Title: 4.5 Personal Security
Course: Information and Communication Technology: Module B > Section: Section 4 - Security Basics

4.5.1 Personal Security

Passwords are the first and best line of defense when connecting to secure sites. Here is a list of guidelines that should ALWAYS be followed:

- For password to remain secure NEVER write them down but committed to memory. A password manager can be used to help.
- Password should also be of sufficient length and complexity that attacker cannot easily guess it.
- Passwords should optimally have at least 15 characters but 6-8 characters is average.
- Passwords should be a random combination of uppercase and lowercase letters, numbers, and special characters.
- Passwords should be replaced with new passwords at least every 30-60 days.
- Passwords should not be reused for 12 months.
- The same password should not be duplicated and used for multiple accounts.
- NEVER leave passwords blank.
- Users have multiple accounts for computers at work, school, and home, e-mail accounts, banks, online Internet stores, and each account should have its own password.

4.5.2 Personal Security

Social engineering relies on deceiving someone to obtain secure information. Protect yourself at all times. Be on the lookout and don’t let your guard down. Physical and electronic mail fraud is a huge concern today. Unsuspecting and unprepared individuals are duped out of millions of dollars every year. Here are a few things you can do to protect yourself from being an unwilling participant:

- Legitimate businesses never call asking for personal information.
- Never give out a password or any personal information unless you are 100% sure the person asking is legitimate. Always ask for a call back number to give time to check out the caller.
- Always ask for the ID of the unknown person.
- Restrict access of unexpected visitors and escort all visitors through your home or company.
- Never respond to an e-mail or to a website that instructs the user to update personal information. Legitimate organizations never ask.
- Don’t respond to e-mails that look like Web sites. Phishers often include the logo of the vendor and otherwise try to make the e-mail look like the vendor’s Web site as a way to convince the recipient that the message is genuine. The presence of logos does not mean that e-mail is legitimate.
- Fake sender’s address – Because sender addresses can be forged easily, an e-mail message should not be trusted simply because the sender’s e-mail address appears to be valid.
- Generic greeting – Many phishing e-mails begin with a general opening such as “Dear Member”.
- Popup boxes and attachments – Legitimate e-mails from vendors never contain a popup box or an attachment.
- Urgent request – Many phishing e-mails try to encourage the recipient to act immediately or else their account will be deactivated.