ABBL

Computers do not recognize the identity of their users automatically. Users thus need to identify themselves, via a password, for example.

Unfortunately, this identification is often not taken seriously enough. Most people see it as a necessary evil. As a result, identification by the user frequently ends up being the weak link in information security. Nevertheless, identification is often the only protection that users have against the fraudulent use of their online identity.
 
Below you will find various identification factors developed by CASES as well as an overview of certain risks that users face.

L'authentification (only available in French)

Make sure that a web page is secure

On commercial or banking websites, you sometimes make use of payment services or consult accounts online. For your own protection, you must make sure that these pages are secure. First of all, type in the address of the site yourself or make sure that it is absolutely identical to the site that you wish to visit. Then check that all of the five following conditions are fully met.

1. https appears at the start of the page address

2. A padlock is present at the bottom and/or top of the secure page

3. The padlock is closed

If the padlock is open or struck through, the site may not be the one which it purports to be. You cannot therefore be certain that the connection is secure and it is better to avoid entering personal data.

4. The closed padlock is linked to a recognized security certificate (or SSL certificate)

To check this, double click on the closed padlock.
A window then opens. Now click on “Display” and the certificate will appear.
 

5. The security certificate linked to the closed padlock is valid

To satisfy this condition, you must verify the information contained in the security certificate. The name of the holder, issuer and certificate expiry date all appear on the certificate. Knowing that even a person with malicious intent can purchase a certificate, check all the information appearing on it before trusting the connection.

In the above example, we see under [2] that the certificate was issued by a public key infrastructure called LuxTrust to a service which provides services for *.cases.lu [1]. The star means that the certificate is used for several Internet sites belonging to cases.lu. The validity of the certificate can be checked at [3].
The certificates are issued by the certification authorities (CA or AC) such as LuxTrust, Verisign, Cybertrust.

Once all these five conditions have been met, you have an assurance that the connection is secure.
 

HTTPS - HyperText Transfer Protocol Secure
 

HTTPS is a network protocol used for secure web navigation. It provides possibilities for authentication and encryption of websites, which require a measure of security in their communication with websurfers. For this purpose, HTTPS uses asymmetrical cryptographic methods for authentication and symmetrical cryptographic methods to encrypt exchanges.

Before entering a password or performing an e-commerce or e-banking transaction, always make sure that you are on an HTTPS and not on an HTTP site. This is not at all complicated.

Only you may know your access data such as your user name or password. Never disclose these to a third party. Never write your access data down. If you do not follow this rule, at least keep the data separate and, above all, away from your desk or computer.

If a person discovers your password, the greatest risk is that this person will misuse your identity. Therefore choose as random a password as possible and follow the recommendations below:

- It should consist of numbers, upper and lower case letters and symbols
- It should contain at least 8 characters (the more the better)
- It should not be a word that can be found in a dictionary
- You should change your passwords frequently, and no less than twice a year. The more important the application or system is for you, the more frequently you should change your password.
- it should be random
- It should not relate to personal information
- You should define a different password for every application and system

Fiche thématique CASES : Les mots de passe (only available in French)

The firewall is one of the most important counter-measures to protect your information system against deliberate attacks by malevolent persons or worms.

Here are the three most important measures:

• An up to date anti-virus system • An up to date operating system (patch) • A correctly configured firewall.

A firewall is a physical (hardware) or logical (software) device which provides protection for personal computers. It can also be used as an interface between one or more corporate networks to monitor and possibly block data circulation by analysing the information which is contained in the data flows (network partitioning).

It therefore enables attacks or suspect connections to be blocked; these may come from viruses, worms or Trojans. They can also be traced. At the same time, a firewall often serves to prevent the uncontrolled leakage of information to the outside world. Install a firewall and configure it correctly. This will enable you not only to block attacks or suspect connections which may come from viruses, worms or Trojans, but also to avoid leakage of your personal and confidential information.
 

Fiche thématique CASES : Le firewall (only available in French)

To beat the cyber criminals who look for and find flaws in operating systems every day, you must update your browser constantly. Also apply appropriate patches. Like every anti-virus, your system needs maintenance. Performing the necessary updates will enable you to beat risks such as worms, viruses and Trojans.

Fiche thématique CASES : Les patchs de sécurité (only available in French)