8 rules for savvy cybersecurity

Has your personal information been exposed in a data breach or hack? Statistics say, most likely. Record-breaking breaches over the past few years have exposed usernames, passwords and Social Security numbers, allowing criminals to open credit cards in their victims’ names, drain bank accounts and seize computers to hold for ransom.

It’s a serious, growing problem. But it’s not a reason for despair. You can take steps to help maximize your security.

What you’ll learn

• Create a secret email address for your financial accounts
• Enable 2-step verification on your email and financial accounts
• Use Wi-Fi with extreme caution
• Secure your home Wi-Fi network to keep out hackers
• Get instant text or email alerts for your credit cards and bank cards
• Freeze your credit and protect your children
• Update all your software—always
• 10-second EMAIL rule

Create a secret email address for your financial accounts

We don’t think twice about sharing our email address with countless businesses, organizations and people. But having your email addresses in so many databases puts you at a significant risk. Hackers routinely breach the security networks of many organizations that hold your primary email address. That stolen personal data, paired with poor email security, could lead to disaster.

Now, you may not care if someone hacks into your Food Network or Yelp account, but you certainly don't want your online banking exposed in the same way. This is why you need to create a separate, secret email for your financial accounts. A separate email address reduces your digital footprint and if your primary, non-financial email address is exposed in a hack, it will not be connected to your financial accounts.

This email address should be:

• Only used for your most sensitive accounts
• Unidentifiable—don’t use your first name, last name, initials, or other identifying information
• Protected by a strong and unique password

Tip! How to create strong passwords. We all face the password paradox: Easy-to-remember passwords are easy to break, hard-to-break passwords are hard to remember. Here’s two ideas that create longer passwords that don’t use names or dictionary words.

• Mnemonic phrase with numbers or symbols thrown in. Example “Jack and Jill went up the hill to fetch a pail of water” → J&Jw^thtf@p0w
• Goal setting (especially good when you need to change every six months). Example “Run everyday” → Run3v3ryd@y

Enable 2-step verification on your email and financial accounts

Creating strong passwords is just the first step in your account protection plan. You need to put another layer of security on all-important accounts such as email, online banking, social media and more. That extra layer is a trend in online security called two-step verification or sometimes two-factor authentication. Add it to any account you have that supports this technology.

With the two-step verification approach:

• You’re sent a short-lived, one-time passcode when you start to log in to an account online.
• You must use that code to finish logging in.
• You can receive this code via text message, or something called an “authenticator app.” The authenticator app is the most secure option as it is more difficult for hackers to compromise.

This method stops your accounts from getting hacked because it requires two separate things: Something you know, your password, and something you have, the temporary code. So even if a hacker has your password, he won’t gain access, and you’ll be alerted if someone is trying to break into your account. If you get a code and you haven’t tried to log-in—you know something is up. At that point, you’ll want to change your password.

Use Wi-Fi with extreme caution

We may all love free Internet access when we are out and about and want to be connected, but that free connection can end up being very costly. These free networks are completely open, and hackers can gain access to anything you do while connected—your email, your credit card number, your bank account.

• When connected to free, public Wi-Fi, avoid making financial transactions or checking your email.
• Instead, use your smartphone as a hot spot. When you do, you’ll be using your data, which provides a private connection, rather than the public wireless network.
• If you need to connect regularly on–the-go, a VPN (virtual private network) would be a good option. This device allows you to create your own private Wi-Fi network anywhere you go.

Secure your home Wi-Fi network to keep out hackers

But what about your home Wi-Fi network? Your home wireless network can open the door to you and your family’s digital life if your router is not properly protected. There are four main things you must do to lock down your router and Wi-Fi network from the hackers.

Note: These are some of the more technical actions you'll have to take. Don't be discouraged if it sounds difficult to you. If you are confused, contact the tech person in your life for help. To do these steps, you’ll have to log in to your router’s IP address. If you do not know your router's IP address, you can find it in your user manual or by searching the make and model of your router online.

1. First, change the default username and password. Hackers know these and will use them to try to break into your network. Pick a strong password.
2. Encrypt your router. Be sure to select the strongest encryption setting for your router—WPA2 or WPA3. WEP is no longer considered secure, and you should replace your router if your only option is WEP.
3. Disable Wi-Fi Protected Setup (WPS). This feature allows others to quickly connect to your network with a short passcode rather than having to type the whole password. But it can lead to strangers gaining access. If you don’t have the option to fully disable this feature, see if you can limit the number of attempts a person can make to log in.
4. Update your router firmware (a fancy word for software). Routers often come with outdated software which leaves your network vulnerable to attacks. Updating your firmware sounds like a daunting task, but it's not that bad. Follow the instructions in your user manual for detailed instructions.

