Can I Sign New Mexico Banking Form

Can i industry sign banking new mexico form secure

whatup s'mores I'm Shannon Morse welcome to my youtube channel all about travel and technology this month I am doing a little miniseries for cybersecurity Awareness Month which is in October yay who doesn't want to be more cybersecurity aware who wants to protect their security and privacy online I know I do we're gonna talk a little bit about sim swapping what it is and how you can protect yourself from it today which I am super excited to share some information on and in honor of cybersecurity Awareness Month I have teamed up with CrashPlan for small business to share this video series about online security and privacy the number one type of attack that I have reported on this year has been ransomware attacks they are all over the place this is when an attacker holds your data hostage and forces you to pay up before you can actually get access to that data again if you are a small business then protecting your data must be a top priority you need to protect that data just as much as I need to protect my digital files my photography files and my editing templates which I use every single day for my small business all of that data would be locked up if I was faced with a ransomware attack and I would have no way to do my job CrashPlan offers you peace of mind with tons of features built into the cloud-based data protection service data can be stored with no restrictions on file size and no additional charges for space so if you have an external hard drive or a network attached storage device guess what those you can backup two backups are continuous with customized file retention options that fit your needs CrashPlan uses 256 bit AES data encryption at rest and they support HIPAA compliance needs CrashPlan is compatible on file servers on Windows on Mac and on Linux and you can cancel anytime plans cost 10 dollars monthly per device it doesn't matter if you want to cover a hundred gigs 250 gigs if you want to backup a terabyte or 2 terabytes all of that is covered under that $10 monthly per device fee so sign up using the link below for a one month free trial don't let ransomware hold you hostage make sure you have a plan with crash plan want to thank crush plan so much for their support of my channel and for supporting cybersecurity Awareness Month so what is sim swapping well luckily I have two phones here that I can use as an example so I can have an attacker phone and my phone so on your phone you have a sim card probably you have your physical device and you have your phone number which seems to be tied to your SIM card if an attacker is somehow able to steal that data by getting a mobile carrier to switch your phone number over they could switch your phone number over to their own SIM card and their own device which means that they will start receiving text messages phone calls and anything else that's related to your phone number your device would stop receiving your text messages your phone calls and anything else and it would basically tell you that you no longer have service with that phone number on this phone so how is it an attacker able to do this because they should not be able to do this well it all comes down to social engineering this is where an attacker is able to call up a customer service representative at t-mobile AT&T wherever it might be a mobile carrier and they basically pretend to be you they say something like uh my phone got stolen and I bought a new one with a SIM card and I need to transfer the phone number wink-wink over to my new phone and then of course the customer service rep wants to help you they want to get you off the phone so the sooner they can do that the better they'll try to help you fix your phone which is actually the attackers phone so they will try their best to get that phone number transferred over and authenticate who you are and if that attacker has access to any data that could authenticate them as being you and let them steal your identity your mobile phone identity then they can steal your phone number so why in the world would they want to do this well it all comes down to two FA and one-time codes two FA is two-factor authentication and one-time codes are one-time codes that are sent to you so with two-factor authentication codes that are sent via text which you would usually receive your attacker will now receive on their phone instead so they would be able to get into your account if they also had your password or they might be able to reset your password with just the two f8 code now if you don't have two factor authentication turned on which you should even if it's just tech space you should still have two f8 turned on then they could use your phone to authenticate them as you on social media platforms so if a social media platform if you forget your password and then it says well we can send you a one-time code to your phone number to authenticate that you are who you say you are then the attacker would receive that one-time code and then they could login and reset your password for example now in some cases attackers don't even need to rely on social engineering because guess what they hired somebody that works at that mobile carrier to give them the data that they want they pay somebody so that they have an Inside Man or woman so these I like to refer to as insider threats now luckily there are some things that you can do to protect yourself from sim swapping unfortunately there is no surefire way to protect yourself a hundred percent and ensure you will never be a victim to sim swapping because it could always happen you can protect everything in your life but if a customer service rep or an inside threat is still there then they might still find a way to transfer your phone number over to an attackers phone but I am definitely an advocate of protecting yourself as much as you can even if the company behind the mobile carrier whatever company you signed up with even if they don't agree that they should be protecting everything I think that I should as a consumer so my first tip is put a pin passcode on your account and on your SIM card so in this case the attacker or the hacker would need to know what the pin or the passcode is before they can get anything transferred or anything changed on your mobile carrier account so when they call in if a customer service rep is like oh well you have a passcode on your account what's the passcode they would need to know what that passcode is now this does not necessarily always work if there's an insider threat for example or if the customer service rep really just wants to get you off the phone and really just wants to help you they might try to clue you in to what your past is which is not a good thing for customer service reps to do the same thing goes for security questions a lot of times companies might set security questions that allow you to authenticate who you are for example mother's maiden name or name of your first car or name of your first pet or whatever it might be so a lot of times I suggest to