What you need to know about cybersecurity
Know the threats, and take steps to keep yourself and your data safe online
There’s nothing that Hollywood can’t glamourise, and in this case we’re talking about hackers. On the big screen they’re often the good guys, doing it for a cause or to bring down the villain, and they seem to be able to access anything within a few taps of their keyboard.
The reality is not quite so charming.
Black Hat hackers and scammers aren’t playing Robin Hood, and they’re not a fun punchline – their actions affect millions of ordinary people’s lives every year, causing financial loss and violating the bounds of privacy.
It might not have happened to you, but you likely know someone who has been the victim of an online malware attack, phishing scam, or ransomware. Chances are also high that an institution that carries your details – your bank, video streaming platform, even your email service – has been targeted at some point.
Almost a million New Zealanders fall victim to cybercrime each year. From January to September 2020, $14.2 million was lost across New Zealand to cyber attacks. And this number is rising.
So what can you do to protect yourself, and how do you know what to look for?
We’ve prepared this rundown for Kiwis who are concerned about their security online, to help you discover more about what the threats are, why they happen, and what you can do to protect yourself.
Table of Contents
- What exactly is a cybersecurity threat?
- Who is behind these threats?
- What cybersecurity threats should you watch out for?
- What can you do to prevent cyberattacks?
- What can you do if it’s too late?
What exactly is a cybersecurity threat?
A cybersecurity threat is a malicious attack that seeks to disrupt digital life through the theft or damage of data. It could take the form of a computer virus, a scam, or a hack.
Cybersecurity threats can impact everyone from the individual to the national level – as seen recently when Waikato DHB’s entire computer system was shut down by ransomware, causing chaos for both staff and patients. In the US, their headlines in May were also dominated by cyberattacks as their largest gasoline pipeline was shut down following a hack, leading to nationwide fuel shortages.
On a personal level, cyberattacks can destroy your data, hold it to ransom, or steal your identity. Your sensitive information could be sold online, or exploited for financial gain. The threat, although mostly invisible, is very real.
But don’t panic just yet, because as cyberattacks have been growing, so have the systems to protect us against them. There are multitudes of tools, tricks, and insights that can protect individuals against cyberattacks and safeguard your data online.
Who is behind these threats?
The actors behind these threats can vary and have any number of motivations, but there are some common categories you’ll find:
Professional hackers or scammers
Professional cyberattackers make a living off exploiting vulnerabilities in other people’s websites, online systems, and networks. Financial gain may be the most common reason behind cyberattacks. There are a number of different ways that both individuals and organisations’ data can be exploited for financial gain, such as through ransom, selling the data on the black market, or directly gaining access to financial logins and details.
This is the main category of attack that individuals need to be concerned about.
Industrial spies
Corporate espionage is a key area of concern for businesses, especially if they’re working on commercially sensitive or internationally important operations. Attackers may be aiming to exploit information for financial gain or notoriety, or to advance their own business. Attacks could be targeting patents, insights, or client information.
Comprehensive cybersecurity is vital for businesses to keep their data, patents, and client information safe. Find tips specifically for businesses from CERT (the government’s Computer Emergency Response Team) here.
Hacktivists
Hacktivists have been made famous by Anonymous, the global group of political activists who use their digital skills to break into and cause damage on government or corporate websites and systems.
Hacktivists see themselves as fulfilling a moral duty – often driven by movements related to free speech, human rights, or freedom of information. Julian Assange and WikiLeaks are other well known hacktivists.
“Script kiddies” or amateurs
Sometimes, a cybercriminal’s agenda isn’t so purposeful. It could be naive amateurs who are pushing the boundaries of what they can do online as they learn to hack, and cause more damage than they intend. Some could be just looking for fun, and in odd cases, some people just like to watch the world burn …
Criminal organisations
This isn’t your typical mafia or gangs-with-guns type of criminal organisations, but coordinated call centres of online scammers who collectively prey on vulnerable people (often older, less tech-savvy citizens).
These organisations often impersonate others in order to gain a person’s trust and manipulate them into revealing private information or handing over money.
What cybersecurity threats should you watch out for?
Hackers
Hackers use their knowledge and skill with online systems to find digital vulnerabilities and exploit them. This usually takes place remotely and could happen through a public WiFi connection, a downloadable program, or a website.
These are the main types of hacks to watch out for:
Malware & Trojans
Popularly known as a “virus”, malware (malicious software) is a type of software that’s designed to corrupt data, take over a system, or otherwise cause damage to a device or network.
In many cases, you can’t recognise malware on the surface – it looks like any other software or document download. It isn’t until it’s in your device that it starts to spread and cause damage. This type of malware is also called a Trojan for its sneaky approach, just like the Trojan Horse did in Troy.
MitM (Man in the Middle)
MitM is both the name of this hack and how it operates: the hacker is literally in the middle of a sender and recipient, intercepting communications. When done well, the sender and recipient believe they are still communicating only with one another, unaware that anyone else is privy to their messages.
