- Do not use a personal virtual private network (VPN). Personal VPNs simply shift residual risks from your internet service provider (ISP) to the VPN provider, often increasing the attack surface. Many free and commercial VPN providers have questionable security and privacy policies. However, if your organization requires a VPN client to access its data, that is a different use case.
Nice try, fed! We all know how trustworthy ISPs are. While I’m at it, why don’t I just install a backdoor for you? Maybe add a keylogger, as a treat?
Most of the advice is prescient, but this one is just stupid.
It’s more nuanced than that. Collaboration is often initiated by simple, “Hey, can we collaborate?” emails, and that’s how these are crafted to look. Legitimate emails of this sort may or may not have attached business proposals.
What is being exploited here is the banality of these kinds of routine business interactions, and it highlights where people have gotten lax in their own practices.
So while I agree that it’s essentially people not following the same standard security advice that’s been repeated over the last two decades, there’s an element of “business dealings are not exempt” that many of these and future entrepreneurs need to remember.