annybell-villarroel

Anny believes in a people-centric trust-based approach for security culture and awareness &mdash; one where we help people learn about cybersecurity in a fun way, and make them feel empowered, rather than afraid. She also leads the Madrid chapter for WoSEC &mdash; Women of Security.

Security Culture Manager

Annybell Villarroel

Our security best practices checklist will help you, and the kids you know, stay safe online.



Today, it’s hard to think about a part of our lives that’s not connected to the internet in one way or another. Work, relationships, entertainment, growth, finances, health, home appliances, cars. They all can have an **online component**.

But the online world is a hard thing to perceive. We can’t quite touch it. We can only experience it through a screen, headphones, or a microphone. So the associated risks and consequences sometimes may not seem as real and bad as a hurricane, an armed theft, or as cutting a finger while cooking. But *are they*? 

Yes, they are!

But it also depends on you, and your “threat model”, which is just a fancy (and possibly intimidating) word to sum up the answers to these six questions:

* What are my assets? 
* Who are my adversaries?
* What can my adversary do?
* How likely is it that I will have to protect my assets?
* How bad are the consequences if I fail?
* What can I do to defend myself against my adversaries?

The questions also sound a bit intimidating, but it’s just about listing what you value, who can hurt you, how, what are the odds of being affected, what the consequences could be and what are your defenses. It works for online and offline risk.

Since so much of our lives are online today, we all have **valuable assets on the web**. Our online identity, our private identifiable information (name, birthdate, home address, phone number, email accounts), our social media, credit card numbers, pictures, work data. We all have information to protect, and we all have a responsibility to protect it too, [_including children_](https://auth0.com/blog/auth0-cybersafe-camp/).

![Auth0 family security](https://images.ctfassets.net/23aumh6u8s0i/4VW4wTpm0aesOHQS6GZJiu/071af53dace08a20a87351ce43a5554d/auth0-personal-security)

And since there have been so many [_data breaches_](https://auth0.com/blog/what-is-a-data-breach/) up until now, we all have adversaries. All the data that has been breached is up for sale for a cheap price on the dark web, and it could be used against us in different ways. Depending on who we are and what we do, we may be an interesting target as well. 

In general, the consequences of an attack can be tremendously hurtful. Identity theft, ransom, data or financial loss, cyberstalking, and even physical damage. 

Now, we can all get ready and protect ourselves, and that is what **October National Cybersecurity Awareness Month** is about. A yearly effort aimed at helping you stay safe online. 

At Auth0 we care very deeply about cybersecurity, and we want to help make the internet safer. Not only by [_increasing the security of your business_](https://auth0.com/blog/how-auth0-makes-your-apps-more-secure/) through our platform, by helping you enable password policies, anomaly detection, and MFA quickly, and by protecting the credentials of your users which helps prevent data breaches. But also by spreading awareness about cybersecurity, and partnering up with the [_US government_](https://www.dhs.gov/national-cyber-security-awareness-month), the [_EU_](https://cybersecuritymonth.eu/), and [_Australia_](https://www.staysmartonline.gov.au/get-involved/stay-smart-online-week) during October National Cybersecurity Awareness Month.

So we have prepared an **easy checklist** to help you, and the kids you know, stay safe online. Download the [Personal Cybersecurity Checklist](https://auth0.com/resources/whitepapers/personal-cybersecurity-checklist)!

We believe in making cybersecurity accessible for everyone, so we’ve translated it to **9 languages** with the help of Auziros from all over the world. 

Follow us on [_Twitter_](https://twitter.com/auth0), where we’ll be sharing 31 days of tips and best practices, and also come talk to us in [_our online meetup_](https://www.meetup.com/Auth0-Online-Meetup/), [_Seattle_](https://www.meetup.com/Seattle-Identity-and-Security-Meetup/), [_London_](https://www.meetup.com/London-Identity-and-Security-Meetup/), and [_Hamburg_](https://cybersecmonth-hamburg.de/). 

Cybersecurity is everyone’s responsibility. We all have to Own It. Secure It. Protect it, so we can stay safe online.


Personal Information Security Checklist for Family and Friends

eHk3ciM

I am the Group Manager, Developer Content at Okta, and a Google Developer Expert in Web Technologies and Angular. I'm passionate about identity, authentication, constant learning, and developer communities. As a developer advocate, engineer, mentor, and international speaker, I love learning from and sharing with other inhabitants of the tech space.

