The term cybersecurity refers to all the practices and tools that can be used to protect people and the tangible and intangible IT assets of states and organizations. Given the financial stakes involved in the vulnerability of Information Systems (IS), every organization must ensure the security of its IS.

What is an information system?

An organization’s information system is the set of assets used to collect, classify, store, manage and distribute information within an organization. Whatever the type of data, any information system must respect 3 essential principles:

• Confidentiality: Data confidentiality is the protection of communications or stored data against interception and reading by unauthorized persons.
• Integrity: Data integrity refers to the state of the data, which must not be corrupted or destroyed, either intentionally or accidentally, during processing, storage or transmission.
• Availability: This is the ability to make information accessible to authorized persons. Infrastructure is used to store this data. But how?

Infrastructure and easy living

For a long time, our working environment consisted of a hardware infrastructure with on-site servers, which hosted the company’s data locally. Today, in response to the need for mobility and accessibility to information, our work environments are becoming increasingly dematerialized. Companies are increasingly turning to solutions stored in the cloud: this is what we call virtualization.

Virtualization means putting your machines, network and/or software in a virtual environment: the cloud. The server is now remote. It can be accessed online via a secure Internet connection.

Three technical arrangements are available to meet different needs:

• IaaS (Infrastructure as a Service): enabling outsourcing of IT hardware infrastructure. Companies can now delegate the installation of file servers, networks and data storage to a service provider on a subscription basis. This avoids the unnecessary costs of purchasing and maintaining equipment.
• PaaS (platform as a service): PaaS involves outsourcing not only hardware infrastructure, but also middleware applications such as operating systems, databases and web servers.
• SaaS (software as a service): this arrangement enables companies to use several applications accessible online. Tools offered by Google (Google Apps) and Microsoft (Office 365) in particular accelerate the integration of collaborative working. CRM (Salesforce), ERP (Infor, NetSuite, Workday…) and HR (SuccessFactors, Talensoft, Cornerstone) solutions are also available in SaaS mode.

What about safety?

The number of companies adopting IaaS, PaaS or SaaS appliances to manage their data is increasing year on year. This rapid growth shows that companies are increasingly willing to put their trust in these solutions. These same companies persist in expressing a degree of mistrust, given the current context and the various incidents reported to the media by some major companies, as was the case, for example, with the security flaw written into Google+’s development code discovered in March 2018. This flaw would have enabled hackers to access nearly 500,000 Google+ accounts in two weeks. And examples abound…

Piracy, but why?

A hacker is anyone who takes advantage of an IS vulnerability to gain access to private data. It’s worth noting that there are three types of hacker: Black Hats, Grey Hats and White Hats. I’ll elaborate on the criteria that distinguish each of these three types of hacker in a second article, but what’s important here is to focus on the motivations of malicious hackers.
In general, hackers steal your private data for the following four reasons:

• Your data is worth its weight in gold: Your credit card number, your date of birth, your favorite books or your most recent foreign destinations are all information that a hacker can convert into cash.
• Industrial espionage: Stealing information about a competitor’s products and services gives you an edge in the marketplace.
• Revenge: Some hackers have political or social motivations. These activist hackers seek to draw public attention to a problem, either by making public unflattering information about their target, or by dismantling all or part of their target’s IS.
• Digital warfare: Entire nations engage in state-sponsored hacking to obtain commercial or national intelligence in order to destabilize their adversaries’ infrastructure, or even to sow discord and confusion in the target country.

You could be the vector of a cyber attack without even knowing it!

In most cases, the human being is the weak link in the IS. A lack of vigilance on the part of the victim, or a moment’s inattention to a piece of computer equipment, are the factors that hackers rely on to create a flaw in the system.

Here are a few examples:

• Human error

A very harmless act can have very serious consequences: leaving a session open, opening an e-mail from an unknown source, clicking on an unsecured link are all ways of inviting a hacker to access your data. Never forget that a hacker is basically a manipulator! Hackers are very imaginative when it comes to finding ways to contact you, and this is how they will mislead you.

• The use of gadgets

1. The MalDuino: is an Arduino-powered USB peripheral with keyboard injection capabilities. Once plugged in, MalDuino acts like a keyboard, typing commands at superhuman speeds. A few minutes in front of your machine is all the hacker needs to download all your data.
   
2. WiFi keylogger: Yes, size does matter! Because with dimensions of 10 mm x 10 mm x 15 mm, it’s the smallest USB hardware keylogger ever available on the market, and is capable of remote data download: e-mail reports, FTP backups and live webcasting to the access point and WiFi. in client and time-stamping modes. Imagine if someone managed to insert this little gadget into your desktop computer, for example?
   
3. WiFi PINEAPPLE: is a powerful wireless network auditing tool, leveraging powerful hardware and an intuitive web interface to fit your pentest workflow. Launching highly accurate attacks is extremely simple with this small device. The management of the current workflow and the accuracy of the information obtained are truly exceptional for such a small device. Simply place this small device close to your machine to gain access.

Users are exposed to many dangers when they are connected to the Internet: IS control or data distortion, identity theft, IS blocking or crypto mining… the only solution is prevention.