Analyze your data: Where is it and who has it?

It is becoming widely recognized that “unknown” data leakage of PCI data, and more broadly other Personally Identifiable Information, within enterprises is the highest value target for the bad guys.

While encryption, tokenization and masking together with current market Data Loss Prevention tools are valuable, they do not provide for expansive and prescriptive data discovery. We urgently need more intelligent data discovery tools to limit our attack surface.

Gartner published the research note “shift cybersecurity investment to detection and response” in January 2016. The research note concluded that IT risk and security leaders must move from trying to prevent every threat and acknowledge that perfect protection is not achievable. Organizations need to detect and respond to malicious behaviors and incidents, because even the best preventative controls will not prevent all incidents. In the digital world, the pace of change is already too fast to anticipate and, combined with advanced attacks, it will be impossible to defend against every type of attack. Organizations must create the right mix of investments across prevention, detection and response capabilities.

I agree with this Gartner research that we need to shift cybersecurity investment to detection and response. I think that the “detect and respond to malicious behaviors” methods can be automated and based on discovery of sensitive data items. Encryption, masking and tokenization are not enough.

From the recent FS-ISAC 2016 Summit, Lawrence Chin reported about “Know Your Data” and stated, “At the end of the day, your business critical data is the asset that needs to be protected. Consequently, an awareness of where it resides, who has access to it, and how it travels through your network is necessary. To protect data, encryption at rest has become the new norm. However, that’s not sufficient. Visibility into how and where it flows during the course of normal business is critical. Armed with this knowledge, deviations from the baseline can be detected and even stopped.”

Understanding where this integral data “resides and who has access to it,” which Chin discussed, coupled with discovering “deviations from the base line” is the best way to rethink our security approach.

PCI DSS 3.2 provides an important and unique update on data discovery (A3.2.5, A3.2.5.1, A3.2.6) for service providers. While these requirements are not mandatory for some time, it’s important to know that you and your service providers now have an opportunity to leverage and adopt these controls. Implementing data discovery solutions can significantly and positively impact or reduce scope/cost, which will ultimately make it easier to validate PCI compliance, and the PCI QSA community developed many specialized tools to support the payment card industry.

The bad guys continue to target leaked PCI data and other Personally Identifiable Information. To mitigate and limit future attacks, it is essential to generate and implement data discovery tools that go beyond the existing data loss prevention tools.

from Help Net Security http://ift.tt/297Lb8i

As threats evolve, faster response times are essential

Two thirds of respondents to a global survey by the Business Continuity Institute reported that they had experienced at least one cyber incident during the previous twelve months, and 15% reported they had experienced at least ten incidents during the same period.

Faster response times are needed

The report found that there was a wide range of response times for cyber incidents. Almost a third of organizations (31%) stated that they responded within one hour. However, one fifth (19%) take a worrying four hours or more in responding to a cyber event, and almost half (44%) take more than two hours to respond. This has clear implications for the time taken to return to business as usual, and the ultimate cost of the incident to the organization.

Even if organizations wish to respond immediately to a cyber attack, the nature of the attack may render them unable to do so. The research found that phishing and social engineering was the top cause of cyber disruption, with over 60% of companies reporting being hit by such an incident over the past 12 months, and 37% hit by spear phishing.

It also found that 45% of companies were hit by a malware attack and 24% by denial of service. All these forms of attack will, in different ways, render an organization’s own network either contaminated or inoperable. Their website may have been taken down and they may well have to switch off their internet connection until they can secure themselves from further attack.

Incidents cost more each year

The research, a study of 369 business continuity and resilience professionals from across the world, also revealed that the costs of these incidents varied greatly, with 73% reporting total costs over the year of less than €50,000, but 6% reporting annual costs of more than €500,000.

“Cyber attacks tend to target the weakest links of an organisation, and this calls for a greater awareness of cybercrime. As the cyber threat evolves, it is crucial to stay on top of it, building long-term initiatives and regularly updating recovery plans,” said David James-Brown FBCI, Chairman of the BCI.

Rickie Sehgal, Chairman of Crises Control, said: “Rapid communication with employees, customers and suppliers is vital for any company in terms of responding effectively to a major business disruption event such as a cyber attack. When your business is at risk, even a one hour delay in responding to an incident can be too long. Taking more than two hours to respond, as almost half of companies do, is just unacceptable.”

from Help Net Security http://ift.tt/294MTGt

Most are unable to control user activity in their IT infrastructure

A majority of organizations report that they lack visibility into their cloud infrastructure, file shares, user activity and mobile devices, greatly impacting data security and system uptime, according to Netwrix.

The survey of 830 respondents, conducted by Netwrix in April and May 2016, was designed to identify the means organizations are using to gain visibility into IT infrastructures, understand whether they get a competitive advantage from their choices, and explore what challenges they might face in the future. The organizations surveyed operate in 30 industries worldwide and represent businesses of all sizes.

Key findings

• Almost 65% of organizations do not have complete visibility into user, IT and third-party activity in their IT infrastructure
• 75% of respondents have partial or no visibility into their cloud and hybrid IT environments
• A strong majority of respondents (78%) are unaware or only partly aware of what is happening across their unstructured data and file storage
• BYOD infrastructure is the most challenging area, with 83% of organizations reporting zero or only partial visibility into user personal devices
• Almost 47% of respondents believe that the increasing complexity of IT infrastructures will make achieving visibility even more difficult in the future.

“Organizations around the globe show growing interest for ensuring visibility into IT infrastructure. In today’s ever-changing threat landscape, companies simply cannot foresee all possible cyber threats that could affect their data security and system uptime. Understanding what is happening in the IT infrastructure, including who or what causes malicious events, enables timely threat detection and prevents serious damage,” said Michael Fimin, CEO of Netwrix.

from Help Net Security http://ift.tt/299VT1p

Risks of working with untraceable documents

An overwhelming majority of professionals are dealing with document-related productivity challenges associated with the inability to locate and track documents, control versions, efficiently complete reviews and approvals, and maintain information security, according to the BPI Network.

Based on a survey of approximately 500 professionals worldwide, a new study finds 92 percent of managers and knowledge workers consider themselves to be document-dependent, including 90 percent who say they are dependent on PDF technology to create and distribute documents. Most expect their dependency to continue to increase into the future.

Top concerns

The study finds that workers are frustrated by a wide range of issues related to creating, finding, sharing, approving, and processing documents. Their top four concerns are:

• Lost time searching for documents
• Wasted time recreating lost documents
• Long waits gaining approvals on documents
• Security and privacy worries.

