Information Technology Security

Best Practices

(Compiled from open source)

 Index
Sl.No. Subject Page No
1. General Computer usage 1
2. General Internet Browsing 3
3. Malware defense 5
4. Removable Information Storage Media 7
5. Smart Device (Smart Phone, Tabs, etc.) 9
6. Social Networking 16
7. Email Communication 19
8. Instant Messaging (IM) 21
9. Home Devices – Wi-Fi , ADSL Routers 23
10. Multi Functional Peripherals 24
11. Smart TV, Refrigerator, Washing 25
Machine, etc.
12. Password 26
13. Online transaction / ATM 28
14. Social Engineering 31
15. Public Computer 33
General Computer usage – Best practices

a) Use account with limited privileges on systems and avoid

accessing with administrator privileges for day-to-day usage.
b) Keep Operating System, Application software and Anti-Virus
software updated by applying the latest service packs and
patches.
c) Backup of important files at regular intervals.
d) Do not leave system unattended. Log out of or lock your
computer when stepping away, even for a moment
e) Supervise maintenance or rectification of faults in the
system by service engineers.
f) Do not download unfamiliar software off the Internet.
g) Remove unnecessary programs or services from computer:
Uninstall any software and services you do not need
h) Restrict remote access. If file sharing is not required in your
day-to-day work, disable file and print sharing.
i) Treat sensitive data very carefully.
j) Remove data securely: Remove files or data you no longer
need to prevent unauthorized access to them. Merely
deleting sensitive material is not sufficient, as it does not
actually remove the data from your system
k) If your networking devices are not using IPv6, disable IPv6
from computer.
l) Always maintain a redundant power supply
m) Use system’s screen locking functionality to protect against
physical access, such as a screen saver that won’t deactivate
without a password, or just log out of everything so anyone
that wants access has to log in again.

Page | 1
n) The systems should be placed in a room which is dust free
and has a good ventilation to avoid overheating of CPU.
o) Do not plug the computer directly to the wall outlet as
power surges may damage computer. Instead use a genuine
surge protector to plug a computer.
p) Don’t eat food or drink near the PC.
q) There should be no magnets near to your PC.
r) Scan all the files after you download whether from websites
or links received from e-mails.

Page | 2
General Internet Browsing – Best Practices

a) Always use updated anti-virus, Operating System and

applications and browser.
b) Use a web browser with sandboxing capability (like Google
chrome, safari, etc.). Sandboxing usually contains malware
during execution.
c) Download software from trusted source only.
d) Be wary of storing personal information on Internet.
e) Do not store any information you want to protect on any
device that connects to the Internet.
f) Verify those you correspond with. It is easy for people to
fake identities over the Internet.
g) Make a habit of clearing history from the browser after each
logout sessions.
h) Delete Windows “Temp” and “Temporary Internet files”
regularly.
i) Avoid all cloud services (Dropbox, iCloud, Evernote, etc) that
are based outside India.
j) Avoid using services that require location information.
k) Remember search engines track your search history and build
profiles on you to serve you personalised results based on
your search history.
l) Be conscious of what you are clicking on/downloading.
m) Some pop-ups have what appears to be a close button, but
will actually try to install spyware when you click on it.
n) Remember that things on the internet are rarely free. “Free”
Screensavers, etc. generally contain Malware.

Page | 3
o) Be wary of free downloadable software - There are many
sites that offer customized toolbars or other features that
appeal to users, which are likely to have backdoors.
p) Avoid Internet access through public Wi-Fi.
q) Never exchange home and office work related contents.
r) Avoid posting of photos with GPS coordinates.
s) Don't respond to email, instant messages (IM), texts, phone
calls, etc., asking you for your password.
t) Only click on links from trusted sources. Never click on a
mystery link unless you have a way to independently verify
that it is safe. This includes tiny URLs.
u) Be extremely careful with file sharing software. File sharing
opens your computer to the risk of malicious files and
attackers. Also, if you share copyrighted files, you risk serious
legal consequences.

