Tips and Advice
A clear summary of the most important aspects of the cyber security fundamentals.
You can also download all the guides in PDF format.
Passwords and Logins
| 1. Password format |
2. Password length |
3. Mnemonic passwords |
4. Password manager |
| A password can contain upper and lower case letters, numbers and special symbols such as +*?- etc. It is advisable not to put a capital letter at the beginning and a number at the end of the password. These are predictable password patterns. |
A good password is at least 12 characters long. Cyber security experts say that password length is the most important factor in resisting password cracking techniques. |
So-called mnemonic phrase-based passwords can help us. They work as a good memory aid. For example, “My first car was a Toyota in 2012!”. “MfcwaTi2012!” |
Password managers are handy little apps that generate passwords, store them in a safe place and issue them to the user if necessary. Experts consider Keepass to be a good password manager. |
Mobile Device Unlocking
| 1. PIN |
2. “Gesture” |
3. Fingerprint |
4. Face scan |
| A PIN is a good method for unlocking mobile devices. To provide good protection, it should consist of at least six digits that do not form a trivial sequence such as 123456. Today’s devices often warn you about this. |
The method of connecting dots on the screen into a pattern does not have a very good reputation. There are few convenient combinations, for example people choose capital letters as a pattern and someone can copy their pattern. |
Using a fingerprint is a good method for unlocking mobile devices. Modern readers no longer track the fingerprint as such, but its electrical charge. This makes them very reliable. They work best together with a strong PIN. |
When the method was new, it was sometimes outsmarted. But it has evolved. It depends on the type of device and scanner, but the reliability of the method is high today. It also works best with a strong PIN. |
Social Engineering
| 1. Social engineering |
2. Phishing |
3. Vishing |
4. Baiting |
| Social engineering techniques focus on manipulating the user. Their goal is to manipulate the emotions and feelings of the users so that, for example, they reveal their confidential information, typically login details. |
It can look like a strange message from abroad or a sophisticated message from the IT department. For example, it is disguised as a notification about an overflowing email inbox. It is important to monitor where the links lead. |
A fraudulent technique that is usually carried out over a phone. For example, attackers disguise themselves as bank or customer support staff. Don’t let them scare you or derail you. |
Popular “flash drives” can cause many problems. Attackers leave seemingly innocent flash drives in public areas, hoping that unsuspecting individuals will pick them up and connect them to their device. It may have an enticing description. It is better to avoid them altogether. |
Trusted Communication
| 1. Electronic signatures |
2. Simple electronic signatures |
3. Guaranteed electronic signatures |
4. Qualified electronic signatures |
| Not all electronic signatures are the same. The legal and IT perspectives on this issue differ significantly. Only some types of signatures increase the trustworthiness of communication. |
A scanned signature and its various variations do not guarantee the identity of the person signing or that the document or message has not been altered after signing. From a security perspective, such signatures have no validity. |
Guaranteed electronic signatures are better in terms of security. Guaranteed electronic signatures based on a so-called qualified certificate have a higher value. We can obtain the qualified certificate from a certification authority. |
A qualified electronic signature is considered the strongest in terms of security. The certificate is stored, for example, on a secure chip card that we connect to the device. We also need to know the PIN. |
Malicious Files
| 1. Malicious files |
2. File masquerading |
3. Malicious macros |
4. Ransomware |
| Malicious files typically run harmful programs that can damage our devices or systems. Attackers like to spread them as e-mail attachments or via online storage. |
To confuse users, attackers disguise malicious files. For example, by disguising it as an invoice or other important document, as one of many files in a .rar or .zip archive, or by camouflaging file extensions. |
Users are often surprised that a malicious file can also be an Excel, Word or PowerPoint file. Attackers can prepare malicious macros in them, a set of advanced rules that can launch an attack. |
Ransomware is a type of malware that can surprise users, perhaps because of a macro. It can encrypt files or entire systems, which are then difficult to recover. |
Device Protection
| 1. Updates |
2. Firewall |
3. Antivirus program |
4. Backup |
| Updates are important, thanks to them developers keep programs in good condition. This also applies to security. Updates can fix discovered security flaws. Therefore, updates should not be delayed. |
A firewall is a tool that monitors the security of a device. Its task is to check the requests that the device receives from the Internet and evaluate them according to specified security rules. |
An antivirus program constantly monitors that there is no known malicious file on our device. If such a file is found, its task is to take the necessary actions to protect the device. |
As users, we can lose our data and files irretrievably. This is exactly when continuous backups come in handy. This means that we save important files “somewhere else” at least from time to time. |
Application Downloading
| 1. Official stores |
2. Application criteria |
3. Application permissions |
4. Application masquerading |
| When downloading apps to mobile devices, we should always download them from the so-called official shops. These are Google Play for Android and AppStore for iOS. These are official sources. |
It is important to monitor user reviews and their ratings for applications. It is worth filtering for bad reviews and looking at what users have complained about specifically. This is a good guide. |
Every application needs so-called permissions to function. As users, we grant them. However, we should grant permissions with caution and evaluate them with common sense. |
Attackers often insert malicious code into an application where users do not expect it. For example, into a photo editing app that spreads well. Or into an app that pretends to be “antivirus protection”. |
Connectivity and Privacy
| 1. Public Wi-Fi networks |
2. HTTPS |
3. End-to-end encryption |
4. VPN |
| Public Wi-Fi networks without passwords should only be used for basic tasks. For example, to find opening hours or public transport timetables. It is better not to use them to send login details. |
HTTPS tells us that the communication between our web browser and the website is encrypted. However, this does not mean that the site is perfectly secure at all times. |
End-to-end encryption is mainly used to encrypt messages. Thanks to this encryption, only the sender and recipient can read them. Not all communication applications support this encryption. |
A VPN acts as an imaginary tunnel through which our internet traffic flows. Attackers cannot monitor and read it. It ensures the maximum level of privacy. We can get a VPN connection for a few hundred crowns. |