1)Web Browser Extensions: How risky are extensions & how can you choose safe ones? answer:Even though extensions can be risky, if used correctly, they can be extremely beneficial. It’s especially important to research extensions if you are using an application that accesses P4 protected data. Before Installing an Extension: Check out the developer’s website to see if it’s a legitimate extension and not a one-off by an unvetted source. Read the description. Look for things that may be questionable, like tracking info or data sharing. Check out the reviews. Look for users complaining of oddities happening, speculating on their data being taken, or for anything that strikes you as odd. When Installing an Extension: Be picky. The more extensions installed, the bigger the attack surface you open up to attackers. Only pick the most useful and delete the ones you don’t need. Only install through trusted sources. While not guaranteed safe, security technicians review extensions for malicious content. Review permissions. Review extension permissions closely. If an extension installed suddenly requests new permissions, be wary. If you can’t find a reason for the permission change, it’s probably better to uninstall. Use antivirus protection. Install and run SCEP(link is external) to detect and neutralize malicious code in browser extensions. 2) Securing Your Browser: Best methods & their trade-offs for a safer browsing experience. answer:Using the internet both safely and privately can be pretty hard these days. With 4.3 billion active internet users globally, it literally is the go-to for almost everything — opening times, reviews, news, shopping; the list is endless. But when you’re browsing the web, there’s a lot of people who know exactly what you’re doing, from your ISP (Internet Service Provider) to advertisers, governments, and social media companies. And while your approach might be the common “I have nothing to hide”, that’s not necessarily the case… Your internet browsing actually gives away a great deal about you, from political beliefs and sexual preferences to shopping habits or health concerns. With this information in the wrong hands, you can find yourself being targeted with ads and subjected to price discrimination. So while you have nothing to hide per se, your browsing habits can be of great interest to others. Which is why we thought we’ve come up with 5 easy tips on how you can browse the web more safely. 1. Stay updated This one is pretty much a given, but you’d be surprised how often it falls by the wayside. Virus threats can be found even in the most reputable of websites, and it’s now more important than ever to keep your wits about you. Hackers are always on the lookout for new vulnerabilities and ways to get their hands on your sweet data, and the current global situation means that more people than ever are online. Ensuring you have an updated browser (most browsers will do this automatically for you) and antivirus software will go a long way in guaranteeing your security. Remember, you don’t need to spend a lot of money on an antivirus — a free one from a reputable source is all you need. In fact, we might be able to help with that. 2. Get an ad blocker Not only can an ad-blocker stop pesky ads and pop-ups from following you around the internet, but it can also make your browsing experience that little bit faster too. Many ad blockers will still allow a certain amount of ‘safe’ ads to allow websites to continue collecting revenue from them. You can also whitelist your favorite sites if you want to keep seeing certain targeted advertisements. As an alternative, you can also consider a browser with built-in ad-blocking. Many of the best browsers for security and privacy offer this feature. 3. Vary your passwords We know, we know, we go on about this one a lot. But it’s super important to vary your passwords. It’s oh so easy to reuse the same password for all your accounts, especially if you have one super secure password. But, all it takes is one leak for all your accounts to then be at risk — no matter how secure that password seemed. Using a wide, unique selection of secure passwords means that if your info is leaked it’s not going to put all your online accounts at risk. Remembering 350 passwords that look like 3CX-6HG-IU8 can be pretty tricky, which is where a password manager can come in handy. 4. Clear those cookies Deleting your cookies — that would be the little bits of data a website has saved on your browser — and clearing your cache can reduce how many ads are following you around the internet and targeting you. It's a short-term solution, but it’ll refresh your browser, and clear out saved data-like passwords that could be stolen easily. Remember to whitelist the pages you want to keep login details for though. Another little tip to reduce your cookies is to turn on any private browsing options your browser may have. It’s really not as private as the name suggests — your ISP can still see everything you do — but it does limit how many cookies you get and hides your browsing history, which can be useful on a shared device. 