status-im
/
status-security
mirror of https://github.com/status-im/status-security.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity
status-security/process/personal-security-checklist.md

99 lines
5.3 KiB
Markdown
Raw Normal View History

added drafts folder
2020-04-21 14:47:28 +00:00
# Security Checklist
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
People in the crypto industry are particularly targeted by hackers & malware. When joining Status as a Core Contributor, make sure you follow the following recommendations to ensure your safety & the security of the organization as a whole.
## General recommendations
Those recommendations are valid for most Core Contributors who are not particularly exposed.
### 💻 Hardware
#### 🖥️📱 Computers & mobiles devices
- [ ] Be aware of unwanted additions & customizations some manufacturers practice in the PC & Android world https://en.wikipedia.org/wiki/Pre-installed_software,
Update drafts/personal-security-checklist.md Co-authored-by: F <franck@status.im>
2021-12-18 10:15:40 +00:00
- [ ] Be aware of the various End-of-life/Guaranteed security update policy for each manufacturer & device, especially in the Android world. For example [Google Pixel](https://support.google.com/pixelphone/answer/4457705?hl=en) & [Nokia](https://www.nokia.com/phones/en_int/security-updates) are known to offer fair update policies. Some manufacturers do not. Once a device do not receive security updates, do not use it anymore,
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
- [ ] Password protect your BIOS/UEFI.
#### 🔑 Hardware authentication devices
We recommend the use of hardware authentication devices supporting the FIDO2 protocols such as the [Yubico Yubikey](https://en.wikipedia.org/wiki/YubiKey)
Status allows to expense 1 authentication device per contributor.
#### 📟 Hardware wallets
- [ ] For important crypto accounts, we recommend the use of hardware wallets such as the [Ledger](https://www.ledger.com/) or [Trezor](https://trezor.io/),
Status allows to expense 1 hardware wallet per contributor.
Added note on where to buy hardware security devices
2022-06-14 11:59:10 +00:00
Always buy hardware security devices from the official website of the vendor (a lot of fake devices are sold on Amazon).
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
#### 🖨️ Printers
When printing recovery codes & very sensitive information,
it is important to do so on a printer that has no wifi as the history can be hijacked and the printed documents can be recovered and reprinted.
If you decide to sell your hardware, make sure all your settings & data have been securely removed from it.
### 🐧 Operating System
- [ ] Whether you use Windows, macOS, Linux, iOS or Android, it is always a good idea to start fresh with a clean install.
- [ ] Keep your OS up-to-date,
- [ ] Make sure your OS install is fully encrypted.
### 📦 Software
Favor software installed from an app store with automated update mechanisms.
- [ ] Do not use clipboard managers ([why](https://coinjournal.net/pc-malware-steals-funds-modifying-ethereum-addresses/)),
- [ ] Do not use cloud screenshot auto-upload,
- [ ] Do not use remote viewer,
- [ ] Review launch-on-startup software.
#### 🌐 Web Browsers
- [ ] Remove unused browser extensions,
- [ ] Disable infrequently used browser extensions,
Update personal-security-checklist.md
2023-03-13 16:03:05 +00:00
- [ ] Bookmark commonly accessed critical websites such as banks, decentralized finance apps, etc,
- [ ] Disable the Autofill feature.
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
### 🗝️ Authentication
- [ ] Use a password manager, such as [Bitwarden](https://bitwarden.com),
- [ ] Do not reuse passwords across applications & services,
Added email breach monitoring
2022-01-02 19:10:36 +00:00
- [ ] Enable notifications/alerts for breaches of your email on [have i been pwned?](https://haveibeenpwned.com/) or [Firefox Monitor](https://monitor.firefox.com/)
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
- [ ] Do not use phone number/SMS authentication as 2FA or backup option,
- [ ] Enable Multi-Factor Authentication (MFA) whenever possible using either:
Fix a typo
2023-07-12 06:11:29 +00:00
- [ ] A hardware authentication device such as a Yubikey,
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
- [ ] A software-based authenticator such as [Google Authenticator](https://en.wikipedia.org/wiki/Google_Authenticator).
### ☁️ Online services & cloud
- [ ] Do not backup directly highly critical data such as seed phrases,
- [ ] Regularly review the Connected/Authorised/Installed/OAuth Apps section on services such as Google, [Github](https://github.com/settings/installations) & cloud storage.
### 💽 Backups
- [ ] Whether you backup on a hardware device or the cloud, make sure they are encrypted.
### 🕵🏻 Privacy
- [ ] Be careful with what you publish on social media,
- [ ] Review carefully social media settings, for eg Facebook [Security](https://www.facebook.com/settings?tab=security), [Privacy](https://www.facebook.com/settings?tab=privacy) [Applications](https://www.facebook.com/settings?tab=applications) & [Timeline](https://www.facebook.com/settings?tab=timeline) settings,
- [ ] Consider making use of [Email aliases](https://www.privacytools.io/#email-alias) for some non-critical accounts,
- [ ] Consider the software & service listed on https://www.privacytools.io/ as alternative to the popular ones.
### 📋 Others & General recommendations
- [ ] If you are unsure about something, just ask the security team on dedicated channels,
Update personal-security-checklist.md
2023-07-12 06:22:45 +00:00
- [ ] Follow the `#security` channel in Logos Discord server and in the Status app to keep yourself up-to-date, make use of those channels if necessary.
Revamp of the security checklist for CC Break down to be simpler to understand & use, lot of things were not up-to-date or relevant
2021-12-10 09:03:33 +00:00
## Going further
Those recommendations are intended for Core Contributors whose role & tasks could make them more exposed.
- [ ] Consider the use of separated systems on a virtual machine, partition, or hardware for sensitive data & tasks according to [this guide](https://github.com/status-im/status-security/blob/master/drafts/linux-recommendations.md),
- [ ] Use a [Good](https://www.privacytools.io/#vpn) VPN provider,
- [ ] Regularly reset or reinstall your devices & operating systems to start from a clean slate.