You probably know cybersecurity is a marathon, not a sprint. Law enforcement officials log the big miles. Fortunately, more and more consumers are joining the race.
We talked to Sgt. Justin Feffer, a Los Angeles-based law enforcement officer and cybercrimes investigator, to bring us up to date about cyber threats and what you can do the help protect against them.
Here’s what he had to say.
5 cybercrime questions answered
What does the future of cybercrime and security look like for people afraid of having their information stolen?
Unfortunately, the future looks very similar to our present. I have 14 years of experience dedicated to combatting cybercrime. I still see the same fundamental security flaws contributing to the theft of our most sensitive data. I don’t see the situation improving.
What should internet users be aware of when it comes to protecting their online information long-term? (e.g., cloud storage, permanent email addresses, etc.)
Be sure to do the due diligence needed to pick the right solution. There is very good literature available, including white papers and reviews by researchers and journalists with proven reputations. Don’t pick a solution based upon an ad—particularly a pop-up ad!
Consult with experts who are familiar with the technology you are considering. Most importantly, make sure that the solution you pick has robust security features including multi-factor authentication.
In your opinion, what are the most common cybercrimes that are the easiest to help prevent?
Business email compromise (BEC) and hacked accounts, due to the theft of stolen passwords, are the two most common and easiest cyber-crimes to prevent.
BEC attacks involve the use of targeted emails asking the victim to wire funds for a fraudulent transaction. BEC works because the victim believes the email with the instruction is from someone with authority.
In the most typical attack, the suspect poses as the CEO of the company and sends an urgent email directing the accounts payable manager to pay an invoice via wire transfer by the end of the day. The invoice is fraudulent, and the suspect steals all of the funds sent via the wire transfer.
Businesses must adopt policies prohibiting wire transfers to unfamiliar accounts based upon emailed instructions.
Accounts are most commonly hacked by suspects who use phishing emails to trick the victims into divulging their account passwords. The password phishing attack usually attempts to induce victims to click on a link crafted by the attacker.
These attacks convey a sense of urgency—warning the victim that unless they perform the requested action they will be locked out of their account or otherwise suffer some adverse result. Victims that click on the link are taken to a website that requests their personal information including their usernames and passwords.
You should never rely solely upon a username and password to secure an account. Implement multi-factor authentication (commonly referred to as two-step verification) to secure your accounts. That way even if a password is stolen the suspect won’t be able to log into the account without access to the second factor.
Have computers made finding cybercriminals easier or more difficult? Why?
Computers and modern technology have proven a double-edged sword in the fight against crime.
Modern surveillance cameras, license plate readers, geolocation services and other technological tools have proven to be extremely helpful to law enforcement in finding criminals of all types.
On the other hand, tools such as TOR (The Onion Router), dark web marketplaces, crypto currencies, robust mobile device encryption, and encrypted communications services have created extreme challenges to law enforcement.
These types of technology can often make it impossible for law enforcement to obtain needed evidence even if they have the proper legal authority and compelling need.
For example, a suspect could have 1 million stolen credit cards on his iPhone, and even if law enforcement seizes the phone and has a search warrant to search the phone, they will not be able to access the phone unless the user provides the passcode.
This type of problem was demonstrated very dramatically in the 2015 San Bernardino Inland Regional Center terror attack when the FBI attempted to analyze the terrorist’s locked iPhone.
Do you recommend any third-party tools individuals can use to privately access the internet, transfer data, or securely delete data?
I find that the most important third-party tools include the following:
Reputable Virtual Private Network (VPN) services allow users to safely access the Internet when working remotely from known secure networks.
Reputable cloud-based file transfer services allow users to safely transfer files to fellow employees and colleagues.
Reputable full disk encryption tools can be used to encrypt portable media such as USB drives to prevent data theft if the devices are lost or stolen.