What the man in the middle can do though, as he intercepts their communications, is read or change key details such as bank account numbers in order to divert funds or access private accounts. This can also be used for identity theft.
Ransomware
Ransomware is a special type of malware that encrypts a user’s files instead of destroying them, and demands a ransom to be paid in order to make them usable again. This is the type of attack that hit the Waikato DHB in May 2021.
Even if a ransom is paid, however, there is no guarantee of getting your files back.
DoS/DDoS (Denial of Service, or Distributed Denial of Service)
A DoS attack is where a server (for example a shopping website) is deliberately overloaded with purposeless traffic by criminals, causing it to crash and become unusable. This hurts real users: it is unavailable for shoppers and the business who cannot make sales suffers.
In a DDoS attack, this is done using multiple computers or other devices that may have been individually hacked and ordered to flood the specified target. Routers that are not patched are vulnerable entry points for DDoS attacks, as they are connected to multiple household devices.
This is used to take down websites by bombarding them with more traffic than they can handle (similar to the way websites can accidentally crash due to demand when tickets go on sale or Black Friday specials become available).
A DoS and DDoS attack make it impossible for legitimate users to access the website in question, and in the case of DDoS can also compromise users’ personal devices.
IoT Attacks (Internet of Things)
IoT devices such as smart home devices and wearable health monitors can be a point of entry for hackers to gain access to an entire network, if they’re not adequately protected.
Because these devices are now more common than ever, but are also frequently using out of date operating systems, they are vulnerable to attack for a DDoS mission or an inroad for data on the network.
A famous surprising example of this is the smart thermometer that was used to hack a casino in America in 2017. The internet-enabled thermometer was installed in a fish tank and connected to the casino network, to send communications about the tank’s water temperature and PH levels, but it also provided a backdoor for hackers to gain access to the casino’s high-roller database. By the time it was discovered, hackers had sent 10GB of data offshore.
Mobile App Malware
As the name suggests, this is a particular type of malware that is designed for mobile devices and commonly finds its host through the download of malicious apps. Attackers can embed malware into apps, and once downloaded it will compromise the device, giving the attacker access to personal information, location data, financial details, and more.
These apps are generally not available from the Google Play or App Store, both of which have their own protocols in place to check applications before allowing them to be distributed through their stores. Both Google and Apple provide guidance on keeping your mobile safe from potentially harmful apps.
Scammers
As opposed to hackers, who can in many circumstances take action without your awareness or consent, scammers require some participation from the victim to activate their plans.
Here’s what to watch for:
Phishing
You may know “phishing” better as an email scam, and it’s been around for about as long as email has. A message arrives in your inbox looking or feeling like it’s from a trusted authority – maybe your electricity provider, your bank, or a friend – and tries to trick you into either downloading or clicking something, or revealing sensitive information.
Some phishing scams are easy to spot – the spelling is so bad it’s laughable, the instruction doesn’t make any sense, or you’re just clearly not interested in whatever they’re claiming to have/do/help you with.
Others can be highly sophisticated, impersonating people you know and trust or making real efforts to be indistinguishable from the real thing, making it harder to tell what to believe and what not to believe.
IT phone scams and remote access software
Similarly to phishing, phone scams usually begin with someone attempting to win your trust by representing a business or organisation that you have faith in. In the case of remote access IT support scams, they’ll claim to be able to help with an issue on your computer. To do this, they’ll ask you to download a software that enables them to access your device remotely, at which point they can obtain all of your logins, personal information, and anything else on your computer.
These programs such as Anydesk and Teamviewer are frequently used by legitimate companies to help solve customer’s IT problems (we at Wireless Nation use these programs too). So how can you tell if it’s legitimate or a scam, before you give away access to your device?
The first sign of a scam is if the call comes out of the blue – if you didn’t ask for help, but someone calls and says they have to fix something on your computer that you didn’t know needed fixing, alarm bells should start to ring in your head. If in doubt, hang up and call the business back on a number that you trust to be true (from their website, a recent bill, or other official communication) to verify the issue. Don’t call back a number that the caller gives you.
This scam commonly targets less savvy internet users, and is so common that Netsafe has dedicated an article to it here.
There are a number of people, such as Kitboga on youtube who have dedicated themselves to exposing these scams (they are known as “scam baiters”). The videos are pretty long, but provide a pretty unique real-life insight into how these scams operate. The scam baiters imitate the most vulnerable possible members of society (with a healthy dose of comedy), and in turn capture information from the scammers that they pass back to the authorities. Mark Rober, a famous YouTuber has also used his massive reach to help fight these criminals organizations.
What can you do to prevent cyberattacks?
While there’s no bulletproof way to prevent an attack, there are plenty of things you can do that can help to significantly lessen the risk.
For businesses, you’ll want to engage with an IT professional or team to ensure your cybersecurity practices are up to date and effective. Protection practices and technology are evolving just as quickly as (and usually in response to) new malicious tactics. Regular consultations can help you stay ahead of the curve.
