Information Security for Human Rights Defenders - Revision history

Kristin1: /* Secure storage */ updated links

2024-05-23T15:52:49Z

Secure storage: updated links

← Older revision		Revision as of 15:52, 23 May 2024
Line 99:		Line 99:
	* [[Secure your devices\|Use anti virus]]		* [[Secure your devices\|Use anti virus]]
	* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]		* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]
	* [[~~Ways~~ to ~~securely~~ store ~~and share files~~\|Have your sensitive information stored safely in the cloud and off of your device.]]		* [[How to collect and store information in a secure way\|Have your sensitive information stored safely in the cloud and off of your device.]]

	[[File:Secure-storage.png\|thumb\|Secure storage]]		[[File:Secure-storage.png\|thumb\|Secure storage]]

	=== Secure storage ===		=== Secure storage ===
	[[~~Ways to securely store and share files~~\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).		[[Trusted hosting companies in the human rights community\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).

Kristin1: /* Understanding and organizing your information */

2023-08-21T21:40:00Z

Understanding and organizing your information

← Older revision		Revision as of 21:40, 21 August 2023
Line 2:		Line 2:

	== Understanding and organizing your information ==		== Understanding and organizing your information ==
			[[File:Info at rest grid example.png\|thumb\|Info at rest, example table from Holistic Security Guide]]
	It’s important to approach information security in a thoughtful, organized way.		It’s important to approach information security in a thoughtful, organized way.

Line 13:		Line 14:

	=== Types of Information ===		=== Types of Information ===
			[[File:Types of information.png\|thumb\|Types of information]]
	Our information can be stored and communicated in many ways: on paper, on our computers, on mobile phones, on the internet, on file servers, various internet services and social networking outlets. Taken together, this information comprises one of the most important assets any of us (or any organisation) has.		Our information can be stored and communicated in many ways: on paper, on our computers, on mobile phones, on the internet, on file servers, various internet services and social networking outlets. Taken together, this information comprises one of the most important assets any of us (or any organisation) has.

Line 19:		Line 21:
	Types of human rights information we manage includes:		Types of human rights information we manage includes:

	# The outcome of the work we are doing (Reports, Database of human rights violations, Images, voice and video recordings).		# '''The outcome of the work we are doing''' (Reports, Database of human rights violations, Images, voice and video recordings).
	# Operational information that helps us do our work:		# '''Operational information that helps us do our work''':
	## Text messages during an action		## Text messages during an action
	## Files		## Files
	## Progress reports		## Progress reports
	## Other office information and communications including Financial, Human resources, Strategic organisational documents		## Other office information and communications including Financial, Human resources, Strategic organisational documents
	# Personal information that identifies who we are both as members of an organisation, as well as other personal or professional affiliations		# '''Personal information that identifies who we are''' both as members of an organisation, as well as other personal or professional affiliations
	# Data generated by our use of digital devices as we work, or ‘meta-data’, which can be used to track our movements or monitor our relationships.		# '''Data generated by our use of digital devices as we work''', or ‘meta-data’, which can be used to track our movements or monitor our relationships.

	== Common threats to information ==		== Common threats to information ==
			[[File:Threat.png\|thumb\|Threats]]
	# '''Data Loss''' - Due to poor computer hygiene, malware infections, power cuts or ageing hardware, computers and other devices occasionally cease to function causing us to lose our data.		# '''Data Loss''' - Due to poor computer hygiene, malware infections, power cuts or ageing hardware, computers and other devices occasionally cease to function causing us to lose our data.
	# '''Compromised accounts''' - Sometimes, our passwords or ‘secret questions’ are not very difficult to break, or we are subjected to phishing attacks (which can be random or targeted for us especially) and unknowingly hand them over to a third party, who gains access to our email or social media accounts		# '''Compromised accounts''' - Sometimes, our passwords or ‘secret questions’ are not very difficult to break, or we are subjected to phishing attacks (which can be random or targeted for us especially) and unknowingly hand them over to a third party, who gains access to our email or social media accounts

Kristin1: /* Information security good practices for human rights defenders */

2023-08-21T21:33:15Z

Information security good practices for human rights defenders

← Older revision		Revision as of 21:33, 21 August 2023
Line 80:		Line 80:

