What security experts use to be digitally secure

How do New York Times staff members use technology in their jobs and in their personal lives? Bill McKinley, executive director of information security, and Runa Sandvik, director of information security, discuss the technology they are using.

What are your biggest concerns about security of the New York Times newsroom these days?
This is a difficult challenge for us. The landscape is ever-changing, and the threats we see today will likely evolve into something more difficult to defend against tomorrow.
Our mission is to help the newsroom protect its communications, data and sources.
Last year, we helped set up The Times’ Tips page, which includes SecureDrop, outlined ways to safely work with the information we receive and built a security awareness programme that is unique to the newsroom.

We provide tools and training, and focus on helping the journalists address the challenges that they are facing.

However, tools and processes will only get us so far. The biggest concern will always be that a source is burned or that a journalist’s life is in danger.

How do you vet tech products to protect journalists and editors from cyberthreats?
The products that we recommend to the newsroom are the products we use ourselves, such as Signal for secure mobile communications.

Before we use or recommend a product, we make sure we understand how it works, its limitations and how it protects our users.

Is it easy to use? Has the product been reviewed by other security researchers? How many people are using it? We look at all these issues.

What’s one tool or product that you have found to be effective in
protecting the newsroom, and why does it work?
Journalists often need to click on links and attachments from people they don’t know, and it’s our job to help them do so securely.

One product that is effective in protecting against phishing of online accounts is the Security Key, which is a physical device that connects to your computer just like a thumb drive. The key is supported by both Google and Facebook.

The Security Key can be used as an alternative to SMS or an authenticator app for two-factor authentication, which is a way to secure your accounts by requiring not just your username or password, but something you have. The key uses cryptography instead of randomly generated codes and works only with the sites that it’s set up to work with — not look-alike sites that might’ve been developed with malicious intent.

What is your biggest tip for people for protecting their online security and privacy?
The best things you can do are to use a password manager, set up two-factor authentication on the sites that offer it and keep all software up to date. Doing so helps secure access to your online accounts and limits your exposure to phishing and malware.

A password manager, such as 1Password, LastPass or Dashlane, helps you create unique, strong passwords for all your websites and securely stores the passwords for you — no more passwords in emails, notebooks or on Post-it notes.

To ensure that your accounts remain secure even if the password manager is compromised, set up two-factor authentication where available and configure your devices not to remember your passwords.

Two-factor authentication helps you protect your accounts by adding a second step to the login process. In addition to your username and password, you also present a second factor such as a Security Key or a random code from your mobile phone.

Logging in will then require a combination of something you know and something you have, so no one can get into your accounts without both things.

Software updates contain more than just new features, emojis and dog filters — they can also contain fixes for security issues that researchers have discovered.

Keeping all software up to date and rebooting when necessary is one of the easiest things you can do to ensure your devices are as secure as possible.