Update your devices
For businesses and individuals, one of the first things to do is ensure that your systems and programs are up to date. Updates for apps, software, firmware, and operating systems are frequently released in response to vulnerabilities being identified. Downloading the latest version of a software or app could protect you by plugging those gaps, effectively creating a stronger defense against malware and hacks.
Password hygiene
Not all hacks are sophisticated – some can even be as simple as guessing through an easy password to gain access to private information. Make sure that your passwords are long and strong, with a mix of upper and lowercase letters, numbers, and symbols. Change your router’s default admin password to a strong, unique password for protection across your household.
Change your passwords regularly, and use a secure, reputable password manager such as LastPass or AnyPass to remember your logins, rather than writing them down. A password manager also means you can use stronger, harder to guess passwords, improving security across your accounts.
Two-factor authentication (2FA) and biometric authentication (e.g. fingerprint scan, face recognition etc) are especially important for email accounts, since access to these can allow someone to reset many of your other online passwords. We recommend using 2FA wherever possible. 2FA and biometric authentication makes it harder for anyone to gain remote access to your accounts without you knowing, even if they have a password.
Antivirus software
Designed to keep your devices free from malware by blocking or disarming it, antivirus software is a must for any internet-enabled device.
A well-tested and reviewed antivirus software such as Norton, Trend Micro, or McAfee is your first line of defence against malicious cyberthreats. As well as detecting them as they arrive, it can also do regular scans to ensure that nothing has slipped through the cracks.
Caution and scepticism online
One of the best lines of defence that an ordinary person can take against cybersecurity threats is to keep a healthy caution and scepticism of everything online.
If you get an email that asks for personal information, for you to download something, pay a small fee for a large reward, or click through a link to log in, check that the email address is legitimate and from a trusted source. Double check the spelling in the email address and contents, and the likelihood of this being a genuine email. If you’re at all unsure, don’t open it, and don’t reply.
Don’t download software, attachments, or open links that you don’t know what they are or who they’re from. And don’t send any personal information over email, especially financial logins or credit card details.
Check Netsafe for a list of current scams doing the rounds, and report any scams that you get sent to Netsafe for their records and to help others.
Backups and encryption
If your files are compromised, destroyed, or held for ransom, a backup can ensure that you still have a copy of your important data so you can start again on a new (or cleaned) device without any loss.
Critical data should be backed up in three places – see more about best practices for backing up and encrypting your data in our article about Protecting Your Data Offline.
This is a good example of why it’s beneficial for at least one of your backups to have a delay, so that if your data is corrupted, it doesn’t automatically backup and overwrite the original, uncorrupted version.
Use a VPN
Although commonly used for evading firewalls, a VPN can also provide an important layer of security when accessing the internet from a public WiFi network. These networks are often unsecure, making it easier for hackers to gain remote access to both the network and any devices connected on it. A VPN hides and encrypts both your connection and data, making it virtually impossible for a hacker to intercept data between you and the access point you’re using.
HTTPS
You may be used to typing and seeing ‘www’ before any web address that you visit, but how often do you check what comes before that? You’ll see in every URL that there’s either an HTTP or HTTPS, which refers to the protocol used to send and deliver the site information. You don’t need to know all the details, just that they’re almost the same except for one key feature: HTTPS has encryption.
This encryption ensures that your browsing is safe and data is protected: whatever you input into the site is more secure than in an HTTP website. You should never enter personal or credit card information into an HTTP website under any circumstance.
To make it easier to check for this, you can try out the Chrome plugin “HTTPS Everywhere” which forces an HTTPS connection, and alerts you if one is not available.
It’s also worth noting that not all web browsers are equal when it comes to security. This article can tell you more about your options, and the pros and cons of each.
Have I been pwned
This popular website allows you to check in minutes whether your email address has been linked to any of the thousands of data breaches that take place each year – and therefore whether your own privacy may have been compromised.
It works by checking your email address against a list of websites that have been hacked or had their user information stolen. It can’t protect you against hacks, but it can be a good reminder to change your passwords, set up 2FA, and be more mindful of your activities online.
What can you do if it’s too late?
If you find yourself caught up in a scam, malware attack, or other cybersecurity threat, there are a few things you can do to lessen the damage to your data, money, and devices.
- Switch off your devices and disconnect them until you can talk to an IT Network Security Specialist and discuss your situation.
- Change any passwords on the compromised device using a different (unlinked) computer or phone.
- Call your bank immediately if you think your financial accounts have been compromised. If you’ve been scammed out of money, you can also call the police.
- Report the attack to Netsafe, so they can spread the word and prevent others from falling victim.
- Let your family and friends know that your accounts have been compromised, so they know not to trust any emails coming from you.
- Take steps to protect yourself and your devices next time, by following the steps in this article.
The consequences of a cyberattack can be far-reaching and damaging for both individuals and businesses. And as official reports tell us, they’re increasing in frequency.
Protect yourself and your data online by knowing the threats, spreading awareness, and taking steps to safeguard your connection.
Pass this article onto someone who may need it, and make the digital world a safer place.