Basic principles of information security

[Демитрий]

Basic principles of information security.

I’m sure you have something to hide. Each of us has files that are not intended for outsiders. But, oddly enough, most people still keep everything open. Today I’ll talk about how to hide my data so that they couldn’t be accessed by special services, hackers, or anyone else without your permission.


To begin with, let's make sure that your data is stored with you. If you use any cloud service - your data does not belong to you. Once you place the file in the cloud, you cannot even be sure that you can delete it later. For example, everyone knows that VKontakte never removes photos posted there. If you decide to delete a photo, VK will simply hide it from users, but the files will still be available through direct links for a long time. This problem is found wherever distributed file systems are used. That is, just in the cloud services. The quick physical deletion of data for them is fraught with big technical problems, so it is simply more profitable for them to spend extra time on holding “deleted” files. This is not done to keep an eye on you - it's just cheaper.


By uploading files to the clouds, you lose control over access to them. Even if the service you have chosen does not have serious security problems, your data may be available to hackers and special services. Under the law, special services can access any data by sending a request. Acting illegally, they may not attack the service itself - this is usually problematic - but your account. For example, having gained control of your phone number and email, they can easily "recover" the password. And if your account is not tied to a phone number, then just one mail is enough. The price for hacking a mailbox is on average from 5 to 100 dollars. And the phone number can be duplicated to receive SMS.


Despite these risks, cloud services continue to gain popularity. Can I use them safely? The best answer is no. However, if you store there not files, but a cryptocontainer, the risks will be significantly lower. Encryption is the foundation of privacy.


<Creating a cryptocontainer>
A cryptocontainer is, roughly speaking, a very securely encrypted drive, access to which can only be accessed with a password. To create and use it you will need special software. Among paid and free programs, specialists usually single out one - the freely distributed and open VeraCrypt. The name may remind you of TrueCrypt - everything is true, this is its continuation. You can download it here: https://www.veracrypt.fr/ and here is a step-by-step instruction for beginners: VeraCrypt - Free Open source disk encryption with strong security for the Paranoid


I recommend creating cryptocontainers as files, not partitions on disk, and not making them too large. It is better to make several separate cryptocontainers than one global one. Treat them like folders. In the same way as you (I hope) do not put all the usual files in one folder, do not put all the secret files in one cryptocontainer. And do not connect all cryptocontainers at the same time! This will protect you even if someone gets access to your computer. The cryptocontainers opened at this moment will become available to the cracker, but at least some of the information will remain protected. And try not to leave the cryptocontainer open when you leave your computer unattended. Treat him like a safe. When leaving, close the key.


Regarding the keys themselves, the cryptocontainer can be protected by password and by key file. I recommend using both options at the same time. Think of a password that will not be very difficult to remember, but it will be difficult to pick up. This could be, for example, a fragment from a song or a long quote from a movie. These passwords are hard to pick up if you don’t tell anyone what methods you use. For each cryptocontainer, have a separate password. You can make passwords look alike, but don't make them the same. And do not record them anywhere. Maximum, write down a hint for yourself, which will be clear only to you. The value of the password is that it cannot be entered without your knowledge and consent, while the key file can simply be stolen.


But, if you use the file key along with the password, this will significantly increase reliability. You can generate it or use a seemingly ordinary file located on your computer as a key. It can be an mp3 file with the same song as in the password, a saved picture, the text of this article, whatever. Any file is suitable for these purposes, the main thing is that it is not too small (less than 1 kb) or too obvious. Do not call it "My_Secret_key.jpg" and then they are unlikely to find it: o) It is in order for the key file to be hard to find, I recommend not using it, but using a normal file.


<Secure File Systems>
If you want to continue to increase the level of security, you can start using secure file systems. These are systems originally created to be encrypted. The most popular among them - LUKS and eCrypt - are initially present in most Linux distributions. So, if you haven’t switched to Linux yet, it might motivate you further. It's no secret that security on Windows is much more difficult. Almost all popular Linux distributions offer encryption of the hard disk and the user's home folder even when installing the OS.


You can also encrypt the drive and home folder when installing Windows, but, as is typical for Microsoft products, the standard offer could not do without nuances. This option has become available since version 8.1, and in the 10th it was even turned on by default. It would seem that what could go wrong? The nuance is that the encryption key in this case is sent to the Microsoft server, and you can use your data only if you log in to the Microsoft account. In other words, your disk can be easily decrypted at the request of law enforcement agencies. Or if Microsoft has a data leak. Data leaks from large companies are no longer a rarity and therefore there is no reason to trust them. Instead, it’s better to use the functionality of the already mentioned VeraCrypt. In addition to creating cryptocontainers, it allows you to encrypt the entire disk.



<Secure Storage Media>
Another option is to use a hardware solution. For example, Kingston has a whole line of flash drives with hardware encryption and beautiful buttons for entering a password. Although it really looks cool, I find it inappropriate to use them. It is easier and cheaper to create an encrypted flash drive yourself. In addition, the same thing can be done with any external media - SD-card, SSD-drive and anything else.


For these purposes, we will use the already known methods: full media encryption using VeraCrypt or the use of cryptographic file systems. In order to use these systems under Windows, you can use the application tdk / LibreCrypt Under Linux, their support is implemented out of the box and there it is quite simple when formatting to select one of them from the list.


An important advantage of external media is their fragility. If any data may need to be destroyed urgently and irrevocably, I recommend storing them on SD cards. For irreversible destruction of data on a hard disk, one has to use rather complicated methods - applying high voltage, press, long demagnetization and the like. The SD card can simply be broken in half with two fingers. The more reliable and most common method is to put it in a regular blender. The powder obtained in a few seconds will be impossible to recover.


<To summarize>
From my point of view, there is not much encryption. Combine different options. Each of them will increase reliability. I recommend encrypting the entire hard drive and the user's home folder with two different algorithms. Store your private data in cryptocontainers, and place them yourself on encrypted external media. Remember passwords, not write them down. And do not forget to make backups. Encrypted data is much worse to recover, so it is always better to have at least one backup in stock.


Encryption makes using data a little less convenient than you might be used to. But, I am sure that it is better to enter a couple of passwords than to provide your data to everyone.
***
Source:
Basic principles of information security