Cybersecurity is a crucial topic for businesses today. With the rapid evolution of technologies, both software and hardware, cyberattacks are becoming increasingly sophisticated and frequent. Over the past three years at Digidop, we have witnessed a significant shift in cybersecurity concerns from most of our new clients. These concerns often stem from a lack of understanding of this often opaque field.
After collaborating with OWN, an expert company in the field, we decided to create a joint podcast aimed at gaining a better understanding of:
- what a cyberattack is,
- how to prevent it,
- and what best practices to adopt.
For this first podcast in our series, we had the opportunity to engage with an expert in the field: Raphaël Walter, the head of the audit team at Own, with ten years of experience in penetration testing. Alongside Lucas, a developer and Webflow expert, and Thomas, co-founder of Digidop, Raphaël shares key insights and lessons from his experience in cybersecurity.
1. What is Cybersecurity?
Cybersecurity aims to protect the data used within businesses and to secure individuals. It encompasses:
- the protection of data,
- the prevention of intrusions,
- and the management of incidents.
It is a vast and complex field, which Raphaël Walter compares to the medical field due to its diversity of specialties.
"Cybersecurity is very broad. I tend to compare it to the medical field... there are as many professions in the medical world as in cybersecurity."
In today’s fast-paced technological environment, businesses must remain particularly vigilant. Cyberattacks are becoming more sophisticated, targeting various vulnerabilities in IT systems. Cybersecurity is not just about technical protection but also involves organizational management and employee awareness.
Raphaël also emphasized the importance of this holistic approach:
"The idea of cybersecurity is really to cover all aspects, whether they are technical or organizational, to protect data and individuals."
Cybersecurity also includes regulatory aspects, such as compliance with standards and laws like GDPR (General Data Protection Regulation), which impose strict obligations regarding the protection of personal data.
Implementing an effective cybersecurity strategy requires a thorough understanding of these various aspects and a proactive approach to anticipate and respond to potential threats. It is an ongoing effort that demands constant vigilance and adaptation to new technologies and attack methods.
2. Types of Cyberattacks and Examples of Vulnerabilities
Cyberattacks can target several critical aspects of security:
2.1 Data Confidentiality
The goal is to ensure that only authorized individuals can access the data. Attacks targeting confidentiality seek to steal sensitive information such as personal data, financial information, or trade secrets.
For example, a phishing attack, which involves sending fraudulent emails that trick recipients into revealing personal information or clicking on malicious links, can lead an employee to disclose their credentials, thus allowing the attacker to access confidential information.
"If I take a common attack example... on an e-commerce site, when I place my order, I receive an invoice. If there is a failure in the segregation between user accounts, I could potentially retrieve invoices from other individuals, and on those invoices, there would be the address, phone number, and the person's order, which could lead to a data breach."
2.2 Data Integrity
This involves ensuring that the data is not altered without authorization. Attacks on data integrity can corrupt information, making it incorrect or misleading.
A common example is SQL injection, where an attacker can insert malicious code into a database to modify or destroy stored information.
"We can encounter logic problems... for instance, on an e-commerce site, if I, as a buyer, can perform an action that typically only a seller can do, we will have a permission flaw, a privilege too high, as if I am a buyer but I can change the displayed price of an item on the site at checkout."
2.3 Data Availability
Ensuring that services and data remain accessible.
Denial of Service (DDoS) attacks are typical examples, where attackers overwhelm a system or network with excessive traffic, rendering services unavailable to legitimate users. This can lead to significant financial losses and harm the company's reputation.
"A very telling example is 'Capital'... if you watch Capital on M6, there is often a business highlighted in the show. You can be pretty sure that within 10 minutes, that company's website will crash. Because if there are 2 or 3 million people watching the show, easily 200,000 people will try to visit the e-commerce site, which is only configured for 10,000 users. The site saturates and crashes, resulting in a loss of availability and potentially an immediate loss of revenue."
Businesses must be particularly vigilant against these types of cyberattacks, as each presents specific risks. To mitigate these risks and better prepare to defend their systems and protect their data, it is crucial to implement robust security measures.
3. Importance of Prevention
It is essential for businesses of all sizes to implement preventative measures to protect against cyberattacks. Here are some of the key measures discussed in this podcast:
3.1 Regular Backups
For Raphaël, "it is very important to have regular backups of the most vital data, and ideally, these backups should be on an external drive that is not connected to the network."
Indeed, in the event of an attack, having offline backups allows for quick data restoration without suffering major losses.
3.2 System Updates
Regularly updating software and systems is crucial. The vulnerabilities discovered in software are often quickly patched through updates. However, if systems are not maintained up-to-date, these vulnerabilities can be exploited by attackers.
3.3 Employee Awareness and Training
Employee awareness and training play a key role in prevention. Phishing attacks, for example, often exploit users' lack of knowledge. By training employees to recognize suspicious emails and establishing clear protocols for handling sensitive information, companies can significantly reduce risks.
3.4 Security Audits
Regular security audits are another important preventative measure. They help identify system weaknesses before they are exploited by attackers.
"The goal of an audit is to improve the security of the systems being audited and to provide an action plan for subsequent corrections," explains Raphaël.
3.5 Good Organizational Practices
Adopting good organizational practices and access management is essential. This includes:
- Establishing robust password management policies.
- Segmenting networks to limit access.
- Applying the principle of least privilege, where users only have access to resources necessary for their functions.
By combining these different measures, businesses can create a more robust defense against cyberattacks, thereby reducing risks and potential impacts on their operations.
4. Website Security: Open Source vs. Secure Solutions
"The core of WordPress and Drupal is secured through audits and bug bounty programs, but poorly managed plugins pose a genuine security risk."
Vulnerabilities discovered in open source solutions are often patched very quickly thanks to the large community of developers involved. However, Raphaël explains that a common problem with this type of solution is that :
"The more people there are on a subject, the less it is controlled because everyone thinks someone else is watching."
This can lead to reduced vigilance over potential vulnerabilities.
Raphaël also identifies three major risks associated with using plugins on open source solutions like WordPress:
- Plugin Quality: Plugins are often developed by companies of varying sizes and seriousness. Some plugins may be well-coded and secure, while others may contain genuine vulnerabilities.
- Frequent Updates: Plugins require regular updates to fix security vulnerabilities. However, these updates are often neglected, leaving "backdoors," or open gateways for attackers.
- Configuration: The configuration of plugins can also pose problems. A well-secured plugin can have its security level degraded by misconfiguration, increasing the risk of compromise.
An alternative would be to opt for solutions like Webflow, which offer a more secure approach by limiting third-party plugins and ensuring strict code control. Webflow, by its more closed nature, reduces the risks of introducing vulnerabilities through unverified extensions. This strict approach minimizes the risks of cyberattacks and better protects sensitive business data.
Learn more about SSL, TLS & HTTPS security
5. Incident Management and Response to Attacks
When a cyberattack occurs, it is crucial to know how to respond quickly and effectively to minimize damage. Here are the key steps in incident management and response to attacks discussed in the podcast:
5.1 Identification and Containment
The first step is to identify the attack and contain the threat.
Raphaël emphasizes: "When I'm attacked, the first reflex should be to unplug the network access of the compromised workstation. It's better not to turn it off to avoid losing traces of the attack."
Disconnecting from the network prevents the attacker from spreading further within the system.
5.2 Impact Assessment
Once the attack is contained,
"it is necessary to understand the extent of the damage in order to effectively plan the recovery steps".
This involves determining what data has been compromised, what vulnerabilities were exploited, and which systems were affected. This assessment allows for an understanding of the extent of the damage and for planning recovery steps.
5.3 Communication and Notification
Communication is crucial during and after a cyberattack. Companies must inform internal and external stakeholders, including customers, employees, and regulators.
Raphaël states: "Communication is crucial... especially if we fail to communicate, we end up with all sorts of nonsense published on social media."
Transparent communication helps maintain trust and manage expectations.
