Introduction
Every year on February 10th, the European Union marks “Safer Internet Day,” dedicated to instilling and learning proper and secure internet usage for all users. Here at MiC, we decided to seize the opportunity to designate the entire month of February as “Cyber Month”— a month that included special tours of IT and cyber municipal departments, alongside various other activities.
While “safe internet use” refers to the specific steps and practices of an individual user—such as ensuring their credentials are not stolen— the term “Cyber” (originally a shortening of the word Cybernetics) has evolved into a term that describes the entire computing world and our conduct within it, usually with a more specific emphasis on the field of Information Security.
Information Security certainly includes the “dos and don’ts” for the end-user, but it also encompasses broader perspectives on potential attack vectors and the defensive measures against them. Often, these defenses do not depend on the individual behavior of the end-user, but rather on how we have pre-emptively prepared and fortified our computing systems.
In this two-parts article, we will present some of the fundamental concepts and mindsets of the Information Security and Cyber world, and briefly explain the current state of local authorities in Israel.
Starting with the Fundamentals
The three primary and well-known goals of information security, represented by the apt acronym CIA, are: Confidentiality, Integrity, and Availability.
These goals are essentially the mirror image of three potential types of damage that hackers can inflict on our internet-connected electronic devices: Hackers may attempt to breach our network to access secret and private data and expose it to unauthorized individuals; They may attempt to delete or alter this data; And they may attempt to block our access to the data or make it difficult to reach. Good information security ensures that data remains confidential (unexposed to those without proper clearance), integrated (not deleted or changed), and available.
From the previous paragraph, we can observe two interesting points regarding cyber and data protection: First, the emergence of this field and its growing importance are inextricably linked to the “Global Village” emergence and the expansion of human communication capabilities since the 1990’s and the advent of the internet. Cyber-attacks, at least in their modern sense, could not have existed before the global transition to internet usage. Humanity’s shift to internet-based communication has made us all more connected and accessible, shortening distances and response times. This is a great blessing for both personal communication and economic growth. However, the fact that we are more connected and accessible to more places in the world has also caused the opposite effect: if we are more connected to everyone, then everyone is more connected to us—and these are not always the people we want to be connected to. This is another example of how almost every technological expansion carries both great blessings and significant risks. A wise and proper adoption of technology must recognize this, anticipating these risks and preparing for them in advance.
This brings us to the next point: The lion’s share of information security is indeed occupied with thinking about the steps to be taken against hackers and other entities aiming to harm us by maliciously exploiting internet capabilities. As seen in the definition of the three main goals of information security, their phrasing highlights the fact that “Information Security” is a “counter-adversarial” field. That is, a field whose entire purpose is to deal with an external, pre-existing phenomenon. For instance, if we lived in an ideal world where we were certain no “bad actors” existed, the field of “Information Security” would essentially not exist. These are not abstract ideas—they have practical meaning: to understand the world of information security well, one must first start with a deeper understanding of the criminal mind attempting to cause harm.
The Goals, Means, and Tools of the Criminal
When we discussed damaging the confidentiality, integrity, or availability of information, we were actually discussing the means and types of damage of the crime. However, we must understand that every attacker has a goal (why they want to hurt us) and a tool or method (how they hurt us). To put it simply: an attacker wants to achieve a certain goal. To achieve it, they decide what type of damage they want to inflict—thus the damage is the actually only the mean to reach the goal. But to actually cause that damage, they need specific tools or methods, which they choose based on the type of damage they wish to cause (as different tools yield different results).
What might a hacker’s goals be? Pure Damage: The attacker simply wants us to suffer. In this case, they will likely choose the type of damage that is most devastating for us. Espionage: Unlike the previous goal, this is usually a covert attack. The goal is for us not to realize we are being attacked, typically focusing on breaching the confidentiality of the information we hold. Influence and Awareness: Here, the attacker usually wants us—and as many other people as possible—to know we were attacked. The goal is a form of public “shaming” or a PR hit. and finally, Personal Gain: An attack carried out to make money—either by expecting us to pay a ransom for stolen data or by selling that data to third parties.
The tools and methods used to cause damage and achieve these goals are numerous and constantly evolving—which is exactly what makes defending against them increasingly complex. Ultimately, all these methods are designed to allow a hacker to break into our closed systems and gain free access to the data within. In this regard, we can divide a hacker’s toolkit into two main types: The Technological Tools: Malicious software (malware) that attempts to attack our computer and internet systems using various technical methods; and The Manipulative (Non-Technological) Tools: Various “Phishing” methods designed to trick an innocent user into willingly, yet unknowingly, providing their login credentials. In this scenario, instead of using complex software to break in, the hacker simply types in the username and password — just like we do.
Sounds like something that isn’t simple to defend against, right? In the next part of the article, we will deal with various defense methods and get to know the situation in Israel’s local authorities a bit more deeply.
