Data leaks are still common with increasingly sophisticated methods, ranging from Wifi lines to cutting-edge software such as Pegasus. Hackers target individuals to government agencies. To note, government sites that have a lot of important data must be equipped with a first-class security system. Starting from encryption, https, VPN, DMZ or de-militarized zone. The security system is a mandatory thing that accompanies the existence of a government site. However, from a report provided by Dark Tracer, many government institutions do not implement https properly on their sites, causing data leaks. Data leaks are not only caused by stealer malware. However, it can also be caused by the carelessness of the manager to protect the site itself. Dark Tracer found that there were at least 470 cross-institutional LPSE subdomains experiencing credential leaks with a total of 11,507 leaked credentials. Weaknesses in subdomain security can be exploited as a side door to attack the main domain that has been well secured. Cyber expert Alfons Tanujaya provides tips to anticipate credential data leaks.
How does leakage occur and how to anticipate and prevent it?
Technically, if the leak occurs from the user's side, there are three methods commonly used by cybercriminals:
1. Trojan/keylogger is malware that will record all keyboard taps from the infected device and send it to the trojan maker.
2. Phishing, where the victim will be directed to a fake site to enter his/her credentials to be stolen. These phishing victims are generally not aware when entering phishing sites due to ignorance and also the expertise of phishing message creators which usually contain threats that if they do not change credentials, their digital services, whether email, bank accounts or accounts will be turned off/blocked.
3. Using unsecured connections such as free unencrypted wifi so that the data transmitted can be intercepted and read by third parties/wifi service providers. Alpha protects connection traffic with encryption such as ensuring the sites being accessed are properly https encrypted or adding additional protection such as accessing office services from home using a VPN.
Then, how to protect data from credential theft?
1. Make sure the antivirus you are using has Identity Shield protection where when you visit a site where you enter your credentials, the credential information will be encrypted so that even if it is stolen, it cannot be read because it is encrypted.
2. Avoid using Wifi whose security is unknown, if you are forced to use Wifi, make it a habit to activate the VPN so that all communication from computer devices that use Wifi will be encrypted.
3. Avoid using pirated software because it is vulnerable to being infiltrated by malware/Trojans.
4. To avoid phishing sites, make sure your browser already has the Webroot Web Threat Shield feature which will detect and prevent you from becoming a victim of phishing and scams.
Tanks mgelh
You must be logged in to post a comment.