Page | 4
Malware defense

a) Always set automatic updates for Operating System, Anti-

Virus and Applications. (My Computer -> properties ->
automatic updates -> select Automatic and time)
b) Enable hidden file & system file view to find any unusual or
hidden files. (My computer -> tools -> folder options -> view
-> select enabled with “Show hidden file and folders” option
and disable “Hide protected operating system files”)
c) Turn off auto play

(Win XP: Start -> Run -> type gpedit.msc -> Computer
Configuration -> Administrative Templates -> System ->
Double Click at Turn off Auto play -> Select Enabled -> Select
“Turn off Auto play on:” to “All drives” and Click OK.

Windows Vista/7 :- Start -> Run -> type gpedit.msc ->

Computer Configurations -> Administrative Templates ->
Windows Components - > Select “AutoPlay Policies” ->
Double Click at “Turn off Auto play” -> Select Enabled -> Set
“Turn off Auto play on:” to “All drives” and Click OK.)

d) Type: dir %temp% in “run” and delete all entries after

opening any suspicious attachments.
e) Type cmd in run and type netstat –na. Checkout foreign
Established connection and IP addresses. Check the IP
address for its ownership.
f) Type “msconfig” in “run” and check for any unusual
executable running automatically.

Page | 5
g) Check Network icon (for packets received and sent) / ADSL
lights for data in non browsing mode. Check data usage
pattern in Mobile. If the outgoing is unusually high, then it is
very likely that the system is compromised.
h) Type “ ipconfig/displaydns” in command prompt and look
out for any URLs which you have not accessed recently.
i) Always be cautious while opening attachments even from
the known sources. Try to use non native applications for
opening attachments. Example for word document use,
WordPad to open the attachment.
j) When in doubt, better to format the Internet connected
computer rather than doing some “patch works”.

What is a Malware?

Malware (Malicious Software) is software designed

to infiltrate a computer system without the owner's
informed consent for a malicious intent.

Examples of Malware include Viruses, Trojans,

Worms, Key loggers, Backdoors, Root kits, Spyware,
Crimeware, Adware, etc.

Page | 6
Removable Information Storage Media

Removable Information Storage Media (RISM) means any device

which is capable of storing electronic information in any form.
Device or media that is readable and/or writeable by the end
user and is able to be moved from computer to computer
without modification to the computer.

For example CDR (multi sessions), CD-RW, DVD-RW, BluRay Disk,

MOD, USB Storage devices (Pen Drives, Media Cards, etc.), MP3
Players, MP4 Players, Smart Phones, Digital Camera, Watches
with memory, Various types of Memory cards, Internet Data
Card, External Hard Disk, or any other gadget having memory
space and could be connected to a system through USB or COM
or any other ports or device connected through Network Share
falls under Removable Information Storage Media.

a) Damaged / faulty RISM should never be handed over to

outsiders / manufacturer for repair.
b) Sensitive information should be stored on removable media
only when required in the cases of assigned duties.
c) All media must be stored in a safe, secure environment
d) All media must be handled with care and it must be ensured
that it is not kept near magnetic material and not exposed to
extreme heat or pollution;
e) The computers should be enabled with “Show hidden file
and folders” option and “Hide protected operating system
files” should be disabled to view hidden malicious files in
USB storage devices.

Page | 7
f) Make sure there is no hidden file and folders present in the
Media.
g) Autorun/Autoplay feature should be disabled in all the
computers.
h) Avoid Baiting. (Someone gives you a USB drive or other
electronic media that is preloaded with malware in the hope
you will use the device and enable them to hack your
computer). Do not use any electronic storage device unless
you know its origin is legitimate and safe.
i) Scan all electronic media for Malware before use.

Page | 8
Smart device

Smart device is a device having any of the features like

computation power, Internet access, storage capability, camera,
recordings, GPS, etc. Smart phone, Tablets, etc. falls under this
category.

