Cybersecurity: Protect yourself and your data

Although it is considered the least secure password in the world, many people still use 123456. You might as well step outside your house and leave a crowbar next to the front door for burglars to use. 

Seriously, secure passwords are essential for your digital security. And they actually require relatively little effort. You just need to know how to do it:

• Minimum length: At least 12 characters, preferably 20 or more
• Colourful mix: Upper and lower case letters, numbers and special characters
• Randomness: Choose random combinations. Words from the dictionary, names and certain preferences of yours or logical number sequences are easy to crack because they may already exist in hackers' lists.
• Unique: Only use each password once
• Initial passwords: Replace initial passwords immediately upon first login

Recommendations from the National Cyber Security Centre (NCSC)(opens in new tab)

Agreed, passwords with 12 characters or more are difficult to remember. But have you ever tried passphrases? If you're wondering what those are, passphrases are complex passwords consisting of random combinations of words (or parts of words) and numbers that you can remember using a mnemonic device. An example?

Passphrase: MyfanaisAlheha3bran1si.

Mnemonic device: ‘My father's name is Albert, he has 3 brothers and 1 sister.’

In the past, especially in larger companies, it was recommended to change passwords approximately every 90 days. However, this often led to weaker passwords being chosen or patterns being used. Change your password:

• If you suspect theft.
• If a service you use has been hacked.
• Once a year – as a good compromise between security and convenience.
  

Even with strong passwords, an account can still be hacked. Two-factor or multi-factor authentication provides an additional layer of security. This is recommended by the National Cyber Security Centre (NCSC)(opens in new tab).

During the login process, you must provide two things: your login details (username and password) and verification via another channel:  

• Authenticator apps: There are numerous apps of this kind, e.g. Google Authenticator or Microsoft Authenticator. As you often have a choice, it is safest to use apps from well-known providers when configuring them.
• Code or link via text message or email: Additional authentication can also be performed using a one-time link or code that is only valid for a short period of time and is sent to your registered phone number or email address. (Sometimes providers even replace the password with such a one-time login link or code that is only valid for a short period of time.) This additional verification method is considered the least secure because emails and SMS messages can be intercepted.
• Biometrics: Biometric data such as your fingerprint, Face ID or, in some cases, voice recognition can also be used for 2FA or MFA.

Passkeys are the latest generation of authentication and are set to replace passwords and 2FA in the future. But what exactly are passkeys? Passkeys work thanks to modern cryptography and use asymmetric encryption with public-private keys for your login process. – Too technical for you?  

To explain it more simply: passkeys are virtual and consist of a digital key pair – think of them as digital twin keys that are automatically created when you register with a passkey. One of the two keys is public and is sent to the provider's website (e.g. your bank, Google, etc.). The other digital twin key is private and always remains locally on your device.  

When you visit the website where you want to log in (e.g. your bank), the bank automatically asks you to verify your identity. Your device responds with the matching private cryptographic twin key. You unlock your access with your biometric data (e.g. fingerprint or Face ID) – and you're in.  

Passkeys are practical because they only work on the real bank website (the key is not recognised on a phishing site and the login fails). They are created uniquely for each website and your key never leaves your device. This makes them extremely secure, significantly more secure (and user-friendly) than even the most secure password, even if you combine it with 2FA. 

More about passkeys(opens in new tab)

Do you have trouble remembering all your passwords? They don't belong on Post-it notes or in a document in the cloud. Instead, a password manager is often a good solution. Here, too, look for providers with a good reputation and strong encryption.  

These are the advantages and disadvantages of a password manager:  

Benefits

• You only need to remember one strong master password that protects your passwords with encryption.
• It generates passwords for each account according to your specifications.
• The login details are only filled in automatically on secure sites.
• You have access to your passwords across different devices.
• It warns you about weak or reused passwords, thus performing a kind of security audit on an ongoing basis.
• No more handwritten notes are necessary.
  

Disadvantages

• As a digital service, password managers usually come with a cost.
• You are dependent on the provider in the event of price increases or network problems, for example.
• Usually requires prior installation on all devices.
• Offline access is sometimes limited, if available at all.
• If you forget your master password, you will have to go through a more or less complicated process to reset it.
• Some apps or operating systems do not support automatic filling of login details.
  

Our recommendation: Password manager from blue Security & Service(opens in new tab)

Even fraudulent online shops can appear genuine. However, like phishing emails, they have their weaknesses. Watch out for these warning signs:

• Suspiciously cheap: Are the prices almost too good to be true? Then they probably are. If a brand-new iPhone costs only half the market price, be cautious instead of jumping at the chance: cybercriminals like to lure people in with unbeatable bargains.
• Suspicious language: As with phishing, clumsy wording or poor translations can be an indication of fraudulent intentions (but not necessarily). Be aware that reputable companies usually invest heavily in a flawless appearance and professional texts and translations.
• Missing contact details: If the contact details are missing from the imprint or, on closer inspection, do not exist at all, this is a strong warning sign. A complete legal notice always includes the company name, address and usually a telephone number. If only an email address is provided, you should be sceptical.
• Reviews from other customers: What others say about the shop can be helpful. Don't just check the reviews for the items you want, but also take a look at Trustpilot or Google reviews. But be careful: reviews can also be fake. You should be suspicious if all the reviews are 5-star and the comments contain little to no detail. Or if there are lots of 5-star reviews (fake) and 1-star reviews (from disappointed customers), but hardly any in between.
• Check the VAT register: You can also check the VAT number in the VAT register, where all reputable Swiss companies are listed. If you cannot find a VAT number in the imprint or if it is not listed in the VAT register, this is a warning sign. 