	== Information security good practices for human rights defenders ==		== Information security good practices for human rights defenders ==
			We can summarize and consolidate the information above into three key security practices that can help protect the important information of human rights defenders. [[File:Secure-access.png\|thumb\|Secure access]]

	=== Secure access ===		=== Secure access ===
	[[File:Secure-~~access~~.png\|thumb]]
			* [[Safe internet browsing using VPN and Tor browser\|Use a VPN and/or Tor browser.]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Protect yourselves against (spear) phishing attacks.]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use two factor authentication for all accounts]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use unique, complex passwords for all accounts]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use a password manager to create, store and protect those passwords]]

			[[File:Secure-devices.png\|thumb\|Secure devices]]

	=== Secure devices ===		=== Secure devices ===

			* [[How to mitigate your risk of being subject to Pegasus surveillance\|Restart your device regularly to disrupt spyware]].
			* [[Secure your devices\|Use anti virus]]
			* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]
			* [[Ways to securely store and share files\|Have your sensitive information stored safely in the cloud and off of your device.]]

			[[File:Secure-storage.png\|thumb\|Secure storage]]

	=== Secure storage ===		=== Secure storage ===
			[[Ways to securely store and share files\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).

Kristin1 at 21:27, 21 August 2023

2023-08-21T21:27:39Z

← Older revision		Revision as of 21:27, 21 August 2023
Line 1:		Line 1:
			The content below is used with permission from the '''Holistic Security Guide''', specifically chapter 2.4 on [https://holistic-security.tacticaltech.org/chapters/explore/2-4-understanding-and-cataloguing-our-information.html Understanding and Cataloguing your Information].

	== Understanding and organizing your information ==		== Understanding and organizing your information ==
	It’s important to approach information security in a thoughtful, organized way.		It’s important to approach information security in a thoughtful, organized way.

Kristin1: /* Common threats to information */

2023-08-21T21:25:51Z

Common threats to information

← Older revision		Revision as of 21:25, 21 August 2023
Line 27:		Line 27:

	== Common threats to information ==		== Common threats to information ==
	~~Data Loss - Due to poor computer hygiene, malware infections, power cuts or ageing hardware, computers and other devices occasionally cease to function causing us to lose our data.~~

	Compromised accounts - Sometimes, our passwords or ‘secret questions’ are not very difficult to break, or we are subjected to phishing attacks (which can be random or targeted for us especially) and unknowingly hand them over to a third party, who gains access to our email or social media accounts		# '''Data Loss''' - Due to poor computer hygiene, malware infections, power cuts or ageing hardware, computers and other devices occasionally cease to function causing us to lose our data.
			# '''Compromised accounts''' - Sometimes, our passwords or ‘secret questions’ are not very difficult to break, or we are subjected to phishing attacks (which can be random or targeted for us especially) and unknowingly hand them over to a third party, who gains access to our email or social media accounts
	Device inspection at checkpoints - Sometimes we may have our devices temporarily confiscated while crossing borders or military checkpoints, where the data may be copied or the computer may be infected with spyware or have a hardware keylogger attached.		# '''Device inspection at checkpoints''' - Sometimes we may have our devices temporarily confiscated while crossing borders or military checkpoints, where the data may be copied or the computer may be infected with spyware or have a hardware keylogger attached.
			# '''Device confiscation or theft''' - Computers and mobile phones are common targets for thieves. Furthermore, if we face acute risk, our offices and homes may be raided by State or non-State actors and computers, mobile phones, hard drives, USB keys and servers could be ‘confiscated’ or stolen for analysis.
	Device confiscation or theft - Computers and mobile phones are common targets for thieves. Furthermore, if we face acute risk, our offices and homes may be raided by State or non-State actors and computers, mobile phones, hard drives, USB keys and servers could be ‘confiscated’ or stolen for analysis.		# '''Information handover''' - Internet service providers and the providers of the email and social networking sites that we use can also hand over our data to certain authorities if a legal request is made to do so. While they protect our data from some, they are more willing to hand it over to others, and this situation is constantly changing in accordance with business and political interests.
			# '''Targeted malware''' - This is a growing industry: some State authorities and other groups invest in software which is designed to trick us into downloading it and later granting the attacker access to much or all of the data on our devices.
			# '''Surveillance and monitoring''' - Data brokers, internet service providers, email providers and many other companies subject the general population to surveillance by gathering and aggregating details of our online activities. While in some cases this has the aim of merely targeting us with advertisements, it can also be used to identify particular minorities to which we may belong as a target for deeper surveillance.

