Blog

HomepageBlog
CategoriesCompany insights

A warm welcome to new employees at SecureIT

SecureIT is growing and welcomes new people aboard

SecureIT is proud to present two new people who have joined the team at its headquarters in Reykjavík, Iceland. Our newest team members are Marín G. Jacobsen and S. Bylgja Sigurjónsdóttir.

Marín studies Computer Science at Reykjavik University. During her studies she has focused on security in programming and how software vulnerabilities can be exploited.
Marín is primarily working within our offensive security team as an entry-level ethical hacker as well as learning the ins and outs of information security and compliance.

Bylgja is SecureITs brand new Partnership Lead. This is a new role designed to meet the growing needs of an increasing customer base and newly forged and exciting partnerships. Bylgja’s role will be to strengthen relations with and between customers and partners, ensuring our support and consulting remains relevant, adequate and future-focussed for our customers built on satisfaction and ever present pursuit of true and trusted partnerships with our customers.

Bylgja is an entrepreneur and experienced project manager and has worked with relational management in many different venues and roles throughout her career. She is enthusiastic about information security in particular, seeking a deeper understanding of systems and security and how they relate to people and corporate cultures. With a bachelor’s degree in PPE (philosophy, politics and economics), and a master’s degree in Human Ecology (emphasis on culture, power and sustainability), Bylgja is equipped with a multi-disciplinary education and outlook on life.

We look forward to working with Marín and Bylgja and include them in our team.

Click here to see SecureIT complete Services

CategoriesPartner insights

SecureIT joins forces with Wib to accelerate API Security

SecureIT joins forces with Wib to accelerate API security

SecureIT is happy to announce their strategic partnership with Wib, to bring API security into the Nordics. Wib is pioneering the API security market with their industry first holistic API security platform and we are excited to show our customers its capabilities. To learn more about Wibs services feel free to send us an email at 

Wib, the fast-growth cybersecurity startup pioneering a new era in API security, today announced a strategic partnership with SecureIT to accelerate its go-to-market momentum across the Nordics region. Based in Iceland, SecureIT is a leading provider of cybersecurity compliance, consulting and managed services to international financial institutions, airlines, large retailers, utility, biotech and healthcare, as well as multiple entities in the critical infrastructure and the government.

In the wake of its recent launch and $16 million funding, Wib is actively investing in building out an international channel ecosystem of specialist cybersecurity partners to expand its reach, drive growth and leverage growing market demand for API security. The partnership with SecureIT gives access to Wib’s industry-first holistic API security platform and recently launched API PenTesting-as-a-Service (PTaaS) capabilities, helping organisations across the region identify API vulnerabilities, defend against the growing tide of API based attacks and meet increasingly API centric regulatory compliance standards such as PCI DSS.

“Building out our channel ecosystem is a strategic priority for Wib as we look to scale our go-to-market presence across key international territories,” commented Ran Ohayon, CRO at Wib. “SecureIT has a trusted brand and strong reputation across the Nordics region with a dynamic team of qualified and experienced security and compliance professionals. Its consultative-led approach, strong compliance expertise and managed services capabilities made them the ideal partner for us and we’re looking forward to a mutually beneficial relationship.”

“The Nordic countries are synonymous with innovation and entrepreneurship, with an early-adopter mentality and pioneering spirit when it comes to new technologies,” explained Magnús Birgisson, CEO at SecureIT. “However, where innovation leads insecurity tends to follow. APIs are critical in driving the modern applications and innovative new web services many organisations use today, but many are undetected, unmanaged and unprotected, creating vulnerability and risk. Our mission is to deliver cyber resilience to our customers across the region and our partnership with Wib is a great addition to our portfolio and will help us achieve this mission.”

