I want to start with the assumption that anything connected to the internet is potentially vulnerable to cyber-attacks. It can be a computer, a mobile phone, an alarm system, or any other device. It has an umbilical cord that can turn into a gateway for hackers. Therefore, it is sufficient not to connect anything to the internet and the problem is solved. Obviously, this statement is a provocation, the advantages that the Internet gives us are enormous. The impact would probably be comparable to do without electricity. And as for electricity, the solution is not to avoid using it, but to make systems and networks with the right level of security.
What are cyber attacks
There are various attack systems and the common factor is to reach the device with a software called malware. The purposes can range from creating a malfunction of the attacked object, to reading the information, up to controlling the system. Let’s consider hackers who take control of the computer network of a modern hotel. As in all other sectors, the level of digitalization is quite high and the doors of the rooms are locked and unlocked with coded cards. The hackers could lock all the doors and ask for a ransom to reopen them. And this is not just imagination, but a true story. They could lock the company’s computers and unlock them only if their requests are granted. In a more hidden manner, they could steal the data present in the computers (emails, documents, etc.) to resell them to whoever may be interested. Nevertheless, we must not be scared of this. Let’s consider another example; think about how our money is managed, in an IT system that goes through the internet and interconnects millions of users. But that doesn’t mean that when we get up in the morning we have to start worrying that someone will steal money from our bank account. In fact, let’s say it’s such a remote possibility that nobody thinks about it. Not because banks keep everything disconnected from the internet, on the contrary, they are totally connected, but because the security system they use is so well structured that being able to penetrate it would be an extremely difficult challenge.
Who are the hackers
Let’s start with the amateurs. These hackers lack advanced technical skills, but they exploit malicious programs found on the internet. Their purpose can even be only to cause damage, sometimes they do it just out of curiosity, other times to demonstrate their skills. In any case, we should never underestimate the troubles they can cause.
Then we find the actual hackers. People with in-depth knowledge of networks and IT systems, who are divided into three types. The White Hats look for vulnerabilities in IT systems in order to improve security. They do this for the owner, to whom the results are reported. On the contrary, the Black Hats do it illegally to make a personal profit. The job can be commissioned by someone else. The Grey Hats are located in between. They find the vulnerabilities of a system and, depending on the case, either they may communicate them to the owner or they publish them on the internet to let other hackers exploit their achievements.
Finally, there are real criminal organisations. These are well-organised and funded people, who can work for other people or even governments. Their attacks are aimed at specific targets, behind which there are often political motivations.
Why choose the Cloud
By cloud system we mean remote servers or, more in general, remote services. Instead of having local computers that manage data storage or different kinds of software, all this is done on computers located in special centres dedicated to this type of service. So, with all the risks we have seen earlier, why should we choose the cloud? I ask you the following question by using a comparison: Why put money in a bank instead of hiding it in our mattresses? After all, It becomes digital, into the network exposed to hackers, so this wouldn’t seem such a clever solution. This would be true if we don’t consider that the security level of a digital banking system is far superior to that of our house. Similarly, the cloud services of big players such as Microsoft, Amazon, or Google have much higher security levels compared to those we can have at home or in our company. These providers spend more than a billion dollars a year just on cyber security.
A migration already in progress
In reality, all of us are progressively moving towards the cloud, even if we don’t always realise it. To read our emails, we open a browser and go to the page of our email provider, or through an app on our mobile phone. All of our emails are on a server somewhere in the world, the same as the backup of our pictures or the files we upload on OneDrive or Google Drive, not to mention on social media. We are much more scared of keeping our photos only on our mobile phone, or emails only on PC because they could malfunction and we would lose everything. Whereas, in the cloud, they are constantly backed up.
Configuration and update of devices
Another important point to be considered is the state of our devices. Let’s take the example of a corporate server where there is a lot of sensitive data. Are we sure that the operating system is constantly updated? As soon as a hacker finds and exploits a bug and the problem becomes known, the operating system supplier releases an update to fix the bug, but, if the update is not promptly installed, our server is at risk. The same can apply to our PC or smartphone. Moreover, security configurations must be set correctly. Even a single wrong or unsuitable setting is enough to make a server or a computer vulnerable. Unfortunately, we cannot always have the best IT security experts who configure our network and the devices connected to it, whereas Microsoft, Amazon or Google have them, as well as banks. Lastly, there are backups. If a device is managed by us, we must manage correctly the backup of all data, to avoid a malfunction causing their loss. On the cloud, this is part of the service, so one thing less to be managed, checked, and maintained, with all the risks it would bring with it.
In conclusion, we can say that a cloud service is an intrinsically more secure system, always updated, with data backup and best configured to make an attack very difficult. The cloud alone is not the solution to every problem, we must also think about the security of the devices that remain on our premises. In the next post, we will talk in more detail about how these IT security systems and configurations work and their importance for the protection of our company from cyber attacks.
