Almost every day, we go online so we can keep in touch with the world and based on our interests, we either watch news, stock market, or spend time on social media and look at what is new and who is doing what? What is happening around us, what is the latest & the greatest, what are the new inventions, ideas and trends? Professionals go online to stay updated on the professional front.

Sharing posts about where we are and what we are doing keeps our near and dear ones excited and updated. Of course, it keeps us motivated.

Reports indicate that just few years ago, almost 80% smart phone users were using phones with location services enabled, the trend has now changed in the western world but in developing countries, still a very large number of users are not aware about the location services and privacy. Those in the IT world have known for a long time that every time we go online, we are leaving our digital footprint out there.

Some of us also think what all is secure and what is not so secure? When people innocently share their kid’s birthday photos, school graduation pics with other details, they do so thinking there is nothing to worry about! They think who is looking at these details?

But, little they know while staying online is a need but then staying secure while online is also a need. It is like driving on the road, while there is a need to be on the road to travel from one place to another but there is also a need to take all precautions to stay safe on the road.

Let us talk about Cyber Security – this is something that needs attention of everyone because in today’s day and age, Cyber Security must fall into everyone’s “need to understand and comply” scope.

Today all across the world, businesses have their presence online – directly or indirectly. Majority of business have some presence online When all our clients are online, where else would we promote our business? So, many of the marketing campaigns are happening online.

All these businesses also need to understand, and follow cyber security norms and stay safe. What all are we sharing online in our marketing campaign?  For example, If we are sharing our IT/Network structure, hackers will know how to crack it.

Simply put, all the information put out online is “publicly available information”. In the world of cyber security, this is called open source intelligence (OSINT). Here, open source means that the sources that provide information are open/public. OSINT is an important part of Recon (Reconnaissance).

Different stages in Cyber Security are,

1. Pre Security
2. Offensive Pen testing
3. Cyber Defense

For Cyber Security professionals, working at any of the above stages, Recon is the very first step taken whenever they get ready to perform Vulnerability Assessment or Penetration Testing. While Active Recon includes direct interaction with the target, Passive Recon includes finding and using the information available on the web.

For Passive Recon, there are some very powerful tools available that will check the target’s online presence, from various different domains, social media platforms, what all has been shared, when it was shared, patterns are set and noted, Pictures and Videos are retrieved and these tools help Cyber Security professionals put very important, and sometimes, private and sensitive information together. These professionals are then able to join the dots and infer the underlying secrets/information.

OSINT or Recon tools are not magical. They only pull out publicly available information and put it together for these professionals to join the dots. Many a times, to start the Recon, all the professionals have with them is a name, or if they are lucky, an email address, or a domain. They start digging with it and in very little time they have a great amount of intel with them.

Once they know something like a website they can use, they will try and find out weaknesses, if any, that they can exploit. This is the process of Vulnerability Assessment. A part of the website might be weak/vulnerable or using some outdated technology, and becomes vulnerable.

Once a vulnerability is found, the next process of Penetration testing begins. Here, those vulnerabilities are targeted and exploited. The experts try and get into the target’s network, system, database, based on the type of vulnerability. Once they are in, they will try and exploit it, causing damage to the target’s  assets. Many a times, cookies from a device give away access to sensitive data.

To stay safe, it is important to clear your browsing history from time to time. Delete all cookies from your device from time to time. When you are using your browser to look at confidential, private or sensitive information, it is not a bad idea to use Incognito mode. Today we have the options available for using encrypted emails.

Firewalls will protect you when you are approached from an unknown website. Antivirus software are available for your further protection and there are range of protective software available. These are the most common, easily available and easy to implement security measures that we should follow.

As a common practice, companies pay the ethical hackers to find vulnerabilities in their system and some companies even pay them to penetrate into the company’s internal assets and see what kind of exploitations are they vulnerable to. If hacker is able to find vulnerabilities on the target’s request, the proof is shared with the target to enhance the security and eliminate the vulnerabilities.

To summarize, we agree that staying online is a need and that staying secure while online is a need too. Cyber Security, I think, should have a place in everybody’s “need to understand and comply” scope.

Stay Online, Stay Safe!

Author: Shital Rai

LinkedIn: www.linkedin.com/in/shitalrai

Our world is becoming more and more dependent on digital technologies. In my previous blog, Alert:You are being watched!, we looked at how vulnerable we are and hence the need to stay alert while we are online . While digital technology is creating lot many opportunities, it also brings the perils of cybercrime, which is affecting organizations and governments all across the globe.

The most challenging part with cybercrime is that the risk landscape is constantly changing. As technology advances, this challenge keeps intensifying. As existing hacking tools enhance and new tools come in to play, securing networks becomes more challenging.