Wib’s holistic API security platform provides complete visibility across the entire API landscape, from code to production. By delivering rigorous real-time inspection, management, and control at every stage of the API lifecycle, Wib can automate inventory and API change management; identify rogue, zombie and shadow APIs and analyse business risk and impact, helping organisations to reduce and harden their API attack surface. Wib’s new PTaaS solution combined with its API security platform, is the only offering that provides complete visibility, automatic inventory, auto-generated API documentation, and simulated attacks against test and/or production systems.

About SecureIT
SecureIT is a leader in cyber security consultation, compliance and managed security services. Founded in early 2017, SecureIT has worked with multiple international financial institutions, airlines, large retailers, utility, biotech and healthcare, as well as multiple entities in the critical infrastructure and the government.

SecureIT focuses on providing exceptional quality services, and to help the customer reach and maintain the desired and necessary security posture. SecureIT offers tailored consultation, assessments and audits, security testing and verification services, risk management and cyber threat intelligence services, along with extensive 24/7 monitoring, detection and response services, managed endpoint protection, API security and DDoS mitigation assessments and simulations. Meeting compliance, contractual and regulatory requirements is critical in today’s business environment.

Get more information at our Linkedin page

About Wib
Wib is pioneering a new era in API security with its industry first holistic API security platform. Providing continuous and complete visibility and control across the entire API ecosystem, Wib enables developers to code with confidence and security teams to secure with surety.

Wib’s elite team of developers, attackers, defenders and seasoned cybersecurity professionals draw on real-world experience and expertise to help define and develop innovative technology solutions that enable customers with the identity, inventory and integrity of every API, wherever it may be within the development lifecycle, without compromising development or stifling innovation.

Wib is Headquartered in Tel Aviv, Israel with international presence in Houston, USA and London, UK. It was founded in August 2021 by serial entrepreneur Gil Don (CEO), Ran Ohayon (CRO) and Tal Steinherz who previously served as the CTO of Israel’s national cyber directorate.

Mynd af tölvuskjá með SANS CTF hugbúnaðinum
CategoriesCompany insights, Partner insights

Icelandic Capture The Flag competition

SANS and SecureIT partner for Iceland’s Capture the Flag competition in October 2022

SecureIT is excited to host a Capture The Flag (CTF) event on October 6th-7th 2022 in collaboration with the information security cooperative SANS Institute. The competition consists of multiple small challenges in network- and computer security, ranging from easy to challenging. Basic knowledge in either web programming or networking is sufficient to have fun and learn new skills.

So why try out a hacking ctf?

  • Well, there is the puzzle-solving aspect, so if you like solving those, you should try it out.
  • If you are making websites using frameworks or some other technology, it’s a great way to better understand how those systems work and it might lead you to some cool superpower of that technology that you didn’t know was possible to do.
  • If you like mathematics, solving cryptography challenges is something that can be very challenging but it’s also rewarding.
  • If you want to learn new things it is a great resource for that too, the challenges are often very direct and to the point, however some rely on arcane knowledge about a specific system or language that really just “clicks” with experience.
  • Of course, if you just enjoy breaking things and trying out weird stuff to see what happens that works too.

Still not convinced?

SecureIT’s Cyber Security Developer and the winner of the 2021 October competition, Sigurður Baldvin writes:

“When I first tried a CTF my mind was blown away. It was a blend of doing all of the computer things I loved to fiddle with, mixed with a puzzle that is difficult to solve.”

Sigurður Baldvin goes on to say:
“As a part of learning to create something, I think it is important to be curious about the potential side effects your product could be producing, be that storing the database credentials insecurely or using the behaviour of something to do unexpected things.
It is a puzzle that can potentially be solved with different tactics or methods and it achieves different results.”

Click here for more information

Mynd úr gagnaveri - ís­lensk fjár­mála­fyr­ir­tæki urðu fyr­ir nokkuð um­fangs­mik­illi netárás
CategoriesRisk and vulnerability alert

Security Incidents in the past week

Security Incidents in the past week

On the 24th and 25th of August, two security incidents were disclosed by
Plex and LastPass respectively.