Three-quarters of all survey respondents say that being able to track the receipt, readership and location of documents would be valuable to their work. Top benefits, according to respondent, would be:

• Ensuring the integrity and trust of each document
• Improving conformance with policies and regulations
• Easier removal of outdated documents from circulation
• Intellectual property protection and control over who sees it.

Key findings

• 92 percent of survey respondents are document dependent, including 51 percent who are “highly dependent”
• 91 percent said the pace of document creation will either increase (58%) or stay the same (33%) within their organizations
• 83% agree that today’s “accelerated pace and connectivity of business” requires them to produce, share, manage more documents
• The most important types of documents: legal contracts/business agreements, price quotes/RFPs, ongoing business communications
• The top frustrations in dealing with documents: lost time searching for them, lost time recreating them, the risk of using the wrong version, security and privacy concerns
• Security and control of documents is a concern to 84 percent of respondents
• 77 percent of all respondents say it would be beneficial to be able to track receipt, readership and location of PDF documents
• The most beneficial features in a next-generation cloud service for PDFs would be: simplified document retrieval, simplified refresh and updating of documents in circulation, ability to easily notify recipients of document changes, the ability to track who is opening and editing a document.

from Help Net Security http://ift.tt/294Jffz

The Independence Day Playlist

You're More Likely to Remember Something If You Exercise a Few Hours Later

Remains of the Day: Karma Adds Option to Create a Private Network

Kick Off a Great Presentation by Showing Visuals Before You Explain Them

Give Any Homemade Pizza Wood-Fired Oven Flavor With Some Toasted Flour

Deadspin Why Are So Many MMA Fighters Truthers, Conspiracists, And Just Plain Weird?

Deadspin Why Are So Many MMA Fighters Truthers, Conspiracists, And Just Plain Weird? | Jezebel It’s the End Times, Because Mika Brzezinski Might Be Doin’ It With Joe Scarborough | Sploid Seeing How Sex Dolls Are Made Is Hauntingly Eerie (NSFW) | Gawker Manhattan’s Only Gun Range Is a Right-Wing Safe Space |

from Lifehacker http://ift.tt/293Ex1T

How to Deal with Frustrating Workplace Bureaucracy

Firefox's Experimental Containers Feature Lets You Log Into Multiple Accounts on the Same Services at Once

Build a Wearable Camera with a Raspberry Pi

Wearable cameras are still in their infancy and it’s a little weird to just wear one when you’re doing daily errands, but if you want to build your own for those more exciting moments of your life, Adafruit shows you how.

To make this, you’ll need to track down a Pi Zero, the Pi camera, a few cables, a battery, and a 3D printed case. Once you make it, the camera snaps a photo every 15 seconds (you can change this, of course). Battery life’s only about two hours, but it’s still a pretty fun little use for the camera. Head over to Adafruit for the full guide.

Raspberry Pi Wearable Time Lapse Camera | Adafruit

from Lifehacker http://ift.tt/29us9cW

Anyone Can Grow Their Own Food With This Discounted Miracle-Gro AeroGarden

Fix Minor Scratches in Glass with Toothpaste

Amazon's Second Annual Prime Day Is July 12: Here's Everything You Need To Know

Fix and Forget This Easy Slow Cooker Queso Dip

This Flight Case Toolbox and DIY Workstation Is Portable and Saves Space

“Beaver Gang Counter” malware ejected from Play Store

Get Free Stuff All Year Long With This List of Marketing Holidays

$29 off $100 at Fandango, $70 Fitbit Charge HR, and More in eBay's Flash Sale

The Foods That Are Most Dangerous to Dogs, and Why

This Push-Up Yoga Move Combination Builds Strength and Stretches You At the Same Time

Android N's Official Name Will Be Android Nougat

Setting up Two-Step Verification on your Amazon account

I admit I am not a fan of shopping, but if it has to be done, I vastly prefer to do it online. Nowadays the vast majority of my household purchases arrive in an Amazon box (apologies to my UPS delivery driver).

So if someone were to try and get their hands on my Amazon account, I shudder to think how much damage they could do to my credit. That’s why I made sure to enable Two-Factor Authentication (2FA) on my account – to make it a bit harder for a criminal to go on a shopping spree on my dime.

We’ve covered how to set up 2FA for Gmail earlier – now I’ll walk you through setting up 2FA on your Amazon account. It only takes just a few minutes and if you do a lot of shopping on Amazon, you should give it a try.

1) On a desktop computer, log in to your Amazon account as usual with your username and password. Keep your mobile phone handy for later steps.

2) Once logged in, click the Your Account menu item, at the top right near the Shopping Cart.

3) In the “Your Account” area, scroll down a bit until you see “Settings – Password, Prime & E-mail” and then click “Login & Security Settings,” which appears directly beneath “Account Settings.”

4) At the bottom of the “Change Account Settings” screen, click “Edit” next to “Advanced Security Settings.”

5) Now you’ll see an introductory screen telling you all about what Amazon calls “Two-Step Verification” – in other words, Two-Factor Authentication. Click “Get Started.”

6) Now Amazon gives you a choice in how you may want to receive your authentication code – Text message (SMS) or via an Authenticator app. For this step, I’m going to choose the Text Message option, but I will walk you through the Authenticator app in step 8.

To set up Text message authentication, enter your cell phone number and then hit “Send Code.”

7) Within a few moments, a text message should arrive on your phone, telling you what your Amazon security code is. Enter that code back on the Amazon screen, and hit “Verify code and continue.”

8) The next screen will prompt you to add a backup method to authenticate into your account, say if you no longer have access to your main phone or do not have cell service. You have the choice here between a text message, a voice call, or Authenticator app.

An important thing to note here is that you can’t use the same phone number you did in step 6 for either the backup text OR voice call.  And since I only have one phone number, I will be using the Authenticator App.

To get an Authenticator app set up and connected to your Amazon account, here’s what you need to do:

• Keep the Amazon window open on your desktop computer.
• Open your phone’s app store – the Apple App Store or Google Play, for example.
• Do a search for “Authenticator App”:
• A number of options will come up – you’ll want to make sure you use an Authenticator from a reputable provider, like Amazon, Microsoft, or Google. I personally use and prefer the Google Authenticator, so that’s what I’ll demonstrate here for you.
• Download the Authenticator app you’ve chosen (Google Authenticator in my case).
• Open the app.
• Tap the button in the app that allows you to add a new website. In the Google Authenticator, it’s the plus + button at the top right.
• Tap “Scan barcode.”
• Your phone’s camera will turn on and you’ll see a green box on your phone’s screen. Hold your phone up to your desktop computer window so your phone camera can scan the barcode shown on your Amazon account.
• It takes just a second to scan, and you should shortly see an entry on your Authenticator that says Amazon, six digits, and the email address you use for your Amazon account.
• Now, enter the six digit code shown on your Authenticator app back on your Amazon account screen, and hit “Verify and continue.”

