Hemingway said that no man is an island. Nowadays, opening our windows to the world does not merely let in fresh air; it is absolutely essential. But the process cuts both ways. We gain access to the world, but the world can also gain access to us. There would be no cause for concern if everyone were good, but… as the Roman emperor of Hispanic origin Marcus Aurelius observed some time ago: “To expect bad men not to do wrong is madness, for he who expects this desires an impossibility”. Marcus Aurelius did not live in the age of the Fourth Industrial Revolution, but he knew a thing or two about human nature, and that brings us to cyber-security.
The Royal Spanish Academy (RAE) defines security as the quality of being secure, and secure as being free and exempt from risk. The RAE does not make it easy. I cannot think of many things that are certain. Death? Taxes? Einstein spoke of human stupidity… but let us leave it there. We can narrow down risk according to its source. If we open up to the world and connect to the computer network, the associated risks fall under the heading of cyber-security.
Do not imagine that this window on the world was opened very long ago. The Internet is a set of communication networks that can connect to one another because they use standard protocols. Rather like recognising that we are more likely to understand each other if we all speak the same language than if each of us speaks our own. It was born around 1969, when three Californian universities linked up by establishing the first connection between computers (ARPANET). Today we assume that the famous www.meconecto.com has always been there. Not so: the World Wide Web is a service (one of many) created later, in 1990, which uses the Internet as its means of transmission and whose purpose is to allow files to be consulted remotely. From then on its growth was utterly exponential, and it has become so much a part of everyday life that today, when we talk about the Net, as with football, we all claim to know what we are talking about.
Does cyber-security matter? It may seem obvious, but apparently some people do not think so. Or rather, given the number of attacks there have been this year alone and their high success rate, it seems that for many people cyber-security was simply not a priority. Given the serious consequences, that is changing. It is always good to learn from other people’s mistakes. It is less painful than learning from one’s own.
As a good friend of mine, a leading expert in cyber-security, used to say, the best protection against cyber-attacks is to be irrelevant. A flowerpot can always fall on our heads simply because we happened to be passing by, but it seems more logical to assume that anyone deploying powerful and costly resources to break through defences and reach the information hidden behind them will do so when the prize is valuable enough to justify the effort. It would make sense for the effort put into protection to be proportionate to the value of the information being protected. Let us not lose sight of this point: what cyber-security protects is information. Information that can reveal our personal data and passwords, allow someone to transfer our money, record us, control industrial processes, or gain access to the control room of a nuclear power station or an air traffic control centre. It is information, but the consequences can be very physical and very serious. Let us look at a few:
The NSA, or National Security Agency, is one of the best-known US intelligence and security agencies, alongside the FBI and the CIA. This year, a group of hackers calling itself the “Shadow Brokers” claimed to have hacked it (the RAE dictionary already includes the word hacker in the sense of a computer pirate, but I have not seen it admit the verb hackear for the hacker’s act of piracy. All in good time). What did they steal? According to them, a tool that takes advantage of (exploits) a vulnerability in the Windows system. The tool is called EternalBlue. What was the NSA using it for? I leave the answer to the reader’s imagination, but I would like to highlight one thing: this tool, as the Shadow Brokers describe it, sat inside a program (Windows) used on a massive scale. Do you have Windows? Hmm.
Last May, a particular type of virus became famous. It was called WannaCry. It is a virus of the ransomware variety, a name that comes from ransom. Its aim is to lock up systems (hold them hostage) or threaten to publish sensitive information unless a ransom (ransom) is paid. We all know the most striking cases. Companies such as Telefónica and the British National Health Service suffered its effects. The impact could have been serious. Imagine the possible implications of delays to surgical operations and the like. The ransom demanded was tiny, and the US authorities said it very probably originated in North Korea. What was someone with the capabilities of a State looking for? Money, it seems, was not the answer.
A comment on what I said above about not taking cyber-security seriously. The WannaCry virus is said to have entered systems through EternalBlue. Microsoft issued a warning and published the fix (patch), known as MS17-010, in March this year. WannaCry arrived in mid-May.
Information is important; the moment (timing) even more so. Two days before the French presidential election, hackers dumped several gigabytes of information online. It contained emails from members of the party of the man who is now President, Macron. The timing was no accident. It fell squarely within the two days of reflection before the vote, when the parties could no longer campaign. The damage was done; the task was to limit its effects. Macron’s response was not bad. His team acknowledged the data breach (leak) and warned that not everything that had been dumped was genuine. That is the advantage of learning from other people’s mistakes. Just ask Hillary Clinton.
Francisco Canos
Article published on 31 October 2017 in:
