The human link in cybersecurity

“The human is always the weakest link in the chain to any form of cyber attack.”

These were the words of cyber-forensic expert and director of security and intelligence operations firm Intelligence i1, Andrew Fordred, in the opening talk of a cybersecurity series at the Namibia Scientific Society.

Fordred’s series of talks aims to make cybersecurity accessible and understandable to small-business owners and ordinary Namibians.

“Everybody should know how to protect themselves against cybercrime, considering that it will increase and that it’s become so easy to do it nowadays,” Fordred said in his first talk.

Fordred urges, first and foremost, that all communication requesting money, credentials or urgent action be treated as high risk.

Financial and operational impact

For small and medium-sized businesses, cybersecurity may not be a priority, but Fordred explains that businesses can be brought to a grinding halt, while individuals could lose money through banking scams and often be unable to recover lost funds.

“We’ve seen throughout these banking scams that people lost a lot of money through social engineering attacks, and unless there was an error on the part of the bank, the money was not recoverable,” he said.

Unusual banking communication or instructions for payment should be verified through a secondary channel.

“If you receive communication through a certain channel, terminate that channel – because the person who reaches out usually has control of that channel – and establish another channel over which you have control. In practical terms, this would be if someone emails you claiming to be the bank and saying they need account information to stop fraud on your account. Terminate that email channel and independently find the fraud number for the bank, call them and ask if they’re aware of you,” explains Lian Aldrich, co-founder of penetration-testing and adversary-simulation service provider Aphotic Security.

Fordred goes on to explain that attackers want one or more of four things: money, access, credentials or data.

“Ultimately, what they want is your money. If they can’t get your money, they want your access … If they can’t get your access, they want your credentials … And they want your data.”

He advises Namibians to limit their financial exposure by using strong, unique passwords and to minimise the collection and retention of unnecessary data by third-party actors.

What’s in a password?

Fordred explains that good cybersecurity can often depend more on good practices than expensive solutions.

“The protection is not that difficult. It’s also not expensive,” he said.

One such low-cost, high-impact measure is password hygiene. This refers to practices that help keep online accounts as secure as possible. Using a combination of upper- and lower-case letters, numbers and special characters is recommended. Users should also avoid using the same password for multiple accounts.

Vanessa Maresch of Salt Essential IT advised during cybersecurity training sessions for the Ministry of Information and Communication Technology that passwords can be built around memorable associations.

“If you’re making a Facebook password, for example, the Facebook logo is blue, and you’re usually sitting at your desk when you log in. Look for something blue on your desk that you will associate with Facebook, and use that in your password,” she said.

Other cybersecurity experts advise creating a ‘password story’, using the first letter of each word to form a password that is harder to crack.

“The weirder it is, the better, because the weirder the story is, the more likely it is that you will remember it,” said Rigo Reddig, head of information security at Grant Thornton Neuhaus.

Fordred says reputable password managers can also be used to create and store unique passwords for each account.

He notes that simply making small changes to the same password is not sufficient.

“We all have that habit. If we have a bunch of accounts, we rotate our password between accounts. It's not a good idea. We also, for instance, vary our passwords, so you might have a password 1 2 3 4 and then password 1 2 3 5, password 1 2 3 6. Hackers work that out very easily. They also have scripts that run against that, and that will devise a list of passwords to use.

“The best thing in all these cases is to make use of a password manager. If you have many accounts – and I'm not talking bank accounts, I'm talking about online accounts – then make use of a password manager. That's your best solution.”

Have I been breached?

To find out whether an email address has appeared in a known data breach, Fordred advises users to check it on Have I Been Pwned.

The website allows users to check whether their email address has appeared in known data breaches. If an address has been compromised, Fordred advises users to take steps to secure their accounts, including changing passwords and enabling multi-factor authentication (MFA).

With MFA enabled, bank fraud is still possible, but it can be harder for malicious actors to carry out.

“They can get in, but they can't transact unless they have the OTP,” he said, explaining that an attacker who gains access to online banking credentials may still require a one-time password (OTP) to complete certain transactions.

Fordred cautioned that users should not regard any single security measure as a complete solution.

“Antivirus is always a start to any form of security,” he said.

However, he warned that sophisticated malware can sometimes disable or evade security software. In a ransomware attack, for example, malicious software can remain on a system while attempting to undermine security protections.