The term cybersecurity refers to all the practices and tools that can be used to protect people and the tangible and intangible IT assets of states and organizations. Given the financial stakes linked to the vulnerability of Information Systems (IS), every organization must ensure the security of its IS.

What is an information system?

An organization’s information system is the set of assets used to collect, classify, store, manage and disseminate information within an organization. Whatever the type of data, every information system must respect 3 essential principles:

• Confidentiality: Data confidentiality is the protection of communications or stored data against interception and reading by unauthorized persons.
• Integrity: Data integrity refers to the state of the data, which must not be corrupted or destroyed, intentionally or accidentally, during processing, storage or transmission.
• Availability: This is the ability to make information accessible to authorized persons. The infrastructure is used to store this data. But how?

Infrastructures and easy living

For a long time, our work environment consisted of a hardware infrastructure with on-site servers, which hosted the company’s data locally. Today, faced with the imperatives of mobility and accessibility to information, our work environments are becoming dematerialized. Companies increasingly use solutions stored in the cloud: this is what is called virtualization.

Virtualization means having the machine fleet, the network and/or the software in a virtual environment: the cloud. The server is now remote. It is accessible online via a secure Internet connection.

Three technical arrangements exist to meet different needs:

• IaaS (Infrastructure as a Service): allowing the outsourcing of the IT hardware infrastructure. It is therefore now possible for companies to delegate to a provider the installation of file servers, networks and the storage of their data via a subscription. Unnecessary equipment purchase and maintenance costs are thus avoided.
• PaaS (Platform as a Service): PaaS consists of outsourcing not only the hardware infrastructure, but also middleware applications such as operating systems, databases and web servers.
• SaaS (Software as a Service): this arrangement allows companies to use several applications accessible online. Tools are notably offered by Google (Google Apps) and Microsoft (Office 365) that accelerate the integration of collaborative work. CRM (Salesforce), ERP (Infor, NetSuite, Workday…) and HR (SuccessFactors, Talensoft, Cornerstone) solutions are also available in SaaS mode.

And security?

The number of companies adopting IaaS, PaaS or SaaS devices to manage their data increases year after year. This rapid growth shows that companies are more and more willing to trust these solutions. These same companies continue to express a certain mistrust, given the current context and the various incidents reported to the media by some large companies, as was the case, for example, with the security flaw in Google+’s development code discovered in March 2018. This flaw would have allowed hackers to access nearly 500,000 Google+ accounts within two weeks. And there are many examples…

Hacking, but why?

A hacker is anyone who takes advantage of the vulnerability of an IS to access private data. It should be noted that there are three types of hackers: Black Hats, Grey Hats and White Hats. I will elaborate on the criteria that distinguish each of these three types of hackers in a second article, but what is important here is to focus on the motivations of malicious hackers.
In general, hackers steal your private data for the following four reasons:

• Your data is worth gold: Your credit card number, your date of birth, your favorite books or your most recent foreign destinations are all information that a hacker can convert into cash.
• Industrial espionage: Stealing information about a competitor’s products and services gives you an advantage on the market.
• Revenge: Some hackers have political or social motivations. These activist hackers seek to draw public attention to an issue, either by making unflattering information about their target public or by dismantling all or part of their target’s IS.
• Digital warfare: Entire nations engage in state-sponsored hacking to obtain commercial or national intelligence in order to destabilize their adversaries’ infrastructure, or even to sow discord and confusion in the target country.

You can be the vector of a cyberattack without knowing it!

In most cases, the human being is the weak link of the IS. The lack of vigilance of its victim or a few moments of inattention on an IT device is what hackers rely on to create a flaw in the system.

Here are a few examples:

• Human error

A very harmless act can have very serious consequences: leaving a session open, opening an email from an unknown source, clicking on an unsecured link are all ways of inviting a hacker to access your data. Never forget that a hacker is fundamentally a manipulator! Hackers have a lot of imagination when it comes to finding ways to contact you, and that is how they will mislead you.

• The use of gadgets

1. The MalDuino: is an Arduino-powered USB device that has keyboard injection capabilities. Once plugged in, MalDuino acts as a keyboard, typing commands at superhuman speeds. A few minutes in front of your machine are enough for the hacker to download all your data.
   
2. The WiFi keylogger: Yes, size matters! Because with dimensions of 10 mm x 10 mm x 15 mm, it is the smallest USB hardware keylogger ever available on the market and is able to download data remotely: reports by email, FTP backups and live web streaming in access point and WiFi client mode and timestamp mode. Imagine if someone managed to insert this little gadget into your desktop computer, for example?
   
3. The WiFi PINEAPPLE: is a powerful wireless network auditing tool, which leverages powerful hardware and an intuitive web interface to fit your pentest workflow. Launching highly targeted attacks is extremely simple with this little device. The management of the current workflow and the accuracy of the information obtained are truly exceptional for such a small device. Simply place this little device near your machine to break into it

Users are exposed to many dangers when connected to the Internet: control of the IS or data distortion, identity theft, blocking of the IS or crypto mining… the only solution is prevention.