5. Use a VPN Using a VPN, or virtual private network, encrypts your data while it travels from one place to another on the internet. Using a VPN when you’re online allows you to browse websites privately and securely, as well as gain access to restricted websites and overcome censorship blocks. Which comes in handy, especially right now when we have more time on our hands than ever, and a greater need for global content access. It’s important to remember that a VPN only hides your IP address, location, and data as it is transmitted. In order to ensure a completely secure browsing experience you need to combine using one with a secure browser. Which leads us nicely onto the next step. 6.Stay safe online with a secure and private browser Of course your ideal solution here is a browser that does as many of these things for you as possible. Now, we wouldn't normally push our products on you here so excuse the little plug, but it is free, so we thought that might help. AVG Secure Browser comes with built-in adblock and anti-track software. The desktop version works with our VPN and the mobile version has one built-in. 3. Two-Step Authentication: Compare methods, strengths, weaknesses & choose the right one. answer:Introduction to Two-Factor Authentication (2FA) and Multi-Factor Authentication (MFA) Long gone are the times when businesses used only traditional passwords to grant access to their users to their services and applications. The modern world requires robust and more resilient data security solutions to reduce the risk of cyber crimes and data breaches. That’s why businesses are focusing on implementing multiple layers of authentication to verify the identity of an individual. Implementing multiple layers of authentication or a multi-step login process is multi-factor authentication. In MFA security, the users have to complete more than two types of digital verification rounds to gain access to the accounts or information. However, on the other hand, two-factor authentication is a specified type of MFA where there will be only rounds of digital identity verification. In 2FA, there will be an additional layer of security checks above the same old traditional password-based authentication method. MFA and 2FA methods protect against phishing, social engineering, and password brute-force attacks, and avoid hacking the account due to poor or weak passwords. Two-factor authentication is a subset of multi-factor authentication, but while discussing 2FA vs MFA, it becomes essential to understand how MFA strengthens security. Exploring Multi-Factor Authentication (MFA) Multi-factor authentication comprises different methods or factors to verify the identities and authenticate the access. The MFA security methods are broadly classified into four categories: Knowledge-based - Knowledge-based authentication is when the user knows about something. For example, asking a secret security question whose answer only the user knows. Possession-based - Possession-based authentication is when the system verifies the identity of the user's device. For example, asking the user to enter a time-based code sent to their respective email or phone number. Inherence-based - Inherence-based authentication is the process of verifying a person's identity through unique biological qualities or characteristics they possess, like fingerprints or facial features. Location-based - Location-based authentication is a crucial part of ensuring safety in a zero-trust environment. The user’s physical location is taken into consideration to grant access, as some apps and services will require the users to be in a particular location to access the information. Based on the combination of the above methods, it is easy to implement two-factor authentication and multi-factor authentication. However, when it comes to two-step verification vs two-factor authentication, there is a fine line between these two methods. Any two factors can be used in two-factor authentication to verify identities. In two-step verification (2SV) authentication, there should be two sequential steps using authentication factors. For example, Google uses 2SV, where the users have to enter the credentials and then enter an additional time-based code. 4. Strong Passwords: What makes them weak, how attackers exploit them & how to create secure, memorable ones. answer:Why do I need a strong password? At this point, you may be wondering, why do I even need a strong password anyway? The truth is that even though most websites are secure, there's always a small chance someone may try to access or steal your information. This is commonly known as hacking. A strong password is one of the best ways to defend your accounts and private information from hackers. Tips for creating strong passwords A strong password is one that's easy for you to remember but difficult for others to guess. Let's take a look at some of the most important things to consider when creating a password. Never use personal information such as your name, birthday, user name, or email address. This type of information is often publicly available, which makes it easier for someone to guess your password. Use a longer password. Your password should be at least six characters long, although for extra security it should be even longer. Don't use the same password for each account. If someone discovers your password for one account, all of your other accounts will be vulnerable. Try to include numbers, symbols, and both uppercase and lowercase letters. Avoid using words that can be found in the dictionary. For example, swimming1 would be a weak password. Random passwords