	== Mitigation techniques for common threats to information ==		== Mitigation techniques for common threats to information ==
Line 39:		Line 40:
	\|+		\|+
	!Threat		!Threat
	!Mitigation ~~technique~~		!Mitigation techniques and links to guidance
	!
	!
	\|-		\|-
	\|Data loss		\|Data loss
	~~\|Have your information securely in the cloud or on a server.~~

	~~Have a backup process.~~
	\|
	\|		\|
			* [[Ways to securely store and share files\|Have your information securely in the cloud or on a server.]]
			* Have a backup process.
	\|-		\|-
	\|Compromised accounts		\|Compromised accounts
	~~\|Use two factor authentication for all accounts~~
	~~Use unique, complex passwords for all accounts~~

	~~Use a password manager to create, store and protect those passwords~~
	\|
	\|		\|
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use two factor authentication for all accounts]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use unique, complex passwords for all accounts]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use a password manager to create, store and protect those passwords]]
	\|-		\|-
	\|Device inspection at checkpoints		\|Device inspection at checkpoints
	~~\|Have your sensitive information stored safely in the cloud and off of your device.~~
	~~Hide or delete any apps that would provide access to this information (you can restore that app later).~~
	\|
	\|		\|
			* [[Ways to securely store and share files\|Have your sensitive information stored safely in the cloud and off of your device.]]
			* Hide or delete any apps that would provide access to this information (you can restore that app later).
	\|-		\|-
	\|Device confiscation or theft		\|Device confiscation or theft
	~~\|Encrypt your devices.~~
	~~Same advice as with “device inspection” threat.~~
	\|
	\|		\|
			* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]
			* Same advice as for “device inspection” threat.
	\|-		\|-
	\|		\|Information handover
	\|		\|[[Ways to securely store and share files\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).
	\|
	\|
	\|-
	\|
	\|
	\|
	\|
	\|-		\|-
			\|Targeted malware
	\|		\|
	\|		* [[Protect your accounts using strong passwords, pw managers, 2fa\|Protect yourselves against (spear) phishing attacks.]]
	\|		* Use a second device for sensitive activities.
	\|		* [[How to mitigate your risk of being subject to Pegasus surveillance\|Restart your device regularly to disrupt spyware]].
			* [[Secure your devices\|Use anti virus]]
	\|-		\|-
	\|		\|Surveillance and monitoring
	\|		\|[[Safe internet browsing using VPN and Tor browser\|Use a VPN and/or Tor browser.]]
	\|
	\|
	\|}		\|}

			== Information security good practices for human rights defenders ==

			=== Secure access ===
			[[File:Secure-access.png\|thumb]]

			=== Secure devices ===

			=== Secure storage ===

Kristin1: /* Know the common threats to information */

2023-08-21T18:59:00Z

Know the common threats to information

@@ Line 26: / Line 26: @@
 # Data generated by our use of digital devices as we work, or ‘meta-data’, which can be used to track our movements or monitor our relationships.
-== Know the common threats to information ==
+== Common threats to information ==
 Data Loss - Due to poor computer hygiene, malware infections, power cuts or ageing hardware, computers and other devices occasionally cease to function causing us to lose our data.
 {| class="wikitable"
 |+
@@ Line 39: / Line 47: @@
 Have a backup process.
+|
+|

Kristin1: Created page with "== Understanding and organizing your information == It’s important to approach information security in a thoughtful, organized way. Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms. The reality is that it will n..."

2023-08-21T18:55:07Z

Created page with "== Understanding and organizing your information == It’s important to approach information security in a thoughtful, organized way. Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms. The reality is that it will n..."

New page

== Understanding and organizing your information ==
It’s important to approach information security in a thoughtful, organized way.

Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms.