Most of the Smart Phones and Tablets (Tabs) are having equal
computing power of a normal Desktop / Laptop systems. These
gadgets are capable of delivering many services on Video, Voice,
GPS and other computational apps like any other computer.
Therefore, all cyber security issues related to computers are also
applicable to these devices. Following are some of the security
concerns of Smart devices:

I. These are equally vulnerable to malware attacks and data

leakages as ordinary Internet connected computers.
II. More application, features and service are available on
Smart device for exploits than ordinary feature phones.
III. These gadgets are known to be used for bugging (audio
and video), monitoring call details, contents, SMS
monitoring, sending malicious SMS, Emails, spoofing, and
other malicious activities without the knowledge of the
user.

Android and IOS platform based Smart Phones and Tabs are
known to have multiple vulnerabilities, which are being widely
exploited by the attackers and adversaries.

Page | 9
a) Smart device must not be used for sensitive telephonic
conversation. The Wi-Fi and blue-tooth should be kept in
turned-off mode.
b) A low-end basic mobile phone without camera / internet /
Wi-Fi may be carried for sensitive voice conversation and
contact details.
c) Internet connection in the Smart device will normally be kept
in off-mode and it will be made 'on' on need basis to access
internet.
d) No free Apps should be loaded in the Smart device.
e) During repairs, do not leave Smart device unattended to deny
the possibility of installation of malware.
f) Relevant anti-virus software should be installed in the smart
device.
g) If the Smart device gets de-activated for any reason for few
hours / one day, the service provider should be contacted
immediately to ascertain the reason for deactivation.
h) If the battery gets unusually discharged very fast or device
gets heated up without any user activity, then it is very likely
some malicious traffic is consuming battery.
i) Free Wi-Fi should not be used at public places such as
Airport. Turn off blue-tooth and Wi-Fi when use of the same
is not required for operational purposes. Even when the
same is in use, set default blue-tooth / Wi-Fi configuration to
"non-discoverable".
j) Compromised smart device should not be connected with
computer even for the purpose of charging.
k) Turn off the applications which are not needed.

Page | 10
 l) When device is idle, it should get locked and require a
password / pin or swipe pattern. Set the device to lock in
relatively short time.
m) Don't reply or click on link on SMS or messages sent by
strangers.
n) Don't jail-break your device as jail-breaking removes the
restrictions on which apps can be installed or not installed.
This removes the protection set by the company.
o) Watch for unauthorised GPRS/data connection during idle
mode of the Smart device.
p) Check the memory frequently if any unusual data is stored
there. Malware stores temporarily, the data collected in the
memory of the phone till the same is sent to the destination.
q) Suitable non-transparent tape/sticker may be applied to
block the camera view.
r) Think before you click, download, forward, or open. Before
responding, registering, downloading or providing
information, get the facts. No matter how tempting the text,
image, or application is, if the download isn’t from a
legitimate app store or the site of a trusted company, doesn’t
engage with the message.
s) Understand the terms of use. Some applications claim
extensive rights to accessing and leveraging your personal
information. If the app requires more access to your account
and/or device than is needed to run the service, do not
continue. In addition, be aware that terms can change over
time. Review your terms of use often.

Page | 11
t) Be cautious with public Wi-Fi. Many Smartphone users use
free Wi-Fi hotspots to access data (and keep their phone plan
costs down). There are numerous threats associated with Wi-
Fi hotspots. To be safe, avoid logging into accounts, especially
financial accounts, when using public wireless networks.
u) Disable Bluetooth and Near Field Communication (NFC)
capabilities when not in use. Capabilities such as Bluetooth
and NFC can provide ease and convenience in using your
Smartphone. They can also provide an easy way for a nearby,
unauthorized user to gain access to your data. Turn these
features off when they are not required.
v) Enable encryption. Enabling encryption on your Smartphone
is one of the best ways to safeguard information stored on
the device, thwarting unauthorized access.
w) Securely dispose of your device. With the constant changes
and upgrades in the Smartphone market, many are upgrading
their devices on a regular basis. It is important that you wipe
the information from your Smartphone before disposal.
Additionally, make sure any SD cards are removed and
erased. If you are not redeploying the SIM card to another
device, then make sure your personal information stored on
the SIM card is erased or destroyed.

