Secure your devices - Revision history

Kristin1: /* Keep your device or operating system up-to-date with software updates */

2024-12-18T16:39:38Z

Keep your device or operating system up-to-date with software updates

← Older revision		Revision as of 16:39, 18 December 2024
Line 1:		Line 1:
	== Keep your ~~device~~ or operating system up-to-date with software updates ==		== Secure your device's operating system ==
	~~When you buy a device or an~~ operating ~~system, keep it~~ up-to-date with software updates. Updates will often fix security problems in older code that attacks can exploit. Note that some older phones and operating systems may no longer be supported, even for security updates. In particular, Microsoft has made it clear that versions of Windows Vista, XP, and below will not receive fixes for even severe security problems. This means that if you use these, you cannot expect them to be secure from attackers. The same is true for OS X before 10.11 or El Capitan. (Source: [https://ssd.eff.org/module/choosing-your-tools Electronic Frontier SSD])
			=== Avoid pirated copies of operating systems ===
			It is very important that you use a ''licensed'' operating system, such as Linux, Windows or Mac. A "pirated copy" of an operating system refers to a version of the OS that is illegally obtained. These pirated copies do not have a valid license and do not receive critical updates, therefore, it exposes users to security risks and potential legal issues.

			=== Keep your devices or operating system up-to-date with software updates ===
			Keep your licensed operating systems (and devices) up-to-date with software updates. Updates will often fix security problems in older code that attacks can exploit. Note that some older phones and operating systems may no longer be supported, even for security updates. In particular, Microsoft has made it clear that versions of Windows Vista, XP, and below will not receive fixes for even severe security problems. This means that if you use these, you cannot expect them to be secure from attackers. The same is true for OS X before 10.11 or El Capitan. (Source: [https://ssd.eff.org/module/choosing-your-tools Electronic Frontier SSD])

	=== Free, open source operating systems ===		=== Free, open source operating systems ===
Line 11:		Line 16:
	== Use antivirus or anti-malware ==		== Use antivirus or anti-malware ==

	=== ~~Advice~~ ===		=== Good practices ===
	1. Know how to check if your antivirus or anti-malware app is working and updating itself.		1. Know how to check if your antivirus or anti-malware app is working and updating itself.

Line 23:		Line 28:
	=== Antivirus software options ===		=== Antivirus software options ===

	~~'''~~Windows~~'''~~		==== Windows ====
	On Windows 10, Security in a Box recommends to turn on Windows's own anti-malware protection [https://securityplanner.consumerreports.org/tool/turn-on-windows-defender-antivirus Windows Defender]		On Windows 10, Security in a Box recommends to turn on Windows's own anti-malware protection [https://securityplanner.consumerreports.org/tool/turn-on-windows-defender-antivirus Windows Defender]

	~~'''~~Linux~~'''~~		==== Linux ====
	On Linux you can manually scan your device for malware with [https://www.clamav.net/ ClamAV]. But be aware it is only a scanner, and will not monitor your system to protect you from infection. You can use it to determine whether or not a file or directory contains known malware — and it can be run from a USB memory stick in case you do not have permission to install software on the suspect computer. You may also consider using paid antivirus (e.g. ESET NOD32)		On Linux you can manually scan your device for malware with [https://www.clamav.net/ ClamAV]. But be aware it is only a scanner, and will not monitor your system to protect you from infection. You can use it to determine whether or not a file or directory contains known malware — and it can be run from a USB memory stick in case you do not have permission to install software on the suspect computer. You may also consider using paid antivirus (e.g. ESET NOD32)

			==== Windows, Linux, Mac, iOS, Android ====
	Software available on multiple operating systems that offer free versions:		Software available on multiple operating systems that offer free versions:
	* [https://www.bitdefender.com BitDefender] (Android, iOS, Mac, Windows) - Warning: This can be a heavy program for many computers.		* [https://www.bitdefender.com BitDefender] (Android, iOS, Mac, Windows) - Warning: This can be a heavy program for many computers.

Kristin1: /* Disable features that create vulnerabilities */ added link to black top presentation

2024-11-14T19:43:26Z

Disable features that create vulnerabilities: added link to black top presentation

← Older revision		Revision as of 19:43, 14 November 2024
Line 63:		Line 63:
	# All data is protected by a single key, which means that if you lose that one key, you lose access to the device		# All data is protected by a single key, which means that if you lose that one key, you lose access to the device

	== Disable features that create vulnerabilities ==		== Disable features that create vulnerabilities (Lockdown Mode) ==
	'''iPhone and Mac devices offers [https://support.apple.com/en-us/HT212650 Lockdown Mode]''' - "When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all. Lockdown Mode is available in iOS 16, iPadOS 16, and macOS Ventura."		'''iPhone and Mac devices offers [https://support.apple.com/en-us/HT212650 Lockdown Mode]''' - "When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all. Lockdown Mode is available in iOS 16, iPadOS 16, and macOS Ventura."