Cybersecurity is the only solution to protect your digital data and resources by mitigating security threats and vulnerabilities originating from cybercrime.

So, what are we dealing with?

Some of the most common cyber security threats are ransomware, malware, phishing and theft of personal and confidential data etc. Data breaches tops the list.

 Phishing and Trojan Horse attacks: Attacker sends malicious emails that appear to be originating from credible sources such as banks or similar credible organizations. When the recipient opens such emails, and/or attachments and/or clicks on a link in it, the malware enter target’s network and steals or damage personal, sensitive and confidential information, customer details, intellectual property and more. Hackers might steal, delete, or corrupt data. Stolen data is either used for by hackers for their intended purpose or it might even get posted on the DarkNet for sale, or just get posted online for anyone to see.

• DOS – Denial of Service attacks: In a DOS attack, hackers penetrate into target’s network and they send so many messages that overwhelms the target’s network system, this prevents the authorized users from getting an access to the system and can create server outages and monetary loss and undue excessive pressure on the IT staff.
• Ransomware: As the name indicates, the purpose of this type of attack is to hold the target to ransom. Hackers penetrate into target’s network and they encrypt data files on the target’s network. A ransom in terms of monetary payment is demanded in exchange for access to data files.

    So, what all can be done to protect ourselves?

Many insurance companies offer cybersecurity policies that provide coverage from activities such as identity theft, unauthorized transactions, and more. Two types of coverage is generally available.

(1) Vendor Indemnity Insurance for cybersecurity vendors and
(2) Third-Party Cybersecurity Insurance for businesses with a risk profile higher than average.

The cost on these policies can be extremely high because of the frequency of attacks.

Below are some very simple and easy to follow recommendations that can go a long way.

1. Restricted Access Policy- Employees  should have access to only the part of data they need to work with. Access to data and resources should be on need-to-know-basis.
2. Keep operating systems and other software up to date. An outdated software can become an easy entry point for hackers.
3. Strong Password. It is a good idea to to have 12 characters password that has upper case letter(s), lower case letter(s), number(s) and special character(s).
4. Network administrators to ensure safety of the network by frequently changing network passwords.
5. Install firewall and protective software like antivirus, antimalware, antispyware.
6. Regularly scan devices for malware
7. Train all employees on cyber security.

    If you rely on the internet for communication and for carrying out daily operations, you must use cybersecurity measures to safe guard your data and resources.

Author: Shital Rai

LinkedIn: www.linkedin.com/in/shitalrai

You can protect yourself against a large number of Phishing Attacks by adopting following behaviors/practices:

• Always hover over the link in an email to see the destination URL before you click on it. Many times the email link would show legitimate name but on hovering, it would show the real name/ real destination
• Before taking suggested action, always scrutinize the content of the email. If unsure, do not take immediate action, talk to someone who knows better
• Ask your elders/ teachers if you are unsure about the legitimacy of an email on which you want to act
• Scan all hyperlinks in incoming email messages to determine if they’re malicious
• Don’t depend browser’s Block or Allow lists, especially since attackers can exploit legitimate sites and services to evade these lists
• Implement advanced email security that can analyze the nature of an email message and ascertain its true intent.

A generation ago, IT and digital media were niche skills. Today, they are a core competency necessary to succeed in almost all fields.…

Let’s face it, Technology is impacting all areas of our lives and this impact is accelerating every day. So much so that Experts are predicting that 90% of the entire population will be connected to the internet within next 10 years. Experts are also predicting that almost 90% jobs of future don’t exist today. With the internet of things, the digital and physical worlds will soon be merged. While these changes announce new & exciting possibilities but at the same time, they are also creating uncertainty & insecurity.

Excitement– because these changes are creating huge opportunities and Insecurity– because our kids are exposed to huge risks at the same time. Risks that are very real, such as, cyberbullying, undesirable, obscene and violent content, radicalization, hacking, identity theft, scams etc. The problem becomes critical because the digital world is changing too much and too fast. And practical issues in updating the school curricula, the slow pace of internet governance and policies for protection of kids is adding to the problem.

We must also be equally concerned about the digital age gap. The usage of technology by kids and by adults is very different which makes it difficult for parents and educators to fully understand & appreciate the risks and threats that kids are exposed to online. As a result, adults are not able to advise children on the safe and responsible use of digital technologies.

So how can we, as parents, educators and leaders, prepare our children for the digital age? Without a doubt, it is critical for us to equip them with skills of the 21st century. As Parents, educators & leaders, we must use encourage our kids to acquire the digital skills and skills of the 21st century. And championships such as COMPUDON JUNIOR solve part of the puzzle by giving kids the needed digital literacy skills.

Credits: World Economic Forum Report July 2019