Checklist for Secure Android Device

There are many ways to make Android device is safe and secure.
A few of these are listed here:

1. Implementing basic security (screen security): Users can

choose from the standard device PIN, password, pattern lock,

Page | 12
face unlock and swipe (swipe is not a secure method). Screen lock
can be set from settings > screen security > screen lock.

2. SIM PIN: users should consider setting up a SIM PIN. With this
option enabled, the device will ask for the SIM PIN every time it
boots up.

3. Encryption: Android 2.3.4 and later versions support device

encryption. Though this is a must-have security, most device
manufacturers choose to ignore it in their customized Android
version. In case this feature is not available, users can use
external apps such as Secret Space Encryptor (SSE), Encryption
Manager, etc.

4. Passwords: Passwords should not be made visible. Users

should make sure that this feature remains disabled at all times.

5. Multiple user accounts: Tablets running on Android 4.2 +

(Jellybean) provide an option to create separate user profiles for
different users. This is helpful if the device is being shared by
multiple family members. This feature can be found under
Settings > device > users.

6. Device Administration: this section provides two features,

‘Device Administrators’ and ‘Unknown Sources’. Device
Administrators are apps that can control certain features of the
device. For example, when an anti-virus app is installed, it
becomes a device administrator. It can erase all data on the
device, set password rules, etc. on the user’s behalf. Often, these
apps provide an option for users to perform these tasks remotely
and hence, they need to act as device administrators.
Page | 13
The ‘Unknown Sources’ feature allows the user to side load apps
or install apps provided by a third party app Store. Apps installed
via this mode might contain some malicious code, which could
pose a risk to the user’s data. This option should remain disabled
at all times except for development purposes.

7. Mobile Security Suite: Installing a mobile security suite is a

must. All the leading anti-virus companies provide a mobile
version of their product. A mobile security suite provides wide
variety of features along with an anti-virus.

8. Device backup: Users should regularly back up the data on

their device. By default Android provides an option to back up the
configuration and settings. This is available under settings >
Personal > Backup & Reset. However, it does not back up data
stored on the device. Device data can be backed up either by
using the desktop software suite for the device or via third party
apps.

9. Mobile Device Management: Many users bring their device and

connect the same to their organization network. Leading to data
leakage and other security compromise. To counter such risks,
MDM solutions (Mobile Device Management) needs to be
deployed by the organizations.

10. Application Permission: No apps should be allowed to access

the device resources without the consent of the user. Use should
refrain from installing apps that look suspicious and asks for other
resources for accessing.

Page | 14
11. Application Locks : If a device is changing hands, users might
want to protect their personal data (SMS, Pictures, Emails, etc.)
from prying eyes. An application lock is an answer to this
problem. By installing apps users can put a password on apps that
store personal data. Once implemented, a password protected
app will ask the user for a PIN before launching.

12. Transaction Passwords: Users can set transaction passwords

for selected App Stores.

13. Rooting Device: Android, ROMs shipped with devices; do not

provide root (super user privilege) access, by default. While many
users do not require root privileges on their device, advanced
users and developers often like to experiment with their device.