Group Manager, Developer Content

Kim Maida

Personal identifying information was compromised for 143 million Americans in a massive Equifax data breach from May to July, 2017.



## 143 Million Consumers Compromised in Equifax Data Breach

On September 7, 2017, consumer credit reporting agency [Equifax announced a data breach that potentially exposed personal data for 143 million US consumers](https://www.equifaxsecurity2017.com/). [Equifax](https://equifax.com) is one of the three largest American credit agencies, alongside [TransUnion](https://transunion.com) and [Experian](https://experian.com).

From mid-May through July 2017, criminals were able to access personal identifying information, including names, Social Security numbers, birthdates, addresses, and some driver's license numbers. In addition, credit card numbers for 209,000 US consumers were compromised, as well as dispute documents for 182,000 people. During the investigation, Equifax also discovered that limited personal information for some UK and Canadian residents had also been accessed. The hack was discovered on July 29, 2017.

Almost half of all Americans may have been affected by this data breach. **Your information may have been compromised even if you haven't signed up to use Equifax.** The data breach of a credit reporting agency (CRA) such as Equifax is particularly insidious because many consumers are _not aware_ that their data is stored with a CRA. [Equifax and other CRAs acquire their data](https://blog.equifax.com/credit/how-do-credit-reporting-agencies-get-their-information/) from credit card companies, banks, retailers, auto and mortgage lenders, debt collectors, and public records in order to generate credit scores. You don't need to have personally signed up with a CRA to have your data stored with Equifax!

## What Should I Do?

You _can_ check to see if your data has been exposed by visiting [Equifax's 2017 Incident Potential Impact website](https://www.equifaxsecurity2017.com/potential-impact/) and clicking the "Check Potential Impact" button. You can fill in your last name and last six digits of your Social Security number to find out if your data has potentially been leaked and receive a date to come back to enroll in free credit monitoring for a year. The [Federal Trade Commission also has detailed instructions available here](https://www.consumer.ftc.gov/blog/2017/09/equifax-data-breach-what-do).

Another thing you should do is actively check your bank and credit card statements regularly. If you see any suspicious or unusual activity, report it immediately to your financial institution. Don't become complacent and stop checking a week or two after a breach. Staying aware and vigilant with your accounts is important at all times. [Unfortunately, large data breaches have occurred many times in the past](http://money.cnn.com/2017/09/07/technology/business/biggest-breaches-ever/index.html), and in the digital age, we should be as prepared as possible to face more in the future.

In addition, you can monitor your own credit by requesting a free copy of your credit report from each of the three major CRAs once a year. If requests are staggered between the agencies, you can check your credit once every four months. Alternatively, you may wish to use services such as [CreditKarma](https://www.creditkarma.com/) to obtain free scores to monitor your own credit. You can also [freeze your credit](http://clark.com/personal-finance-credit/credit-freeze-and-thaw-guide/) if you choose. If you do this, make sure you freeze it with all three major CRAs, not just Equifax.

## Aside: Use Auth0 to Protect Your Users From Data Breaches

Auth0 provides [breached password detection](https://auth0.com/breached-passwords) that can be enabled simply and easily. The Auth0 security team maintains a database of third party breached credentials. This database is updated daily. On each login, user credentials are checked against the leaked passwords database. If a breach is suspected, the user is notified and cannot log in until they change the compromised password.

<video autoplay="" loop="" width="600">
  <source src="https://cdn.auth0.com/blog/breach/lock-2.m4v">
<img src="https://images.ctfassets.net/23aumh6u8s0i/3DpdlDPwLfrdGGb7RUQ6NU/d959326b776a71764727d5e3eae43c8a/lock"/>
</video>

Read about [Breached Passwords](https://auth0.com/breached-passwords) and [Anomaly Detection](https://auth0.com/docs/anomaly-detection) to learn more about how to protect users and their credentials with Auth0. You can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account and start protecting your users today</a>!



Equifax Data Breach Compromises 143 Million People

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Sensitive personal information of 198 million Americans citizens, with potential political inclinations, was exposed by a data analysis firm.



On June 19, 2017, a cybersecurity company called [UpGuard](https://www.upguard.com) reported that a huge amount of data about Americans citizens and their political inclinations was publicly available on an AWS S3 bucket. More precisely, personal information of over 198 million American voters was left exposed to the internet. The leak revealed sensitive personal information like voter's date of birth, mailing addresses, phone numbers, political inclinations, voter registration status, and so on.

