Tag: attack

Posted on

A new approach for 2019

I know it’s a bit hackneyed, but making New Year’s resolutions is part and parcel of this time of year. Wouldn’t it be great if everyone in security could all make the same one, to commit to doing the same thing? We’d need to bring others with us, like our IT colleagues, our enthusiastic amateur friends, and also particularly the media and marketing people around the globe.

Let’s try to see, report on and celebrate the positives, not just focus on the negatives.

The press and online media seems to be full of stories about data breaches, ransomware, data losses and other information security related catastrophes. When these occur, my LinkedIn, Twitter and Instagram feeds fill up with people talking about the breaches, how terrible they are, how companies can allow things like this to happen etc. I’m sure you’ve noticed it too. It’s almost like people are glorying in, celebrating even, the misfortunes of others.

Yes, we security professionals have a responsibility to identify weaknesses in systems and people, and try to mitigate those weaknesses. However, I think we have a greater responsibility to provide encouragement and support to our colleagues, acquaintances, friends and family. They’ve become much more aware now of the impact of their online actions, as illustrated in this story from the BBC. But many people have little or no idea how to protect themselves effectively.

If it feels like we keep having to repeat the same messages over and over, there’s a very good reason for that, which Rik Ferguson highlighted in a podcast with Jenny Radcliffe last year (2017). He said “Every day is someone’s first day online”. This is true, and I think we often forget that fact. This is why we have to keep repeating the basics, because these are new to people, and will continue to be so for years to come.

How do we change the narrative, from highlighting the negatives, to emphasizing the positives? Rather than say “there was a breach because such-and-such happened”, can we say “the breach could have been worse, but controls x, y and z helped make sure it wasn’t”? Rather than castigating individuals for missing a patch, can we not praise them for applying as many as they do? Those in the know already appreciate how hard it is to do even the simple things consistently well over the course of a year, and some things are bound to slip through the net.

I think it’s time for change. I think it’s time we recognised the excellent work so many people do. I think it’s time to shine the light on the positives.

Let’s try to see, report on and celebrate the positives, not just focus on the negatives.

Posted on

It’s a scary cyber world – or is it?

Have you ever stopped to wonder why the press use terms like “cyber attack”? Think about it for a second. Any loss of data, anyone having their passwords stolen, any bad stuff at all to do with computers is generally referred to as an attack, the language is very emotive, and is all about combat, battle, warfare etc. 

But is it really an attack? Is it really as confrontational as it sounds? Is there really so much emotion involved? I don’t think so – and nor should you. The language used is deliberately provocative, because nothing sells newspapers like bad news and scare tactics.  

Let’s take one example. You’ve probably heard about or even seen websites which are defaced. What I mean by that is that someone has amended the page so it no longer displays the text or pictures it is supposed to. Instead the text and / or pictures have been changed to reflect someone’s political or activism beliefs for example.  If that was done “in the real world”, say to a billboard or poster, we’d call it vandalism or graffiti. There’s no logical difference just because it’s on a computer. It’s not a cyber attack, it’s just vandalism. 

In the same way, data which is accessed and stolen from an online database isn’t the result of an attack: it’s theft, plain and simple.  Nation state acting against nation state could potentially be seen as an act of war, and the fact it’s carried out on computers makes no difference to that viewpoint. 

It’s easy to see how what goes on in cyber space can be seen to be traditional crimes, threats etc. Please bear that in mind when these things are reported in the media in future.