Marvin Waschke Personal Cybersecurity How to Avoid and Recover from Cybercrime Marvin Waschke Bellingham, Washington, USA Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub via the book’s product page, located at www.apress.com/9781484224298 . For more detailed information, please visit http://www.apress.com/source-code . ISBN 978-1-48422429-8 e-ISBN 978-1-4842-2430-4 DOI 10.1007/978-1-4842-2430-4 Library of Congress Control Number: 2017930630 © Marvin Waschke 2017 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark. The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights. While the advice and information in this book are believed to be true and accurate at the date of publication, neither the authors nor the editors nor the publisher can accept any legal responsibility for any errors or omissions that may be made. The publisher makes no warranty, express or implied, with respect to the material contained herein. the material contained herein. Printed on acid-free paper Distributed to the book trade worldwide by Springer Science+Business Media New York, 233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505, e-mail orders- For Rebecca Apress Business: The Unbiased Source of Business Information Apress business books provide essential information and practical advice, each written for practitioners by recognized experts. Busy managers and professionals in all areas of the business world—and at all levels of technical sophistication—look to our books for the actionable ideas and tools they need to solve problems, update and enhance their professional skills, make their work lives easier, and capitalize on opportunity. Whatever the topic on the business spectrum— entrepreneurship, finance, sales, marketing, management, regulation, information technology, among others—Apress has been praised for providing the objective information and unbiased advice you need to excel in your daily work life. Our authors have no axes to grind; they understand they have one job only—to deliver up-to-date, accurate information simply, concisely, and with deep insight that addresses the real needs of our readers. It is increasingly hard to find information— whether in the news media, on the Internet, and now all too often in books—that is even-handed and has your best interests at heart. We therefore hope that you enjoy this book, which has been carefully crafted to meet our standards of quality and unbiased coverage. coverage. We are always interested in your feedback or ideas for new titles. Perhaps you’d even like to write a book yourself. Whatever the case, reach out to us at Introduction I wrote this book to solve two very specific problems for my fellow IT professionals. We all get too many questions from individual computer users who are worried about the security of their personal computers, tablets, and phones. In the industry, the acronym RTFM is hurled at beginners for asking naïve questions. But that is not an appropriate answer to a user concerned about computer security. These folks ask good and important questions that deserve serious answers. A few years ago, after repeating the same answers many times, I started to look for the right book to recommend. There are many good books on computer security but most of them drift into security for system administrators; this confuses ordinary users and leaves them uncertain. And no one needs to be reminded that the details of computing change rapidly, but the basic principles stay the same. Users need knowledge that will give them a foundation to build on as the details of security issues change. Many books on personal computer security tend to be highly prescriptive with lots of screenshots and values to fill into specific fields. This is nice, but this aspect of computing changes rapidly and many of these books become confusing within months of publication because interfaces change. Users need simple explanations of what they are doing and why they are doing it, not outdated, detailed instructions. The rate of change has escalated as products adopt automated update practices. Products evolve much more rapidly than a few years past. To stay safe during rapid change, computer users must have a firm grasp of what they are protecting themselves against, how the protections work, and why they need to protect themselves. The book is divided into three sections. The first section explains how computing has developed, how cybercrime has become a serious problem, and the extent of its severity. The second section examines what government and industry have done to respond. The third section relies heavily on the previous two sections and focuses on what you can do to protect yourself and what to do when you become a victim. Throughout, I have tried to maintain focus on what is wrong, why it is wrong, and how the response works so that a user can apply the advice to any computer they work with. If I have succeeded in my goal, the users who read this book will be informed, not quite so nervous, and prepared to avoid or actively resist the security issues that plague them. This book will not eliminate user questions to security issues that plague them. This book will not eliminate user questions to IT professionals, nor will it eliminate the need for operating system and product security documentation. In a world where substantial updates are automatically applied every month, a book like this would not be useful for long if it was only a snapshot of cybersecurity at one moment in time. Readers may be tempted to skip to the last two chapters. If you are under attack and feel the need to take immediate action, do skip ahead. But then go back and read the preceding chapters. You will find that the recommendations in the final chapters will make more sense, are easier to accept, and can be applied more effectively after you have the background the earlier chapters provide. Acknowledgments I owe a tremendous debt to all my former colleagues at CA Technologies, Inc. I learned from my colleagues and customers every day I worked at CA. I had daily opportunities to confer with security specialists, antimalware builders, and encryption experts. I talked with customers who had been hacked, asking how it happened and how it affected their business and them personally, how they could have avoided it, and what they would do to prevent it in the future. Since I retired from CA and began to concentrate on writing about computing, I have pursued another passion: public libraries. I serve on the board of the Whatcom County Library System in Washington State. The library and its patrons inspired me to focus on personal cybersecurity. Special recognition goes to the Executive Director, Christine Perkins, and IT Services Manager, Geoff Fitzpatrick. My good friend Efraim Moskovitz was my constant sounding board while writing this book. He pushed me on and reined me in as needed. Efraim and I worked together on the CA Council for Technical Excellence for several years and Efraim contributed several articles to the CA Technology Exchange , which I edited. Efraim was technical reviewer for both of my previous books with Apress. My online acquaintance Shawn Coyne made some