## The Data Leak

One week before announcing the leak, a Cyber Risk Analyst of UpGuard found out that a AWS S3 bucket (a cloud storage) was misconfigured. This misconfiguration enabled anyone with an internet connection to gain access to the data simply by navigating to a six-character Amazon subdomain called "dra-dw". The cloud storage bucket and its contents were owned by [Deep Root Analytics](https://www.deeprootanalytics.com/), a data firm that identifies audiences for political ads, and were created to feed the Republican National Committee in their efforts to elect Donald Trump.

The data included 1.1 terabytes of unsecured personal information compiled by Deep Root Analytics and two other contractors: TargetPoint Consulting, Inc. and Data Trust. In total, the personal information of potentially all of America's 200 million registered voters was exposed, including names, dates of birth, home addresses, phone numbers, and voter registration details.

<include src="TweetQuote" quoteText="1.1 terabytes of U.S. citizens leaked by an analytics contractor."/>

## The Nature of the Data

Two critical directories entitled *data_trust* and *target_point* were found in the cloud storage. The first folder, *data_trust*, contained data gathered on an effort to host a comprehensive and detailed information about potential 2016 voters. This data was organized on two file repositories: one for the 2008 presidential election; and the other one for 2012. Each of these repositories contained a file for every state in the U.S, formatted as a comma separated value (CSV), and uniquely identified every potential voter in the database.

Chris Vickery, the researcher that discovered the leak, and Dan O'Sullivan, the reporter that wrote the [data leak announcement](https://www.upguard.com/breaches/the-rnc-files), looked up in the spreadsheets (CSV are usually read as spreadsheet) found and confirmed that the files contained accurate and sensitive personal information. They have identified one hundred and forty seven different categories of data in these spreadsheets, with columns like: "State", "Town", "MT10_ObamaDisapproval", "SD_NextElection", "SDProper_NextElection", "NamePrefix", "FirstName", "MiddleName", "LastName", "Sex", etc.

The second directory, *target_point*, contained information about voters' likely positions on 48 different political subjects. Ranging from how likely it is the individual voted for Obama in 2012, to whether they agree with the Trump foreign policy of "[America First](https://www.whitehouse.gov/america-first-foreign-policy)", to how likely they are to be concerned with auto manufacturing as an issue, among others.

The reporter responsible for the official announcement was able, after determining his identifier in the spreadsheets, to view his modeled policy preferences and political actions as calculated by the contractors. He stated, to his surprise, that the results forecasted by the companies were pretty accurate. Therefore, what we can see here is that a reckless action taken by Deep Root Analytics, ignoring the most basic security measures, exposed a very detailed and precise dossier about virtually all potential voters in America.

<include src="TweetQuote" quoteText="Virtually all potential voters in America had their personal data leaked."/>

To take a deeper look in the security breach details, [check the official announcement made by UpGuard](https://www.upguard.com/breaches/the-rnc-files).

## Aside: How Auth0 Helps to Protect Your Data

At Auth0 security is of the utmost importance. Our authentication and authorization services let you set up multiple policies that greatly improves the security of your web and native applications. Some features that customers can benefit from are:

- [Multifactor Authentication](https://auth0.com/multifactor-authentication?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak),
- [Automatic Breached Password Detection](https://auth0.com/docs/anomaly-detection?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak#breached-password-detection),
- [Custom Rules](https://auth0.com/docs/rules?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak),
- [Passwordless Authentication](https://auth0.com/passwordless/?utm_source=blog&utm_medium=sc&utm_campaign=navy_leak),
- and [Per-Client On-Site Installations](https://auth0.com/docs/overview/deployment-models)

To check how we protect the most sensitive data of our customers and their users, visit our [Security & Privacy webpage](https://auth0.com/security). There you are going to find an overview about our security approach, and a list of certifications and compliance capabilities. You will also find a link to our *Information Security White Paper* with a detailed explanation about our security measures, practices, and certifications.

<a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">Sign up today</a> and try a free account to get a taste of how easy these features can be set up on application of any size.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.

## Conclusion

Security has always been hard and it will become even harder as companies continue to migrate to cloud solutions. One of the ways to approach security is by [keeping multiple layers that complement each other](https://auth0.com/blog/navy-data-leaked/). But, when it comes to sensitive data, like personal information, it is better to rely on companies where employees are fully focused on improving data security, at rest and in motion, like Auth0.