9) Now that you’ve added a backup method, Amazon will show you one last screen about using 2FA on older devices (like an older Kindle) as well as disabling 2FA on computers you frequently use.

10) That’s it! Amazon will confirm that you’ve enable 2FA on your account, and you are good to go.

You’ll also get an email from Amazon confirming this change to your account.

With 2FA set up you now have an extra layer of security on your account, and can shop a little bit safer. (2FA won’t save you from your own shopping spree of course, so be careful out there.) Will you be giving 2FA a try? Is there another service you use online that you’d like to see a 2FA guide for? Let us know in the comments.

Follow @NakedSecurity

from Naked Security http://ift.tt/29cJNFu

Today's Best Deals: Amazon Echo, Nest Thermostat, iPhone Battery Cases

How to Jump Ship From Evernote and Take Your Data With You

How’d You Do During June’s Money Challenge?

Here's a Rare $50 Discount on Nest's Newest Thermostat

Easily exploitable LibreOffice flaw is a godsend for hackers

A serious LibreOffice flaw can be easily exploited by attackers to deliver malware on computers running a vulnerable version of the popular free and open source office suite.

According to The Document Foundation, which develops the software suite, the vulnerability (CVE-2016-4324) arises from an insufficient check for validity while parsing the Rich Text Format (RTF) character style index.

It is a Use After Free vulnerability that could ultimately allow for malicious code execution. And, unfortunately, it’s easy to exploit.

“A specially crafted RTF document containing both a stylesheet and superscript element causes LibreOffice to access an invalid pointer referencing previously used memory on the heap. By carefully manipulating the contents of the heap, this vulnerability can be able to be used to execute arbitrary code,” says Cisco Talos technical lead of security research Martin Lee.

The attacker has to know how to create such a file, and the trick the targeted user into opening it via a vulnerable version of LibreOffice.

“Attackers have previously exploited RTF parser vulnerabilities in MS Office, and used RTF files as a vector for embedding other malicious objects,” Lee noted. “Raising awareness of the existence of vulnerabilities such as these with users can help in reminding people not to open unexpected or suspicious emails or files.”

Luckily, there is currently no indication that the flaw is being exploited in the wild, but now that the existence of the flaw has been made public it’s possible that it soon will, and upgrading to the latest version (5.1.4) of the suite is advised.

LibreOffice might not be as popular and widely used as MS Office, but it was used by over 75 million users in 2013, and that number is growing with each passing year.

Among its users are many government, city and law enforcement agencies and departments in many countries of the European Union, as well as all UK Government agencies nationwide.

The flaw was discovered by Cisco Talos researcher Aleksandar Nikolic.

from Help Net Security http://ift.tt/297CvE3

Secure Trash Bags in the Can with Binder Clips

Add Lemonade to Your Cold Brew for a Summery Caffeine Boost

Google Maps Adds Multiple Destination Directions, Timeline Notes to Android

Here’s How to Get Your Money Back If You Own a Recalled IKEA Dresser or Chest

Deadspin Report: Joakim Noah Is “Almost Certainly” Signing With The Knicks | Jezebel Woman Screams R

Deadspin Report: Joakim Noah Is “Almost Certainly” Signing With The Knicks | Jezebel Woman Screams Racial Slurs At Reporter As She Delivers Broadcast in Iowa | Gizmodo American Women Sure Do Love Grooming Down There | Gawker Boris Johnson Fakes Everyone Out, Announces He Will Not Run for Prime Minister |

from Lifehacker http://ift.tt/2983iOX

You Can Save $40 on an Amazon Echo Today, If You Don't Mind Buying a Refurb

Research the Drone Flight Laws In Your Country With This Guide

Live By the Five Hour Rule to Always Keep Learning New Skills

AutoArduino Lets You Control Your Arduino Projects From Tasker

Android: As if Tasker’s plugins weren’t powerful enough, the developer behind popular plugins like AutoVoice and AutoInput has released a new plugin that lets you control an Arduino from Tasker.

AutoArduino, which finally left beta this week, can control your Arduino board via USB OTB, Bluetooth, or Ethernet. After only a few weeks of beta testing, the plugin has already been used to control a sprinkler system, and possess a Furby. Being able to connect an Arduino to your phone gives your projects access to a ton of new sensors and information, so if you’re into electronics hacking, this should be a fun new frontier for you.

AutoArduino | Joaoapps via Android Police

from Lifehacker http://ift.tt/295GvzH

Windows 10 Anniversary Update brings security improvements

Microsoft has scheduled the release of Windows 10 Anniversary Update for August 2.

Aside from new and/or improved tools to aid with productivity, gaming, device set-up, and a better, more efficient and helpful Edge browser, this Anniversary Update also brings improved security features.

Individual user security

For home users, the Windows Hello password-free authentication feature that allows logging in with face and/or fingerprint will now be usable with Windows apps and Microsoft Edge, as well as companion devices.

Windows Defender, Microsoft’s free anti-malware service, will also provide new scan scheduling and notification options.

To all this you can add the bloatware-removal tool that will allow users to rid their machines of buggy applications pre-installed by original equipment manufacturers (OEMs) in one fell swoop.

Enterprise user security

As regards the enterprise version of the OS, all users will now get Windows Defender Advanced Threat Protection (WDATP), a service that aims to help enterprises to detect, investigate, and respond to advanced attacks on their networks.

The service has been in the testing phase for a while, and is now ready to be deployed for all enterprise users.

It is a combination of client technology within the OS itself and a cloud service.

“Windows Defender Advanced Threat Protection is powered by a combination of Windows behavioral sensors, cloud based security analytics, threat intelligence, and by tapping into Microsoft’s intelligent security graph. This immense security graph provides big-data security analytics that look across aggregate behaviors to identify anomalies – informed by anonymous information from over 1 billion Windows devices, 2.5 trillion indexed URLs on the Web, 600 million reputation look-ups online, and over 1 million suspicious files detonated every day,” Microsoft explained.

“This data is then augmented by expertise from world-class security experts and advanced threat protection Hunters from across the globe, who are uniquely equipped to detect attacks.”