are the strongest. If you're having trouble creating one, you can use a password generator instead. Common password mistakes Some of the most commonly used passwords are based on family names, hobbies, or just a simple pattern. While these types of passwords are easy to remember, they're also some of the least secure. Let's take a look at some of the most common password mistakes and how to fix them. illustration of character Password: brian12kate5 "I doubt anyone could guess my password! It's my kids' names and ages. Who else would know that?" Problem: This password uses too much personal information, along with common words that could be found in the dictionary. Solution: A stronger version of this password would use symbols, uppercase letters, and a more random order. And rather than using family names, we could combine a character from a movie with a type of food. For example, Chewbacca and pizza could become chEwbAccAp!ZZa. illustration of character Password: w3St! "My password is so simple! It's just the beginning of my street address with a few extra characters." Problem: At only five characters, this password is way too short. It also includes part of her address, which is publicly available information. Solution: A stronger version of this password would be much longer, ideally more than 10 characters. We could also substitute a nearby street name instead of her current address. For example, Pemberly Ave could become p3MberLY%Av. illustration of character Password: 123abccba321 "My password follows a simple pattern, so it's easy to remember and type on my keyboard." Problem: While patterns like this are easy to remember, they're also some of the first things a hacker might guess when attempting to access your account. Solution: Remember that random passwords are much stronger than simple patterns. If you're having trouble creating a new password, try using a password generator instead. Here's an example of a generated password: #eV$pIg&qf. If you use a password generator, you may also want to create a mnemonic device to make the password easier to remember. For example, H=jNp2# could be remembered as HARRY = jessica NORTH paris 2 #. This may still feel pretty random, but with a bit of practice it becomes relatively easy to memorize. illustration of character Password: BrAveZ!2 "I use the same passwords for all my accounts. This way, I only have to remember one password!" Problem: There's nothing really wrong with this password, but remember that you should never use the same password with different accounts. Solution: Create a unique password for each of your online accounts. Using password managers Instead of writing your passwords on paper where someone might find them, you can use a password manager to store them securely online. Password managers can remember and enter your password on different websites, which means you won't have to remember longer passwords. Examples of password managers include LastPass, 1Password, and Google Chrome's password manager. illustration of character Password: m#P52s@ap$V "I use a password generator to create all of my passwords. They're not super easy to remember, but that's OK; I also use a password manager to keep track of them." This is a great example of a strong password. It's strong, long, and difficult for someone else to guess. It uses more than 10 characters with letters (both uppercase and lowercase), numbers, and symbols, and includes no obvious personal information or common words. This password might even be a bit too complicated to remember without a password manager, which underscores why they're so helpful when creating a strong password. Remember to use these tips whenever you create a password to keep your online information safe and secure. 5. POS Security Threats: Identify vulnerabilities & suggest solutions for malware, breaches & theft. answer:As mobile point-of-sale applications and systems are picking up speed at retailers around the world replacing traditional one, they become appealing targets for cybercriminals allured by the amount of consumer data entered in POS systems whether through unauthorized access, mobile malware or hacking the backend. The benefit for cybercriminal is clear. The hack one point-of-sale application and grab a hold of hundreds of thousands or millions of credit/debit cards from many shoppers. They exploit a compromised point-of-sale application of a retailer and get their hands on multiple point-of-sales applications and systems operated by this one retailer in multiple locations. As mobile point-of-sale applications and systems become more and more popular and start to replace traditional methods, they are becoming a tempting target for cybercriminals. With so much consumer data entered into POS systems, hackers seek to gain that information in a variety of ways, from unauthorized access, to mobile malware, to hacking the backend. By hacking just a single point-of-sale application, cybercriminals can gain hundreds of thousands, or even millions, of credit and debit card details from shoppers, which they can then use fraudulently, or even sell on to others. They often exploit compromised point-of-sale applications from retailers and then get their hands on multiple point-of-sale applications and systems operated by the same retailer across multiple locations. As you can see, then, the impact of this can be enormous and leaves the retailer legally liable for what has happened. In this article, we’ll look at the four most common point-of-sale security issues. 