Cyber self-defense

Cyber self-defense refers to self-defense in cybersecurity to defend against cyberattack.^[1] While it generally emphasizes active cybersecurity measures by computer users themselves it is sometimes also used to refer to self-defense of organizations as a whole^[2] such as corporate entities or even entire nations.^[3][4][5] Surveillance self-defense^[6][7][8] is a variant of cyber self-defense or largely overlaps with it.

Background

Cybersecurity researcher, entrepreneur and consultant Jeffrey Carr compares cyber self-defense to martial arts with ones computer network having numerous vulnerabilities like ones body. He notes that similar to it, ones digital attack surface can be shrunk.^[9]

Measures

• Making use of antivirus software^[10]
• Making use of a firewall on Internet-connected devices^[10]
• Updating all of one's software — including but not only operating systems and potentially by the usage of dedicated updating-software^[10][9]
• Multi-factor authentication^[10]
• Strong and unique passwords for each account^[10][9]
• Encrypting ones computer and phone^[10]
• Regularly creating backups of ones data^[10][11]
• Reducing ones social networking footprint^[12]
• Uninstalling insecure software such as Adobe Flash^[12][13][14]
• Regularly checking ones social media security settings^[15]
• Paying more attention to what information one could accidentally reveal in online posts^[15]
• Not rooting ones phone^[15]
• Never giving out logins or passwords to anyone^[16]
• Using security questions and answers that are impossible for anybody else to answer even if they have access to ones social media posts or engage in social engineering^[16]
• Gathering evidence, creating documentation and contacting relevant authorities, administrators or organisations in the case of a cyberattack^[16]
• Being cautious when browsing and opening email attachments or links in emails^[9]
• Avoiding free WiFi or not logging into any accounts while using it^[9]
• Making adequate use of privacy and anonymity software
• Publishing public keys for PGP authentication for being able to prove ones identity

Education

Information security professional Paul Carugati states that training, awareness and education is "the only path forward to holistically protect ourselves against these very dynamic threats".^[17]

He also advices employers to "continue to advance their employees in cyber self defense and look for cyber security skill level".^[18]

"Hacking back"

Legal theorists and policy makers are increasingly considering authorizing the private sector to take active measures on their own.^[19]

The question when does a cyber-attack (or threat therof) give rise to a right of self-defense is the subject of studies and discussion.^[20]

In March 2017 Tom Graves proposed the Active Cyber Defense Certainty Act (ACDC) that would enhance the Computer Fraud and Abuse Act (CFAA) to allow individuals and the private sector to use limited defensive measures, including tools that are currently restricted under the CFAA, for identification and stopping attackers.^[21][22]
Brad Maryman warns of unintended consequences, stating that in his view "the notion that we should legislate and accept a level of undocumented and unmonitored cyber actions by anyone who thinks they have been hacked is unfathomable".^[22]

See also

• Proactive cyber defence
• CryptoParty
• Information security
• Internet security

References

External links

• Cybersecurity self-defense, Slate
• Moore, Alexis; Edwards, Laurie. Cyber Self-Defense: Expert Advice to Avoid Online Predators, Identity Theft, and Cyberbullying. Rowman & Littlefield. ISBN 9781493015429. 
• Surveillance Self-Defense, EFF
• Paul Carugati: Cyber Self-Defense, TED talk