Page | 15
Social Networking

a) Do not store any information you want to protect on any

device that connects to the Internet.
b) Always use high security settings on social networking sites,
and be very limited in the personal information you share.
Monitor what others are posting about you on their online
discussions.
c) Use anti-virus and firewall software. Keep them and your
browser, and operating systems patched and updated.
d) Change your passwords periodically, and do not reuse old
passwords. Do not use the same password for more than one
system or service. For example, if someone obtains the
password for your email, they can access your online banking
information with the same password.
e) Do not post anything that might embarrass you later, or that
you don’t want strangers to know.
f) Do not automatically download, or respond to content on a
website or in an email. Do not click on links in email
messages claiming to be from a social networking site.
Instead go to the site directly to retrieve messages.
g) Only install applications or software that come from trusted,
well-known sites. “Free” software may come with malware.
Verify what information applications will be able to access
prior to enabling them. Once installed, keep it updated
h) Avoid accessing your personal accounts from public
computers or through public Wi-Fi spots.
i) Disable Global Position System (GPS) encoding. Many digital
cameras encode the GPS location of a photo when it is taken.

Page | 16
 If that photo is uploaded to a site, so are the GPS coordinates,
which will let people know that exact location.
j) Whenever possible, encrypt communications with websites.
It may be a feature (like HTTPS site rather than HTTP site)
social network sites allow you to enable.
k) Beware of unsolicited contacts from individuals in person, on
the telephone, or on the Internet who are seeking corporate
or personal data.
l) Monitor your bank statements, balances, and credit reports.
m) Do not share usernames, passwords, credit cards, bank
information, salaries, computer network details, security
clearances, home and office physical security and logistics,
capabilities and limitations of work systems, or schedules and
travel itineraries.
n) No legitimate service or network administrator will ask you for
your password.
o) Do not provide information about yourself that will allow
others to answer your security questions—such as when using
“I forgot my password” feature.
p) Be thoughtful and limit personal information you share such
as job titles, locations, hobbies, likes and dislikes, or names
and details of family members, friends, and co-workers.
q) Verify those you correspond with. It is easy for people to fake
identities over the Internet.
r) Do not click advertisement shown in the social web pages

Page | 17
Registering an Account

a) Use a strong password different from the passwords you use

to access other sites.
b) If you are asked to provide security questions, use
information that others would not know about you.
c) Never provide a work-associated email to a social network,
especially when signing up. Consider creating a new email
address strictly to connect with your social networking
profile(s).
d) Do not use your real name
e) Provide only information that is necessary or that you feel
comfortable providing. When in doubt, err on the side of
providing less information.
f) During the registration process, social networks often solicit a
new user to provide an email account password so the social
network can access the user’s email address book. The social
network promises to connect the new user with others they
may already know on the network. To be safe, don’t provide
this information at all.

Page | 18
Email Communication

a) Auto save of password should not be enabled.

b) Users must check their last login details while accessing the
Email account.
c) Use of encryption and digital signature certificate (DSC) may
be considered for mails deemed necessary.
d) Email IDs should have a strong password (at least 13
characters with alpha numeric and special characters)
e) Once in every 30 days the email passwords should be
changed.
f) Logout properly from mail accounts.
g) Before opening any attachment, the same should be scanned
through an updated anti-virus for malicious contents.
h) Do not keep mails in Inbox, sent box, draft, etc. which are no
longer required.
i) User should type the complete URL in the browser instead of
clinking links from other sources.
j) Before accepting the SSL certificate, the user should verify
the authenticity of the certificate.
k) Make a habit of clearing history from the browser after each
logout sessions.
l) Do not open / forward / reply to suspicious E Mail.
m) Do not click any URLs mentioned in the body of the E Mail
text.
n) Be cautious of Tiny URLs in Email contents.
o) Do not open attachment having extension
EXE, DLL, VBS, U64, SHS, PIF , SCR

Page | 19
 Typical example .txt.exe , .doc.exe
p) Some malicious program starts executing as soon as they
appear on the Outlook Express preview pane. Disable that
option ( view -> layout -> uncheck “show preview pane”)
q) Don't open unsolicited or unexpected attachments. If you
can't verify an attachment is legitimate, delete it.
r) Don't log in to web sites or online applications unless the
login page is secure (HTTPS).
s) Don't enter personal or sensitive information online unless
you are using a trusted, secure web page.