1. Unauthorized access to point-of-sale application Fraudsters exploit mobile point-of-sale apps to steal personal and sensitive information such as credit or debit card information. They then use these to make fraudulent purchases, which results in both financial losses and damaged credit standings for unsuspecting customers. It’s a fact that customers are more likely to buy from retailers that they believe protect their information. Compromised retailers suffer far-reaching consequences from point-of-sale hacks, as their customers may switch to other retailers. That’s not to mention enduring a burden of a potential lawsuit, which could leave the company substantially out of pocket. Combating this fraud is therefore of crucial importance to point-of-sale vendors because it can threaten the very existence of the business itself, and has a devastating impact on retailers, the core customer of point-of-sale vendors. It is vital for point of sale vendors to improve the security of point of sale applications and to make it easier to identify suspicious and fraudulent POS transactions and act on them to protect shoppers’ sensitive data. 2. Malware targeting point-of-sale application Mobile malware is quickly becoming one of the main ways that cybercriminals steal payment card details. Malware is used to obtain sensitive information, and in some cases to even steal money directly from bank accounts. Retailers are vulnerable to point-of-sale malware attacks and remain so until they implement the right security technology to strengthen their point-of-sale applications. An effective application security technology should be able to detect malware, tampering, rooted/jailbroken point of sale devices, and more, so that point-of-sales providers can act before it’s too late. The right application security technology needs to include a feature that alert retailers and POS providers when it is not safe to use mobile POS devices for making payments or performing other electronic transactions. 3. Cyberattacks against the point-of-sale application backend system A point-of-sale application running on a smartphone, a tablet or a mobile device is only a single component in a full, intricate point-of-sale system. The majority of business transactions are processed on the server’s side. That means most cyberattackers use the entry point from the point-of-sale application to the server to begin their attack on internal business systems. Once the cyberattackers get inside the data center of POS vendors or retailers, not only can they access the compromised POS application, but also all other POS applications used by the retailer in other locations. Attacking the entry point at the backend is a common attacking method, and countless large-scale security breaches have been caused by this method. Therefore, it is essential that this entry point is kept secure and protected. Point-of-sale application backend systems and other business systems hosted in the data center need to be shielded from direct internet exposure. Otherwise, hackers could easily exploit a single weakness to access numerous POS retail apps. For retailers to trust a mobile point of sale application, they need to feel comfortable operating mobile POS apps without the risk of having their internal business systems hacked and risk being sued by affected customers. 4. Business disruption due to poor unavailability of point-of-sale applications Retailers not only want their business and customer data to be kept safe, but also expect that there will be no disruption to their business caused by cyberattacks or technical downtime with their point of sale applications. Retailers want to operate point of sale applications in a secure, reliable way, and prevent attacks before they even happen. For this to happen, the ideal point of sale application needs to not only boast strong POS security technology but also feature a reliable security monitoring and incident response service. This service should alert IT personnel- either in-house or outsourced to a third-party outsource- when there is a breach, and also monitor POS application-related activities, detect and flag up threats, and provide real-time responses to any problems. Having a reliable POS security monitoring and incident response service in place help POS providers to assure their retailer customers, and give them a peace of mind as they process countless of data transactions via point-of-sale applications. If you are a provider and operator of POS application, you want to pay attention to these four common security issues affecting point-of-sale applications. If you make sure that each of them is covered, then you can rest assured that your POS application is secure, and you putting yourself at unnecessary risk of cyberattacks. To find out how we helped O2, a large Telco, build and operate a secure large-scale mobile POS system which became the fastest selling and most used POS system in the Czech Republic, read our customer success story. Alternatively, get in touch with us directly to request a FREE Demo of our POS system management solution and learn how it can help you manage your POS system more effectively and reduce unnecessary support overheads.