2018 has kicked off not so well with the outing of basic flaws in the worlds core technology. Spectre and Meltdown show new threats to companies building complex machines and systems to run our lives and upon which we are encouraged to become more and more dependent.

The issues allowing Spectre and Meltdown are built into the basic design of the systems, meaning that these vulnerabilities bypass our software security measures. It is not just desktops or your laptop or only at work, it’s the whole system – mobile, cloud, IoT, servers, tablets…all technology.

Why were these now seemingly basic flaws not noticed years ago?

Our computer systems are growing in complexity and with more and more layers and interaction, the complexity is outstripping our ability to fully understand how it all works. The systems are built to rules and standards that have not been security tested as a whole. Add this to that, put in one of those, add some software, connect to a router, voice enabled and with none of these devices and systems being tested for security from the ground up in design. They are all built to the same standards and using standard components

As we use this complex technology and leave it online, connected into new and old systems, they are providing a tempting target for hackers. This target will be further complicated and expanded with the growth of the Internet of Things (IoT), as we build capabilities into all our devices, tools, home appliances, cloths and garden furniture, all in the name of making our lives easier. With this ‘ease’ comes ever more complexity and as it turns out higher risks.

Market researcher IHS Technology estimates the number of devices using IoT technology will reach 53 billion by 2020, and this is early days – just like the spread of electric power in the 1800’s, the spread of IoT and AI is only just starting.

With this growth so goes the exponential growth in cyber-attacks. Not only attacks of a more traditional nature but now we are to contend with attacks that cannot not be fully detected as the ‘security hole’ being exploited was built into the base design of the computers and systems.

This is the basis of the Meltdown and Spectre attacks which come from combining unrelated design features that were thought to be well understood. Computer science 101 if you like. The attack was not via one individual system or but through the interaction between them, the complexity that humans think they know, but don’t. Its outside our capabilities or understanding.

It’s a bit like Move 39……

The move occurred in a Go match between AlphaGo and Lee Sedol, one of the world’s top players, in 2016. As he approached the match series he was confident. He lost the first match, but he thought he knew why. In the second match we got to move 39 played by AlphaGo. The move perplexed not only Lee but all the commentators saying they would not have played the move, many thought it was a mistake. This was outside the collective expert’s knowledge. It was highly unlikely that any human would have played the move.

However, it was this move that caused the loss of the game. In review afterwards Lee Sedol said that he now has a new understanding of the game of Go through these matches with AlphaGo and respect of the machine. After playing, and losing to Alpha Go, he went on to win more and more games with this new understanding.

Go, a game played by millions, and for centuries, has been given new insights by a machine. This same reasoning should be applied to our security world, developing new mathematical models that will understand the complexity and show us Move 39 before it hits us hard.

Machines see the world differently to us. A machine, like AlphaGo, can see many more moves than any human. New machines need to look at our complex world and model our security in partnership with humans.

When the founders of MIC Global first met in 1999 they were focused on understanding the emerging cyber threats that were starting to swirl around the internet and internet based businesses. They became busy building insurance products to help businesses manage these risks.

Since then they have seen the sophistication and number of attacks grow massively with numbers of affected accounts per attack grow to staggering levels. Back in 2000 it would have been almost unbelievable that a single attack could affect over 3 Billion accounts as the 2013 Yahoo case has now finally highlighted. It is also still hard to understand why it took Yahoo so long actually discover the attack. They are meant to have employed the best brains after all.

However, if we look at how our homes and businesses have changed over the past 20 years perhaps we can start to understand this. These changes have drifted into our lives through small incremental steps that have almost gone un-noticed and yet have managed to deliver mind boggling change. How can we or anyone keep up?

Is this the underlying issue that we don’t deal with, keeping up with these small changes and never adding up the true impact?

The sum total of these changes today has completely turned upside down and inside out the way many people run their lives and how small businesses communicate and do business.

We Google everything; Facebook our lives; Uber ourselves home; Stay on airbeds in stranger’s homes; You Tube anything; WhatsApp instead of phoning; Open Online accounts for everything from banking to accountancy to TV to car hire, Have Virtual Assistance for all things useful that we have hired a person for in 1999; Booking a cleaner online and being worried about every review; As for cars, Self-driving cars and trucks are here. The list is endless, and people say its only just started.

Today, as in 1999, we are being asked to ‘Trust’ these new companies as they build the new economies around us. However, the levels of security the companies offer us don’t seem to have changed much.

When we read the scary reports about cyber-attacks nothing much changes in terms of the advice we are given about what we are meant to do to secure our online world; Strong Passwords; Back up everything; Anti-virus software; Firewalls. And finally, Don’t Clink on a Link Unless You Know Where its From – TRUST Nothing, yet trust the new company?

This was the advice 20 years ago and it’s not changed despite everything about the internet getting more complicated and its penetration into our lives going exponential.

Why has nothing seemed to have changed?

A recent survey by Netwrix pointed to the most common reason people and businesses are not so sure about their ability to combat information security threats, these being 1. Lack of budget 2. Lack of time 3. Insufficient training. Or, in other words, we are only human, and we are the weakest link, we are the ones who do nothing.

But if businesses do nothing then, as we hear every day, the consequences can be catastrophic, not just for your business but also for the people you do business for and with.

Things we can and should do.

1. Avoid Ransomware – this is a type of malware put on your computers by hackers. It is then used to encrypt all of your computer or smartphone data. The hackers then threaten to destroy your data unless you pay a ransom. Your computers are effectively locked. The Hackers ask you to pay and once they have the money ‘promise’ to unlock your computers. Ransomware is used against companies, government agencies and individuals, so all of us face this threat. Simple mitigation can be :
   • Never click on any link in an email or text message unless you have absolutely confirmed that it is legitimate, this includes adverts and any other links
   • Backup all of your data regularly via the cloud or on an external hard drive, or both!
   • Keep your security software up to date with the latest security patches
2. Passwords – Use strong, unique passwords for all your accounts and dual-factor authentication whenever possible.
3. Routers and Other Devices. Many people do not change default passwords to routers or other internet of thing devices. This is a must as soon as you install any device. It is also to consider how the devices are managed, many people and businesses don’t need the devices to be managed from outside the local area network (LAN) so they should be limited so not to be accessed via the internet. If remote access if required use secure and encrypted virtual private network (VPN) to gain access first.
4. Smartphones – the same applies! Use Pin and Password to lock the phone when not in use. Refrain from using public WiFi for sensitive communication. Don’t store sensitive data on your phone.

These are just a few of the things you can easily do to increase your cyber security. It’s time to make yourself aware, maybe use Google to find out the best approach for you and your business!