ThePagey posted:

So this question is going to be pretty vague, if only because I have literally 0 experience with the practical application of things beyond theory at this point and am going to be spending the next few months learning as I go, but I'm transitioning into a new role modernizing small business' security solutions and am curious what you guys think the best practices to implement might be. Assume I'm a complete loving idiot, if you don't mind (because I am),

I'm mostly looking for a suite of solutions that'll cover most of the things they'll need, given that most of the systems I've seen in small businesses pretty much boil down to what you'd find in a tech illiterate SOHO, things like fresh out of the box firewalls, factory setting routers, no intrusion detection software, etc etc.

This is probably a pretty broad question, but I trust you guys (lol) more than I trust just loving about on the internet looking for the best solutions blindly, so any help would be appreciated.

ETA: Also if anyone has any links or something that might be useful instead, I'll totally take those too.

Also ETA: I figure it's probably a good idea to give some context into what I'm familiar with. I've done IT administration with small businesses before in smaller roles, though it's mostly boiled down to building and configuring desktops, simple networks, and pretty simple help desk style troubleshooting. Tier 1 dabbling in more specialized stuff. I'm currently in a degree program for Cyber Security and Information Assurance, which is why I say I understand most of the theory and some of the fundamentals, though I haven't had any practical experience configuring secure environments just yet.

I've recently gotten some pretty dope offers from some friends-of-friends to do some IT work for them, and figure this is a good way to get some of that practical training, but seeing as they handle things like social security numbers and do credit checks, I don't want to just run in without doing research first and end up getting them hosed over.

I figure, bare minimum, I need to have a conversation with them about the basics of social engineering and best practices they can perform without much issue (like password strength, privacy filters, locking their loving computer screen when they step away), but seeing as most of these people fall into the "Click the phishing link because it offers to save them money" category of internet user, I want to try and make it as hands-off and idiot-proof as possible.

Saukkis posted:

This blog post might align with the interests of this thread.

Vectorized Emulation: Hardware accelerated taint tracking at 2 trillion instructions per second

Biomute posted:

What would be a reasonably secure way to do email that does not require much from the receiver (no PGP etc)? I want to send an email and not have it be easily traceable back to me as the the sender for a third party monitoring the receiver. I don't mind if the receiver knows who I am or anything.

rafikki posted:

Public computer where you sign up for a free email account?

rafikki posted:

Public computer where you sign up for a free email account?

Diva Cupcake posted:

It’s the 10 year anniversary of MS07-067.

Potato Salad posted:

Don't touch computers

Potato Salad posted:

Don't

Volguus posted:

gently caress Trustwave.

18 Character Limit posted:

rafikki posted:

I'd like to hear more

rafikki posted:

free email account

EssOEss posted:

I notice that a few email services now require phone number verification unless they can otherwise associate you with a known identity via tracking cookies. Protonmail has completely anonymous registration, though.

Double Punctuation posted:

Probably because if they didn’t, they’d be blacklisted, and a lot of their outgoing e-mails would wind up in the receivers’ spam boxes.

Biomute posted:

What would be a reasonably secure way to do email that does not require much from the receiver (no PGP etc)? I want to send an email and not have it be easily traceable back to me as the the sender for a third party monitoring the receiver. I don't mind if the receiver knows who I am or anything.

OSU_Matthew posted:

Go the Maniford route, don't send the email, just save it in the drafts folder and send the login information instead

Is not securing the email per se, but if you're just shooting to send it from an alternative email address, VPN service to mask your public IP + private browsing session (not cookied and traceable back to you), + temporary email service like inboxbear, or of all things, Yahoo aliases/disposable email addresses. The Yahoo one is actually fairly decent, use a Google voice number or something to register for the Yahoo email.

Biomute posted:

There are no crimes involved. It just seems like a conscientious way of doing it.

quote:

I want to send an email and not have it be easily traceable back to me as the the sender for a third party monitoring the receiver.

OSU_Matthew posted:

Go the Maniford route, don't send the email, just save it in the drafts folder and send the login information instead

CLAM DOWN posted:

suuuuuuuuuuuuuuuuure

CLAM DOWN posted:

suuuuuuuuuuuuuuuuure

Inept posted:

They're probably just trying to give someone a heads up that they're being cheated on but want to remain anonymous.

Although thinking about it, just using a junk account you make at home is sufficient unless you're trying to warn Melania that Donald's been cheating and don't want the feds to get you.

Volmarias posted:

Seriously, unless the person you're sending this to can subpoena your provider (and had the interest to do so) you're probably fine. If you need to whistle blow the feds go show up to a local ACLU office in person and ask them to contact the EFF for you to help or something.

Powered Descent posted:

I keep meaning to make a thread about how to be all sneaky-like with your browsing -- blocking ad trackers, and foiling browser fingerprinting, and how to use VPNs and coffeeshops and whatnot. But, you know, .

Wiggly Wayne DDS posted:

not only is it bad advice this'll get flagged even faster - there's automated intel systems to alert on this very specific activity chain

maybe don't my_crimes.txt this thread imo

evil_bunnY posted:

This is all extremely potent bad advice, especially if you're worried about LE. You want a shared machine on a shared network with a payment system that cannot track you.

OSU_Matthew posted:

I was just being facetious... Though, in all fairness, the investigators only found out about Maniford doing that after the recipient confessed while being interviewed, right?


With enough threads, you can trace nearly anything back. Your shared machine could have a session logged and traced back to a hotel room stay or library card or credit card/security footage at an internet cafe, etc, it's just an extra investigative step.

Just out of curiosity though, would it be device information collected by the browser or traffic collected by the ISP that would be considered traceable in this case? The google number would be an easy trace, that was bad advice. Or potentially the VPN service provider collecting information (since it should otherwise be encrypted from the ISP)? I'm just curious where that chain specifically unravels. From personal experience, I've noticed different pricing on airlines while using VPN + incognito, as well as Google's captcha not being happy when it doesn't have adequate cookie/screenshot information to identify you.

Unless it's crimes worthy of federal investigation, I'm presuming most LE is still pretty unsophisticated, considering the volume of death threats and blatant criminal activity occurring on a daily basis that gets ignored from LE, even when personally asked to step in.