Security 101 Coursework 2

Over the duration of this module, I have learnt a lot about the security of my personal files both offline and online. I used to assume that certain files or information were safe and have now come to realise that, in many circumstances, this is not the case. There are three main topics I will be covering in my reflection. The first is my use and storage of passwords. The second is the encryption of files that I carry around on a my latop and USB stick, and store on my private computer at home. The third is how I can protect myself against certain attacks such as a Distributed Denial-of-Service Attack (DDOS).

Use and storage of passwords

Prior to starting this module, my use and choice of passwords was very poor. I was not aware of how easy it could be to ‘brute-force’ some of my passwords. I wanted to change the way I created passwords as well as how often I reused them. I looked at the possibility of a password manager as it has many benefits compared to the way I choose and store passwords now.

A password manager simply has one password to access every other password that one chooses to store. They can also be used to generate random passwords for websites and store them for you. Most password managers will store the passwords in an encrypted format. This would be beneficial for many reasons. The first is that I would not have to remember strong passwords for multiple sites. I would also have secure passwords for every site as the generated passwords are long and random and so would be extremely hard to crack. Some password managers also allow users to sync their passwords between different devices such as desktops and mobiles so that you could access your passwords anywhere. I was very tempted to switch to using a password manager system but ultimately decided not to use one. One reason was that most of the options that I found required you to pay a fee or monthly subscription in order to sync your passwords across multiple devices. I was also worried about relying on one password for essentially every website or account that I ever used. The final reason that I decided against it was that it could be inconvenient in some scenarios, for example if I cannot access the password manager for whatever reason, or if I wanted to log into websites quickly on devices that I did not own.

For these reasons I decided against a password manager. Previously, I had used the same password for most of my accounts. REWRITE THIS SENTANCE: I realise now that this can be very dangerous as people that crack passwords will often try the same password and username on other websites until they find one that works. My old passwords also used to be quite short and often included things such as names or easy numbers to remember (e.g. 123). This makes them easy to crack using a ‘dictionary attack’. In order to avoid my password being cracked by a ‘dictionary attack’, I try to use words that are either not in a dictionary or are particularly random. A very strong password would be three to four random uncommon words appended together. This can be made even stronger by inserting numbers or symbols in one of the words. This would also make the password secure as the length would mean that it would be far too long to ‘brute-force’. I have created some of my new passwords using this method. Rather than using a password manager, I have changed the passwords of the most importand sites and accounts that I use. I use strong passwords for these sites and have continued to use the same weak password for sites that I do not care about, for example sites that do not contain any personal information or personal files. I believe that using these methods, my passwords are far more secure than they were.

Ecryption of personal files

I recently purchased a laptop to use while studying at university. Previously, I never worried about protecting any personal files as my computer never left the house. I never encrypted any files on my USB or laptop and have been looking for the best methods to do so. There were many different ways I could go about this including full-disk encryption, file-level encryption and using encrypted filesystems. A few problems arise as I use both windows and linux regularly on my laptop and so some options will not be ideal.

The first option I explored was full-disk encryption. I use Ubuntu for lots of my work at university. On installation, Ubuntu offers an option to encrypt the entire partition that Ubuntu is installed on. At the time of the installation I was not planning on using full-disk encryption and so did not tick this option. After some research I found that unfortunately you cannot enable this option post-installation. I would rather not reinstall Ubuntu and so decided to persue other options to protect my files on this partition. Windows offers a full-disk encryption feature called ‘BitLocker’. I began to research this feature but found that it was only available to users with Windows 10 pro installed. I have Windows 10 home installed and upgrading to the pro version is quite costly. I also found that accessing drives, encryted with BitLocker, from Linux can be quite challenging. Due to these reasons I decided against full-disk encryption.

Another option I persued was single file encryption. I wanted to encrypt some documents I was writing on LibreOffice on Ubuntu. I researched and found that LibreOffice now uses the ‘Advanced Encryption Standard’ (AES) to encrypt files when using the ‘save with password’ option. AES is currently used by the U.S. Government to protect classified information. Seeing as LibreOffice is free to use on both Windows and Linux, and uses such a secure encrpytion algorithm, I now use this option regularly when saving personal or important files that I am working on.

In one of the lectures we touched upon encrypted filesystems and a piece of software called VeraCrypt. Seeing as VeraCrypt is free, open-source, and runs on all major operating systems, it looked ideal for my situation. VeraCrypt is very easy to use as once you have created a VeraCrypt encrypted volume, you can use it just like any normal volume. While writing to and reading from this volume, data is encrypted before it is stored and unencrypted and stored in the RAM while you are reading the data. VeraCrypt call this an ‘on-the-fly-encrytped volume’