Data thinking and cybersecurity

Challenge: Describe your challenge, including all

relevant information.

Cybersecurity is the practice of securing networks, systems and any other digital infrastructure from  malicious attacks. With cybercrime damages projected to exceed a staggering $6 trillion by 2021, it’s no  wonder banks, tech companies, hospitals, government agencies and just about every other sector are  investing in cybersecurity infrastructure to protect their business practices and the millions of customers  that trust them with their data.

What’s the best cybersecurity strategy? A strong security infrastructure includes multiple layers of  protection dispersed throughout a company’s computers, programs and networks. With cyber attacks  occurring every 14 seconds, firewalls, antivirus software, anti-spyware software and password  management tools must all work in harmony to outwit surprisingly creative cybercriminals. With so  much at stake, it’s not hyperbolic to think that cybersecurity tools and experts act as the last line of  defense between our most vital information and digital chaos.

Types of Cyber Attacks

Cyber attacks come in all shapes and sizes. Some may be overt ransomware attacks (hijacking important  business products or tools in exchange for money to release them), while some are covert operations by  which criminals infiltrate a system to gain valuable data only to be discovered months after-the-fact, if  at all. Criminals are getting craftier with their malicious deeds and here are some of the basic types of  cyber attacks affecting thousands of people each day.

  Malware

Malware is used to describe malicious software, including spyware, ransomware and viruses. It usually  breaches networks through a vulnerability, like clicking on suspicious email links or installing a risky  application. Once inside a network, malware can obtain sensitive information, further produce more  harmful software throughout the system and can even block access to vital business network  components (ransomware).

  Phishing

Phishing is the practice of sending malicious communications (usually emails) designed to appear from  reputable, well-known sources. These emails use the same names, logos, wording, etc., as a CEO or  company to dull suspicions and get victims to click on harmful links. Once a phishing link is clicked, cyber  criminals have access to sensitive data like credit card, social security or login information.

  Social Engineering

Social engineering is the process of psychologically manipulating people into divulging personal  information. Phishing is a form of social engineering, where criminals take advantage of people’s natural  curiosity or trust. An example of more advanced social engineering is with voice manipulation. In this  case, cyber criminals take an individual’s voice (from sources like a voicemail or social media post) and  manipulate it to call friends or relatives and ask for credit card or other personal information.

  Man-in-the-Middle Attack

Man-in-the-Middle (MitM) attacks occur when criminals interrupt the traffic between a two-party  transaction. For example, criminals can insert themselves between a public Wi-Fi and an individual’s  device. Without a protected Wi-Fi connection, cyber criminals can sometimes view all of a victim’s  information without ever being caught.

  Zero-day attack

Zero-day attacks are becoming more-and-more common. Essentially, these attacks occur between a  network vulnerability announcement and a patch solution. In the name of transparency and security,  most companies will announce that they found a problem with their network safety, but some criminals  will take this opportunity to unleash attacks before the company can come up with a security patch.

Cybersecurity is important because it protects all categories of data from theft and damage. This  includes sensitive data, personally identifiable information (PII), protected health information (PHI),  personal information, intellectual property, data, and governmental and industry information systems

Selection: In your own words, briefly describe the tool

you selected

To fully emphasize the importance of cybersecurity and its importance, in my personal opinion story  telling is the right way to go.

Storytelling tool

The fundamentals of using the storytelling tool is connecting with the audience.

In order to do so we must ask ourselves 3 important questions:

1. Who is our audience?

2. Where do they come from?

3.What do they need?

The answers to these three questions must be incorporated in our story. This will cestablish a personal

connection between the audience and the product.

Next it is important to have a clear sequence of events.

Application: Describe how you applied the tool you

selected to your challenge

On a morning like any other, the senior management of the company John Doe Inc., received calls from  several branches that are unable to access emails or phone lines. The management initially thought it  was a bit of a glitch that will be cleared up quite quickly. Unfortunately, all was not as it appeared.