Another addition is Windows Information Protection (WIP), which will help with device protection (when lost or stolen), data separation, data leak protection and data sharing protection.

“Windows [will now include] the functionality necessary to identify personal and business information, determine which apps have access to it, and provide the basic controls necessary to determine what users are able to do with business data (e.g.: Copy and Paste restrictions),” it has been explained.

“Windows Information Protection is designed specifically to work with the Office 365 ProPlus and Azure Rights Management, which can help protect business data when it leaves the device or when its shared with others (e.g.: Print restrictions; Email forwarding).”

Deploying the solutions is a breeze, apparently. “Just turn on a few policies in your MDM (e.g.: Microsoft Intune) or System Center Configuration Manager and WIP is ready to go,” they say.

How to get Windows 10 Anniversary Update?

Users who have already updated to Windows 10 can simply download it and install it. Users who have still not upgraded to Windows 10 have until July 29 to do it for free – after that date, they will have to pay for it. Once they do it, they will be able to install and deploy the Anniversary Update.

Microsoft says Windows 10 is currently installed on over 350 million devices.

from Help Net Security http://ift.tt/29c7AFt

How I Got Over My Fear of Investing and Started Saving for My Future

Google found not guilty of stuffing kids with tracking cookies

Rooting Hummer malware brings $500,000 per day to its creator

Android malware with device rooting capabilities has been hitting Google Play for a while now, but for users third-party app stores the situation is even more dangerous.

The Hummer malware family

Hummer, an Android Trojan family that dates back to 2014, has managed to infect as much as 1.4 million devices daily in the first half of 2016, Cheetah Mobile researchers have found.

As the recently spotted fake LevelDropper app in Google Play, various legitimate-looking apps carrying Hummer root the device (the latest variant has as many as 18 different root methods), and then install unwanted applications and make ads pop-up.

Indian users are the most hit, followed by Indonesian and Turkish users. But by now, the Trojan has spread all over the world:

Who’s behind Hummer malware?

An analysis of the malware’s code and the domain names used to update the trojan and send instructions led the researchers to believe that it originated in China.

“According to data collected by Cheetah Mobile Security Research Lab, between January and June 2016, the average number of Hummer-infected phones is 1,190,000, which is larger than any other mobile phone trojan,” the researchers noted.

The researchers estimate that the developer(s) of the malware could make as much as half a million dollars per day, as $0.50 is the average pay out for pushing a new app installation onto unsuspecting users.

Unfortunately, getting rid of the malware for good is not easy. Performing a factory reset won’t do it – victims will have to flash their device. Alternatively, Cheetah Mobile’s Stubborn Trojan Killer app can apparently boot the malware from the device. I’m guessing the unwanted apps the Trojan installed have to be removed manually.

from Help Net Security http://ift.tt/29a9Hbu

How many businesses will pay a ransom if attacked?

Some 84 percent of information technology executives at firms that had not faced ransom attacks said they would never pay a ransom. But among firms that had been attacked, 43 percent paid.

Radware polled more than 200 IT executives across the US and UK The study found that US companies were far more willing to admit that they would pay a ransom. Among US firms who had not been attacked, 23 percent indicated they were prepared to pay a ransom, in contrast to the 9 percent in the UK.

Companies that paid ransoms reported an average of $7,500 in the US and £22,000 in the UK.

“This is a harbinger of the challenging decisions IT executives will face in the security arena,” said Carl Herberger, Radware’s Vice President of Security Solutions. “It’s easy to say you won’t pay a ransom until your system is actually locked down and inaccessible. Organizations that take proactive security measures, however, reduce the chance that they’ll have to make that choice.”

Former hackers are seen as reliable watchdogs

Senior executives see former bad guys as the best way to test their systems. Some 59 percent of respondents said they either had hired ex-hackers to help with security or were willing to do so, with one respondent saying, “Nothing beats a poacher turned gamekeeper.”

Firms see telecommuting as security risk

Work-from-home arrangements are seen as an increasing risk. The survey found a big jump in changes to telecommuting policies, with 41 percent of respondents saying they have tightened work-from-home security policies in the last two years.

Wearables require more than a dress code

While about one in three companies implemented security policies around wearables in the last two years, 41 percent said they still have no rules in place, leaving a growing number of end points potentially vulnerable. Perhaps this is because wearables aren’t seen as a major target—only 18 percent pointed to wearables when asked what hackers would most likely go after in the next three to five years.

New connected devices will be the next security frontier

While wearables were less of a concern, many executives surveyed think the Internet of Things (IoT) could become a bona fide security problem. Some 29 percent said IoT devices were extremely likely to be top avenues for attacks, similar to the percentage of nods received for network infrastructure, which received 31 percent.

Cleaning up after a cyberattack can be expensive

More than a third of respondents in the U.S. said an attack had cost them more than $1 million, and 5 percent said they spent more than $10 million. Costs in the U.K. were generally lower, with 63 percent saying an attack had cost less than £351,245 or about $500,000, though 6 percent claimed costs above £7 million.

Security risk is business risk

Whether motivated by ransomware or another factor, attacks impose significant reputational and operational costs on victims. When executives named the top two risks they face from cyberattacks, brand reputation loss led the pack, with 34 percent of respondents choosing that as a big fear. Operational loss (31 percent), revenue loss (30 percent), productivity loss (24 percent), and share price value (18 percent) were also included in the top concerns.

from Help Net Security http://ift.tt/292iuIE

How CISOs can work with the C-suite to define the cybersecurity risk level

Defining the cybersecurity risk level for any organization should be a collaborative effort that balances the need for risk mitigation with fiscal responsibility. Although the CISO is primarily focused on cybersecurity, the ultimate goal is to run a successful business. As a result, the CISCO will be reliant on the cooperation of their C-Suite colleagues to strike the right balance between operational business needs and security to derive a successful outcome.

A truly effective CISO understands that defining the cybersecurity risk level for both current and desired levels requires a holistic view of the enterprise with buy-in and support from each functional team. The collaboration process should be similar to large-scale enterprise risk management programs requiring input from internal teams to determine a rating for the enterprise as a whole.

No single team or individual could, or should, define a cybersecurity risk level in a silo. Whether measuring the current-state or defining the desired, future state, the outcome will likely impact the entire organization and is therefore a shared responsibility.

Each functional area of a company will be tasked with reducing risk within their perceived circle of influence. For example, the CFO will be focused on financial risk and the profitability of certain investments, with the CIO focused on technology risks that could lead to outages. Ultimately, the changes or future initiatives requested by these groups to limit their risk all come with a price tag.

