Digital crisis management – what’s your recovery plan?

How big a disaster will it be if your Facebook account gets hacked? What will you lose when your laptop’s hard drive self-destructs? How will you cope if you lose your mobile phone?

The digital world provides a wealth of applications for business and pleasure we generate volumes of files including our work, our money, our photos and videos – a comprehensive archive of our modern lives. These digital assets are hugely important and should be protected.

There are two principle theatres for digital disasters; system failure and criminal intervention.

File not found

Computers and mobile phones are disposable but our data is not. The fridge in your kitchen has been switched on doing its job seamlessly for the last decade. How many laptops and mobile phones have you got through in that time?

Your important data should not be stored locally on a single device. It is easy to synchronise all your devices through cloud services so that you can access your contacts, calendar and files from any device at any time. Syncing via the cloud is free and easy.

Google and Apple both provide some free cloud storage as do Amazon and Dropbox. Software is available that carries out incremental backups both to external and off-site drives automatically – meaning you don’t have to remember to do it. 

If you have a lot of important data (like we do) then there are dedicated, unlimited storage services providing backup-and-restore facilities from around $9 a month.

External hard drives are ten-a-penny, tiny, capacious and stable. For the price of a night out, you can buy a solid-state hard drive which will takes years to fill. Flash drives and SSD drives are subtly different but the important thing is that they have no moving parts. Short of chiselling it into slabs of marble, there’s no more enduring way to store your data.

That’s our Digital Crisis Management Plan in place in the event of a catastrophic coffee spillage on our laptop. Oh, but all our passwords are saved in our browser! But that’s ok because we use our first pet’s maiden name for everything…

Pa$$words and Two-Factor Authentication

Don’t use the same password in multiple logins. Do we really have to say this? The most common form of data breach is in the vast databases of big service providers. Amazon, AirBnB, Facebook, Instagram, Netflix, eBay… anywhere you have a login, there’s a database holding your data which is a target for hackers.

The hackers harvest and collate your personal data and sell it in vast troves on the dark web. You won’t know about it until you start getting bills for a mobile phone you never bought on a credit card you don’t own.

The bad news is there is nothing we can do to prevent these data breaches but there are measures we can take to mitigate. Firstly, use big random passwords generated and managed for you by a password manager. There are plenty to choose from. In the Graphic Violence office, we use LastPass and Bitwarden – using one as backup of the other. Both have apps for use on mobile devices.

Storing your passwords in your browser on your laptop is not a useful solution. The data is local to your device and when it dies on you (it will),  you’ve lost all your logins. Password managers are cloud-based services you can access from any device.

Increasingly, security services are being consolidated by providers. Many companies who offer Virtual Private Networks (VPN) include dark web monitoring to see if your email address has appeared in a data breach, password management and malware detection for desktop and mobile devices. VPN providers protect multiple devices with a single plan.

Activate Two-Factor Authentication (2FA) on your accounts and then your passwords are of limited use to the hackers without access to your mobile phone. But there are complications. 

Many 2FAs involve a verification code sent by SMS to your mobile phone. This is not very useful if you have no phone signal (we’ve been there) or worse still, if you’ve lost your phone.

Authenticator apps on mobile devices provide 2FA security to your other apps like Facebook and Instagram but do it such that you can transfer to a new phone, via web browser, without needing access to the old device. They also allow you to add 2FA without the need to disclose your phone number. For example, you can add 2FA to Facebook on your mobile without needing to give Facebook your phone number. 

Mobile phones are vulnerable not simply because they are easily lost or damaged but also because of exposure to public wi-fi networks. VPN services protect your mobile on public wi-fi and a host of apps are available to protect against malware and viruses. 

Google and Apple both provide free authenticator services with find my phone and remote disable and or delete functions in the event of your phone being lost. The phone finding function is a very useful way if it is still switched on somewhere.

Faking and entering

‘Phishing’ is the practice of harvesting personal data with fake login pages. Typically, a message or email advises you your account has been disabled or is going to be deleted because of a T&Cs violation, suspicious activity or the need to verify something or other.

A link is provided for you to carry out the required action and instructs you to login again, for security. It’s a fake login page. You enter your details and continue on your way without realising you’ve just handed over your email and or phone number and password to the hackers.

They now have access to your Facebook account and will change the password and lock you out. If you have made purchases through Facebook, they’ll have access to your payment details too. Masquerading as you, they’ll now brag about the easy money you are making on cryptocurrency. They’ll post links to more scams and your friends will fall for them because they trust your recommendations.

These phishing scams target personal and business profiles across all online accounts including Instagram, X-Twitter, LinkedIn, PayPal, Gmail et al. Recovering a hacked account is entirely dependent on the service provider and is, by no means, a certainty.

Spot the scams

Always be sceptical of messages. Copy the text of the message and post it into a Google search. The first result will tell you whether it is a scam or not. 

The golden rule is never use the link provided. If your PayPal account has been suspended, you’ll find that out by signing in via paypal.com.

The scammer’s fake login page always looks very convincing but it won’t have the real URL. Password managers spot this and won’t offer up your login details. We know, our password manager saved us on a fake Gmail login once.

Do it today

If you do nothing else today to ramp up your digital security, change the passwords on the accounts most important to you. If you are still using the same login for your Facebook and LinkedIn accounts you set when you created them, then your details are definitely out there in multiple data breaches.

We hope this article raises your awareness of the likely vulnerabilities in your digital life and prompts you to increase your security. It is a huge subject and below is a list of links you’ll find useful for more guidance but if you aren’t interested in reading any more but want some barricades errecting, call or message us.