The reality is that it will not be possible to protect all your information from every possible way it could be compromised, and so you must prioritise. You should proceed systematically on the basis of risk. You should consider both the value of information to your work and the potential harms to you and others that could arise if it is compromised or lost.

You can also consider how likely it is that the value will be realised or that a given harm will occur. This provides a rational basis for prioritising where you should focus your attention.

Follow the guidance and exercises in the '''Holistic Security Guide''', chapter 2.4 on [https://holistic-security.tacticaltech.org/chapters/explore/2-4-understanding-and-cataloguing-our-information.html Understanding and Cataloguing your Information]

=== Types of Information ===
Our information can be stored and communicated in many ways: on paper, on our computers, on mobile phones, on the internet, on file servers, various internet services and social networking outlets. Taken together, this information comprises one of the most important assets any of us (or any organisation) has.

As with any asset, we are best served when we are sure that this asset is properly cared for so it doesn’t accidentally or maliciously get lost, corrupted, compromised, stolen or misused. In caring for our own security, we need to care for the security of our information.

Types of human rights information we manage includes:

# The outcome of the work we are doing (Reports, Database of human rights violations, Images, voice and video recordings).
# Operational information that helps us do our work:
## Text messages during an action
## Files
## Progress reports
## Other office information and communications including Financial, Human resources, Strategic organisational documents
# Personal information that identifies who we are both as members of an organisation, as well as other personal or professional affiliations
# Data generated by our use of digital devices as we work, or ‘meta-data’, which can be used to track our movements or monitor our relationships.

== Know the common threats to information ==
Data Loss - Due to poor computer hygiene, malware infections, power cuts or ageing hardware, computers and other devices occasionally cease to function causing us to lose our data.
{| class="wikitable"
|+
!Threat
!Mitigation technique
!
!
|-
|Data loss
|Have your information securely in the cloud or on a server.

Have a backup process.
|
|
|-
|
|
|
|
|-
|
|
|
|
|}

← Older revision		Revision as of 15:52, 23 May 2024
Line 99:		Line 99:
	* [[Secure your devices\|Use anti virus]]		* [[Secure your devices\|Use anti virus]]
	* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]		* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]
	* [[~~Ways~~ to ~~securely~~ store ~~and share files~~\|Have your sensitive information stored safely in the cloud and off of your device.]]		* [[How to collect and store information in a secure way\|Have your sensitive information stored safely in the cloud and off of your device.]]

	[[File:Secure-storage.png\|thumb\|Secure storage]]		[[File:Secure-storage.png\|thumb\|Secure storage]]

	=== Secure storage ===		=== Secure storage ===
	[[~~Ways to securely store and share files~~\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).		[[Trusted hosting companies in the human rights community\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).

← Older revision		Revision as of 21:33, 21 August 2023
Line 80:		Line 80:

	== Information security good practices for human rights defenders ==		== Information security good practices for human rights defenders ==
			We can summarize and consolidate the information above into three key security practices that can help protect the important information of human rights defenders. [[File:Secure-access.png\|thumb\|Secure access]]

	=== Secure access ===		=== Secure access ===
	[[File:Secure-~~access~~.png\|thumb]]
			* [[Safe internet browsing using VPN and Tor browser\|Use a VPN and/or Tor browser.]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Protect yourselves against (spear) phishing attacks.]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use two factor authentication for all accounts]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use unique, complex passwords for all accounts]]
			* [[Protect your accounts using strong passwords, pw managers, 2fa\|Use a password manager to create, store and protect those passwords]]

			[[File:Secure-devices.png\|thumb\|Secure devices]]

	=== Secure devices ===		=== Secure devices ===

			* [[How to mitigate your risk of being subject to Pegasus surveillance\|Restart your device regularly to disrupt spyware]].
			* [[Secure your devices\|Use anti virus]]
			* [[Secure your devices#Full disk encryption\|Encrypt your devices.]]
			* [[Ways to securely store and share files\|Have your sensitive information stored safely in the cloud and off of your device.]]

			[[File:Secure-storage.png\|thumb\|Secure storage]]

	=== Secure storage ===		=== Secure storage ===
			[[Ways to securely store and share files\|Host your information with a company you trust]], who will not turn over information to your opponents (via subpoena, request, etc).