Page | 20
 Instant Messaging (IM)

Instant Messaging networks provide the ability to not only

transfer text messages, but also the transfer of files.
Consequently, IM can transfer Malware and other programs.
Many IM allows peer-to-peer file sharing, a malware can
configure the IM client to share all files on the system with
full access to everyone.
Hackers can impersonate other users in many different
ways. The most frequently used attack is simply stealing the
account information of an unsuspecting user.

a) Careful when creating a screen name. Each IM programs

asks you to create a screen name. Screen name should not
provide or allude to personal information. Use a nick name
instead of full name.
b) Never provide sensitive personal information. Do not share
credit card numbers/ passwords. Etc. over IM.
c) Create a barrier against unwanted IM. Do not list your name
or email address in public areas or to strangers.
d) Only communicate with people who are on your contact
lists. If you decide to meet a stranger that you know only
from IM communication, take appropriate safety
precautions. For example do not meet that person alone,
take a friend or colleague with you. Always meet and stay in
public place such as café or other places.
e) Never open pictures, download files or click links in
messages from people you do not know.

Page | 21
f) Do not send personal or private IM at work.
g) If you uses a public computer, do not select the feature
allows you to log on automatically. People who use that
computer after you may be able to see and use your screen
name to log on.

Page | 22
Home Devices – Wi-Fi, ADSL Routers

a) All ADSL Broadband routers should be adequately secured.

b) Disable web and telnet services from outside network
c) Change the default passwords of all the network devices.
d) Turn off the Network during extended periods of non-Use.
e) Disable DHCP service
f) Try to use your ISP DNS rather than open DNS IP addresses
g) Always configure ISP provided DNS IP address in computer
rather than automatically obtaining the same from ADSL
device.
h) If update option is available in the ADSL device, update the
firmware from the legitimate vendor’s web site.

Wi-Fi Device

i) Information/Data on the Wi-Fi Network should always be

in the encrypted form.
j) Do not connect the access point directly to the wired
network. As there is a chance of compromised wireless
client in turn effecting the systems in the wired network, a
firewall and an antivirus gateway should be placed
between the access point and the wired network
k) In order to allow authorized users to connect to the access
point, wireless clients should be provided access based on
MAC address.
l) Do not auto-Connect to open Wi-Fi Networks.
m) Do not use WEP encryption use WPA2 or higher graded
encryption

Page | 23
 n) Change your SSID (Wireless Network Name)
o) Turn off SSID broadcasting.
p) Change the default passwords while configuring the access
point.
q) When the number of users accessing the access point is
less, it is recommended to disable the DHCP service. As
this may make the attackers easy, to connect to the
network once they get associated with the access point.
r) Update the firmware of access point. It will reduce the
number of security loop holes in the access point.

Multi Functional Peripherals (MFP, Fax-Printer-Scanner-

Photocopier) with hard disk / solid state disk

a) If possible, disable the option of saving contents in the hard

disk of the MFP.
b) Set up devices to perform regular overwrites (Wiping) with a
pattern more frequently. In some environments that may
mean overwriting the disk after any content is printed,
scanned, faxed, and copied.
c) Encrypt the data on the disk if that function is available.
d) Regularly check FAX reports in MFP.
e) Do not connect MFP to telephone line, if the MFP with FAX
is to be connected to a sensitive computer.

Page | 24
Smart TV, Refrigerator, Washing Machine, Gaming Console etc.

a. Always protect your devices with a password. 

b. Change the default password of the smart devices (IOT
devices)
c. Update software. 
d. Do your research: Investigate the data sharing and privacy
policies of the company selling the product.
e. Browse with caution. Smart TVs are every bit as susceptible
to hacking as your home computer.

What is Internet of Things (IOT)?

It refers to uniquely identifiable objects and

their virtual representations in an Internet-like
structure on standard communication protocol.

Each person and thing has a locatable,

addressable, and readable counterpart on the
Internet.

Internet connected household devices with the

potential to be turned in the spy tools.

