2024 CFM Workshop - Digital Security (PDF Slides)

Digital Security

Creating Freedom Movements JC April 3rd, 2024

When it comes to compromised data, we no longer live in an “if” world, but instead of a “when”.

Where to start: Your Security Plan Trying to protect all your data from everyone all the time is impractical and exhausting.

Security is a process not a purchase, and through thoughtful planning, you can put together a plan that’s right for you.

Security isn’t just about the tools you use or the software you download. It begins with understanding the unique threats you face and how you can counter those threats.

Threat model In computer security, a threat is a potential event that could undermine your efforts to defend your data.

You can counter the threats you face by determining what you need to protect and from whom you need to protect it.

This is the process of security planning, often referred to as “threat modeling.”

When building a security plan answer these five questions: What do I want to protect?

Who do I want to protect it from?

How bad are the consequences if I fail?

How likely is it that I will need to protect it?

How much trouble am I willing to go through to try to prevent potential consequences?

What do I want to protect?

An “asset” is something you value and want to protect. In the context of digital security, an asset is usually some kind of information.

For example, your emails, contact lists, instant messages, location, and files are all possible assets. Your devices may also be assets.

Make a list of your assets: data that you keep, where it’s kept, who has access to it, and what stops others from accessing it.

Who do I want to protect it from?

To answer this question, it’s important to identify who might want to target you or your information. A person or entity that poses a threat to your assets is an “adversary.”

Examples of potential adversaries are your former partner, your business competition, your government, or a hacker on a public network.

Make a list of your adversaries, or those who might want to get ahold of your assets.

How bad are the consequences if I fail?

Security planning involves understanding how bad the consequences could be if an adversary successfully gains access to one of your assets. To determine this, you should consider the capability of your adversary. For example, your mobile phone provider has access to all your phone records. A hacker on an open Wi-Fi network can access your unencrypted communications.

Write down what your adversary might want to do with your private data.

How likely is it that I will need to protect it?

Risk is the likelihood that a particular threat against a particular asset will actually occur. It goes hand-in-hand with capability.

It is important to distinguish between what might happen and the probability it may happen. For instance, there is a threat that your building might collapse, but the risk of this happening is far greater in San Francisco (where earthquakes are common) than in Stockholm (where they are not).

How likely is it that I will need to protect it? (cont.)

Assessing risks is both a personal and a subjective process.

Many people find certain threats unacceptable no matter the likelihood they will occur because the mere presence of the threat at any likelihood is not worth the cost. In other cases, people disregard high risks because they don’t view the threat as a problem.

Write down which threats you are going to take seriously, and which may be too rare or too harmless (or too difficult to combat) to worry about.

How much trouble am I willing to go through to try to prevent potential consequences?

There is no perfect option for security. Not everyone has the same priorities, concerns, or access to resources. Your risk assessment will allow you to plan the right strategy for you, balancing convenience, cost, and privacy.

Write down what options you have available to you to help mitigate your unique threats.

What's Secure Today May Not Be Secure Tomorrow It is crucially important to continually re-evaluate your security practices. Just because they were secure last year or last week doesn't mean they're still secure!

A perfect security plan on paper won't work if it's too difficult to follow day-to-day.

A chain is only as strong as its weakest link.

Types of Data Data at Rest Data that is stored somewhere: on a mobile device, laptop, server, or external hard drive, for example. When data is at rest, it is not moving from one place to another.

Data in Motion Information that is moving over a network from one place to another.

When you send a message on a messaging app, for example, that message moves from your device, to the app company’s servers,

Protecting Your Data at Rest

Encryption Is the process of converting information or data into a code, especially to prevent unauthorized access Examples of encryption date back as far as ancient Greece.

Encryption as we know it today it is heavily focused on math that is handled by computers. The need for encryption has grown over the last few years with the amount of information that we centralize in our mobile devices as they become more and more an extension of ourselves.

Encrypting your data Computers and mobile phones can be locked through passwords, PINs or gestures, but these locks do not help protect data if the device itself is seized. It's relatively simple to bypass these ‘locks’, because your data is stored in an easily readable form within the device. All an attacker needs to do is to access the storage directly, and the data can be copied or examined without knowing your password.

Full-Disk Encryption Also known as whole disk encryption, protects data that is at rest on a computer or phone Most computers and smartphones offer complete, full-disk encryption as an option. It is often safer and easier to use full disk encryption than to manage just a few individually encrypted files. Apple's OS X, Linux and high-end versions of Windows all have built-in full disk encryption, but it is usually not turned on by default.

Full-Disk Encryption Examples Window: Bitlocker Mac OS: FileVault Android and iOS: both have have full-disk encryption through their general settings

Passwords It is sometimes recommended to generate passwords with the assistance of a password management software. However, moving forward you might need a password manager as it gets harder to remember multiple passwords that are 10 random characters long As an alternative it is recommended to create a password that contains 5 to 6 random words. The longer a password is, the longer it will take an adversary gain access. The following comic explains this eloquently.

Open Source Open-source software (OSS), Free and Open Source Software (FOSS) is a type of computer software in which source code is released under a license in which the copyright holder grants users the rights to study, change, and distribute the software to anyone and for any purpose. Open-source software may be developed in a collaborative public manner. Open-source software is a prominent example of open collaboration.