Get instant text or email alerts for your credit cards and bank cards

Use technology so you’re always aware of what funds are leaving your accounts or being charged to your accounts. Sign up for alert notifications with your financial institution and credit card companies. By doing so, you'll receive a text or email alert every time a charge or withdrawal is made.

Freeze your credit and protect your children

Here’s something most people don’t quite understand about their credit files: By default, our credit files are open. That means anyone with enough information to impersonate you may be able to open a new line of credit in your name.

This happens all the time and is a major source of identity theft. And when you consider how many private and public organizations have been hacked—institutions we’ve trusted with our Social Security numbers, employment history and other details about our financial lives—you need to be worried about the state of your credit file at the big three agencies.

Take back control of our credit through a credit freeze. A credit freeze locks your credit file with a PIN at each of the credit bureaus. No new credit can be issued in your name unless you lift the freeze with your special PIN.

\You will have to contact each of the credit bureaus separately. Credit freezes are free in every state thanks to a 2018 federal law. A credit freeze puts you in control. It is way more secure than credit monitoring or a fraud alert, both of which will alert you after credit has been issued in your name. With a credit freeze, you can prevent identity theft from happening instead of cleaning up after your identity theft nightmare.

But it’s not just your credit that you need to be concerned about: Experts say around 500,000 children suffer from identity theft every year. Why? Their clean records are attractive to thieves looking to open new accounts without any issues, and the theft can go unnoticed for years as parents and guardians often don’t think about checking their children’s records.

But childhood identity theft can lead to a lifetime of fraud and ruined credit.

• The first step in protecting your children is ensuring they have NO credit report by contacting all three of the credit bureaus (Equifax, Experian and TransUnion).
• Parents should send a letter including copies of their child's birth certificate listing them as the parent, their driver's license and proof of address to all three of the credit reporting agencies and ask for a manual search of their child's Social Security number.
• If no report is found, you’re in luck. You should still periodically check on your child’s status, however. If a report is found, it’s usually a sign your child has been victimized. Ask the credit bureaus to immediately place a credit freeze on your child’s record and investigate further.

Update all your software—always

Out-of-date software allows hackers to plant viruses and malicious software on your devices. Hackers exploit security holes in unpatched software which allows them to install malware and viruses on your unprotected devices. This malware could record everything you do or kidnap your computer for ransom.

So, you want to be sure that all the software and programs on all your devices are up to date. That includes your operating system, your browsers, Microsoft Office, Adobe programs and more.

• Many programs allow you to enable auto-updates. You should enable this on all your programs that allow it. A good place to start to see if a program will auto-update is the Security or Settings tab. You can also always google the name of the program and auto-update.
• It’s also a good idea to install a good antivirus program on your computer. You’ll want to make sure that it is always up to date as well.
• And periodically go through the programs on your devices and uninstall anything you don’t use. The fewer programs you have, the fewer holes for hackers to attack.

10-second EMAIL rule

Ransomware attacks are normally spread through a method called “phishing.” Phishing messages are emails that impersonate a legitimate company or person and are designed to steal your personal information or install malware on your machine through a malicious link.

Billions of these messages are sent every day. While most get caught in your spam filter, some find their way to your inbox. Here’s a 10-second “EMAIL” cybersecurity rule below can help you fend off the phishers who manage to get through:

• Examine
• Message
• And
• Inspect
• Link

Examine Message. Start by examining the subject line of an email. Phishers try to get us to react quickly to an urgent situation. Often, they will make the subject line something frightening such as: Warning, Account Closed or Security Alert. Some are more subtle, but still require you to act. For example: Mail Delivery Failed: Return Message to Sender or Incoming Fax Received. Subject lines like this should alert us that this may be a phishing attack.

Next, you need to discover the true sender of the email. Phishers can spoof the from line to appear to be a legitimate business or organization. You can determine the true sender by hovering your mouse over the display name. A small box will appear with the true email address.

Other suspicious things to look for include greetings that refer to you as “customer” or “sir” or “madam” instead of your name, poor grammar or a vague signature line with false contact information.

You should also be suspicious of unsolicited emails with attachments. Never click to open an unsolicited attachment. What presents itself as a resume, receipt or payment could be a .exe file that plants a virus on your computer or seizes it for ransom.

Inspect Link. The second half of E.M.A.I.L. requires you to inspect links within the message. Like you did with the sender, hover your mouse over any link or hyperlinked text. Be sure that the link is truly directing you to the correct website. If it looks phishy, delete the email. You can always contact the organization directly to ask if they sent you the email.

This is an action that needs to become part of your daily cybersecurity practices. Make it a habit so you can thwart off phishers without thinking about it.