While one can (and must) invest time on, at least, basic security checks and configuration, they will never be able to achieve the same level of security of companies that are specialized on handling sensitive data. [That's why sometimes it is better to buy external solutions, from reliable companies, than building your own](https://auth0.com/blog/when-to-build-and-when-to-buy/).


Massive Data Leak Exposes 198 Million US Voters

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

An unsecured database allowed hackers to steal personal information from over 820,000 Cloudpets customers. Learn how this may affect you and what to do next.



[Spiral Toys](http://spiraltoys.com/) is a company that creates toys for children. It has an internet-connected product called [CloudPets](http://cloudpets.com/) which allows parents and children to record and send voice messages to each other through a mobile app. On January 7, hackers discovered that the database the company was using to store data for this product was unsecured. Hackers took control of the database, deleted all information, and demanded a payment to restore the data.

![Cloudpets Homepage](https://images.ctfassets.net/23aumh6u8s0i/4ISXmWTbhcqnqACVvBoSLv/6c7cb193c8c49f69d71da5ffd32cc7bc/cloudpets)

The database contained information for 820,000+ users containing emails, bcrypt hashed passwords, and links to voice recordings customers and their children had made which could now be publicly accessed. Additional information stored included pictures, names, birthdays, and relationships. Customers were not notified that their data had been compromised.

[Troy Hunt](https://twitter.com/troyhunt) wrote an excellent [article](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/) covering this incident. Some highlights include that the database used was publicly accessible and did not even require a password to access. Cloudpets was also notified at least four times that their database was exposed and the reporters never heard back from the company. Finally, staging and test databases were also discovered which had production data that could have also been compromised.

Aside from the devops failure to secure the database properly, password requirements for user accounts were non-existant. Although the passwords were stored as bcrypt hashes, Troy was able to use [Hashcat](https://hashcat.net/hashcat/) and find valid passwords such as "qwe", "password", and "123456".

![Cracked Bcrypt Hashes](https://images.ctfassets.net/23aumh6u8s0i/1ChTEWQXZQBJD3YjBclNhX/76bdc049376598ed8261792961ad335d/cracked-bcrypt-hashes)

Source: [Troy Hunt](https://www.troyhunt.com/data-from-connected-cloudpets-teddy-bears-leaked-and-ransomed-exposing-kids-voice-messages/)

Since the database has been publicly exposed since at least December 25, 2016, it is safe to assume that many malicious parties have accessed and downloaded the data. We urge customers that have Cloudpets accounts to change their passwords and monitor their other accounts for signs of malicious activity.

## Personal Information Security Guide

Even if you don't have a Cloudpets account, it may be a good time to review our [personal information security guide](https://auth0.com/blog/personal-information-security-identity-guide/) which has plenty of tips on securing your personal information online, best practices for choosing good passwords, and much more.

Top things to remember when it comes to choosing a good password:

* Don't reuse the same password for multiple accounts.
* Combine alphanumeric, special, lower and uppercase characters.
* Your password should be at least 10 characters long.
* If possible, enable [multifactor authentication](https://auth0.com/multifactor-authentication) for your account.

## Auth0 Can Protect Your Users and Apps

Managing identity is a complex and difficult task. At [Auth0](https://auth0.com), our goal is to make identity simple for developers. A recent feature we launched called [Breached Password Detection](https://auth0.com/breached-passwords) can help alert your users that their credentials have been compromised in a data breach when they login to your app. We are still working on getting and adding credentials from this breach to our database to better protect your users. This feature helps your users stay safe, but also protects your apps from malicious access. Additionally, Auth0 meets the standards for various [password strength requirements](https://auth0.com/docs/connections/database/password-strength), provides [multifactor authentication](https://auth0.com/multifactor-authentication), and more.

If you want to make identity simple and secure for your applications, <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">give Auth0 a try</a>.

> [Auth0 offers a generous **free tier**](https://auth0.com/pricing) to get started with modern authentication.


Cloudpets Data Breach Affects Over 820,000 Customers

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Help your family and friends being secure with this printable security guide


**TL;DR:** The digital age is upon us. As much as it has blessed us and made collaboration and work easier, faster and more efficient, it also has its downsides. A lot of damage can be done by someone in a remote village over the internet. Cybercriminals carefully exploit loopholes to steal information and perform unauthorized transactions across devices and applications that are not secured enough.