			Lockdown Mode covers a lot of different scenarios and reduce attack surface for attacks: remove JIT from browser, disable a lot of webkit features, block calls from unknown contacts in iMessage, remove many file types in messages etc. You can read a [https://blacktop.github.io/presentations/0x41con_2023/HTML/index.html#0 2023 analysis presentation by Blacktop].

	'''Android also offers a version of [https://www.zdnet.com/article/how-to-use-the-android-lockdown-mode-and-why-you-should/ Lockdown Mode]''' - "When lockdown mode is enabled, fingerprint sensors, facial recognition, and voice recognition do not function. Once you've activated lockdown mode, the only way to gain access to your device is either via PIN, password, or pattern. One thing you must know about lockdown mode is that it's a one-time thing. In other words, once you've enabled it, it will immediately be disabled upon successful login. That means you have to re-enable lockdown mode every time you want to use it."		'''Android also offers a version of [https://www.zdnet.com/article/how-to-use-the-android-lockdown-mode-and-why-you-should/ Lockdown Mode]''' - "When lockdown mode is enabled, fingerprint sensors, facial recognition, and voice recognition do not function. Once you've activated lockdown mode, the only way to gain access to your device is either via PIN, password, or pattern. One thing you must know about lockdown mode is that it's a one-time thing. In other words, once you've enabled it, it will immediately be disabled upon successful login. That means you have to re-enable lockdown mode every time you want to use it."

Kristin1: /* Keep your device or operating system up-to-date with software updates */

2024-06-18T17:09:06Z

Keep your device or operating system up-to-date with software updates

← Older revision		Revision as of 17:09, 18 June 2024
Line 1:		Line 1:
	== ~~Use licensed~~ operating ~~systems and~~ software ==		== Keep your device or operating system up-to-date with software updates ==
	~~Some general advice is almost always true, however.~~ When you buy a device or an operating system, keep it up-to-date with software updates. Updates will often fix security problems in older code that attacks can exploit. Note that some older phones and operating systems may no longer be supported, even for security updates. In particular, Microsoft has made it clear that versions of Windows Vista, XP, and below will not receive fixes for even severe security problems. This means that if you use these, you cannot expect them to be secure from attackers. The same is true for OS X before 10.11 or El Capitan.		When you buy a device or an operating system, keep it up-to-date with software updates. Updates will often fix security problems in older code that attacks can exploit. Note that some older phones and operating systems may no longer be supported, even for security updates. In particular, Microsoft has made it clear that versions of Windows Vista, XP, and below will not receive fixes for even severe security problems. This means that if you use these, you cannot expect them to be secure from attackers. The same is true for OS X before 10.11 or El Capitan. (Source: [https://ssd.eff.org/module/choosing-your-tools Electronic Frontier SSD])

			=== Free, open source operating systems ===
			If you cannot afford to purchase a licensed Windows or Mac operating system, you can use a free and open source operating system, such as:

			'''[https://www.linuxmint.com/ Linux Mint]''' is an operating system for desktop and laptop computers. It is designed to work 'out of the box' and comes fully equipped with the apps most people need. Linux Mint works on most computers. It can also be run from a live USB stick to make sure everything works fine without having to install anything.

			[https://tails.net/ '''Tails'''] is a portable operating system that protects against surveillance and censorship. To use Tails, shut down the computer and start on your Tails USB stick instead of starting on Windows, macOS, or Linux. You can temporarily turn your own computer into a secure machine. You can also '''.''' You can also stay safe while using the computer of somebody else'''.''' Tails is a 1.4 GB download and takes ½ hour to install. Tails can be installed on any USB stick of 8 GB minimum. Tails works on most computers less than 10 years old. You can start again on the other operating system after you s t down Tails. You don't have to worry about the computer having viruses because Tails runs independently from the other operating system and never uses the hard disk. But, Tails cannot always protect you if you install it from a computer with viruses or if you use it on a computer with malicious hardware, like keyloggers.