Page | 25
Password – Best Practices

a) Passwords must be changed at regular intervals.

b) Always use different passwords for different accounts.
c) Do not share passwords with anyone.
d) All passwords are to be treated as sensitive.
e) Passwords should never be written down or stored on-line
without encryption.
f) Do not reveal a password in email, chat, or other electronic
communication.
g) Do not reveal a password on questionnaires or security
forms
h) Always decline the use of the "Remember Password" feature
of applications
i) All users should be aware of how to select strong passwords.
j) Strong passwords contain combination of lower case
characters, upper case characters, numbers, “Special”
characters (e.g. @#$%^&*()_+|~-=\`{}[]:";'<>/ etc).
k) Contain at least thirteen alphanumeric characters (except in
the case of BIOS, if the same is not possible).
l) Weak passwords have the following characteristics:

I. The password contains less than thirteen characters

II. The password is a word found in a dictionary (English
or foreign)
III. The password is a common usage word such as:
Names of family, pets, friends, colleagues, Movie /
Novel / Comics characters, etc.

Page | 26
 IV. Computer terms and names, commands, sites,
companies, hardware, software.
V. Birthdays and other personal information such as
addresses and phone numbers.
VI. Word or number patterns like aaaaa, qwerty, asdfg,
zxcvb, etc.
m) Password history should be enforced wherever possible to
ensure that the users are forced to select different
passwords with a user account.
n) Maximum password age should be configured to enforce the
period of time (90 days) that a password can be used before
the system forces the user to change it.
o) Always use different passwords for different accounts.
p) Do not reveal a password in email, chat, or other electronic
communication.
q) Do not speak about a password in front of others.
r) Do not hint at the format of a password
s) Do not reveal a password on questionnaires or security forms

Page | 27
 Online transaction / ATM

a) Before you buy, check out the store’s and the seller’s
reputation through website reviews or physical address
verification to ascertain the legitimacy of the party you are
going to deal with. Keep in mind however that online reviews
can be manipulated to credit or discredit reputation.
b) Be aware of what details legitimate sites ask for before
entering into a transaction. Acquaint your-self with the site’s
procedure and compare this with similar sites. This will help
decide whether the site or the communication from it is
genuine.
c) Be wary of unsolicited mail, especially those with email
attachments and embedded links.
d) Learn to distinguish bogus communications that claims to be
from banks, auction sites, and other financial institutions,
specifically those asking for personal or account information
as these are never requested electronically by institutions.
e) Review financial and credit card statements for un-known
expenses. Incorrect entries or suspicious transactions serve
as a warning bell that online financial accounts are
compromised. If so, contact the financial institution
immediately, consider re-porting the attack to the police,
reset online pass-words, ATM PINs and check for malware on
your home computer
f) Cancel unused debit / credit cards (cutting them up is not
enough).

Page | 28
g) Don't carry your PAN card Aadhar card, passport, or EC card,
etc. with you, except when necessary.
h) Shred all credit card / debit card receipts and solicitations,
canceled checks and financial documents before throwing
away.
i) Check your credit card statements and immediately report
unauthorized purchases.
j) Don't give out your mother's maiden name, or any account
information over the phone, unless you are sure the caller is
legitimate. Adopt a "need to know" approach to your
personal data.
k) Have your name removed from lists sold to companies
offering pre-approved credit cards
l) Never write down PINs and passwords: memorize them. Do
not use any part of your Social Security number, your name
or any easy to guess words or sequences.
m) Always use phishing filters at your Internet browser.
n) Confirm whether email is received from bank or not.
o) Be cautious while providing bank details via online, before
proceed further confirm with bank about the email you
received. Think that if something is important or urgent why
don’t bank calling me instead of sending email?
p) Delete all cookies and history file before you perform online
transactions.
q) Always use virtual keyboard while accessing online banking.
r) Enable mobile number and email with banking transactions
for timely SMS and Email alerts.

