Cybersecurity and its Effect on the Everyday Person
Cybersecurity has taken center stage in recent years as cyber attacks have become increasingly sophisticated with enormous impact on governments, businesses and individuals.
With systems becoming increasingly digitized, there is a massive cause for concern. Electrical grids, hospitals, schools and many other key organizations are all vulnerable to cyber-attacks.
The country of Costa Rica, for example, was held hostage to hackers through the use of ransomware for two months. Ransomware involves hackers encrypting an organization’s data, effectively taking it hostage until a ransom is paid, often in cryptocurrency. Costa Rica was disrupted in several ways. Public servants went unpaid and customs services were stalled, among other issues.
The United States of America is no stranger to these issues. In 2021 the Colonial oil pipeline was shut down for six days, causing fuel shortages and costing Colonial Pipeline $5 million. Not to mention the Solar Winds attack that affected an estimated 18,000 businesses and government agencies in 2020.
Cybersecurity Statistics
Hacking is a global problem. According to an article in Forbes, Ransomware hacks alone cost $20 billion globally in 2021. This figure does not take other forms of hacking or online scams into account.
In the same year, U.S. banks processed $1.2 billion in transactions related to ransomware, according to a federal report released to CNBC. 2021 also saw 50% more cyber attacks than the previous year on corporate networks.
A study also found that hackers can breach an organization’s defenses 93% of the time.
The Importance of Cybersecurity
In modern society, every aspect of daily life depends on computers. As the Colonial Pipeline incident revealed, infrastructure including electrical grids and fuel can be shut down by hackers. When hospitals are hacked, healthcare professionals are unable to access patient records. Schools in the U.S. have also been closed due to hacking.
Of course, hacking poses real security threats to governments as well. If sensitive data were leaked to foreign enemies, the results could be disastrous.
When businesses are hacked, individuals are also affected. Imagine what would happen if a bank’s computer systems were to go down for even one week. With fewer people carrying cash and using cards or other electronic means like Apple Pay to purchase groceries and other necessities, millions of people could be in real trouble.
Everyday appliances and vehicles are also becoming outfitted with surveillance technology, capturing enormous amounts of personal data that could be hacked. RSnake guest Russ Bodnyk mentioned that China wouldn’t allow Tesla vehicles into certain areas of the country due to the many cameras on those cars.
The Chinese government was concerned about the vehicles transmitting sensitive information. Recently, concerns over leaked private data collected from Roomba vacuum cleaners have surfaced. Bodnyk said, “It’s unfortunate, that level of no control over your own privacy.”
Methods Hackers Use
In a conversation with security expert Karim Hijazi, RSnake discussed some novel hacking methods. Hackers are now using legitimate programs such as free Virtual Private Network (VPN) software to gain access to networks.
“One of the free VPN providers, they have two businesses. One is to give you a free VPN and the other is to sell access to your company,” said RSnake.
Ransomware, for example, is often installed by companies doing something called penetration or pen testing. The company claims to test an organization’s security by using a program to penetrate its defenses, then uses the technology to install malware. This recently happened at the Hospital for Sick Children in Toronto, Canada. Hijazi explained that many companies do penetration testing legitimately, but there are bad actors who exploit it for their purposes.
According to an article in Bleeping Computer, hackers are also using publicly disclosed system weaknesses called Common Vulnerabilities and Exposures (CVEs). Once the CVE is disclosed, hackers are often able to take advantage of it within 15 minutes.
Hackers use a variety of other techniques. One of them, called “bait and switch” uses website advertisements that link to pages with malware.
Cookie theft occurs when hackers use electronic signatures to impersonate others. This is most common when using unprotected or public wi-fi.
Phishing is when hackers trick users into giving away sensitive personal information using fake online forms.
What is Being Done?
Understandably, industries and governments are increasingly aware of the threats posed by cyber-attacks. Hijazi said, “Governments have every reason to be concerned. There’s no Geneva convention for this type of warfare.”
As a result, organizations are spending more on cyber security. According to McKinsey and Company, $150 billion was spent globally on cybersecurity in 2021, and the market is growing.
Cyber insurance is becoming a more popular way for companies to protect themselves against losses due to hacking. RSnake guest Jeremiah Grossman led the way on cyber insurance and warranties. He has helped design warranties for cybersecurity companies to offer customers and began seeing the need for cyber insurance before others in the information security field.
Problems Facing the Cybersecurity Industry
The cybersecurity industry, like most, has its problems. One issue is talent. RSnake explained that people coming into the industry simply aren’t as knowledgeable as they were 10-15 years ago. He believes this is because people are now drawn to the industry for money instead of pure interest in the subject.
In his interview with Hijazi, RSnake also pointed out that people in organizations aren’t truly interested in finding out where their vulnerabilities are. Hijazi agreed, stating that in many cases, the person hiring a cybersecurity consultant stands to look bad when vulnerabilities are found, causing a conflict of interest.
RSnake also noted that people often aren’t paid well enough to do cybersecurity work. As a result, the best talent goes elsewhere.
Incredibly fast changes in technology can also be challenging to keep up with. In his interview with Alex Romero, Security Officer for the U.S. Department of Defense Digital Service, RSnake opined that software patches will quickly become outdated because they take too long to implement. Romero agreed, saying it can take days or weeks to patch a vulnerability. “That’s days worth of a window of opportunity that can be exploited. And that time is gold for an attacker,” he said.
The Takeaway
The threat of cyber attacks is very real, and it has already affected people around the world. Individuals and organizations would be wise to educate themselves thoroughly on this important issue. To find out more, start with this episode.