This article aims to serve as a personal information security identity guide for you, family and friends. Follow this guide and keep your family and friends safe from cybercriminals this season!

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Find the printable guide to give it to your family and friends here: <a href="https://cdn.auth0.com/blog/personal-info-security-guide/Personal-Information-Security-Guide.pdf">Personal Information Security Guide for Family and Friends PDF</a>.</strong>
</div>

## The Guide

We came up with a list of questions that sums up the common security challenges that a lot of people experience and also provided answers that can guide you below:

### How do I make sure my email is secure?

* Set up [Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/). This adds an additional step to verifying a user logging into their email, e.g Your email provider sends a code to your phone that you must enter into a form to successfully authenticate and gain access to your email.
* Avoid sending confidential information such as passwords or social security numbers through email.
* Assume links in your emails are not from a secure and reputable source e.g links that lead to banking services and billing sites. Type the address in the browser to go to these sites instead.

![2FA](https://images.ctfassets.net/23aumh6u8s0i/3aoXPDNrzYX9QSlwQ811HU/94256dc0e5937a702adf56f09bee237e/tfa-what)

### How do I secure my social network accounts and prevent them from being hacked?

* Don’t use the same password across multiple online services.
* Use a password manager such as [LastPass](https://www.lastpass.com) or [1Password](https://1password.com) to store and also generate secure passwords.
* Change passwords frequently.
* Register yourself on [Have I Been Pawned](https://haveibeenpwned.com) to ensure your accounts haven't been hacked.
* Set up [Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication) if it’s available on the social network.

### Is my home network secure?

When setting up your wireless network at home, ensure you have a very strong WPA-2 (Wi-Fi Protected Access 2) password by following this process:

* Log into your account
* Open the wireless tab to edit your wireless settings
* Click to enable **WPA-2** from the dropdown option
* Set a strong password. Check out how to pick a good password on question #5

![WPA-2 Settings Dialog](https://images.ctfassets.net/23aumh6u8s0i/qxKEKQUBsAA4YtkNpIkXX/4ec646da1616fe96a06426fa9d900f26/X5wMl)

### How do I detect phishing emails?

**Phishing** emails are emails designed to look like legitimate messages from actual banks, businesses, and other organizations. In reality, they are crafted messages from cyber-criminals intended to steal your identity, personal information, or money. 

Do not click on any links that you do not recognize, especially if they come from an unknown source. Better still, assume all links from emails are phishing attempts. If it’s a mail from the bank, type the address in the browser rather than clicking on the link. Often, phishing emails do not include your name but something generic like **“Dear Client,”...**. 

Watch out for such emails.

![Phising Email](https://images.ctfassets.net/23aumh6u8s0i/6kvkEo4fq3jmKVoqTh5Tmf/27b93bfaed750d2ba87fc8c608565ee0/phishingemail)

_Phishing Email_

### How to pick a good password?

* Your password should be at least 10 characters long.
* It should be a combination of alphanumeric, special, lower and uppercase characters.
* Check out this [guide](https://auth0.com/docs/connections/database/password-strength) for more information on defining a strong password.

![How to pick a good password](https://images.ctfassets.net/23aumh6u8s0i/4Fi0J601exBxy5EBXti6jD/2840507af25ad497fd94a665ab872627/password-strenght)

### Do I need antivirus software on my computer?

Yes, antivirus software is needed on your computer. It detects, prevents, and removes malicious software on your computer. You can install trusted antivirus software like [Kaspersky](https://www.kaspersky.com) or [Avast](https://www.avast.com) on your computer.

### Why is it not good to share too much information about yourself and family on social media platforms?

If you post too much information about yourself, friends and family, an identity thief can find information about your life, use it to answer *challenge* questions on your accounts, and get access to your money and personal information.

Make as little content as possible public. For example, *share only with friends*, is a good default option for Facebook accounts.

![Sharing too much information on social media](https://images.ctfassets.net/23aumh6u8s0i/1FVp2HYk6ZhMp4DjoYZntp/d1c112dc22fea1d50bb54210e1e36d6b/2016-09-30-1475236577-9265213-socialmediaimage)

_Source: Huffingtonpost.com_

### Should I care about security while connecting to Wireless Networks?

While connected to public WiFi networks, ensure that the sites you visit or submit  information to are secure by ensuring that the URL starts with **https** instead of **http**.

