1. Introduction

This document serves as a personal threat model focused on cybersecurity in the area of cryptocurrencies. Its aim is to identify potential threats and vulnerabilities and propose measures to minimize them.

2. Identification of Actors and Assets

Actors

• Hackers
• Regulatory Bodies
• Competitors
• Close Associates

Assets

• Crypto Wallet
• Transaction History
• Investment Strategy

Actors and Assets: Detailed View

In this part of the threat model, it is crucial to identify in detail the actors who could pose a threat and the assets they might want to compromise. Each actor and asset should be elaborated on, including motivations, capabilities, and methods of attack.

Hackers

• Motivation: Financial gain, reputational reasons, ideological beliefs
• Capabilities: Malware, ransomware, phishing attacks
• Attack Methods: Wallet infiltration, keylogging, SIM swapping

Regulatory Bodies

• Motivation: Oversight and regulation, ensuring compliance with laws
• Capabilities: Legal measures, access to public and private databases
• Attack Methods: Court orders, asset seizure, audits

Competitors

• Motivation: Gaining competitive advantage, financial gain
• Capabilities: Industrial espionage, social engineering
• Attack Methods: Infiltration, misinformation, market manipulation

Close Associates

• Motivation: Personal interests, possible financial gain
• Capabilities: Access to personal devices, knowledge of personal information
• Attack Methods: Using known passwords, accessing unsecured devices

Assets

Crypto Wallet

• Importance: High
• Attack Types: Phishing, malware, physical access
• Mitigations: Hardware wallet, 2FA, strong passwords

Transaction History

• Importance: Medium
• Attack Types: IP tracking, exchange compromise
• Mitigations: Use of VPN, decentralized exchanges

Investment Strategy

• Importance: Medium to High
• Attack Types: Social engineering, industrial espionage
• Mitigations: Limiting information sharing, using encrypted communication

3. Vulnerabilities

Using Online Wallets with Low Security

• Description: Online wallets are often targeted by attacks, especially if not properly secured.
• Actors: Hackers, competitors
• Attack Types: Phishing, brute-force attacks
• Mitigations: Switching to a hardware wallet, using 2FA

Unsecured Wi-Fi Network

• Description: Using unsecured Wi-Fi networks can allow attackers easy access to your data.
• Actors: Hackers, close associates
• Attack Types: Man-in-the-middle attacks, sniffing
• Mitigations: Use of VPN, connecting only to trusted networks

Using Outdated Software

• Description: Old or outdated software may contain vulnerabilities that can be exploited for infiltration.
• Actors: Hackers, regulatory bodies
• Attack Types: Exploitation of known vulnerabilities
• Mitigations: Regular software updates, application of security patches

Insufficient Two-Factor Authentication (2FA)

• Description: Absence or poor implementation of 2FA can lead to easy access to sensitive data.
• Actors: Hackers, close associates
• Attack Types: Brute-force attacks, SIM swapping
• Mitigations: Activation and proper configuration of 2FA

Insufficient OPSEC (Operational Security)

• Description: Insufficient OPSEC may include poor handling of passwords, keys, and other sensitive data.
• Actors: All
• Attack Types: Social engineering, phishing
• Mitigations: Cybersecurity education, use of a password manager

4. Attack Vectors

Phishing Attacks

• Description: Attacks that aim to obtain sensitive information through fraudulent emails or websites.
• Actors: Hackers, competitors
• Vulnerabilities: Insufficient OPSEC, using online wallets with low security
• Mitigations: Cybersecurity education, use of 2FA

Man-in-the-Middle Attacks

• Description: Attacks where the attacker eavesdrops on or manipulates communication between two parties.
• Actors: Hackers, regulatory bodies
• Vulnerabilities: Unsecured Wi-Fi network, outdated software
• Mitigations: Use of VPN, encryption of communication

Social Engineering

• Description: Manipulating people to obtain sensitive information or system access.
• Actors: Competitors, close associates
• Vulnerabilities: Insufficient OPSEC, insufficient 2FA
• Mitigations: Cybersecurity education, limiting information sharing

SIM Swapping

• Description: An attack in which the attacker gains control of the target’s SIM card.
• Actors: Hackers
• Vulnerabilities: Insufficient 2FA, insufficient OPSEC
• Mitigations: Use of hardware-based 2FA, high level of OPSEC

5. Measures

Using a Hardware Wallet

• Description: Hardware wallets provide a high level of security for storing cryptocurrencies.
• Actors: Hackers
• Suitable for: Protecting the crypto wallet
• How to Implement: Purchase a reputable hardware wallet such as Ledger or Trezor and transfer your cryptocurrencies to it.

Using a VPN

• Description: A VPN provides anonymity and security when browsing the internet.
• Actors: Regulatory bodies, hackers
• Suitable for: Protecting transaction history, securing Wi-Fi
• How to Implement: Choose a trusted VPN provider and enable it when connecting to the internet.

Activation and Proper Configuration of 2FA

• Description: Two-factor authentication adds an additional layer of security.
• Actors: Hackers, close associates
• Suitable for: Protecting the crypto wallet, securing online accounts
• How to Implement: Enable 2FA on all important accounts and use an app like Google Authenticator or a hardware key like YubiKey.

Cybersecurity Education

• Description: Education and awareness are key to recognizing and preventing attacks.
• Actors: All
• Suitable for: Protection against all types of attacks
• How to Implement: Take cybersecurity courses, read current news and articles, and participate in webinars and conferences.

