awesome-threats

A curated list of security threats and how to mitigate them

First, are you worried about threats to the company you work for or threats to you personally

Non-tech company

TODO

• forcepatch windows and office
• work with sysadmins to fix servers
• sweep for unique services / processnames / dns lookups
• Lock down local admin and domain admin

Tech company

TODO

• gsuite
• osquery
• endpoint management + malware detection

Platform i.e. FB, Goog, Imgur

TODO

• iterate on abuse cases
• use AI to detect malware on platform

Financial i.e. btc exchange or law firm

TODO

• Require 2FA for everyone
• Audit access

What kind of user are you?

• I am an average computer user and intel agencies aren't out to get me
• I write code for a living
• I handle a lot of money on behalf of myself or my company
• BONUS: I'm worried intel agencies are out to get me

When You are Average

• [Get a Mac with Chrome or a Chromebook] (https://www.amazon.com/Chromebooks/b?ie=UTF8&node=2858603011)
• Use Google Drive or Dropbox instead of Word
• Install AdBlockPlus and DisconnectMe and Password Alert

When You Develop Software

• Use input sanitization on any user-provided input
• Be careful when rendering HTML and doing redirects to mutable URLs
• Require valid API tokens for non-public endpoints and rate limiting for public endpoints
• Keep your servers and dependencies patched
• Give your webapp end-to-end crypto

When You Handle the Money

• Use a Mac or Chromebook
• Setup Two-Factor Authentication for wire transfers (if your bank supports it)

When You're a Dissident

• Throw your phone away
• Make new freemail accounts from a library computer
• Contact a friendly embassy or Amnesty Int'l