When all departments are competing for a finite amount of resources and budget, it is extremely important that the requestor be able to easily articulate the risk and explain the potential impacts to the enterprise. Without an understanding of the risk and potential impact if that risk were to be realized, it is next to impossible to define an acceptable cybersecurity risk tolerance and obtain the support and funding needed to maintain that level of tolerance. In short, there are two parts to managing the cybersecurity risk level:

1. Define the threats, current risks and desired acceptable risk tolerance for the organization.
2. Obtain funding to reach and maintain the desired risk tolerance going forward.

However, unlike other members of the C-Suite, the success of a security program is more difficult to measure. Investment in more servers to accommodate more customer traffic can be justified easily with evidence of fewer outages and better performance. Investment in a new intrusion prevention system or a more effective endpoint protection solution cannot be justified in terms of financial savings or improved customer experience.

You cannot quantify the ROI when it may be unclear if the solutions prevented an attack, or the company was simply never targeted. The CISO will therefore need to ensure the threats, risks and potential opportunity costs are clear and easily understood by their C-Suite counterparts and not focused entirely on traditional ROI measures.

There are numerous methodologies and frameworks out there to help organizations measure their security posture, or their cybersecurity risk level. However, any of the industry-leading frameworks such as NIST CSF or C2M2 for example, all require input from departments outside of the security team.

Regardless of whether the organization is required to meet specific regulatory or industry compliance requirements, or is internally motivated to protect sensitive data, systems and assets, there are multiple ways to achieve the same result, each with its own price tag. The CISO can work in conjunction with other executives to find synergies and opportunities for combined efficiencies that benefit everyone. For instance, many CFO’s are focused on implementing technology to generate greater reporting detail and accuracy while the CISO is focused on limiting exposure to sensitive data.

Both objectives require the organization to know where their data is located and drive a single source of truth. Combined, the projects can avoid the duplicated task of data discovery requiring less effort and driving cost efficiency. Only through collaboration with their C-Suite partners can the CISO identify these synergies.

Each organization’s cybersecurity strategy needs to be holistic. The CISO plays a pivotal role in driving the security of the enterprise, but it is only with a combined commitment and support from all C-Suite partners can the organization truly reach a risk tolerance that all parties are comfortable with.

from Help Net Security http://ift.tt/296YCtU

Brexit security implications: Major, and only starting to unfold

The Brexit shock continues to reverberate throughout the global economic and policy worlds. Despite protests against the referendum’s results being cancelled due to concerns of violence, hundreds of protesters demonstrated outside the House of Parliament earlier this week.

Alongside financial and political uncertainty, the rising discontent over Brexit will also spill over into the digital domain, with numerous important implications for the security industry over the next few days, months and years.

Will Brexit make the UK more or less safe?

The key question for many security professionals is whether the Brexit will make the UK more or less safe when it comes to cybersecurity. One poll administered prior to the vote found that most security professionals believed there would not be any major cybersecurity implications, noting that Britain may simply pursue a national implementation of EU policies. However, another poll of security professionals offered different conclusions, with most respondents believing that a Brexit would weaken cybersecurity because of additional bureaucratic hurdles to information sharing with the EU, as well limited cross-national collaboration in fighting cyber criminals. There is also concern about the possibility of a brain drain – in-demand security talent pool fleeing the UK – which could increasingly impact security and data protection.

The UK could decide to implement modified versions of EU policies, such as the General Data Protection Regulation that aims to facilitate commerce through the Digital Single Market while providing enhanced digital privacy. However, the vote in favor of the Brexit was a vote in favor of greater national control over matters such as the economy and immigration.

Push for digital sovereignty

As has historically been the case when more isolationist policies defeat internationalist ones, these policies are not single issue, but address the larger need for national control over all aspects of life. Arguably, this same desire will bleed into the digital arena, with a push for digital sovereignty and greater national control over the Internet. Though it’s still too early to tell, the Brexit may further the global Balkanization of the Internet if the UK pursues its own path in the digital domain.

British FinTech uncertain about the future

In addition to the data protection and privacy policies, digital trade and finance will also be impacted, with the British FinTech community getting hit especially hard. The FinTech community benefits from London remaining the hub of the financial world. With Bitcoin surging and the pound dropping, FinTech is rightfully concerned about the Brexit.

In addition to missing out on the impending EU Digital Single Market, FinTech companies will also no longer benefit from their passport to the European Economic Area, likely resulting in UK-based companies fleeing to EU countries. In fact, many companies have already delayed expansion into the UK or have signaled a potential shift to continental Europe. The UK may well adapt, but London’s role as the financial hub is now threatened thanks to the Brexit, the rise of digital currencies, and the EU’s move toward greater digital integration.

Bots wreaking havoc

Finally, while most in security associate bots with malware, there are initial signs that bots attempted to influence voting behavior. Bot traffic comprises 60% of all online traffic, and an army of social media bots was found to have played a key role for both the leave and remain camps. Bots have also continued to wreak havoc after the referendum.

Inconsistencies have surfaced on the site petition.parliament.uk, showing signs of automated signatures on a petition calling for a second referendum the weekend following the vote. Moreover, as elections increasingly see a spike in phishing scams, it would not be surprising to see a rise in phishing campaigns targeting both those in favor of and those opposed to the Brexit.

The future

With the Brexit now a reality, the UK will find limitations in worker mobility, sharing threat intelligence, and accessing the evolving Digital Single Market, while other forms of digital collaboration and regulations could encounter a growing patchwork of hurdles.

The pendulum historically tends to swing between extremes of isolation and integration, before eventually settling on greater integration. While the Brexit vote may not have registered on the radar of many in the security community, time will show that this was an extremely impactful vote with security implications that need continued attention as the fallout unfolds over months and years to come.

from Help Net Security http://ift.tt/29hbJG4

Companies are embracing an enterprise-wide encryption strategy

The biggest users of encryption are companies in financial services, healthcare and pharmaceutical, as well as technology and software industries, according to Thales.

A new study, which is part of an annual survey of more than 5,000 individuals covering 14 major industry sectors and 11 countries, focuses on how encryption is being used in conjunction with business applications in order to protect data and allows companies to benchmark their use of encryption against companies in similar industry sectors and geographies.

