What is cybersecurity?

Cybersecurity is news once again. After the Log4j flaw and the attempts of many attackers to exploit its vulnerabilities, ransomware hits the headlines again. Many experts warned about attackers scanning for vulnerable systems, installing malware, and stealing user credentials. With this breaking news in mind, let's revisit cybersecurity.

 

Cybersecurity, also known as computer or information technology security, establishes how we protect computer systems and networks. That refers both to the hardware and software parts of the aspect. The idea behind cybersecurity is to avoid information disclosure, theft, or damage, among other things.

 

Computer security also prevents or attempts to prevent unauthorized individuals from disrupting or misdirecting a private computer or system. With the increasing number of users, vulnerabilities grow, and the bounties look more promising each day.

 

Cybersecurity is one of the most challenging areas in IT and technology. Innovations like the Internet and wireless networks (Bluetooth and Wi-Fi) are both a blessing and a curse. Today, most of our smart devices can be exploited by remote actors with potentially bad intentions.

 

Cybersecurity not only affects daily users like you and me. Organizations, both private and public, often suffer the attacks of hackers and cybercriminals. Even the NSA hacking tools have been hacked, and as there was an arms race during the cold war, today cyberwarfare follows the same logic between the powers that be.

Cybersecurity by specialists

There are many cybersecurity experts nowadays, and many know how hacking works and use it for good. Thanks to ethical hacking, we have higher security standards created by people that know all about this topic.

 

That is why I wanted to bring some of the basics presented by said specialists to make your time on the Internet safer. In his TED Talk, Nick Espinosa describes the five Laws of Cybersecurity.

 

• Law #1: If there is a vulnerability, it will be exploited.
• Law #2: Everything is vulnerable in some way.
• Law #3: Humans trust, even when they shouldn't.
• Law #4: With innovation comes an opportunity for exploitation.
• Law #5: When in doubt, see Law #1.

 

As you can see, these laws are really all connected. Our excessive trust and failure to assess risk provoke a landscape full of vulnerabilities that can be rapidly exploited, many times without us noticing. That is why being up to date and taking cybersecurity seriously can change your internet experience.

 

Anyway, the Internet has given us so much more than just malware and scam emails. Today, maybe more than ever, we can learn from the best online. That’s why I also link to some hacking questions from Twitter answered by Amanda Rousseau on YouTube.

 

Among other things, she presents different kinds of hackers. While they all have extensive knowledge about breaking into computer networks and bypassing security protocols, the difference stems from what they do with that knowledge.

 

• BlackHat: these are malware writers, fueled by personal or financial gain, involved in cyber espionage, protest, or perhaps just having fun by wreaking havoc. They can be amateurs or professionals searching to steal data, financial and personal information, or login credentials. They might even be interested in modifying or destroying data as well. TL;DR? The baddies.
• WhiteHat: these are portrayed as the good guys, also known as ethical hackers. They usually work as security specialists that look for vulnerabilities using the same methods as black hats but towards an entirely different goal. Their duties involve penetration testing, vulnerability assessments, and in-house training.
• GreyHat: this kind of hacker will often look for vulnerabilities without the owner’s permission or knowledge to report them in exchange for a fee for fixing the issues. While we can find an assortment of people, the activity is still considered illegal because they do not have permission from the owner.

 

Even if we tend to put all hackers in the same bag, some use their abilities for good, trying to create a more secure digital world for all of us.

 

Every system has vulnerabilities and needs constant protection and upgrades. So let's review some good practices that can help you attain a higher level of security.

Cybersecurity data

The ever-changing evolution of the digital and technological world drives companies to keep taking more precautions regarding computer security, no matter the organization's size.

 

The digital transformation that businesses are experiencing shows a future of constant renewal and new challenges. This exponential growth of the digital age and network connectivity, without a doubt, also compromises the security systems of structures and organizations.

 

This wild reality still finds several companies at an immature stage in computer security, even with threats with more sophisticated planning and better execution each day.

 

The data speaks for itself: according to Interpol, in just four months of 2020, a private business associated with that office detected 907,000 junk mails, 737 malware incidents, and 4,000 malicious URLs, all of which were generated after COVID-19. "A further increase in cybercrime is highly likely shortly. Vulnerabilities related to working from home and the potential for increased financial benefit will see cybercriminals continue to ramp up their activities and develop more advanced and sophisticated modi operandi," states Interpol.

What is a cybersecurity audit?

A cybersecurity audit is a mechanism that identifies the chances of a potential vulnerability in an organization's IT infrastructure. After reading the segments above, you must already know. If you can't find any breach in the system, you have not searched enough.

 

The process includes an audit of all assets, networks, and data flows, an analysis of the overall perimeter security plan, and assessing all hardware and software, including updated policies to build a technical proposal with a fully-fledged improvement.

 

With the ever-changing evolution of the digital and technological world, security audits are usually performed biannually. The audit report should list the recommendations to optimize the company's computer security and establish one or several protocols to follow in case of an attack. It is not only preventing attacks but also calculating damage control.

How to perform a cybersecurity audit

A cybersecurity audit comprises different phases depending on the company's infrastructure.

Web audit

A web audit is meant to discover what level of security a website and its corresponding server have, for instance, if it is vulnerable to a virus attack when someone enters the site. It also checks if the site uses the HTTPS protocol indicating a secure server and has any bugs (an error in the code) that may lead to a security breach.

Code audit

Code audit refers to testing the quality of the code used by a company's applications, whether they were developed in-house or by third parties. The aim is to identify vulnerabilities.

Ethical hacking

Ethical hacking is a mock —and authorized— cyberattack designed with hacking techniques to determine a system's level of vulnerability to this type of attack. Here is where white hat hackers come into play or events like hackathons aimed at providing better security.

Network audit

Network audits involve assessing the Internet connection and mapping the company's network. Its purpose is to understand how someone could find their way into the network to attack it. Once this information is available, replace any obsolete devices, perform firmware updates of all mobile devices and operating systems, and apply security filters.

Social engineering

Many cyberattacks succeed because of negligence or excessive trust from employees (see the laws above). Opening a virus-infected file is like leaving your keys in the lock.

 

Lack of knowledge is often fertile ground for phishing or malware, attacks designed with advanced social engineering (Red button! Monkey press!) to break into personal or work devices. These techniques involve deceiving people into sharing personal and confidential information on the web, such as passwords and credit card numbers.

 

Identity theft is not a joke, Jim! Millions of families suffer every year.

Password audit

More often than not, users choose vulnerable or extremely basic passwords to remember them. (Avoid birthdays, special dates, repeated numbers, obvious combinations, or any four-digit pin, if possible). Nowadays, any hacker can decipher an insecure password in just a matter of seconds, what might take you days a computer can do in an instant.

 

At Awkbit, we assume that every lock can be picked, every wall breached, and every system hacked. We are not saying that it is better to leave the door open; installing safe systems and performing regular maintenance help us protect our clients. Thanks to our open-source mindset, we have a shared interest with the community to deliver secure systems with as few vulnerabilities as possible.

 

Do you want to sleep as if renting a room in Fort Knox?