	== Use antivirus or anti-malware ==		== Use antivirus or anti-malware ==

Kristin1 at 15:13, 18 June 2024

2024-06-18T15:13:36Z

← Older revision		Revision as of 15:13, 18 June 2024
Line 1:		Line 1:
			== Use licensed operating systems and software ==
	= ~~Secure your devices~~ =		Some general advice is almost always true, however. When you buy a device or an operating system, keep it up-to-date with software updates. Updates will often fix security problems in older code that attacks can exploit. Note that some older phones and operating systems may no longer be supported, even for security updates. In particular, Microsoft has made it clear that versions of Windows Vista, XP, and below will not receive fixes for even severe security problems. This means that if you use these, you cannot expect them to be secure from attackers. The same is true for OS X before 10.11 or El Capitan.

	~~This~~ is a ~~collection~~ of ~~resources~~ for ~~human rights defenders to better understand when~~, ~~why and how~~ to secure ~~devices~~.

	== Use antivirus or anti-malware ==		== Use antivirus or anti-malware ==
Line 64:		Line 62:

	== Separate your phone number from your device ==		== Separate your phone number from your device ==
	~~Guidance:~~ https://theintercept.com/2017/09/28/signal-tutorial-second-phone-number/		[https://theintercept.com/2017/09/28/signal-tutorial-second-phone-number/ How to use signal without giving out your phone number] (article) - A step-by-step guide to protecting your private phone number while enjoying the security of encrypted texting app Signal.
	----		----
	''Last updated ~~Nov 30~~, ~~2023~~''		''Last updated June 18, 2024''

	Source for this content: [https://securityinabox.org/en/phones-and-computers/malware/#use-antivirus-or-anti-malware Security in a Box]'' , Electronic Frontier SSD, and discussions with human rights security practitioners.''		Source for this content: [https://securityinabox.org/en/phones-and-computers/malware/#use-antivirus-or-anti-malware Security in a Box]'' , [https://ssd.eff.org/ Electronic Frontier SSD], and discussions with human rights security practitioners.''

Kristin1: /* Disk encryption vulnerabilities */

2024-05-09T13:07:59Z

Disk encryption vulnerabilities

← Older revision		Revision as of 13:07, 9 May 2024
Line 52:		Line 52:

	=== Disk encryption vulnerabilities ===		=== Disk encryption vulnerabilities ===
			There are some risks related to disk encryption that you need to consider before moving forward, and find ways to mitigate these risks:
	# Data is exposed as soon as it leaves the protected disk		# Data is exposed as soon as it leaves the protected disk
	# Data is exposed in the clear if a user session is hijacked		# Data is exposed in the clear if a user session is hijacked
	# Data is exposed if device credentials are compromised.		# Data is exposed if device credentials are compromised
	# All data is ~~protect~~ by a single key.		# All data is protected by a single key, which means that if you lose that one key, you lose access to the device

	== Disable features that create vulnerabilities ==		== Disable features that create vulnerabilities ==
	iPhone and Mac devices offers [https://support.apple.com/en-us/HT212650 Lockdown Mode] - "When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all. Lockdown Mode is available in iOS 16, iPadOS 16, and macOS Ventura."		'''iPhone and Mac devices offers [https://support.apple.com/en-us/HT212650 Lockdown Mode]''' - "When Lockdown Mode is enabled, your device won’t function like it typically does. To reduce the attack surface that potentially could be exploited by highly targeted mercenary spyware, certain apps, websites, and features are strictly limited for security and some experiences might not be available at all. Lockdown Mode is available in iOS 16, iPadOS 16, and macOS Ventura."

	Android also offers a version of [https://www.zdnet.com/article/how-to-use-the-android-lockdown-mode-and-why-you-should/ Lockdown Mode] - "When lockdown mode is enabled, fingerprint sensors, facial recognition, and voice recognition do not function. Once you've activated lockdown mode, the only way to gain access to your device is either via PIN, password, or pattern. One thing you must know about lockdown mode is that it's a one-time thing. In other words, once you've enabled it, it will immediately be disabled upon successful login. That means you have to re-enable lockdown mode every time you want to use it."		'''Android also offers a version of [https://www.zdnet.com/article/how-to-use-the-android-lockdown-mode-and-why-you-should/ Lockdown Mode]''' - "When lockdown mode is enabled, fingerprint sensors, facial recognition, and voice recognition do not function. Once you've activated lockdown mode, the only way to gain access to your device is either via PIN, password, or pattern. One thing you must know about lockdown mode is that it's a one-time thing. In other words, once you've enabled it, it will immediately be disabled upon successful login. That means you have to re-enable lockdown mode every time you want to use it."