people to use weird really strong authentication answers for things like that if you can't just disable them altogether so for example if I was talking to customer service and they said what's your mother's maiden name my answer this is not my real answer but my answer would be something like a favorite verse from one of my favorite songs a scrub is a guy that thinks he's fly can't get no love from me now obviously that is not my mother's maiden name but it's also not something that would be easily guessed unless an attacker somehow knew what your favorite verse from your favorite song was and then you might want to choose something different that is completely off the wall that nobody could guess it I have a third tip and this one has to do with two-factor authentication not all companies that you are going to do business with online offer good two-factor authentication options now while you still should sign up for two fa if they have text based authentication if they offer something better like at based tokenized hardware tokens as a two-factor authentication protocol then you should switch to that immediately in the case of app based 2fa this means that they send you a code to an application which is installed on your phone via iOS or Google Play this app based token changes every 30 seconds and it is tied to your phone as opposed to your phone number there's a whole bunch of different applications that you can choose from that are free they are readily available and they are cross-platform and that includes Google Authenticator that includes authy there's a whole bunch I prefer Google Authenticator and of--they as the ones that I normally use luckily a lot of companies have started taking this a lot more seriously because of sim swapping so they have started implementing app based or Hardware tokens as an option so for what it's worth app based is a really really excellent option however if you want to take it a step further you can also do hardware tokens a physical hardware tokens such as the Yubikey which is the one you see here enables two-factor authentication over a hardware device so you have to plug this thing into your phone or plug it into your desktop your laptop before you can actually access your account so that to a PHA code that is kind of built into that hardware token it changes to and it will automatically generate one whatever you plug it in so with that hardware token that means that you would not only have to know something which is your password but you would also have to have something in your possession which would be the physical hardware token now that means that if there was an attacker online who was trying to do a sim swap it wouldn't necessarily matter as much because they would not have access to that hardware token unless they were able to physically get it from you and steal it that's why physical hardware tokens for two-factor authentication are the best of the best that you can get now for my fourth tip I would definitely recommend either making notes offline or mentally of all of the data that a company might use to authenticate you or in this case an attacker could use to authenticate themselves as you with the company so that could include your date of birth any credit cards that are associated with the account a physical address or a mailing address or an address that you use on the company's account your name or your screen name or email addresses associated with that account security answers a pin code basically any of that information that they might use against you be aware of phishing scams phishing scams happen all the time over email I have gotten phishing scams sent to me attackers send these emotionally triggering scams over email all the time they try to get you to click on something and log in to a page that might look like the real deal for a brand like your mobile carrier but in actuality are a website that they created so that they can steal your password and your email address or your username and your 2fa code SMS is not necessarily encrypted that's my sixth tip so since SMS is not encrypted on its own a lot of times you will want to use an encrypted platform like signal or whatsapp or iMessage all of these are third-party services that allow you to send text messages back and forth which means that when you are receiving those two-factor authentication codes from your brand from the company that you're trying to log into on their website or or wherever it is that means that that 2fa code is encrypted so if somebody was trying to snoop on your data or sleep on your phone they would not see it in plain text because it is already encrypted and it just looks like gibberish so the core problem here is something that we have not fixed as a society it's the fact that we look at phone numbers as being a part of your identity that is allowed to authenticate you because we tie our phone numbers to our identity that opens us up for vulnerabilities it is especially bad if your phone number is widely accessible or if it is something that is shared with a lot of folks now one thing that a lot of folks do including myself because I'm all true paranoid is create a second phone number that nobody has access to it's a secret phone number that I only use for those two-factor authentication codes this phone number is used for platforms that just don't allow me to set up an account without having a phone number so that way even though they're associating my identity with a phone number nobody else knows that identity nobody else knows that phone number which means I'm just a little bit more protected you might look at that idea and think oh my gosh I can't afford another phone number I can't add another line to my current mobile carrier Google Voice is free and it doesn't necessarily mean that you have to have a phone either you can set up Google Voice to just send messages to your computer now one thing I personally don't do is forward Google Voice text messages or Google Voice messages to my actual phone number phone on here because if somebody stole this phone number they would also get those transfers of text messages and phone calls so I don't forward anything over I just keep it completely separate we need as an entire society to separate ourselves from our phone numbers yes it's great stay connected yes they're awesome for uploading stuff and all those good things with social media but tying your identity to a phone number is opening us up to a realm of vulnerabilities it's opening us up to a realm of attacks and unfortunately so many companies just don't see that pattern even though sim swapping has become so prevalent so I'm really curious if you are planning to use any of these or all of these options and tips as something to better protect yourself from sim swapping and if you have any tips that I didn't mention I would love to hear those down below in the comments and don't forget to Like and subscribe if you would like to see more videos just like this one again I'm Shannon Morse thank you so much to my s'mores I will see you next time bye [Music]