Computer Security Day

What the day is

Computer Security Day is observed on November 30. It was established in 1988 by a computing professional association to push security awareness out to ordinary users rather than specialists.

Origin and background

The timing was not a coincidence. On November 2, 1988, a graduate student released a self-replicating program onto the early internet. It exploited known weaknesses in widely used software and was, by the author's account, intended to measure the size of the network. A flaw in how it decided whether to reinfect a machine made it multiply far beyond anything intended, and it disabled a substantial share of the machines then connected.

The consequences shaped the field. The author became the first person convicted under the United States computer fraud statute, and the scramble to coordinate a response led directly to the first computer emergency response team, which remains the model for handling vulnerabilities today.

The advice worth acting on has narrowed considerably since then, because the attacks that actually reach people have narrowed too. Nearly all account compromise begins with either a reused password or a convincing message, not with anything technically sophisticated.

That points at three measures carrying most of the benefit. Unique passwords on every account, which in practice means a password manager. Multi-factor authentication, ideally a passkey or hardware key, since codes sent by text can be intercepted by taking over the phone number, though text codes still beat nothing at all. And prompt updates, because the vulnerabilities exploited at scale usually have a patch available already.

Backups belong beside those three, as the only defense that still works after something has gone wrong.

How to take part

• Install a password manager and replace your reused passwords, starting with email.
• Secure the email account first. Whoever controls it can reset everything else you own.
• Turn on multi-factor authentication, choosing a passkey or hardware key wherever it is offered.
• Apply pending updates on every device today, including the router nobody ever updates.
• Test a backup by actually restoring a file from it. An untested backup is an assumption.
• Slow down on any message that manufactures urgency. That pressure is the technique.