Trend on the extensive use of encryption technologies

“The increased usage of encryption can be traced to many factors, chief among them being cyber-attacks, privacy compliance regulations and consumer concerns. Additionally, the continuing rise of cloud computing as well as prominent news stories related to encryption and access to associated keys have caused organizations to evolve their strategy and thinking with respect to encryption key control and data residency. Our global research shows that significantly more companies are embracing an enterprise-wide encryption strategy, and demanding higher levels of performance, cloud-friendliness, and key management capabilities from their encryption applications,” said John Grimm, senior director security strategy at Thales e-Security.

Key findings

• Companies reporting extensive use of encryption jumped 7% up to a total of 41%, the largest increase in the 11 year history of this report.
• Financial services, healthcare and pharmaceutical, and technology and software companies are using encryption the most – indicative of the influence of regulations, privacy concerns, and the need to protect against purposeful or accidental data breaches.
• Companies that are more mature with respect to their encryption strategy are more likely to deploy Hardware Security Modules (HSMs) across a wide array of encryption applications. HSMs are most frequently used in conjunction with SSL/TLS, database encryption, and application level encryption.
• Companies with a more mature encryption strategy, and who use HSMs more extensively, consistently report lower levels of key management pain.
• Databases, internet communications (SSL/TLS) and laptop hard drives consistently top the list of areas where encryption is most frequently used.
• For cloud data protection, Financial Services companies apply encryption to data at rest, and exert sole organizational control over encryption keys, at rates that significantly exceed averages across all industries.
• Support for both cloud and on-premise deployment ascended to the second most important feature of encryption applications, reflecting the increased move to the cloud and requirements for cryptographic services that span seamlessly from the enterprise to the cloud.
• Performance and latency have ascended to being considered the most critical feature of encryption applications, reflecting increased encryption adoption and the need to ensure it does not interfere with business operations.

Average rank on encryption application extensive usage

1=highest usage rate to 14=lowest usage

“In the 11 years the core survey has been conducted, there has been a steady increase in the use of encryption technology, with the highest increase ever in this year’s results. Along with that increase we’ve seen the rise of new challenges in the areas of encryption key management, data discovery, and cloud-based data storage. The findings of this study demonstrate the importance of both encryption and key management across a wide range of industries and core enterprise applications – from networking, databases and application level encryption to PKI, payments, public and private cloud computing,” said Dr Larry Ponemon, chairman of The Ponemon Institute.

from Help Net Security http://ift.tt/29eEDcq

Top 10 strategic technologies for government in 2016

After nearly a decade of “doing more with less,” government CIOs remain under pressure to further optimize IT and business costs while leading digital innovation in the public sector, according to Gartner. Government CIOs face organizational and cultural challenges that are barriers to harnessing the synergistic potential of social, mobile, data analytics, cloud and the IoT to drive transformational change.

Rick Howard, research vice president at Gartner, said legacy silos of systems, data and processes reinforce “business as usual” practices and behaviors that limit government participation in broader partner ecosystems capable of supporting fully digital end-to-end citizen services.

“In the digital service economy, government must make strategic investments in IT or risk perpetuating suboptimal business and service models that are financially unsustainable in the long term,” said Mr. Howard. “Government CIOs who are too slow to adopt the technology innovations that are transforming private sector service industries will increase business risk and cost, while compromising the mission of their organizations.”

Spending by national, federal and local governments worldwide on technology products and services is forecast to grow slightly by 0.3 percent to $430.1 billion in 2016, growing to $476.1 billion by 2020. This is a turnaround after a 5.2 percent decrease in 2015.

To enable government transformation initiatives, Gartner has identified the top 10 strategic technologies in 2016 and provides recommendations to CIOs and IT leaders regarding adoption and benefits. It is not a list of what government CIOs spend the most time or money on, rather it is a list of strategic technologies that Gartner recommends they should have a plan for in 2016.

1. Digital workplace

The government workforce is increasingly populated with digitally literate employees, from frontline workers to top-level executives. The digital workplace is a business strategy to boost employee engagement and agility through a more consumerized work environment. The digital workplace promotes collaborative work styles; supports decentralized, mobile work environments; and embraces employees’ personal choice of technologies.

2. Multichannel citizen engagement

Delivering an effective citizen experience requires a holistic approach to the citizen: (1) using data to capture and understand the needs and desires of the citizen; (2) leveraging effective social media and communications to actively engage citizens; (3) allowing the citizen to engage on his or her own terms; (4) understanding the citizen’s preferred engagement channels; (5) affording seamless transitions among channels; and (6) ultimately delivering a more satisfying set of citizen interactions. Adopting a citizen-centric information management strategy with multichannel citizen engagement opportunities will deliver quantifiable benefits.

3. Open any data

Open any data in government results from “open by default” or “open by preference” governance policies and information management practices. These make license-free data available in machine-readable formats to anyone who has the right to access it without any requirement for identification or registration. Open data is published as collected at the source (“raw”) at the lowest granularity, as determined by privacy, security or data quality considerations. Open data is accessible with open APIs and is not subject to any trademark or copyright.

4. Citizen e-ID

As government becomes more digitalized, digital identity will need to become more reliable in order to serve as the core for all digital transactions. Citizen electronic identification (e-ID) refers to the orchestrated set of processes and technologies managed by governments to provide a secure domain to enable citizens to access these core resources or services. Governments should require online authentication and identity proofing, because in-person verification methods are becoming outdated for offering citizens integrated and seamless access to resources and services. This “no wrong door” business model must be able to associate each citizen with one unique and persistent identifier within the bounds of what is culturally acceptable and legally permissible.

5. Analytics everywhere

Analytics is the collection and analysis of data to provide the insight that can guide actions to increase organizational efficiency or program effectiveness. The pervasive use of analytics at all stages of business activity and service delivery — analytics everywhere — allows leading government agencies to shift from the dashboard reporting of lagging indicators to autonomous business processes and business intelligence (BI) capabilities that help humans make better context-based decisions in real time.

6. Smart machines

In practice, smart machines are a diverse combination of digital technologies that do what we once thought only people could do. While capabilities are evolving rapidly, it already includes deep neural networks, autonomous vehicles, virtual assistants and smart advisors that interact intelligently with people and other machines. Government IT leaders must explore smart machines as enhancements to existing business practices, and possibly as foundations for new public services or ways of accomplishing business goals altogether.

7. Internet of Things

The IoT is the network of physical objects (fixed or mobile) that contains embedded technology to communicate, monitor, sense or interact with multiple environments. The IoT architecture operates in an ecosystem that includes things, communication, applications and data analysis, and is a critical enabler for digital business applications in all private-sector and public-sector industries. The business use cases and adoption rate by government agencies vary according to service domain or program mission. Government business models are emerging that take advantage of the IoT; for example, pay-for-use or subscription-based taxation models, smart waste bin collection on city streets, and the remote monitoring of elderly patients in assisted-living settings.