6. Conclusion

This personal threat model is the first step toward ensuring my cybersecurity in the field of cryptocurrencies. I plan to regularly update this document and implement new security measures according to the evolving threat landscape.
“`

The post Personal Threat Model appeared first on DIGITAL SELF-DEFENSE.

Video sérii naleznete na tomto odkazu

Jednotlivé díly:

The post Videosérie Digitální Sebeobrany appeared first on DIGITAL SELF-DEFENSE.

Here are a few tips on how to reduce that risk.

1. Set up automatic locking

   Never leave your phone or laptop unlocked in public places, for example on a table in a restaurant, café or bar.

   Set your phone to lock automatically after a reasonably short time. One minute should be about right: not too long, but also not so short that it makes normal use annoying.

   Get into the habit of locking your laptop every time you step away from it. Even if you only get up from your café table to get some sugar. On Windows and most Linux distributions, you can use the Win + L keyboard shortcut. On a MacBook, Command + Control + Q should do the same.

2. Use a good lock

   When travelling, use fingerprint unlock or Face ID for your phone or laptop whenever possible. During the rest of the year, I usually recommend using a sufficiently long and unique password or PIN. But on holiday, the bigger problem is often the number of cameras around you and tourists filming everything they see. It is easy not to notice that someone is watching or recording you while you type your password.

   If you do use a password or PIN, avoid the obvious ones like “password” or “iloveyou”. PINs like “0000” or “1234” are not a great idea either.

   Unlocking your phone with a pattern, by connecting dots on the screen, can also be risky. Your fingers leave traces on the display.

   Tip: Use passwords in Czech or Slovak.

3. Be careful with public Wi-Fi networks

   You know how it goes. You land in a country outside the EU and need to read an e-mail, post a photo on Instagram or find accommodation. And you do not really want to pay for data roaming. So, right there at the airport, you search for the nearest public and free Wi-Fi network and connect to it.

   And guess what? Hackers know that people do this at airports. It is not difficult for them to create a Wi-Fi network called something like “Airport Free Internet” from their own device. Then they just wait for someone to connect and start collecting data.

   The same applies to restaurants and cafés. That is why it is usually better to pay extra for roaming. And if that is really not possible for some reason, at least use a VPN. It encrypts your data so that an attacker cannot read it.

4. Do not tell the world that your home is empty

   The urge to show your friends that you are enjoying your holiday can be hard to resist, but try to wait. A photo from Bibione or Mont Blanc can be a great tip for a burglar, who will immediately know that no one is home to disturb them.

   You can upload photos to Instagram or Facebook after you return. And you will probably enjoy your holiday without social networks much more anyway.

   Tip: Be offline. It is nice

5. Be careful with photos of children

   Photos of your children from the beach that you share on social networks may end up on websites used by paedophiles. Such photos can be a strong attraction for them. If you want to share these photos with family or friends, send them by e-mail, or even better, through a messenger app, ideally via Signal Messenger.

6. Enable disk encryption

   If you lose your laptop during your holiday, it is definitely better if the data on the disk cannot be read by someone who might misuse it.

   On Windows, you can use BitLocker. On Apple devices, there is FileVault, and on Linux there is LUKS. Alternatively, you can use the open source software VeraCrypt.

7. Border checks and adult content

   In some countries, border officers may ask you for passwords to your devices or even your social media accounts. If you are travelling to such a country, be careful about what you have stored on your device. There are countries where saved adult content may get you into trouble.

   Many people travelling to these countries use a different, “clean” laptop and phone.

8. Back up before your holiday

   If you lose your device during your holiday, a backup of your files or contacts will definitely come in handy. Do not underestimate it.

If your phone or laptop is actually lost or stolen, here are a few tips on how to minimise the damage.

The post 8 tips for a digitally safer holiday appeared first on DIGITAL SELF-DEFENSE.

This increases the risk of losing or stealing these devices. And because the person who has just found out that he has lost his device often panicking (it’s a very stressful situation) and in the first moments is unable to calmly realize what needs to be done, it is good to have these steps ready.

Here is the checklist of steps that should follow after losing or stealing your phone or laptop. You can download it here (pdf), print it and check steps out.

1. Find location
   • Android: android.com/find
   • iPhone: icloud.com/find
2. Try to send sms to your phone
   • If messages appear on the display, you can give a message to a potential finder
   • iPhone: Lost Mode
3. Contact IT
   • It is necessary to block access to internal systems of the company or organization for accounts
4. Remote backup
   • If your phone has a remote backup application, back up now.
5. Lock and wipe
   • Android: At android.com/find activate lock and erase features
   • iPhone: At icloud.com/find select your device and wipe it.
6. Sign out of accounts
   • From another device, log in to your accounts where you are signed in lost device and log off those accounts on the lost device
     • Facebook, Twitter, Gmail, Alza etc.
     • Ask others to temporarily remove you from conversation groups (e.g., Signal, Telegram, Threema, Whatsapp, Slack, etc.) where sensitive information may occur (yours or others).
7. Change passwords on accounts that were logged on a lost device
8. Send your cryptocurrencies to the new address
   • If you have a wallet backup, restore it, create a new one, and forward there your cryptocurrencies
9. Contact your phone operator to lock SIM card
10. Block payment cards stored in device applications
    • Your credit cards may be stored in some apps or websites
11. Notify friends and/or customers
    • Your accounts may be misused for phishing attacks, tell your friends about this possibility

The post Lost or stolen phone/computer appeared first on DIGITAL SELF-DEFENSE.