My column in Invertia this week is titled آ«The disastrous state of cybersecurityآ» (pdf), and attempts to clarify the causes why we have not been able, as a society, to establish a minimally reasonable cybersecurity culture.
Obviously, cybersecurity is an issue that evolves at great speed and in which every expert knows perfectly well the challenges of simply keeping up to date: it is a bit like the famous image of the red queen from Alicerunning at full speed to stay in the same place. But from there to the disaster of the usual practices of the majority of users, which place them in a position to wonder not if they are going to have a problem, but simply when, goes a long way.
Hence, last November, as a consequence of what is already considered the largest cyberattack on US infrastructure in its entire history, Salt Typhoonin which the criminals apparently extracted data from the AT&T and Verizon networks by reconfiguring the routers Cisco to access certain people defined as آ“high valueآ”, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the FBI issue joint guidance with recommendations intended to help protect American citizens. The telecommunications companies affected, apparently, They didn’t think it was important to inform affected users.
One of the recommendations contained in that guide is to preferably use end-to-end encryption in communications (end-to-end encryptionor E2EE), available by default in tools like Signal or WhatsApp (which makes use of the encryption protocol developed by the first). It is, to say the least, curious to see government agencies recommending to the population the use of a communications protocol that puts the possibility of intercepting these communications practically out of reach, and somewhat evokes past episodes in which ignorant judges in Brazil or in Spain threatened companies for not facilitating the decryption of conversations of defendants that those companies simply could not carried out from a strictly technical point of view.
In the case of Apple’s iMessageit is a little more complicated, because when you have an iPhone, it replaces the use of SMS and MMS and applies end-to-end encryption, but only when the message is directed to a user who has another iPhone, while It does so unencrypted if it is sent to someone who does not have it.
But the use of end-to-end encryption is only one of many minimum recommendations to obtain a certain peace of mind in the use of a tool already as widely used as the network. If our parents had done as bad a job explaining to us the dangers of walking around the city as society has done in explaining the functioning and dangers of the Internet, we would all have been run over.
Sadly, the cybersecurity practices of most users are so disastrous that they expose them to all kinds of problems ranging from information theft and scams to blackmail and scams. The absurd and destructive idea of ”I’m not really important, I have nothing to hide or anything to protect” makes many renounce a minimum level of protection that is increasingly necessary.
Most passwords are still not only absurdly simple, but in many cases, shared between all types of services and, in many cases, already published. Password managers are used by very few, as is double authentication factor, which only represents minimal inconvenience when entering some services. Advertising blockers, whose use was already recommended by the FBI itself a long time ago, are very rarely used, and those who use them do not do so thinking about their cybersecurity, but simply to get rid of a nuisance. And public WiFi networks in hotels, airports and places of all kinds are used without the slightest precaution and without even considering the use of a virtual private network or VPN. Yes, they are tools that are worth money, but they really are money well spent.
It is simply a matter of minimally disciplining oneself to use tools that have become essential to avoid problems, and that although they do not ensure that we are not the target of criminals, they do make it quite difficult and make it much less likely. If educational institutions do not provide that minimum of training and prefer to give in to the absolute comfort of prohibiting and renouncing education, we will have to learn for ourselves. But let’s do it, it’s important.
This article is also available in English on my Medium page,آ آ«Sure, keeping up with cybersecurity can seem like a mad race, but it’s easier than you thinkcome on