8. Digital government platforms

Governments face constant pressure to improve service delivery and save costs. Digital platforms reduce effort and facilitate user-centric design. These platforms deliver services such as payments, identity management and verification, reusable application services and notifications (for example, SMS and email) that are commonly used across multiple domains. Globally, governments are taking a platform approach to simplify processes, improve citizen interaction and reduce expenditure.

9. Software-Defined Architecture

Software-defined architecture (SDA) inserts an intermediary between the requester and the provider of a service so that the service can change more dynamically — in other words, it is the IT equivalent of changing the tires while the car is moving. Adding a layer of software to abstract and virtualize networks, infrastructure or security has proved to be a useful way of deploying and utilizing infrastructure. Applying the same technique to software architecture improves the manageability and agility of the code so that the organization can respond to the fluidity requirements of digital government and the IoT. Some government organizations have begun implementing software-designed infrastructure (SDI), but most are still operating in traditional data centers.

10. Risk-based security

The cybersecurity threat environment is constantly evolving, but it represents only one dimension of a complex, multifaceted set of threats and risks. Government CIOs must adopt a threat-aware, risk-based security approach that allows governments to make knowledgeable and informed decisions about risks in a holistic fashion, allowing for a wiser allocation of resources; more sound decisions about risks and their impacts on government missions, operations, assets and people; and engagement of senior leadership in risk-based decisions.

Four new trends emerged in 2016 with the potential to significantly benefit government performance within the next three to five years. Analytics everywhere, smart machines, software-defined architecture and risk-based security will each challenge governance, human resources management, sourcing and financing practices.

“Many of these technology trends change business models in ways that need to be reflected in more modern policies, especially those related to privacy or regulation,” said Mr. Howard. “CIOs will need to be front and center in providing advice to policymaking bodies and working with industry experts who can consult on options and impacts.”

from Help Net Security http://ift.tt/29eCxcR

The Faded Getaway Desktop

Save Tomatoes That are Past Their Prime by Turning Them into Chips

Remains of the Day: Google Maps for Android Adds Multiple En Route Destinations

The 20 Best Places to Party In the U.S.

Deadspin Holy Shit, The Canadiens Traded P.K.

Deadspin Holy Shit, The Canadiens Traded P.K. Subban | Jezebel Defensive Stylists Argue Leslie Jones’s Designer Gown Dilemma Is Because of Her Size | Sploid Video Perfectly Skewers the Assholery of OK Go | Gawker Justin Trudeau Finally Fucked Up |

from Lifehacker http://ift.tt/29atrxp

Perfectly Grill Fish In Three Minutes Flat With a Cast Iron Skillet

Find Out If Your State Has a Tax-Free Shopping Weekend in 2016

When It Comes to Wedding Gifts, Stick to the Registry

Slip on a Pair of Wireless, Noise-Canceling On-Ear Headphones For $40

Build an Automatically Updating Digital Photo Frame with a Raspberry Pi and Google Photos

Mac CLI Is a Massive Collection of Command Line Tools for Developers

TP-Link's Echo-Compatible Smart Plug Is Back Down to $25

An Easy Way to Practice Wheelies and Gain Confidence for Mountain Biking

This New VLC Beta Is Built for Windows 10, Xbox One, and HoloLens

Upgrade Your Rice Krispies Treats with Browned Butter

These Are Your Four Favorite Camera Bags

Learn New Google Now Commands With OK Google

How to Reframe Your Stress and Anxiety Into Productivity

If You’re a Costco Member, You Can Shop at Sam’s Club for Free Until July 4th

Today's Best Deals: Chargers Galore, Rugged Anker Speaker, Sport-Brella

How Long You Should Rest Between Sets for the Biggest Training Benefits

New Russian law to force service providers to decrypt encrypted comms

An extremely wide-ranging anti-terrorism law has been passed last week by the lower house of the Russian Federal Assembly (i.e. parliament), and it is widely expected to pass the upper house without a hitch and be signed into law by president Putin within the next few weeks.

Proposed by right-wing politician Irina Yarovaya, the new law will bring tougher punishments for extremism and international terrorism, make failure to report a crime, as well as justifying terrorism on social media a criminal offense; but also force telecoms and ISPs to store data and metadata for years, and online services that offer encrypted communication to help the Russian intelligence agency (the FSB) to decipher any message sent by its users.

According to Russian news outlet Meduza, the new law will require telecoms to store records of all calls and text messages exchanged between customers for a period of six months, and all metadata of these communications for three years.

“Organizers of information distribution on the Internet,” a category of service providers that has yet to be completely defined and populated, will have to store metadata for one year.

Those information distributors that offer encrypted communications and information will have to aid the FSB in decrypting it and will be fined if they refuse to do so.

While the final version of the law does not contain the proposed sanctions of revoking people’s citizenship and right to leave the country if they have been convicted of certain crimes, the rest of the legislation is still pretty extreme.

NSA whistleblower Edward Snowden, currently residing in Moscow after being offered asylum in 2013, described the new “Big Brother” law as “an unworkable, unjustifiable violation of rights that should never be signed.”

“‘Store 6 months of content’ is not just dangerous, it’s impractical,” he noted. “What is that, ~100PB of storage for even a tiny 50Gbps ISP?”

Some of the largest Russian telecoms have expressed their opposition to the law, saying that the additional infrastructure that would have to build to comply with it would be too costly. And the company behind Russian search engine Yandex said it would excessively limit the rights of both companies and users.

from Help Net Security http://ift.tt/29p0vhm

This Infographic Lists 128 Words You Can Use Instead of “Very”

Expand Your Small Garden Space with This DIY Tiered Planter

If you don’t have a lot of gardening space, growing up instead of out makes the most of what you do have available. This three-tiered planter is easy to put together yourself and will help turn your vertical space into a lush garden.

You’ll have no trouble getting the inexpensive supplies for this project from your local hardware or gardening store. Here’s what you need:

• A large pot with saucer
• A medium pot
• A small pot
• Two sturdy plastic or metal containers (old paint cans, yogurt containers)
• Soil
• Plants of your choice
• Plant labels (optional)

For the plastic or metal containers, one will need to fit inside the large pot and one will need to fit inside the medium pot. They should take up about around half of the pot’s volume. You can use pots of almost any material, but terra cotta or unglazed ceramic will let water drip between levels easily and will add weight to the tiers so they don’t topple in the wind.