Plex

Security Incidents in the past week. On 24th of August this year, Plex disclosed through email, a data breach that affected most users using the platform. Around 20 million password hashes and email addresses were leaked due to this breach and it’s recommended that every Plex user change their password as soon as possible and as an extra security measure. 

We encourage double checking devices logged in or to sign out of every device after the password change.

LastPass

On the 25th of August, LastPass disclosed a partial leak of the platform’s source code and technical implementations through a breached developer account. LastPass states that no user information or data was leaked and the breach has not affected their services at all.

LastPass also mentioned that no user action is required, however we highly recommend enabling Multi-factor authentication if you have not done so already. Read more about statement from LastPass here.

It is important to always use Multi-factor authentication when available,
and these incidents serve as a cold reminder of this fact

Although data breaches continue to be a risk and something we never hope to seldom encounter, it is an unfortunate reality we must live with. As users of online services we can minimize the impact of data breaches by using password managers and unique passwords for each service, both personally and professionally. We have to keep our personal and professional information separate so that in case of a more severe breach, we and our organizations are as protected as we can be.

Image of a laptop and a computer screen with code
CategoriesExperience

How to code like a team – SPOFing in coding alone

By Sigurður Baldvin Friðriksson

 

In my professional career, I’ve been a team member, a manager and had a variety of responsibilities for assignments and projects. My team experiences have been outside of the tech industry, ranging from a stint at a pizza place to a local computer hardware reseller. It has been informal for the most part and very collaborative and had a flat hierarchy. Here are a few words about how to code like a team.

Often experience took lead over role.

In software development the process has been “We have an idea, let’s make it happen!”. 

This freedom can be nice to have as one can decide on how to build, however it comes with drawbacks, such as running into weird issues or not understanding something. Then having to do a bit of googling and try different things until it works. This can be time-consuming and frustrating.

How to code like a team

I dream of a world, where I can bounce ideas off of colleagues and they can help me with the answer. 

However, that has not been my experience which brings me to the title of this post “How to code like a team”, am I a seasoned expert in team management? No. Caveat: The below is a survival story and is best avoided in the long term. 

 

The daily routine

Try your best to brain dump what you do every day – tasks should live outside of your head!

This is good advice for anyone, regardless of how large your team is. Popular project management tools allow you to put comments and thoughts into tasks and this provides a timeline for task progress and helps you follow up.

“Hot-fixes” tend to be more common than we care to admit and they tend to become “cold-fixes” as more tasks are completed to advance development. Since you are the sole proprietor of the advancement of the project, any backtracking, refactoring or documentation feels like stopping a fully seated bus during rush hour to clean the dashboard properly. It’s not that you shouldn’t do that every now and then, however, the timing tends to feel wrong. It’s always rush hour for people that are paying you to finish the project, so take the time to fix the issue. Most projects underestimate the time allocated in the scope anyway, so add more time to your estimations and remember, set time aside for refactoring and backtracks.

 

“Doing agile development is the king of the development process” – I don’t disagree. However, it also takes enormous discipline to maintain one-person teams for weeks on end. What helps with maintenance is doing stand-ups 1 or 2 times a week just to make sure you are on track. This may seem silly but it works – although your progress may vary.

You might have realized that since you are the only one working on the projects, you have to do everything. The upside of doing everything yourself is that you learn a lot of different things. Who would have thought setting server permissions could be such a thrilling experience after implementing your very rough, paper prototype (granted you didn’t just skip a step during the agile process)? Congratulations, you are now the fullest stack developer!

The single point…of everything

Now, imagine this. You find yourself sitting in a lawn chair, drinking a cold beverage at around noon, the sun is shining and you are enjoying your vacation, when suddenly *buzz*…*buzz*  “System A isn’t working and we can’t do the thing, can you fix it”. You begrudgingly open your personal laptop because “Work should only happen at work, you don’t need a work laptop” but you knew better. A new hot-fix or server restart later, you reply “fixed” and carry on with your vacation. This is the single point of failure aspect of this post. 