5.4 Recovery and Restoration
The recovery phase involves restoring systems to their operational state. This may include restoring data from backups and repairing compromised systems. It is essential to ensure that exploited vulnerabilities are fixed to prevent future attacks.
5.5 Post-Incident Analysis
After managing the incident, a post-incident analysis is necessary to draw lessons and improve security posture.
Raphaël explains: "The post-incident phase is crucial for understanding what happened and how to prevent it from happening again."
This analysis helps identify weaknesses in security protocols and implement measures to strengthen defenses.
By adopting a structured approach to incident management and attack response, companies can minimize the impact of cyberattacks and continuously improve their resilience against threats.
6. AI and Emerging Trends in Cybersecurity
As technologies evolve, cybersecurity threats become increasingly sophisticated. Here are some of the emerging trends in cybersecurity discussed in the podcast:
6.1 Artificial Intelligence and Machine Learning
Artificial Intelligence (AI) and machine learning (ML) are being increasingly used for both defending and attacking IT systems. AI-based tools can analyze massive volumes of data to identify anomalies and suspicious behavior more quickly than traditional methods.
Raphaël notes that "AI and machine learning can be major assets for detecting threats in real time and automating responses to attacks. However, these technologies are also used by attackers to create more sophisticated attacks."
6.2 Cyberattacks Targeting Critical Infrastructures
Critical infrastructures, such as electrical grids, healthcare systems, and transportation networks, are becoming prime targets for cyber attackers. Disrupting these systems can have serious consequences for national security and daily life.
"Attacks on critical infrastructures are particularly concerning as they can paralyze essential services and cause major disruptions," warns Raphaël.
6.3 Ransomware
Ransomware attacks continue to be a major threat to businesses of all sizes. These attacks encrypt victims' data and demand a ransom for decryption. The sophistication of ransomware has increased, employing more advanced methods to evade detection and maximize impacts.
"Ransomware has become more sophisticated, utilizing advanced evasion techniques and targeting backups to make recovery without paying the ransom more challenging."
6.4 Zero Trust Security
The Zero Trust security model, which assumes that no user or device, even within the network, should be automatically trusted, is gaining popularity. This model enforces strict controls and continuous verification of identity and access.
"Adopting a Zero Trust approach can greatly enhance security posture by minimizing risks associated with unauthorized access."
6.5 Internet of Things (IoT) Security
With the proliferation of connected devices, the security of the Internet of Things (IoT) is becoming increasingly critical. IoT devices can often serve as vulnerable entry points for cyber attackers.
"IoT device security is often overlooked, making it a prime target for attackers. It is crucial to secure these devices to protect networks," highlights Raphaël.
By staying informed about emerging trends and adopting proactive strategies, companies can better prepare to face the ever-evolving threats in the cybersecurity landscape.
7. Recommendations for Businesses
Based on the discussions and insights provided by Raphaël, here is a summary of initial recommendations to strengthen your company's cybersecurity:
- Adopt a proactive approach: Don’t wait for an attack to occur before taking action. Implement security measures now and maintain them regularly.
- Continuously train employees: Awareness and training of employees are essential to reduce risks related to human error.
- Regularly update systems: Ensure that all software and systems are up-to-date with the latest security patches.
- Conduct regular security audits: Identify and correct weaknesses before they are exploited by attackers.
- Adopt advanced technologies: Utilize AI and ML-based tools to detect threats and automate responses.
- Apply the principle of least privilege: Limit access to sensitive resources to only the users who really need it.
In conclusion, cybersecurity is a priority that must be integrated at all levels of the business. By implementing robust security strategies and staying informed of emerging trends, companies can not only protect themselves against cyberattacks but also strengthen their resilience and ability to respond to incidents. As Raphaël Walter emphasizes,
"Cybersecurity is a complex field, but with the right practices and constant vigilance, it is possible to effectively defend against threats."
--
Other resources:
- Own
- ANSSI Guide - National Cybersecurity Agency of France
- Root Me - practice cybersecurity attacks