Over the next few hours branches were reporting that all computer systems, access to emails and  documents have been revoked, and phones lines were down (DDOS). It became apparent that the  company has been hit with a catastrophic cyber-attack (Malware) as all computers across the company’s  branches and offices displayed a ransom demand for the attack of $400 in Bitcoin per station  (Cryptocurrency), or else their data will be destroyed (Ransomware).

At first, the company decided not to pay the ransom, and activate its backup system, instead. However,  as it turned out, the backup system has been infected with the same malware (Data recovery). After a  several hours of total shutdown, John Doe Inc. finally decides to pay, but only minutes after all of the  company information was wiped out (Wiper).

That evening of the cyber-attack, large clients of the company report the same issues with their  computer network (Worm\Virus). It wasn’t long until the attack hit the headlines, and caused chaos  among clients and regulators (Reputation & Compliance).

After a full day without phones. Three days without email. Nearly two weeks without complete access  to system’s data, it appeared that the damage was even greater. Confidential data of the company and  its clients were being auctioned off to the highest bidder (Data Breach + Spyware) on several online  marketplaces (Darkweb). It is yet unknown if John Doe Inc. could ever recover from this cyber-attack.

John Doe Inc. could be any company. It could be your own.

Through this real story, my hope is to clearly illustrate the importance of cybersecurity. Every individual  needs to educate themselves on the importance of Cybersecurity.

Insight: Describe the insight you gained from applying

the tool you selected to your challenge

One of the best ways to educate staff and ensure key messaging is retained is by introducing the  concept of storytelling in Cyber Security awareness training.

Storytelling is one of the most powerful ways to breathe life into your Cyber Security awareness

campaign. Let’s face it, Cyber Security can be a dull topic but it’s vital you find ways to engage your staff  if you want to positively impact behaviour within your organisation. The message is just too important  to get lost in formal, corporate communications.

Stories are fundamental to the way people learn; they help create an emotional response which makes  it easier to remember what’s being taught. Cyber Security messaging can be brought to life, making it  more relatable and real to people in their everyday lives. By making the story relevant to the end-user,  you greatly increase the chance of that person retaining the information, therefore improving the  overall security posture of your organisation.

Approach: Describe what you might do differently next

time -- applying the same tool you selected or a

different one -- and the reason(s) why.

Our society is turning into a cyberphysical society having dependence on Information and  Communication Technology (ICT) across all aspects of our daily lives, which makes the need for  cybersecurity paramount. The intangible nature of cybersecurity, the socio-technical dependences, the  ambiguous impact and contested nature of fighting cybersecurity all make it a challenging area for  policymakers. Cybersecurity can be framed in different ways, having different effects on people.  Cybersecurity is a complex and multifaceted area which has no clear heroes or villains. The inability to  frame cybersecurity has resulted in a failure to take appropriate measures and develop suitable policies.  However, there are already ongoing cyberwars, and citizens and governments need to be better  prepared. Message framing is a strategy for communicating a complex problem in such a way that the  main arguments are understood and cannot be easily challenged. Simple message frames do not work  for cybersecurity and therefore evidence-based message framing is necessary. In a similar vein to  evidence-based policymaking, messages are framed based on the evidence and use framing strategies.  Thinking in terms of framing strategies to communicate a difficult message has profound implications.  We argue that it is important to take the evidence as a starting point and avoid utopian and dystopian  frames, as these standard messaging strategies might be counterproductive. Instead, the following six  strategies were identified as offering a better way to frame cybersecurity: 1) do not exacerbate  cybersecurity, 2) make it clear who the villains are, 3) give cybersecurity a face by putting the heroes in  the spotlight, 4) connect cybersecurity to values other than security alone, 5) personalize the message  for easy recognition and 6) connect to other tangible and clear issues.

Message framing is not only important or cybersecurity but in many domains of government  information. For example, the discussion about privacy, the use of personal files, identify management,  Internet governance, public-private systems, and the opening of data are all complex socio-technical  areas in which the results of intensive research are not easily to communicate. Cybersecurity specialists  and experts, but also researchers and policy-makers, needs to frame their message well to avoid  misunderstanding and ambiguity. Capacity building by government and more research about  evidence-based framing strategies and its effectiveness is

