Scott Jones is the Director General of Cyber Defence at the Communications Security Establishment (CSE). CSE provides advice, guidance and services to help protect government networks and electronic information. The Cyber Defence branch at CSE works to stop malicious cyber threats on government systems and helps departments understand the cyber threat environment.
If you saw a blog about the benefits of patching your cyber systems and running the most recent versions of your browser, you might click somewhere else. But as you read further, you’ll see that patching and other small, but important, tasks have big benefits that protect your systems and the important information they contain.
CSE’s work in protecting government systems is a crucial job. The Government of Canada is targeted by malicious cyber activity every day from a variety of terrorists, foreign states, hacktivists, and criminals. Why? Government systems hold important information like Canadians’ private information, trade secrets, information about new technology and our natural resources, and much more. Access to this information is a desirable thing, and it’s our job at CSE to constantly look for, and stop, these malicious activities.
While CSE is primarily focused on protecting government systems, the advice and guidance we provide to government departments is useful to anyone looking to better protect their own systems at home.
So what are some of the ways that cyber criminals try to infiltrate computer networks? Two of the most common ones we see are:
- Spear phishing campaigns: CSE detects thousands of malicious emails sent to Government of Canada email addresses every year. Spear phishing emails will invite the person to click on a link, which once clicked, compromises the system. These emails can be extremely crafty, resembling legitimate messages from a friend or colleague. Publicly available information on the Government Electronic Directory Service (GEDS) can be used to find addresses, or use social media can be used to carefully target and disguise messages. Messages can be clumsy-looking, with a lot of spelling mistakes and they can often be sent to many people at. It just takes one person to click on a link to cause a big problem.
- Watering holes: CSE has tracked a number of watering holes implanted in legitimate and frequently visited websites. Here, an educated guess is made as to which websites their targets frequently visit, and infects this site with malware before the site administrator becomes aware. When someone on the network goes to that site, the whole network can be compromised.
These are only two examples, but cyber threats appear in all shapes and sizes.
How do you protect yourself? The reality is there is no quick fix or easy solution to cyber security. But there are steps you can take to significantly (and I mean significantly) hinder cyber threats.
The most important step is to patch against known vulnerabilities. Download and install patches for your operating system applications, Internet browsers, anti-virus software, as often as you can. Malicious code that exploits unpatched systems is frequently available within hours of a vulnerability being known, but often so are the patches. An up to date system is more resistant and resilient in the face of a cyber threat.
The vast majority of malicious activity could be thwarted if individuals were more diligent in patching their systems. There isn’t anything profound or complicated about installing patches or updating your anti-virus software, but they can have a big impact on your security.
Want to learn more? CSE has advice to help IT professionals and individual users protect their systems, and the information they contain, from cyber threats.
October 31, 2014
Source: http://www.getcybersafe.gc.ca/cnt/blg/pst-20141031-1-eng.aspx
