd add extensive use of virtualisation and sandboxing. I run less and less software as native, installed applications on any device I use personally or professionally. Instead it tends to run inside things like VMs or Docker containers or cloud-hosted platforms now. My basic policy is to try and make every device and installed application expendable/replaceable in case anything breaks or gets compromised and then focus on the data. I apply the principle of least privilege for access to any sensitive data, try to keep all important data in standardised formats and avoid lock-in effects as much as reasonably possible, and keep good back-ups under my own control with the ability to redeploy/restore anything quickly and as automatically as possible.

BLKNSLVR 4y ago
100% with you on the entirety of your last paragraph. I generally use a device as an access mechanism; a configured window into the data. This configuration is the only thing lost when a device is lost. No data, no function, no service. Configure the replacement device and continue as you were. Virtualisation and Docker-isation makes backups and restores almost enjoyable.
- amelius 4y ago
  How do you deal with leaking of data?
  - BLKNSLVR 4y ago
    Not sure I fully understand the context of the question, but for a device to gain access it needs to be allowed into the local network by being in wifi range or authorised on the VPN, plus have username/password access to the service/data. If, however, there's a backdoor I don't know about, then I'm pwned.

ttctciyf 4y ago

> enable anti-malware if your OS has it . . . Would be interested in hearing other things Given the most common network activity is web browsing, it seems like enabling protections in the browser is becoming mandatory for the security-conscious. For me this amounts to enabling NoScript and uBlock[edit: [0]] plugins in Firefox, desktop and mobile versions, and disabling or locking down various "features". An additional step I take is to use several browser profiles for different purposes (mail, banking, shopping, default, to name four) so that Firefox always asks me to pick a profile on startup. As well as reducing the possibility of XSS, this lets me relax the settings for some profiles where I restrict myself to a small number of trusted sites. (This may well be overkill!) 0: uBlock Origin, that is, as per instructive commment below[1] 1: https://news.ycombinator.com/item?id=34389942 https://news.ycombinator.com/item?id=34389942

paulryanrogers 4y ago
Firefox multi-account containers can be a more convenient way to isolate things, especially now that the container can be limited to only the allowed sites. I also made an app and extensions to help me use multiple browsers, one per site. (Browsr Router)
- ttctciyf 4y ago
  Regards the containers, I started my profile compartmentalization practice before they arrived, so I never explored them. But I'm curious as to whether each container comes with a complete set of browser permissions, like profiles do, which would enable you (for example) to have a location-enabled container specifically for google maps (in reference to[0]) while disabling it on the container used for search, as you could quite easily do with profile compartmentalization? (Which, tbf, is a privacy rather than a security concern.) 0: https://www.simpleanalytics.com/en/blog/google-changed-google-maps-url-your-location-data-is-no-longer-safe https://www.simpleanalytics.com/en/blog/google-changed-googl...
  - paulryanrogers 4y ago
    Add-ons cross over container boundaries, so I suspect other browser permissions do too. You're solution is more bullet proof. For similar reasons I am hoping to add better profile support to Browser Routr.

ghostpepper 4y ago

Since you mention routers, I’m curious what brand you use. Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik. While they do seem to have regular CVEs (which is good, I think?), they also don’t seem to have a public bug bounty program.

nickjj 4y ago
> Since Ubiquity started fown the cloud-first path I’ve switched to Mikrotik I was thinking about getting a Ubiquity router because it has good support for setting up wired VLANs without needing to go down the path of finding a solid OpenWrt router. Is it really true that you can't access the router's dashboard and configure things without associating an online account to your router?
- Terretta 4y ago
  No
- rolph 4y ago
  https://www.lifewire.com/ubiquiti-promised-premium-secure-routers-then-they-were-hacked-5121136 https://www.lifewire.com/ubiquiti-promised-premium-secure-ro... [2021]
- Spooky23 4y ago
  That’s not true. You need to use the gui though. I think some folks preferred the cli in the past.
- shamiln 4y ago
  My UDM and UDR aren’t connected to UI’s cloud services, so it’s not really cloud first.
- ghostpepper 4y ago
  It's definitely still possible to use without cloud now, what I meant by "started down the path" is that it seems like the direction of the company is not aligned with what I want. I was in the market for more hardware and I had to decide whether to increase my investment in Ubiquity or make a change, and I chose the latter.

drpixie 4y ago

I like your shorter list - but I'd suggest concerned people also avoid the obvious attack surfaces: * Windows * storing data on other people's computers (cloud apps) (Yes, they're all safe under the right circumstances. But the right circumstances are far from universal.) And loosing access to important stuff can be worse than other people seeing the stuff - anything behind a google (etc) account can be lost in a moment, due their mechanised decision making and inability to meaningfully contact humans. If you can't always easily contact a helpful and authorised human, the continuing existence of your stuff is a gamble. And no, setting off a twitter storm and hoping that the company will be embarrassed into restoring your data is not a suitable contact method!

themadturk 4y ago

> Would be interested in hearing other things that HN'ers do to limit risk. We have a pretty standard setup at work: screen times out after 15 minutes, and co-workers teach you pretty fast to lock your machine. At home, where I use a MacBook Air, I work in a physically unstable situation...in a rocking chair, on my lap. Whenever I stand up, I close the machine, which locks it immediately. If not, I risk the machine sliding to the floor.