Enable the firewall on your computer. You can configure the application firewall on your Mac by going through the [apple support instructions](https://support.apple.com/en-ng/HT201642). You can also configure the application firewall on your Windows PC by going through this [instructions](https://goo.gl/CKKPcB).

### How do I detect phone scams?

**What are Phone Scams?** Phone scams are text messages or phone calls designed to trick you into providing sensitive information to unauthentic authorities. 

 * Make sure you check out for typos
 * Watch out for “Too good to be true” deals sent via text messages.

![Phone Scams](https://images.ctfassets.net/23aumh6u8s0i/4wi0zL8pD35Vf6po1lm2b0/10580c8f026dc30e3ce1504c1b6ab445/phonescams)

### How to use a password manager?

A password manager is software that helps store and organize user passwords. It is not advisable to use the same passwords across various websites and services, thus using a password manager helps alleviate the challenge of committing complex and strong passwords to memory. There are several password managers available to use. Notable ones and instructions on how to use them include [1Password](http://www.businessinsider.com/1password-manager-how-to-2015-6), [Dashlane](https://blog.dashlane.com), [LastPass](https://lastpass.com/how-it-works) and [KeePass](http://keepass.info/help/base/firststeps.html).

### Why should I not reuse my password on every website?

Reusing a password on several services is a high-risk venture. If your password is compromised on one service, hackers can have access to your accounts on several services and cause lots of damage.

### How would I know if a website is secure to enter my credit card information?

Look out for the encryption symbol, *padlock*, in the URL. Verify that the site is secure by ensuring that the URL starts with **https** instead of **http** before providing sensitive information to the website. In addition, prefer recognized brands over unknown ones, even if the padlock icon for https is present in the address bar.

![Unsecure Sites](https://images.ctfassets.net/23aumh6u8s0i/7wJqzJ0zgyqqCbHlvqpjdw/cfb8474d9a636d4c621c4c78ec5ea306/Unsecure-Sites)

### How do I make sure a website is real?

Look out for typos in the site name and URL. A typical example is [https://www.paypal.com](https://www.paypal.com) , a fake version of this might be *https://paypa1.com*. Also look out for the encryption symbol, *padlock*, in the URL. Verify that the site is secure by ensuring that the URL starts with **https** instead of **http**.

![secure_website](https://images.ctfassets.net/23aumh6u8s0i/2zmsKZfQFzJmycmk6rAdrD/c50f434ca37b8dc0333190ba1f3e8493/secure_website.png)

### How to secure your mobile devices?

* Ensure that your mobile device Operating System(OS) is always up-to-date.
* Have a lock system for your device, e.g password lock, fingerprint lock or pattern lock.
* If there is an option for *“encryption”* in the device settings, enable it.
* Do not use alternate app stores e.g Alternatives to Google Play & App Store

![Fingerprint Hero](https://images.ctfassets.net/23aumh6u8s0i/5mTklB19ML2ZkbRu9nDse6/acc0fb06fdf2323e68e4320a2a4b6f44/Fingerprint-Hero)

### What are your personal backup strategies?

We recommend that you backup your personal information securely on a regular basis. There are several good options for automatically backing up your data. Some popular and trusted options are [Crashplan](https://www.crashplan.com), [Carbonite](https://www.carbonite.com), [SpiderOak](https://spideroak.com) and [BackBlaze](https://www.backblaze.com). For Mac users, you can also use [Apple Time Machine](https://support.apple.com/en-us/HT201250).

![Backups](https://images.ctfassets.net/23aumh6u8s0i/4RMJTko1iCpclEwajl62vz/1d10f933fd5529f1c3a710ca59f0c11d/backup)

## Conclusion

Finally, we would like to give you a word of advice to complement these tips to ensure you, your family and friends stay safe this season and beyond! Keep these things in mind, and we are hopeful that you will enjoy this season with your friends and family.

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-500"></i>
  <strong>Find the printable guide to give it to your family and friends here: <a href="https://cdn.auth0.com/blog/personal-info-security-guide/Personal-Information-Security-Guide.pdf">Personal Information Security Guide for Family and Friends PDF</a>.</strong>
</div>

Merry Christmas and Happy new Year in Advance!


Personal Information Security Guide for Family and Friends

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

The recent leak of US Navy sailors' personal information puts in the spotlight the difficulties of keeping sensitive data secure, here's what you can do about it

"personal information"