Largest open-source-software projects and contributors include Mozilla Foundation, Wikimedia Foundation, Wordpress Foundation

Protecting your Data in Motion

The diagram shows unencrypted data in transit—which is often the default setting for internet service providers. Along the way, a cellphone tower passes the message along to company servers and then to another cellphone tower, which can each see the unencrypted “Hello” message. All computers and networks passing the unencrypted message are able to see the message.

Transport Layer Security (TLS) Transport-layer encryption, also known as transport layer security (TLS), protects your data as they travel from your device to the app’s servers and back.

Helps prevent against someone spying on the network you are in.

Servers simply put are someone else’s computer.

TLS example: HTTPS Notice the lock and “https://” beside the web address for riseup.net HTTPS is an example of transport-layer encryption that we encounter frequently on the web. It provides more security than unencrypted HTTP. Why? Because the servers of the HTTPS website you are browsing can see the data you enter while on their site (for example, messages, searches, credit card numbers, and logins) however this information is unreadable to eavesdroppers on the network.

Transparency Because your messages can be seen by (and are often stored on) company servers, they may be vulnerable to law enforcement requests or leaking if the company’s servers are compromised.

Big Tech is not your friend. At the end of the day, these companies develop proprietary software, that only they know what is under the hood.

The diagram shows transport-layer encryption. On the left, a smart phone sends a green, unencrypted message: “Hello.” That message is encrypted, and then passed along to a cellphone tower. In the middle, the company servers are able to decrypt the message, re-encrypt it, and send it along to the next cellphone tower.

End-to-End Encryption End-to-end encryption ensures that a message is turned into a secret message by its original sender, and decoded only by its final recipient. Other forms of encryption may depend on encryption performed by third-parties. That means that those parties have to be trusted with the original text. End-to-end encryption is generally regarded as safer, because it reduces the number of parties who might be able to interfere or break the encryption.

The diagram shows end-to-end encryption. The message is encrypted, and then passed along to a cellphone tower and company servers. At the end, the other smartphone receives the encrypted message, and decrypts it to read “Hello.” Unlike with TLS, your ISP servers are not able to decrypt the message; Only the endpoints have the keys to decrypt the message.

End-to-End Examples

PGP (Pretty Good Privacy) or GNU (Gnu Privacy Guard) email encryption that has been around since the early 90s.

Other Signal - a security messaging tool used for voice calls, video calls, chats and file sharing (available for iOS and Android)

Virtual Private Network (VPN) A VPN is a method for connecting your computer securely to the network of an organization on the other side of the Internet.

When you use a VPN, all of your computer’s Internet communications are packaged together, encrypted and then relayed to this other organization, where it is decrypted, unpacked, and then sent on to its destination.

VPN

What VPNs Don’t Do A VPN protects your internet traffic from surveillance on the public network, but it does not protect your data from the private network you’re using.

Most commercial VPNs require you to pay using a credit card, which includes information about you that you may not want to disclose to your VPN provider, as it can easily be linked back to your identity.

What VPNs Don’t Do You should also take note of the countries in which the VPN provider does business. The provider will be subject to the laws of those countries, including laws governing government requests for information. Laws vary from country to country, and sometimes those laws allow officials to collect information without notifying you or giving you an opportunity to contest it. The VPN provider may also be subject to legal requests for information from countries with whom the countries in which it operates have a legal assistance treaty.

VPN (cont.)

Compiled list of popular VPNs: https://docs.google.com/spreadsheets/d/1ijfqfLrJWLUVBfJZ _YalVpstWsjw-JGzkvMd6u2jqEk/edit#gid=231869418 Alternative Tor Project: https://www.torproject.org/

Cell-Site Simulators/ IMSI Catchers Cell-site simulators, also known as Stingrays or IMSI catchers, are devices that masquerade as legitimate cell-phone towers, tricking phones within a certain radius into connecting to the device rather than a tower.

It is difficult for most people to know whether or not their phone’s signals have been accessed by an active cell-site simulator, and it is impossible for anyone to know if their phone’s signals have been accessed by a passive IMSI catcher.

Cell-Site Simulators/ IMSI Catchers Once your cellular device has connected to a cell-site simulator, the cell-site simulator can determine your location and trigger your device to transmit its IMSI for later identification.

If the cell-site simulator is able to downgrade the cellular connection to a 2G/GSM connection then it can potentially perform much more intrusive acts such as intercepting call metadata (what numbers were called or called the phone and the amount of time on each call), the content of unencrypted phone calls and text messages and some types of data usage (such as websites visited).

So, which one?

Important questions to ask to decide whether you need transport-layer encryption or end-to-end encryption are: Do you trust the app or service you are using? Do you trust its technical infrastructure? How about its policies to protect against law enforcement requests?

If you answer “no,” to any of these questions, then you need end-to-end encryption. If you answer “yes” to them, then a service that supports only transport-layer encryption may suffice for you—but it is generally better to go with services that support end-to-end encryption when possible.

Fallbacks Encryption is not a cure-all. Even if you are sending encrypted messages, the message will be decrypted by the person with whom you are communicating. If your endpoints (the devices that you are using for communication) are compromised, your encrypted communications can be compromised.

Additionally, the person with whom you are communicating can take screenshots or keep records (logs) of your communication.