Page | 29
s) Update your details such as change of address for receipt of
cheque books, statements /debit/credit cards at the right
address.
t) Vishing is a form of phishing, where instead of people
receiving an email to lure them into giving personal
information, the criminal uses a phone call, either live or
automated, to attack the bank or credit union customer and
get critical information.

ATM

a) Always protect your PIN, Do Not give the number to anyone

b) Cover the keypad while you are entering the PIN.
c) Do not operate ATM in lonely places / unguarded ATMs.
d) Be wary of anything about the ATM machine that looks out
of ordinary, such as odd-looking equipment or wires
attached to the device.
e) Look for a”no tampering” sign. Crooks often place these to
stop anyone curious about a new piece of equipment.
f) Regularly check bank accounts to make sure that no unusual
or unauthorized transactions (even smaller amount)

Page | 30
Social Engineering

Social Engineering is an approach to gain access to information

through misrepresentation. It is the conscious manipulation of
people to obtain information without realizing that a security
breach is occurring. It may take the form of impersonation via
telephone or in person and through email.

a) Some emails entice the recipient into opening an attachment

that activates a virus or malicious program in to your
computer.
b) Be suspicious of unsolicited phone calls, visits, or email
messages from individuals asking about employees or other
internal information. If an unknown individual claims to be
from a legitimate organization, try to verify his or her identity
directly with the company.
c) Do not provide personal information or information about
your organization, including its structure or networks, unless
you are certain of a person's authority to have the
information.
d) Do not reveal personal or financial information in email, and
do not respond to email solicitations for this information. This
includes following links sent in email.
e) Don't send sensitive information over the Internet before
checking a website's security. Pay attention to the URL of a
website. Malicious websites may look identical to a legitimate
site, but the URL may use a variation in spelling or a different
domain (e.g., .com vs. .net).

Page | 31
f) If you are unsure whether an email request is legitimate, try
to verify it by contacting the company directly. Do not use
contact information provided on a website connected to the
request; instead, check previous statements for contact
information.
g) Install and maintain anti-virus software, firewalls, and email
filters to reduce some of this traffic.
h) Take advantage of any anti-phishing features offered by your
email client and web browser.
i) If you believe your financial accounts may be compromised,
contact your financial institution immediately and close any
accounts that may have been compromised. Watch for any
unexplainable charges to your account.
j) Immediately change any passwords you might have revealed.
If you used the same password for multiple resources, make
sure to change it for each account, and do not use that
password in the future.
k) Don't make you mobile phone as a source for your personal
data, which is dangerous if it falls in to the hands of strangers.
It is advisable not to store important information like credit
card and bank cards passwords, etc in a mobile phone.
l) Note the IMEI code of your cell phone and keep it in a safe
place. This helps the owner to prevent access to the stolen
mobile. The operator can block a phone using the IMEI code.

Page | 32
Public computers (like Internet Cafes etc)

a) If you store or download any personal information on Desktop

in cyber cafe make sure you delete all the documents after
you’re done with your work.
b) When surfing the Internet, you always should check about the
browser security to avoid risks of exposing personal
information such as disabling the option “Remember my ID on
this computer”.
c) A keylogger is basically spyware and logs or records your
keystrokes so that your username and password are made
available to Cyber cafe owner or any Attacker. These records
may types into directly into Hacker’s machine or collected
afterwards through a file transfer. Some of Cyber Cafes may
use Hardware key loggers so that you check that there is an
intermediate device between your keyboard and CPU.
d) Cyber Cafe computers are public computers and shared
computers. Your data or communication may be exposed to
all users at the same time. So be aware that sensitive
information like personal details like username, passwords
etc. should be deleted.
e) Whenever you go to Cyber Cafe, you ensure that it has most
up to date Anti Virus and Anti spam software. These may help
to stop some of the key loggers, Trojans and other malware.
f) Don't leave the computer unattended with sensitive
information on the screen.
g) Don't enter sensitive information into a public computer.
h) Always make sure to logout properly when you leave Cyber
cafe.

Page | 33
Page | 1