Some of these texts can wait and often they do. But it can drain you. You think about work for a couple of minutes or hours, thinking about what went wrong or imagining a solution to the problem, remembering that temporary “hot-fix” you made. 

Bugs and issues can become very personal, since – well – you know that there isn’t anyone else that contributed to it. My solution to this problem is very simple but hard to execute. The “it’s nothing personal, kid” mindset. Bugs, weird issues, and interactions are a part of software development, no matter how experienced you get or how strict your testing process, something will inevitably slip through and cause issues. This happens at any team and company size. You just have to document the issue, provide a fix, and re-deploy.  

 

Expectation management

You are a singular person with the same amount of time in their day as the next person, set realistic expectations to all stakeholders, and remind them if they don’t have the budget for additional people (or simply don’t want to add more people) that the project will likely take more time than with added resources. With these words I hope you have gained some insights into how to code like a team.

Sideview of a laptop screen closing down on the keyboard
CategoriesExperience, Guide

Being up to date managing your security program

Guidance for a successful security program

This article is aimed at providing guidance for a successful security program and insight into the differences and challenges between compliance operations and security operations.

Evolving compliance

Compliance is no check mark sport – it is a constant gardening exercise. Here are some of the essential points for keeping your compliance in good shape, Guidance for a successful security program:

  • Keeping up to date with standards, regulatory requirements, and future changes can be a good way of staying ahead. Be knowledgeable about many different standards and security best practices, while ensuring that you are going beyond just meeting compliance. Why? Standards are not updated fast enough to correlate with the ever evolving threat landscape and security best practices.
  • In the case of the organization not have to meet information security standards or issue reports such as ISO 27001, SOC 2, NIST, PCI DSS or others, it is still a good idea to follow the frameworks such as ISO 27001 or NIST as they provide good guidance and a foundation on security best practices for your ISMS.
  • Continually monitoring the effectiveness of your controls and implementing security measures that not only meet standard or regulatory requirements, however going beyond to increase the security posture of your organization is a great way to ensure your ISMS is up to date and the controls are actually helpful for you and your business units. If the organization has multiple frameworks that it needs to be certified against, evaluate whether the policies, processes, and controls can be used to meet the objectives of multiple standards at once. This cross-reference can save you valuable time.

Compliance is only a small part of the security function and being compliant or certified must be taken with a grain of salt as compliance to standards does not mean you are completely secure or that your vendors are secure as the scope and quality of controls can significantly differ.

Current threat landscape

The ever evolving landscape of corporate business is a:

  • Modern threat agents are becoming more and more sophisticated and the threat landscape is continually evolving. Following news on security, recent attacks, and vulnerabilities is paramount to being up to date with the current threat landscape.

  • It is recommended to conduct threat intelligence, implement continuous monitoring and alerting, and use continuous risk management for new threats that are arising at each time. If budget allows for it, consider implementing technical solutions that allow for continuous monitoring of thresholds and vulnerabilities through agents, and implementing solutions that offer threat intelligence of your company and supply chain.

Guidance for a successful security program

Keeping current within your own company

  • It can be common that some business leaders may view the security function as a barrier or blocker for the business. It is important to understand the business goals and create a culture of security as an enabler where business units are freely willing to share information and concerns and seek help from the security team. This is why it is critical to be visible, knowledgeable about where your company is headed, what the business requirements are, and how security best practices can be implemented at each phase and within all business units.
  • Creating a culture and mindset where the company sees security as an enabler for the business instead of a restriction, will lead to better collaboration between the companies departments and increased information sharing to ensure the security team is up to date with new developments, systems or strategies. In addition, ensuring your colleagues and stakeholders such as the BoD are informed through a Security Council, regular reporting and awareness training to ensure the success and visibility of the security function and increased security awareness within your organization. Stand-ups or regular meetings with relevant teams, especially development and IT should be held in order to follow current changes and issues with the IT environment.
  • Ensure you have a good overview of your assets and vendors through dedicated asset management and vendor management programs. As the attack vectors are increasingly becoming more and more sophisticated, keeping current with your enterprise infrastructure, assets, and supply chain will enable your organization to have a deeper understanding of your attack vectors.

