DHS Securing the Internet of Things

National Cyber Awareness System: ST17-001: Securing the Internet of Things 11/16/2017 04:52 PM EST Original release date: November 16, 2017 The Internet of Things refers to any object or device that sends and receives data automatically through the Internet. This rapidly expanding set of “things” includes tags (also known as labels or chips that automatically track objects), sensors, and devices that interact with people and share information machine to machine. Why Should We Care? Cars, appliances, wearables, lighting, healthcare, and home security all contain sensing devices that can talk to other machines and trigger additional actions. Examples include devices that direct your car to an open spot in a parking lot; mechanisms that control energy use in your home; control systems that deliver water and power to your workplace; and other tools that track your eating, sleeping, and exercise habits. This technology provides a level of convenience to our lives, but it requires that we share more information than ever. The security of this information, and the security of these devices, is not always guaranteed. What Are the Risks? Though many security and resilience risks are not new, the scale of interconnectedness created by the Internet of Things increases the consequences of known risks and creates new ones. Attackers take advantage of this scale to infect large segments of devices at a time, allowing them access to the data on those devices or to, as part of a botnet, attack other computers or devices for malicious intent. See Cybersecurity for Electronic Devices, Understanding Hidden Threats: Rootkits and Botnets, and Understanding Denial-of-Service Attacks for more information. How Do I Improve the Security of Internet-Enabled Devices? Without a doubt, the Internet of Things makes our lives easier and has many benefits; but we can only reap these benefits if our Internet-enabled devices are secure and trusted. The following are important steps you should consider to make your Internet of Things more secure. Evaluate your security settings. Most devices offer a variety of features that you can tailor to meet your needs and requirements. Enabling certain features to increase convenience or functionality may leave you more vulnerable to being attacked. It is important to examine the settings, particularly security settings, and select options that meet your needs without putting you at increased risk. If you install a patch or a new version of software, or if you become aware of something that might affect your device, reevaluate your settings to make sure they are still appropriate. See Good Security Habits for more information. Ensure you have up-to-date software. When manufacturers become aware of vulnerabilities in their products, they often issue patches to fix the problem. Patches are software updates that fix a particular issue or vulnerability within your device’s software. Make sure to apply relevant patches as soon as possible to protect your devices. See Understanding Patches for more information. Connect carefully. Once your device is connected to the Internet, it’s also connected to millions of other computers, which could allow attackers access to your device. Consider whether continuous connectivity to the Internet is needed.  See Securing Your Home Network for more information. Use strong passwords. Passwords are a common form of authentication and are often the only barrier between you and your personal information. Some Internet-enabled devices are configured with default passwords to simplify setup. These default passwords are easily found online, so they don't provide any protection. Choose strong passwords to help secure your device. See Choosing and Protecting Passwords for more information. Additional Information The following organizations offer additional information about this topic: Online Trust Alliance: https://otalliance.org/smarthome Open Web Application Security Project (OWASP): https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project  https://www.owasp.org/index.php/IoT_Security_Guidance Atlantic Council: http://www.atlanticcouncil.org/publications/issue-briefs/smart-homes-and-the-internet-of-things Department of Homeland Security: https://www.dhs.gov/securingtheIoT Stop.Think.Connect.: https://www.dhs.gov/stopthinkconnect Authors: Stop.Think.Connect. and National Cybersecurity and Communications Integration Center (NCCIC)

Windows Fall Creators Update Controlled Folder Access

 Ransomware threats are growing. Microsoft is providing some protection.

 With the Fall Creators Update, Windows 10 users can enable Controlled Folder Access.

 While this feature, when enabled, offers some protections be aware the ransomware will still be a threat. To make yourself safer use 3-2-1 backup.
  3 copies of your important files
  2 separate media
  1 copy offline (except when doing the backup for offline storage)

 As mentioned the Controlled Folder Access feature is off by default. Also, the feature is provided by the Fall Creators Update.

 The feature has a list of files and folders and a list of approved applications that can modify that list of files and folders. Users can add or remove the list of files and folders   or the list of applications allowed access. The goal is to allow file and folder access as normal, but to prevent ransomware or malware from any modifications. The feature may work for you as intended, but you may need to tune the list of applications or files & folders. I expect ramsomware to bypass the feature in future as well as Microsoft updating the feature to those ransomware changes.

 To enable the feature use the Windows Defender Security Center. Type defender into the Cortana search box.

Click on Virus and threat protection

Then Virus and threat protection settings

Now set Controlled folder access to On as shown above.

You can view and edit the protected files and folders list

and the application list

Note: If the button to turn on Controlled folder access is grayed out, you may have a conflict with another security application or security suite and Windows Defender.

 Other tutorials on Controlled folder access are on the Internet and YouTube. 

 Beware: A tactic ransomware could employ to gain access to files and folders to encrypt and require a ransom is to spoof the name of the application to have you enable that access.

Netflix scam

 Like a lot of phishing scams, this one from Netflix.
 Claims to have suspended your Netflix account unless you take action. The action, being to login with your account, passphrase, and credit card number.
 This campaign is carefully crafted and is being more widely discriminated  in addition to being sent to Netflix subscribers only.
 Be aware. Do NOT use the link to Netflix in this phishing email
 If you have responded to a similar email recently, might be good to login to your Netflix account to determine if you have become a victim.