Place the larger of the plastic or metal containers upside down in the large pot. Fill with soil up to the bottom of the container, then place the medium pot on top of the container. Plant your first tier of plants as they fit around the medium pot. Place the other plastic or metal container upside down in the medium pot and fill with soil until it reaches the bottom of the container. Place the smallest of the pots on top of the container and plant your second tier. Fill the small pot with soil and plant your third tier. The video above uses herbs, but you can put anything from flowers to vegetables in this DIY planter. Vines or other plants that grow downward would look great dangling over each tier, too.

3 Tiered Herb Planters | Nifty (YouTube)

from Lifehacker http://ift.tt/2907Thi

Anker's New Bluetooth Speaker Is Rugged, Powerful, and On Sale For the First Time

US Customs wants your social media account details when travelling

Windows 10 now asks nicely if you want your free upgrade

Use Gelatin and Water to Clean Used Cooking Oil and Use It Again

World-Check crime and terror database exposed online

Security researcher Chris Vickery, who has become well-known for unearthing databases that should not be accessible via the Internet but are, has found another one that contains old data from Thomson Reuters’ World-Check database of politically exposed persons and heightened risk individuals and organizations.

World-Check is used by 49 of the 50 biggest banks, 9 of the top 10 global law firms, and over 300 government and intelligence agencies around the world. It lists over 2.7 million people who have been flagged for potential involvement or link to terrorism, money laundering, bribery, organized crime, etc.

“25% of World-Check data is derived from information on sanctions, watch or regulatory and law enforcement lists. The remaining 75% consists of PEP [politically exposed persons] information as well as individuals and entities not found on official lists, but who instead are reported to be connected to sanctioned parties, or reported to have been investigated for, or convicted of engaging in, financial crime related activities,” Thomson Reuters explains.

“The current-day version of the database contains, among other categories, a blacklist of 93,000 individuals suspected of having ties to terrorism,” notes Vickery.

He says that the database he found was not the one operated by Reuters, which is accessible to vetted users for a fee. Also, this database contains a copy of the World-Check database from mid-2014.

He took to Reddit’s Privacy subreddit to ask users what should he do with the data.

“When private data is involved, I always do my best to get the database secured before disclosing news of the exposure. However, this brand new find is a different kind of animal. It appears to all be sourced from publicly available material,” he explained his thought process.

He also pointed out a few arguments for and against making the data public, but hasn’t released it so far.

Instead, he contacted Thomson Reuters with the information about the location of the database.

“We are grateful to Chris Vickery for bringing this to our attention, and have acted with the upmost urgency to contact the third party concerned – with whom we are now in contact in order to secure the information,” a company spokesperson has stated.

Earlier this year Vice accessed the original database, and revealed some of the people and organizations that are listed in it under its “terrorism” category, a move that made some of them react with “anger and shock” and dispute the categorization.

Critics of the practice of compiling such lists say that it’s more than likely that mistakes are and will be made when adding individuals and organizations to them, and this could seriously impact those people’s lives and livelihood, and those organizations’ functioning.

Thomson Reuters is not the only firm that compiles such a database. According to a report commissioned by the Canadian government, Dow Jones, Oracle Mantas, Verafin, Lexis Nexis, and others also keep and fill out databases for identifying possible money launderers and terrorists.

from Help Net Security http://ift.tt/29c4jqh

A Whole Mess of RAVPower Charging Gear Is On Sale In Amazon's Gold Box

Google's New My Activity Page Lets You See and Delete All of Your Google Activity

Deadspin Report: Donald Trump Cobbles Together A Cast Of Sports Dickheads For GOP Convention | Jezeb

Deadspin Report: Donald Trump Cobbles Together A Cast Of Sports Dickheads For GOP Convention | Jezebel TV Reporters Charged With Child Abuse After Infant Tested Positive For Cocaine | Sploid A Great White Shark Got Caught Napping on Camera for the First Time Ever | Gawker Where Are They Hiding Donald Trump’s Phone? |

from Lifehacker http://ift.tt/29eDVJH

StoolAnalyzer Will Tell You How Healthy Your Poop Is Based On a Few Questions

Backblaze B2 Leaves Beta, Offers Crazy Cheap, NAS-Connected Cloud Storage

Interview with an NSA Hacker

How Brexit Will Affect Your European Travel Plans

How to set up two-factor authentication for Gmail

We’ve previously written about why two-factor authentication (or 2FA) is a good idea – it’s an extra layer of security to help protect your information on sites you use frequently.

If you’d like to get started with 2FA but aren’t sure how, this is part one of a series that will walk you through how to set up this service with popular websites and services.

Today, let’s set up 2FA for Gmail. It only takes a few minutes. All you need is your desktop computer and a mobile phone.

Here are the steps:

1. Log in to your Gmail account on a desktop computer (not a phone) – but keep your mobile phone handy, you will need it in a few steps.

2. Once you’re logged in, click the round icon with your Google Account icon (or letter from your first name) – it’s at the very top right of the screen. Then click “My Account.”

3. Now you’re in the My Account area of Google. On the left side, under “Sign-in & security,” click “Signing in to Google.”

4. On this “Signing in to Google” page, you’ll see an option for “2-Step Verification” – which at the moment should say “off” – click this to begin the process of turning it on.

5. Click “Get Started” on this handy little introductory screen.

6. Google will prompt you to re-enter your password.

7. At this screen, you’ll need to enter your phone number, preferably a mobile one that you’ll often have handy. (Make sure you select the correct country where your mobile phone is registered from the drop-down list!) Select if you prefer a text message or phone call, and then click “Try It.”

 

8. Within a moment, you should receive either a phone call or text message – depending on which one you selected. Enter the numerical code you were given, and hit “Next.”

9. Google should now confirm that 2FA will work for your account, and you can now tell Google that you’d like to enable 2FA for your account. Make sure to click “Turn On”!

And with that, two-factor authentication is enabled for your Gmail account.

You’ll also receive an email to your Gmail account confirming this:

Next time you try to log in to this Gmail account, after entering your username and password, you’ll see a screen like this:

You can select “Don’t ask again on this computer” if you’re on a computer you trust, such as one you have at home, but it does somewhat defeat the point of having 2FA in the first place.

All in all, it takes less than 5 minutes to get 2FA set up on your Gmail account – and it’s something we highly recommend, especially if you use Gmail for important transactions or billing.

Follow @mvarmazis
Follow @NakedSecurity

from Naked Security http://ift.tt/292nouk