Being involved within the industry and security sector

  • Join security communities if they are available through professional industry specific platforms or social media platforms as they may often provide good intel on current challenges and threats.
  • Evolving cyberthreats create a continual need to educate the security team, and all relevant team members on how to protect against data breaches and threats. Being involved in discussions, events, and gathering intel from trusted media will help in being current with the industry.
  • Offering to achieve professional certifications for your security team additionally gives a good foundation for the career success and continued learning of your security team.
Portrett mynd af Birni Símonarsyni
CategoriesCompany insights

Switching from offense to defense: SecureIT wishes their CTO good luck and thanks for all the phish

SecureIT thanks for all the phish and wishes their CTO good luck

New Beginnings

Changes are coming to SecureIT. In its sixth year of operations, the company is entering an exciting period and is growing rapidly and with growth comes new challenges, new services – and changes to staff. This fall, SecureIT will have great and exciting roles to fill, however before we do that, we are saying a tremendous thanks and until next time to one of our dearest colleagues, who is switching from offense to defense.

Björn Símonarson has been an integral part of SecureIT successes since March 2019. As one the company’s first hires, Björn has successfully developed and cemented one of SecureIT’s core services; Offensive Security Testing, which includes ethical hacking (to some still referred to as pentesting) as well as other products related to evaluating – through the exploitation of vulnerabilities -the overall resilience of security measures taken to protect crucial infrastructure.

To be given the responsibility and task of testing the mesh of the woven cloth of security is not to be taken lightly. SecureIT has been fortunate and honoured that Björn has led this work and – while building the foundation of our unique approach – mentored colleagues and customers in seeing what he sees, given them the knack and intuition that needs to follow the rigours routine and dedication needed to ensure true resilience in security.

 
 

The entire team at SecureIT wishes Björn the absolute best in his new professional challenges and looks forward to seeing Björn again as a friend, as a co-conspirator and as a part of the growing IT security community in Iceland.

New Challenges

The legacy Björn leaves behind – the ground on which we his colleagues will further build on is solid. In his years with SecureIT, Björn built up a solid Offensive Security infrastructure that is the foundation that encompasses both crucial methodologies honed through his decade of offensive security knowledge as well as ethical hacking infrastructure that enables SecureIT to excel in its performance of providing outstanding services to its partners and customers. On what he leaves behind, Björn says:

“The infrastructure I have built throughout the years derives its importance from the methodologies we developed. That and the format of the deliverables we provide our customers with. These components together form a fundamental part of a foundation of solid security assessment at any company.”

 

“Bjössi has not only been a great colleague, strategic partner and confidant - he has been and will remain a true friend. I am thankful for the time Bjössi spent with us at SecureIT and albeit a bit sad, I am very excited to see him take this next, exciting step in his professional career. We will no doubt be seeing and hearing more from him.”
Portrett mynd af Magnúsi Birgissyni
Magnús Birgisson
founder and CEO of SecureIT

Next Steps

What are the next steps for Björn? In late August he will be joining Kvika Bank as their Head of Information Security. In Björn’s new position he will be forming a resilient environment, taking a position on the side of Defensive Security, ensuring resilience and security for the future within an organisation committed to investing in and strengthening its infrastructural security. 

Are you interested in the work SecureIT does?
Please come see us and have a talk over a coffee or tea – ping us here!

Image of a backlit keyboard
CategoriesRisk and vulnerability alert

Vulnerability Alert (CVE-2022-30190) – updated

Over the weekend, a serious vulnerability
(CVE-2022-30190) was discovered.

Microsoft released guidance for the vulnerability, saying the following.

 

“A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights.”

