It’s time to take the protection of your data an IT systems beyond your technical team, says Pete Roythorne at Three-sixty
I recently found myself in a room full of techies listening to a journalist talking about cyber security. The journalist – Misha Glenny – argues that “the tech” is just one part of the cyber security landscape; and that everything from politics to anthropology also plays a major role in what we are currently experiencing.
The reaction, in many ways, was predictable; some of the audience were moved others said his presentation was little more than scaremongering. Interestingly the more “marketing” focused people I spoke with found the deepest connection. But having stood with my feet in both camps, here’s why I agree that we currently stand at a junction of our digital futures, and how the decisions we make in the very near future will dictate whether the digital world we are building around us either enslaves or frees us.
Data beach and data protection is just the tip of the iceberg
Let’s be honest, while total security is an impossible dream the tech side of making our networks more secure is not that difficult to cure – put simply you need to do the basic. Various reports I’ve read state that 90%-plus of all security breaches can be prevented by ensuring patches are up to date and basic security protocols are adhered to – such as removing admin rights and employing a simple layered security approach.
Changing the way we think – security is everybody’s problem
We can no longer sit by and leave the fight against cyber crime to our already overworked colleagues in IT. We need to take responsibility – every one of us, from the CEO down. IT are faced with the task of defending against every possible weakness, whereas the bad guys just need to find one vulnerability and they’re in. It’s a losing battle, unless we’re all on the look out.
One of the biggest threats we currently face comes from human error and the susceptibility to social engineering. Email is still the most popular attack vector for cyber criminals, and people generally are still too quick to click on links or open attachments in emails even if they are unsure where they have come from. This is the way of the old confidence trickster, and we need to train our staff how to spot a con.
Guarding against the petty cyber criminals
However this is just the start, and for many the boring bit. Much of what we see with ransomeware today is just lowest common denominator stuff. Petty criminals working a numbers game (the rise of Cybercrime as a Service means literally anyone can buy and run an exploit kit). I read a stat once that claimed cybercrime emails had as good an open-and-clickthrough rate as most marketing campaigns. Read into that what you will, but what it does mean is that if you send 1 million emails you’re going to get a pretty good return for your investment.
Fortunately, we still have a secret weapon up our sleeves – backup! If you get hit and you just backed up your machine yesterday, there’s no need to pay, just recover from your backup. But this does mean you need to be sure it works. Yes there are nasty persistent variants that get into your system files, and infect connect drives, but the reality is these are still few and far between.
The problem is that from here things start to get darker…
Turning to the dark side?
What we have talked about up to this point is really just data security – cyber security is a much bigger and more worrying picture.
Over the past couple of years we have seen allegations of nation states being at the centre of data and sentiment manipulation over Brexit, as well as elections on both sides of the Atlantic. Fake Facebook pages have also been targeted as intentionally stirring up religious hatred in the wake of various terror attacks.
The reality is that we live in a time where it has never been easier to control public opinion. Fake news abounds on both side of the fence and even news agencies can be mislead with potentially catastrophic results. In 2013, Associated Press tweeted that explosions in the Whitehouse had injured then President Obama, instantly wiping $90 billion off the US markets. Blame for the tweet was eventually put on the Syria Electronic Army.
Digital is the new front line
The current cyber spotlight at a nation state level seems to be squarely on the Russians (they’ve even been blamed for the attacks on the winter Olympics). And it’s not just the paranoid delusions of the looney left powering this. The much vaunted Gerasimov doctrine, the brain child of General Valery Gerasimov, sets out that as Russia can no longer compete with the US on solely tactical basis it must turn to technological, information, diplomatic, economic, cultural and other tactics. This “political warfare” is preferred due to its comparatively low cost.
Naturally this is also double-edged as putting it out there also serves to intimidate and worry your rivals. Thanks to the recent Vault 7 inspired attacks such as Wanna Cry and Petcha we know for a fact that the US has been weaponising malware. Digital is the new front line.
Our weakness for social
But lets bring this back closer to home. Much has been written about how social networks allow us to surround ourselves with people who simply reinforce our own opinions, so we are never challenged and we never question what is out in front of us. We’ve all known for years that the internet is home not only to brilliantly informative and genuinely insightful material, but also to crackpots, frauds and liars. A discerning eye and critical eye has never been more important.
Social media is also responsible for another ill; we share too much. Our obsession with social media (and a lack of understanding of its limits) means that for anyone looking to employ a bit of social engineering, it’s all out there. It’s relatively easy for the bad guys to use this information against us, whether it’s to enable CEO fraud – you know what a company is doing simply by looking at its Twitter feed, Facebook page or it’s blog – or trolling, cyber bullying, threats and identity theft.
Time to wake up?
And why is this happening? Because we think cyber security is boring and because we generally bury our heads in the sand and believe everything that’s put in front of us. What we need to do is wake up. With so much of all our lives in the digital space we should all take cyber security as seriously as we take our personal security. We must take responsibility for our own security online, and not leave it to someone else or to chance.
We must look beyond the techie stuff and think about what it is we’re actually doing rather than glibly trying to push the onus of security onto those around us – whether that be the IT team, Facebook, or the Government.
About the Author
Pete Roythorne is a partner at technology content and communications specialists Three-sixty