Cyber security is one of the important issues for units operating on digital platforms. In this article, VSEC will provide you with frequently asked questions when you are new to the field of Information Security.
1. Why do hackers hack?
– Cyber security is the activity of protecting computers, servers, mobile devices, electronic systems, networks, and data from malicious threats. It is also referred to as information security or electronic information security. This term can be applied in various contexts and can be divided into several common types, as below:
– Application security: focuses on keeping software and devices free from threats. An infiltrated application may provide unauthorized access to the data it is designed to protect. Security should be started buiding from the design phase, before a program or device is deployed.
– Information security: protects the integrity and privacy of data, both during storage and transmission.
– Operational security: includes processes, regulations about handling and protecting data assets. The rights that users have when accessing the network and the procedures that determine how and where data can be stored or shared belong to the scope of this protection.
– Incident Recovery and Business’s continuity: determine how an organization responds to a cybersecurity incident or any other event that causes operational or data loss. Incident repair policies dictate how an organization restores its operations and information to return to normal functioning prior to the incident. Business continuity is the plan that organizations rely on when attempting to operate without certain resources.
– End-user education: resolves the most unpredictable cyber security factor: people. Anyone can accidentally introduce virus into a secure system if they do not conform to good security measures. Instructing users to delete suspicious email attachments, do not plug in unidentified USB drives, and other important lessons are crucial for any organization’s security.
2. Who or which organization can be attacked?
The reality is that in today’s world, all organizations are at risk of cyber attacks. The digital revolution is driving innovation in business, but it also brings new threats that organizations must face to. Exciting new technologies like virtualization, AI, and Cloud, etc. help organizations enhance the integration and reduce costs, but they also come with risks and the potential for exploitation. The more avenues for exploration, the more organizations must confront a greater number of cyber attacks.
However, for many businesses, the concept of cyber security remains quite vague and complex. Although it may be part of a strategic program, what does it truly mean? And what can organizations do to strengthen their defense systems and protect themselves from cyber threats? A common misconception is that cyber attacks only happen to certain types of organizations, such as well-known technology companies or financial institutions. However, the truth is that every organization has valuable assets at stake.
The losses from cyber attacks are significant. Tangible costs include stolen money, damaged systems, legal expenses, and financial compensation for affected parties. However, what can be even more damaging are the intangible costs—such as loss of competitive advantage due to stolen intellectual property, loss of trust from customers or business partners, loss of integrity because of breached digital assets, and overall damage to the organization’s reputation and brand—all of which can have a profound impact and, in extreme cases, even lead to a company ceasing operations.
3. What is Ransomware?
Ransomware is malicious software that uses encryption to keep the victim’s information for various purposes, with the most common being ransom money. The critical data of users or organizations is encrypted, preventing them from accessing files, databases, or applications, and with conditions to request for the access right.
Ransomware is often designed to spread across networks and target databases and file servers, thus can quickly cripple an entire organization. Threats related to ransomware are more and more increasing , causing damages amounting to billions of dollars paid to cybercriminals by businesses and government organizations all over the world.
4. Black hat and White hat?
A hacker is an individual or organization that uses their skills to breach cyber security defenses. In the world of cyber security, hackers are often classified into different “hats.” This system may have originated from the old cowboy movie culture, where good characters typically wore white hats and bad characters wore black hats.
There are three main “hats” in the cyberspace:
– White Hat: White hat is like Marvel’s Captain America. They always stand up for protecting the truth, people and organizations in general by actively identifying and reporting vulnerabilities in systems before bad characters find them. They often work for organizations and take on roles such as cyber security engineers, penetration test engineers, security analysts, CISOs (Chief Information Security Officers), and other security positions.
– Grey Hat: DC’s Dark Knight and grey-hat hackers have a lot in common. Both aim to protect the trutht but employ unique methods to do so.
Grey-hat hackers are a balance between white-hat and black-hat hackers. Unlike white hats, they don’t ask permission to attack the systems, but also do not perform any illegal activities like black-hat hackers. Grey hats have a controversial history, and some even must go to prison for their actions.
– Black Hat: The Joker is the closest comparison to black-hat hackers. They engage in illegal activities for financial benefit, challenge, or simply for entertainment purposes. They seek out vulnerable systems, exploit them, and use them to gain any advantage possible.
They can use both technical and non-technical measures as long as they achieve their ultimate objectives.
5. Why do hackers hack?
Hackers are individuals or organizations who gain unauthorized access to different information technology systems with a specific objective, such as gaining prestige by shutting down computer systems, stealing money, or causing network disruption.The experience gained from these attacks and the satisfaction derived from successful attacks can become an addiction. Some common reasons for launching attacks include reputation, curiosity, revenge, boredom, challenge, theft for financial gain, sabotage, corporate espionage, extortion, etc. Hackers are known to frequently cite these reasons to explain their actions.Furthermore, a very common scenario is when hackers steal data to assume identities and then use that data for other purposes, such as borrowing money, transferring money, ect. The occurrence of such incidents has increased with the popularity of mobile banking and internet banking services.
6. How to secure your private data?
Below are some tips to ensure your personal information does not fall into the hands of wrongdoers.
a. Create strong passwords
When creating passwords, think beyond easily guessable words or numbers that cybercriminals might easily figure out, such as your date of birth. Choose a combination of lowercase and uppercase letters, numbers, and symbols and change them regularly. You should also use a unique password instead of using the same one across multiple websites. If you are worried about remembering too many passwords, a password manager tool can help you keep track.
b. Avoid oversharing on social media
We all have a friend who post too many details about his life online. This not only causes annoyance but can also put your personal information at risk. Check your privacy settings to know who is viewing your posts and be cautious when sharing your location, hometown, date of birth, or other personal information.
c. Be cautious with free Wi-Fi
Most public Wi-Fi networks are not well-secured, which means others using the same network can easily access your activities.
d. Beware of links and attachments
Cybercriminals operate stealthily and often design their deceptive schemes to make them look like legitimate communications from banks, utility companies, or other businesses. Pay attention to errors such as spelling mistakes, unusual numbers or characters, wrong brand names, different email addresses from the usual senders, as these could be indicators of a trap.
e. Check if a website is secure
Before entering personal information on a website, check your browser’s address bar. If there is a padlock icon and the URL begins with “https,” it means the website is secure. There are other ways to determine if a website is trustworthy, such as checking their privacy policy, contact information, or “verified security” seal.
f. Consider additional protection
Installing antivirus software, anti-spyware software, and a firewall may not be foolproof methods, but they are essential for self-defense against low-level threats in the “flat world” era.
Above are some frequently asked questions when new to the concept of Information Security/Cybersecurity. If there are any questions not listed above, please follow the information here to be answered,