Although Microsoft has not released a patch for the vulnerability it has however released a workaround disabling MSDT.

Recommended workaround:

  1. “Run Command Prompt as Administrator.
  2. To back up the registry key, execute the command “reg export HKEY_CLASSES_ROOT\ms-msdt filename“
  3. Execute the command “reg delete HKEY_CLASSES_ROOT\ms-msdt /f”.

 

This vulnerability is particularly malicious. It can have damaging effects through something as simple as a person opening a Word document, according to Microsoft an attacker could,

 “install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights”.

It is important to note that this vulnerability is being investigated and the workaround from Microsoft hasn’t been confirmed by researchers.

For a technical review of this vulnerability we highly recommend a report by  Huntress Labs

The important facts about this vulnerability are as follows:

  • Confirmed to being actively exploited since at least April this year
  • Workaround in place although it’s effectiveness unconfirmed

We will keep an eye on how this vulnerability develops and update this post.

 

Update

Microsoft has patched this vulnerability in a security update recently published. Make sure to refer to this page for further more specific information on each operating system.

CategoriesCompany insights

Oktavía Hrund joins forces with SecureIT

Oktavía Hrund joins SecureIT as a Holistic Security Consultant

Oktavia Hrund Jóns is the most recent addition to SecureIT. Oktavía has provided consultation services and conducted audits and assessments in security and privacy worldwide for two decades and is a recognized Senior Holistic Security Advisor.

Oktavía has a Bachelor’s degree in Business and Communications and a Master’s degree in International Development and International Communication. Oktavia was certified as a BSI ISO 27001 Lead Auditor in 2021.

Oktavia co-founded and managed the DDoS mitigating secure hosting platform VirtualRoad which provides DDoS protection to a variety of clients worldwide and designed and directed the SAFE initiative providing integrated security training, emergency assistance and incidence response to at-risk groups. A seasoned trainer and facilitator, Oktavía has conducted information and holistic security training since 2007.

In 2017 Oktavía founded future404, which specializes in security consultation, audits and implementation of security standards, as well as GDPR consultation.

Oktavia will provide consultation and be part of SecureIT’s virtual CISO services as well as conduct multiple types of audits and assessments in security and privacy, provide risk management services and use their experience to further strengthen SecureIT’s incident response team.

Click here to see SecureIT complete Services

Click here for media in Viðskiptablaðið (in Icelandic)

Portrett mynd af Kristjáni
CategoriesIndustry Insights

Ógnirnar taka stöðugum breytingum

Íslensk fyrirtæki geta verið bitastæð skotmörk í augum tölvuþrjóta og árásir þeirra valdið miklu tjóni

Sumum gæti þótt lýsingar Kristjáns minna á atriði úr mynd um James Bond en hann segir að því miður sé hættan stundum það mikil að varasamt geti verið að hafa t.d. viðkvæm gögn á tölvum og símum í viðskiptaferðalögum.

Íslendingar eru enn svolítið saklausir þegar kemur að netöryggismálum og sýna ekki næga varkárni. Þetta segir Kristján V. Jónsson, tölvuöryggisráðgjafi hjá SecureIT, en fyrirtækið sérhæfir sig í að aðstoða fyrirtæki og stofnanir við að bæta öryggismál sín með heildrænum hætti. 

„Við fylgjum stjórnendum á þessari vegferð, því það að hafa upplýsingaöryggið í lagi er nokkurs konar þroskaferli þar sem þarf stöðugt að vinna að því að gera betur. Á sama tíma verður að haga vörnunum í samræmi við þarfirnar á hverjum stað og engar þumalputtareglur til um það hve miklar ráðstafanir þarf að gera,“ útskýrirKristján. „Þar sem unnið er með mikið af persónugreinanlegum upplýsingum eða viðkvæmum fjárhagsupplýsingum á borð við kortanúmer væri eðlilegt að hafa hærra öryggisstig en hjá t.d. litlu fyrirtæki sem heldur bara úti einfaldri heimasíðu og tölvupósti og er ekki með neina sölu yfir vefinn.“

