0

I've talked with a new friend who is fairly bright and who can do some interesting things programming Office applications, but whose technical abilities omit infosec. And he got bitten by nasty malware.

I'm wondering what options might be most productive to offer to him. I'm not sure it's realistic to repel all dedicated assault, but cybercriminals often look for someone who would be an easy kill, and (perhaps showing my ignorance here), I think it could be realistic to make a system that's hardened enough not to be an easy kill.

Possibilities I've thought of include:

  1. Windows 10 with screws turned down (how, if that is possible?).

  2. Mint or another Linux host OS for what can be done under Linux, and a VMware or VirtualBox VM that is used for compatibility and may be restorable if the machine is trashed.

  3. Migrating to a used or new Mac, possibly with a Windows Virtual Machine, but most people using Macs don't complain they are missing things.

  4. Perhaps with one of the technical situation, point my friend to user education saying things like "Don't download software that you hadn't set out to get. The price of Marine Aquarium of $20 up front is dwarfed by the hidden price tags of adware and spyware offering a free aquarium screensaver."

This is not an exhaustive list, although it's what I can think of now. I've had a pretty good track record for not engaging malicious software, and I think it can be learned (and that documentation for online safety would be taken very, very seriously).

What can I suggest to my friend for online safety?

  • Mac and Linux get malware, too. I'm not sure why that's a focus or what that's supposed to solve. This question is really broad. Especially since your list goes from "Windows hardening" to "user education". You can't approach the problem thinking that there can be a single list that covers everything. Security is an emergent property. You would have to create a list that covers all possible scenarios and situations. Can you focus your question to something specific? – schroeder Aug 2 at 7:50
3

Perhaps with one of the technical situation, point my friend to user education saying things like "Don't download software that you hadn't set out to get. The price of Marine Aquarium of $20 up front is dwarfed by the hidden price tags of adware and spyware offering a free aquarium screensaver."

Start by hardening the mind to have a security focus mentallity, why? Because of social engineering attacks, attacks in which the attacker will fool the person into running the malware. These attacks works because the victim allowed it to happen and no amount of technical security will stop that. Understand that the human user is a big vulnerability to security.

Example:

  1. A Trojan horse in which the malware will be made to look like something innocent.

  2. An attacker leaving a USB drive out with a note that says top secret.

  3. A message like, "Hey I have found some leaked photos of you download it at link ."

and many more.

Basic stuff like:

  1. Think before you act.

  2. Don't trust everything you see or hear.

  3. Don't click on strange links or ads

  4. Don't download any and everything you see.

  5. Don't plug in strange USB drives

Can be very powerful.

So user education first...

| improve this answer | |
  • While true overall, the average person doesn't have to worry about random ISB drives laying around. Maybe if you work for a large company or a defense contractor, but definitely not in your personal life. – Conor Mancone Aug 2 at 10:16
  • Something I would edit into this excellent answer is terrifying emails from admin@yourisp.com saying, "We have had a breach and we believe your account was almost certainly compromised. For security reasons, please change your password to _________ immediately." – Christos Hayward Aug 2 at 11:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.