Safe Internet for individual users and companies. Sii Poland expert says how to effectively protect yourself against cyber attacks

Michał Mionskowski, IT ​​Security Specialist at Sii Poland, identifies, analyzes and counteracts cyber security incidents on a daily basis. On the occasion of Safer Internet Day, our expert suggests what to watch for on the web and how to effectively protect yourself from cyber criminals’ attacks.

There are many dangers in the web that are ignored by users. In addition to attempted intentional attacks, there are many incidents resulting from the irresponsible behavior of Internet users. They enter links from unknown people, download attachments from unverified e-mails, download files from sites with a bad reputation, or use illegal software.

How do you guard against the dangers on the web and what to to watch out for when using the Internet every day?

Michał Mionskowski: You can protect yourself in many ways. The user’s awareness of online threats is very important. On average, 1 in 1846 email is a phishing attack. The purpose of this attack is to pull information from a victim – usually a login and password. An example would be a message where we have documents to view, and the link leads us to a page that looks like a well-known company website. How to defend against this? It’s best to verify the sender – check if the email is from a valid source, e.g. “Jan Kowalski <[email protected]>” instead of “Jan Kowalski <[email protected]>”. If it is a person we know, it is worth warning them by phone that someone may use their data to commit a crime.

Verifying a link or email attachment is no longer so easy for the user. Nearly 66% of malware is delivered via email attachments. If we are exposed to an attack in the workplace, it is worth reporting suspicious messages to the security team for analysis.

In addition to awareness and good habits on the web, tools are also very important. Antivirus with current signature libraries will protect us against most malware attacks. The firewall detects suspicious network traffic and blocks it.

The key tool is an updated web browser, which can also warn us about a malicious page or a suspicious file to download.

And most importantly, try to use only trusted websites.

Does having current tools and using only reliable websites give us a guarantee of security?

M.M.: Unfortunately not. The owners of the website or application are responsible for their security. How can we be sure that they use the right tools, software and their methods have no gaps? The website may be “trusted”, but that does not mean that it is 100% secure.

An interesting example is an attack on a British airline website. A malicious script was placed on the site that read credit card numbers. The attack was detected after a long time because the attacker collected information but did not use it. This way, credit card data of  several hundred thousand people leaked. Such a situation negatively affected the image and finances of the attacked company, which had to pay a fine of £ 183 million.

So how can a company ensure the security of its applications? What solutions in this area do the Security Operations Center (SOC) team at Sii recommend?

M.M.: Our SOC team offers incident handling and detection. Thanks to this, we are able to repel the ongoing attack or at least limit its effects. The key is to properly secure your applications and websites. This is done by our colleagues from the Application Security team at Sii Poland.

Depending on the needs, the team supports our clients at various stages of the application development process. Starting from the identification of potential threats and defining appropriate security, through the audit of the code and architecture of the ready solution, to carry out verification. Such verification consists of 2 elements:

• Vulnerability assessments, i.e. identifying areas that are potential aim for typical attacks
• Penetration testing, which is an actual simulation of hacker activities aimed at hacking the application.

Network defense is as strong as its weakest point, and without testing it – we don’t know where it is.

If you want to find out how we can ensure the security of your company, contact us through the form on our website