Kostnaðurinn og fyrirhöfnin við að viðhalda viðunandi öryggisstigi er að sama skapi breytilegur og segir Kristján að jafnvel hjá litlu
fyrirtæki sé það umhugsunarvert ef ekki er ráðstafað a.m.k. nokkrum vinnustundum í viku í öryggismálin. „Minni fyrirtækjum hentar vel að fá aðstoð utanaðkomandi ráðgjafa í hlutverki tæknilegs öryggisstjóra enda hafa þau ekki sömu forsendurnar til að ráða og þjálfa manneskju í slíka stöðu í fullu starfi.

Það er nauðsynlegt að leggja nægilegan tíma jafnt og þétt í öryggismálin því tækniumhvefið og ógnirnar taka stöðugum breytingum.“

Tölvuþrjótar hafa áhuga á Íslandi

Um þá tilhneigingu Íslendinga að vera gálausir þegar kemur að netöryggi segir Kristján að þar sé eflaust því um að kenna að Ísland er öruggt samfélag og ríkt í Íslendingum að treysta öðrum. „Ég heyri það líka oft í mínu starfi að fólk telur að tölvuþrjótarnir hafi engan áhuga á Íslandi, enda bara lítil eyja norður í Atlantshafi. En raunin er með netið að þar skipta landsvæði engu máli og óprúttnir aðilar eru sí og æ að skima vefinn eftir mögulegum skotmörkum hvar svo sem í heiminum þau er að finna. Eru ógnirnar þær sömu á Íslandi, Þýskalandi eða Bandaríkjunum og sáum við það t.d. þegar Log4j-öryggisgallinn kom í ljós seint á síðasta ári að tölvuþrjótarnir biðu ekki boðanna og hófu strax að leita hátt og lágt að kerfum sem væri hægt að komast inn í til að misnota þessa glufu.“ 

Kristján segir það líka útbreidda ranghugmynd að íslensk fyrirtæki og stofnanir séu ekki góð skotmörk. Það hefst kannski lítið upp úr því að ætla að krefja íslenskt félag um margar milljónir dala í lausnargjald vegna gagnagíslatöku, en þess þekkist dæmi að tölvuþrjótarnir hafi haft umtalsverðar upphæðir upp úr krafsinu með hnitmiðuðum og útpældum árásum sem beint var að Íslandi. 

„Við vitum t.d. um tilvik þar sem milljónir króna hafa tapast vegna svokallaðra forstjórasvika þar sem tölvuþrjótum tekst að villa á sér heimildir og blekkja fyrirtæki til að millifæra háar fjárhæðir inn á bankareikninga. Einnig hafa allstórar upphæðir farið í súginn í gíslatökuárásum, ýmist vegna greiðslu lausnargjalds eða einfaldlega í formi dýrmætra gagna sem glötuðust eða vinnustunda sem töpuðust á meðan kerfi og gögn voru óaðgengileg,“ segir Kristján og bætir við að aðeins lítill hluti slíkra árása rati í fréttir. 

„Er þá eftir að nefna hættuna á iðnaðarnjósnum en fjöldi íslenskra fyrirtækja býr að dýrmætu hugviti sem er afrakstur langrar þróunar- og rannsóknarvinnu. Þetta eru verðmæti sem margir geta haft áhuga á að komast yfir og eitthvað sem fyrirtæki í öðrum löndum hafa tamið sér að gæta sín sérstaklega á.“

Mynd af Pikachu

Ert þú að veiða Pikachu eða er Pikachu að veiða þig?