	== Separate your phone number from your device ==		== Separate your phone number from your device ==

Kristin1: /* SECURE YOUR DEVICES */

2024-05-09T13:04:28Z

SECURE YOUR DEVICES

← Older revision		Revision as of 13:04, 9 May 2024
Line 1:		Line 1:

	= ~~SECURE YOUR DEVICES~~ =		= Secure your devices =

	This is a collection of resources for human rights defenders to better understand when, why and how to secure devices.		This is a collection of resources for human rights defenders to better understand when, why and how to secure devices.

Kristin1: added section on separating phone number from device

2023-11-30T20:15:52Z

added section on separating phone number from device

← Older revision		Revision as of 20:15, 30 November 2023
Line 62:		Line 62:

	Android also offers a version of [https://www.zdnet.com/article/how-to-use-the-android-lockdown-mode-and-why-you-should/ Lockdown Mode] - "When lockdown mode is enabled, fingerprint sensors, facial recognition, and voice recognition do not function. Once you've activated lockdown mode, the only way to gain access to your device is either via PIN, password, or pattern. One thing you must know about lockdown mode is that it's a one-time thing. In other words, once you've enabled it, it will immediately be disabled upon successful login. That means you have to re-enable lockdown mode every time you want to use it."		Android also offers a version of [https://www.zdnet.com/article/how-to-use-the-android-lockdown-mode-and-why-you-should/ Lockdown Mode] - "When lockdown mode is enabled, fingerprint sensors, facial recognition, and voice recognition do not function. Once you've activated lockdown mode, the only way to gain access to your device is either via PIN, password, or pattern. One thing you must know about lockdown mode is that it's a one-time thing. In other words, once you've enabled it, it will immediately be disabled upon successful login. That means you have to re-enable lockdown mode every time you want to use it."

			== Separate your phone number from your device ==
			Guidance: https://theintercept.com/2017/09/28/signal-tutorial-second-phone-number/
	----		----
	''Last updated Nov 11, ~~2022~~		''Last updated Nov 30, 2023''

	Source for this content: [https://securityinabox.org/en/phones-and-computers/malware/#use-antivirus-or-anti-malware Security in a Box]'' , Electronic Frontier SSD, and discussions with human rights security practitioners.''		Source for this content: [https://securityinabox.org/en/phones-and-computers/malware/#use-antivirus-or-anti-malware Security in a Box]'' , Electronic Frontier SSD, and discussions with human rights security practitioners.''

Kristin1: /* SECURE YOUR DEVICES */

2023-08-15T18:52:56Z

SECURE YOUR DEVICES

@@ Line 36: / Line 36: @@
 Note that all antivirus and anti-malware apps collect information on how the protected devices are being used. Some of this information may be shared with companies which own them. There have been cases where this information was sold to third parties.
 == Full disk encryption ==
@@ Line 60: / Line 55: @@
 # Data is exposed as soon as it leaves the protected disk
 # Data is exposed in the clear if a user session is hijacked
 # Data is exposed if device credentials are compromised.
 # All data is protect by a single key.

Kristin1: /* Full disk encryption */

2023-08-15T18:42:52Z

Full disk encryption

@@ Line 44: / Line 44: @@
 == Full disk encryption ==
-How to encrypt your [https://ssd.eff.org/module/how-encrypt-your-windows-device Windows device] (available in 10+ languages)
+=== For computers ===
-How to encrypt your [https://ssd.eff.org/module/how-encrypt-your-iphone iPhone] (available in 10+ languages)
+'''Linux''' distributions usually offer full-disk encryption when you first set up your system.

Kristin1: /* Full disk encryption */ added encryption resources

2023-08-15T18:35:53Z

Full disk encryption: added encryption resources

← Older revision		Revision as of 18:35, 15 August 2023
Line 5:		Line 5:

	== Use antivirus or anti-malware ==		== Use antivirus or anti-malware ==


	=== Advice ===		=== Advice ===

	1. Know how to check if your antivirus or anti-malware app is working and updating itself.		1. Know how to check if your antivirus or anti-malware app is working and updating itself.

Line 46:		Line 44:
	== Full disk encryption ==		== Full disk encryption ==

	~~Coming soon~~		How to encrypt your [https://ssd.eff.org/module/how-encrypt-your-windows-device Windows device] (available in 10+ languages)

			How to encrypt your [https://ssd.eff.org/module/how-encrypt-your-iphone iPhone] (available in 10+ languages)