Protection Against Cyber Attacks: Personal Data Security and Passwords

With digitalisation, use of the internet and networks has increased. In addition, with the impact of COVID-19, the place of remote working models in our lives has grown stronger. As a natural result, within the scope of cybersecurity, supervising employees and ensuring their digital security has both gained importance and become considerably harder. There has also been a serious rise in the cyber attacks we may face individually and in the use of malware (malicious software) targeting our personal data. It is possible to read news about this in the media almost every day.

Cybersecurity experts actively working in the field frequently warn about cyber attacks or malware we may encounter that could have serious consequences. Despite this, many people prefer easy-to-crack passwords when creating them, one of the first steps of personal data security. According to the “Most Common Passwords” report published every year by NordPass, it was found that people commonly use football teams, car brands, band names or their own names as passwords.

There are interesting examples…

In a study in Israel, security researcher Ido Hoorvitch carried out research on 5,000 WiFi networks in Tel Aviv. The researcher focused on capturing the value known as the PMKID (Pairwise Master Key Identifier), which relates to roaming in the network and is used for authentication. He was able to crack 2,200 passwords at an average speed of nine minutes per password.

Using a simple and easy cracking method, Hoorvitch cracked about 70% of the WiFi passwords by the end of the research. This shows that no strong password policy has been set for WiFi networks. If attackers obtain our personal WiFi password, they can access our personal network (LAN – Local Area Network), change our modem settings and take over our devices on the network by exploiting flaws. To protect ourselves from such cyber attacks, we first need to use a strong password policy.

In the rest of the article we will make a brief assessment of the subject and try to find out how personal data can be made more secure. We will also touch on the negative situations we may personally face and the important methods to pay attention to in creating passwords.

The concept of personal security, covering a wide area from the personal social media accounts we use to email and bank accounts, is of vital importance and must certainly not be ignored. If our personal social media accounts are taken over or hacked (hacking activities), what we may face can reach very serious dimensions, and posts amounting to crimes made from these accounts may also bring us face to face with legal proceedings.

If our accounts are taken over, our identity information can be used both for illegal purposes and for certain financial gains by the person or persons who seize it. A fake identity card created in our name or a credit card account opened in our name are the first examples that come to mind. It would be pointless to remain indifferent to a situation with such serious consequences.

So what can be done against these cyber attacks? Although the answer may seem a little complicated, we can overcome the problem with the effective password methods we use. So what might these password techniques or methods be? It is worth explaining these techniques a little. Before turning to them, it is useful to know about the general methods used by attackers.

Some general techniques cyber attackers use to crack passwords can be listed as follows:

• Guessing: The attacker makes continual attempts involving general information such as the target’s birthplace, sports team or children’s names.
• Online Dictionary Attack: The attacker carries out attacks by using online, constantly updated dictionaries through an automated program. The term dictionary refers to lists of previously used passwords, usually obtained from past security breaches.
• Offline Dictionary Attack: The attacker uses a method similar to the online dictionary attack but makes use of an offline dictionary of which he has taken a copy. The attacks are again carried out by automated programs.
• Offline Brute Force Attack: The brute force attack, also described as an exhaustive key search, is a cryptanalytic attack that can be used to try to decrypt encrypted data. In short, the target in this attack is the encryption algorithm itself.

The main methods that can be taken against these attacks are: physical access to the system we use should be controlled, electronic access to password files should be controlled, password files should be encrypted, strong password policies should be created, passwords should be masked (the passwords we type should not appear as text on the screen), and multifactor authentication and account lockout methods should be used.

What should we pay attention to when creating strong password policies? It is worth noting a few important points here:

• A combination of lowercase and uppercase letters should be used.
• Non-consecutive numbers should be used.
• Symbols other than letters should also be used.
• Unicode characters should be used.
• Names or words of a personal nature that we have used on social media should not be used. For example, we should not use the name of the cat in our Facebook profile photo as a password, because attackers research and analyse the target before launching an attack.
• At the same time, passwords should be created so that people can remember them.
• Passwords longer than 14 characters are much harder to guess and crack than shorter ones. Passwords of at least 14 characters are therefore more secure. If a shorter password is to be used, it must have a complex character structure.
• Passwords should generally be changed every 42 days, and old passwords should not be reused.
• Passwords should not be saved on a computer or phone. If they are to be recorded electronically, a reputable password manager should definitely be used. This way passwords are kept in an encrypted password vault. Recording them physically also carries serious risks. If this method is used, at least an encryption method we have devised ourselves should be used, so that a person who obtains this record cannot access our accounts with the data written there.

In conclusion, protecting our personal data is first and foremost a personal responsibility, and the necessary measures must be taken. To avoid facing any accusations in the future and to protect our personal data, it is very important to take the measures described above. Personal security will also bring happiness and peace of mind. It is of great importance to take our personal measures against cyber attacks, one of the basic problems of today’s digital world, and not to neglect them.