Always use official stores to be on the safe side: for software, it's best to go to the manufacturer, and for apps, go to Google Play(opens in new tab) or the App Store(opens in new tab).

And feel free to check out the NCSC recommendations on ‘Buying and selling online’(opens in new tab).

Not all payment methods are equally secure online. What should you look out for?

• Invoice: This is the safest payment method, as you only pay once your order has arrived. Unfortunately, not all online shops offer invoice as a payment method.
• Prepayment and direct transfer: This is rather risky, as your money cannot be tracked and you send it before you have the product in your hands.
• PayPal: If you do not receive your item after payment, PayPal buyer protection(opens in new tab) protects you from losses. However, it is important to note which transactions are eligible and what limits and conditions apply.
• Credit card: With credit cards, you can also report fraudulent activity and complain about and reclaim any unjustified charges. The terms of use of your credit card provider or bank apply.
• Twint: As a Swiss payment solution, it is generally suitable for smaller amounts. Technically speaking, Twint is closest to e-banking, which means that money transfers cannot usually be reversed. However, transactions that are still open can sometimes be withdrawn.
• Western Union or Bitcoin: Both allow anonymous transactions, which makes it impossible to revoke them. So it's best to steer clear of them when paying in an online shop.

Before you click ‘Buy’, take a moment to check:

• Is the amount correct? Compare the price to be paid with the price in your shopping basket. Sometimes hidden costs creep in.
• Who is the payment going to? Are the names of the invoice sender and the shop the same? If not, is it a reputable billing partner? If the invoice sender is unknown or different, it is better to err on the side of caution and cancel the payment.

If something seems strange to you, trust your gut feeling. It is better to check once too often than once too little:

• Have you already made this payment? Especially with bookings (hotels, flights), there have been cases where hackers have resent paid invoices with fake payment links. So before making another payment, it's best to quickly check your payment confirmations in your emails or your bank statements.
• Research the shop: You can search for the shop on Google or other search engines in combination with words such as ‘fraud’, “fake” or ‘experiences’. You will usually find fake shops quickly.
• Ask around: Perhaps someone you know is already familiar with the shop (or payment partner) you want to order from? Maybe they have already ordered from them themselves or have read about a case of fraud.
  

A cloud is convenient because you can access your data from anywhere. Reputable providers such as Google Drive, OneDrive and Dropbox also work hard to keep your data secure: specialised security teams monitor for threats around the clock. And they have to: because cloud providers manage so much data, they are an attractive target for hackers.

When choosing your cloud solution, pay attention to: 

• End-to-end encryption: Your data should be stored in such a way that even the provider cannot read it.
• Zero-knowledge architecture: This means that when you upload a file, your data is already encrypted on your computer. This ensures that only encrypted data is stored in the cloud. If there is a data leak in the cloud, your data will be unreadable to hackers because the key is stored on your device.
• Two-factor authentication: Choose a cloud service that allows you to protect your cloud access with two-factor authentication to protect it from hackers.
• Regular security audits: The provider should have its systems regularly challenged by experts.
• Incident response: Perhaps you can find information about the provider's response speed in the event of previous cyber incidents? The faster they respond, the better.
• Storing particularly sensitive data: If you upload identity documents, financial records or similar, it is best to encrypt them yourself beforehand and protect them with an additional password.
  

What can a cloud do that local data storage cannot – and vice versa? These are the advantages and disadvantages of cloud and local data storage:

You usually only realise how important backups are when you need them. Automatic backups are worthwhile because they require little effort and offer maximum benefit.  

You can activate automatic backups in your smartphone settings. On your MacBook or iMac, you can activate automatic backups with Time Machine. For Windows backups, you can also use tools such as Acronis True Image, which create a complete system image.  

Check regularly (approximately every 3-6 months) whether your backup is still working: as a test, try to restore a current file from the backup.

Professionals swear by the 3-2-1 rule: 3 copies of your important data (original + 2 copies), 2 different media (e.g. cloud + external hard drive), 1 backup in a different location (e.g. not in the same house).  

Sounds excessive? That depends on the value of your data. If you want to store data that you definitely don't want to lose because it is unique and irreplaceable (e.g. childhood photos), this multiple backup is worthwhile.

Emails and chat histories are often forgotten when backing up data. If you have stored important information, contracts or invoices there, it is best to export your emails or data about once a year and save them to an external hard drive.

Infected backups are useless because if you restore a backup containing viruses, not only will your data be back in the system, but so will the viruses. So what can you do to keep your backups virus-free?

• Air gap strategy: The most important backup must be completely disconnected from the network so that it cannot be attacked by ransomware.
• Immutable backups: Use cloud services with ‘object lock’ or ‘legal hold’ functions. These backups cannot be deleted or modified for a specified period of time – not even by you.
• Separate backup accounts: Use a separate cloud account with completely different login details for backups. Use a different browser or even a different device for this.
• Take advantage of versioning: Cloud services often store file versions that are 30-90 days old. Even if ransomware encrypts your current files, you may be able to fall back on clean versions.