DO: Use Unique Passwords for all Online AccountsWhen shopping online, and the website requires you to create an account, use a unique password for every site, and do not use the same password as banks, social media, or other retailers. If one location is breached by a cyberattack, then the password cannot be re-used at another location to propagate a crime. Understandably it is difficult to remember all the passwords and users should consider a password manager like Apple’s iCloud Keychain to help create random passwords and remember them automatically.
DO: Examine all “Too Good to be True” Email OffersThe most common attack vector for hackers today is phishing emails. Be aware of fake emails from popular websites with incredible deals. They are probably just a scam linking you to a fake website that looks like the real thing, just to steal your credentials (password) and possibly your credit card too. Always check the URL (link) in the email and make sure it goes to the correct site before clicking on it. You can easily see it by hovering over the picture or right clicking and selecting copy link. Then you can paste it into a browser and verify it is real verses clicking on the link in the email.
DO: Look for Secure Website EncryptionWhen visiting a web site for a purchase, make sure that when you click on the cart and check out, the website is encrypting the traffic using HTTPS. This ensures no one can snoop on the data you are transmitting or receiving. Checking to make sure the site’s communications are encrypted is as simple as looking for a “pad lock” in the URL browser address field or seeing if HTTP or HTTPS is present with a red hash. If you see the later, avoid purchasing any items since the vendor is not protecting your transactions electronically with encryption. This typically happens with smaller merchants or fake websites designed to steal your information.
DO: Update all Security Patches Before ShoppingBefore surfing the web for the best deals, make sure your computer, laptop, tablet, and even cell phone are up to date with the latest security patches and operating system versions. Using search engines to find deals can unfortunately display malicious sites that can take advantage of operating system, browser, and application vulnerabilities like Adobe Flash and Oracle Java. Surfing to the wrong page with an exploit can cause havoc for your system; keeping up to date on patches helps ensure that a fake deal does not compromise your device.
DO: Beware of Fake Shopping AppsBeware of fake shopping applications for use on your phones and tablets. Both Google and Apple are removing fake shopping applications that attempt to steal information and present fake advertisements from their app stores. These applications can be difficult to spot but here are a few clues:
- If it is an application from a major retailer and has little to no reviews, it is probably a fake. Most major retailers have applications that have been downloaded thousands of times. New fake ones just do not have the credibility in terms of reviews documented and are a simple clue.
- The developer’s name is in a foreign language or is listed by an individual and not a company.
- The application requests permission to access information on your device like photos, text messages or contacts that it really should not have.
- The application logo uses different colors or is not quite the same as the vendor you are looking for. For example, a Starbucks logo is always green and white. Variations would indicate a fake application trying to mimic the real deal.
DO NOT: Store Your Credit Card on WebsitesIf a website asks if you would like to store your credit card for future purchases, decline the setting. If a breach occurs into their credit card environment, then your card could be re-used by a cyber thief. Some websites like Apple, Amazon, and Microsoft require you to store your card credit in order to purchase products since re-occurring charges can occur for applications or music. Unfortunately, this is a risk we must accept in order to use their services, but in general, if there is no need to store your credit card, then don’t do it. Cyber Monday can offer some huge savings for consumers during the holiday season, and also presents an opportunity for merchants to deliver on customer service. Simple steps can protect you as a consumer and a merchant from the modern threats we face in this next generation digital economy. If you are a merchant and want to better understand the status of your application vulnerabilities or the state of your enterprise passwords, contact us today for a health check!
Morey J. Haber, Chief Security Officer, BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored three books: Privileged Attack Vectors, Asset Attack Vectors, and Identity Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.