Welcome to Week 2 of Cyber Month.  This week we’ll be focused on a rapidly evolving area of cyber security: Identity and authentication.

Why are we talking about identity and authentication?  You’ve got my username and password, right?  What else do you need?  Well, consider:

  • Your digital identity is an online record of your personal information, be it something as simple as your email address or as sensitive as your SIN. Your identity says a lot about you, so you need to protect it.
  • 80% of cyber breaches are identity-driven. The criminals want access to your identity so that they can impersonate you, raid your bank accounts, tax accounts, etc.
  • As we saw in our look at phishing, cyber criminals are most often trying to steal your username (identity) and password (authentication).
  • Use of your digital identity is becoming more widespread.  Just think about how many sites /services allow you to log in with your Facebook or LinkedIn credentials.  Just a few years ago that would have been unheard of.

 

Bottom line: you need to protect your digital identity.

 

How?  Let’s start with the basics:

 

Passphrases, not Passwords

  • Passphrases are the standard here at RRU
  • A short, easy to remember phrase instead of one word.
  • Much more secure than passwords
    • Easier to remember
    • Essentially impossible to crack

 

Using Passphrases

  • NEVER use your RRU passphrase at any other website / online service.
  • NEVER share your RRU passphrase with anyone. Ever…
  • Avoid using pet names, common keyboard patterns, family names, etc.

 

We’ve got a great video on the basics of using passphrases – here’s the link:

https://www.youtube.com/watch?v=XIySPpFHJCo (2 min)
Credential Stuffing Attacks

 

  • The reason we ask that you never use your RRU passphrase at another site / service.
    • If that site gets hacked, cybercriminals now have your RRU passphrase.
  • Credential stuffing attacks are responsible for some well-known data breaches, for example:
    • Canada Revenue Agency – over 11 million  accounts exposed.
    • General Motors
    • TurboTax

 

Protecting yourself

Cybersecurity journalist Kerry Tomlinson has an informative video on Credential Stuffing, with tips on how to protect yourself – check it out:

https://www.youtube.com/watch?v=g_RVoNvx-9Y (2 min)

 
Is my passphrase secure?

 

Good question!  Yes, it’s very possible that the passphrase you come up with has been compromised in a data breach.  So, how do you check it?

 

https://Haveibeenpwned.com

 

HIBP searches for compromised user data being sold on the internet and catalogues it in searchable databases.  You can:

  • Search an email address or passphrase to see if either were involved in a data breach; and
  • Set up alerts to be notified if your email address is ever detected in a data breach.

 

Next time, we look at Multi-factor Authentication (aka “MFA”), new to us here at RRU, and how the cyber criminals will try to bypass MFA.

 

As with all of our cybersecurity awareness materials, you are welcome to share this email with family and friends.

 

REMEMBER: STOP! THINK! CONNECT.