Hugvitssemi tölvuþrjótanna á sér engin takmörk og segir Kristján að þeir séu oft leiftursnöggir að nýta sér minnstu tækifæri til að koma óværu inn á síma og tölvur fólks. „Snjallsímaleikurinn Pokemon GO naut t.d. mikilla vinsælda hér um árið en leikurinn var þó ekki fáanlegur strax í öllum löndum. Þeir sem vildu spila hann þurftu því að leita að óopinberum útgáfum leiksins sem voru í boði hér og þar á vefnum,“ segir Kristján. „Strákurinn minn nauðaði mikið í mér að ná í leikinn fyrir hann svo að ég fór að skoða hvað var í boði. Viti menn,
margar af þeim óopinberu útgáfum af Pokemon GO sem ég fann á þeim tíma reyndust innihalda spilliforrit sem smituðu síma þeirra sem sóttu forritin. Minnir þetta á að fólk þarf að hugsa sig tvisvar um áður en það setur upp hugbúnað og reyna að meta áhættuna eftir því hvaðan hugbúnaðurinn kemur og hvort útgefandinn er traustsins verður.“

Ættu að nálgast viðskiptaferðir eins og James Bond

Kristján undirstrikar að gott net- og gagnaöryggi kalli ekki á takmarkalausa tortryggni en óhætt væri fyrir landsmenn, bæði í störfum sínum og einkalífi, að temja sér ögn meiri varkárni. „Það er ágætis dæmi um hugarfar okkar að nýleg rannsókn leiddi í ljós að Íslendingar eru mun viljugri en aðrir Evrópubúar til að samþykkja vefkökur, og stór hluti landsmanna virðist ekki gera sér grein fyrir því hvernig nota má vefkökur til að safna upplýsingum um netnotkun þeirra. Væri athugandi að flétta það inn í námskrá grunnskólanna að kenna börnum og unglingum að umgangast netið betur og gera þau betur meðvituð um hvernig aðrir geta safnað um þau upplýsingum til dæmis gegnum það sem þau birta á samfélagsmiðlum.“

Sumir ættu að vera enn varkárari en aðrir og nefnir Kristján að stjórnendur fyrirtækja, tæknimenn með aðgang að viðkvæmum kerfum og jafnvel stéttir á borð við blaðamenn verði að gera heiðarlegt mat á því hvort einhver kunni að hafa þá í sigtinu og hafi eitthvað að græða á því að komast inn í tölvur þeirra og tæki. „Eru sum innlend fyrirtæki farin að setja strangari reglur af þeim sökum og gefa tilteknu starfsfólki skýr fyrirmæli um t.d. hvaða forrit þau mega ekki hlaða inn á farsíma sinn eða fartölvu, að enginn annar megi nota tækin og jafnvel að sérreglur gilda um þau tæki sem notuð eru í ferðalögum erlendis.“

Sumum gæti þótt lýsingar Kristjáns minna á atriði úr mynd um James Bond en hann segir að því miður sé hættan stundum það mikil að varasamt geti verið að hafa t.d. viðkvæm gögn á tölvum og símum í viðskiptaferðalögum.

„Þá geta óprúttnir aðilar átt auðveldara með að komast í tækin þegar fólk er á ferðalagi og er t.d. til þekkt tölvuárás sem kallast „evil maid“ eða „vonda herbergisþernan“, þar sem tölvuþrjótar sæta lagi á meðan eigandinn skýst t.d. í morgunmat á hóteli sínu, stelast inn í herbergi hans og skrúfa fartölvu hans í sundur til að gera afrit af harða diskinum eða koma fyrir njósnabúnaði.“ 

Bendir Kristján á að það geti líka verið hluti af vörnunum að fólk geri sig ekki of sýnilegt á samfélagsmiðlum. „Ef forstjórinn er t.d. mjög duglegur á samfélagsmiðlum og lætur allan heiminn vita þegar hann fer í sólarstrandarferðalag þá gæti það verið tækifærið sem tölvuþrjótarnir voru að bíða eftir til að reyna að plata gjaldkerann til að gera millifærslu.“

 

Greinin birtist fyrst í Morgunblaðinu þann 2. febrúar 2022 og var skrifuð af Ásgeiri Ingvarssyni.