Lots has been written in the past about the importance of being vigilant when browsing the web, opening e-mails and their attachments, or when installing third-party software. Remember to “Protect your family” () against “An old scam in a new disguise” () i.e. “Malware, ransomware, doxware and the like” ()? But we never spoke specifically about CERN…
In the past, attackers were targeting end-users. You. Me. Our families. Everyone. Trying to get hold of your PC, your laptop or your smartphone. Obtaining illicit access. Sniffing out all your passwords. Reading your personal documents. Watching you via the embedded webcam. Listening to you using the embedded microphones. And eventually encrypting your hard disk. Once that’s done, they will blackmail you by asking for money in exchange for the decryption key. And threatening that, if no money is provided, all data will be purged (“Ransomware – when it is too late…”; ). With this threat becoming less successful, attackers have started threatening instead to expose your data. Mobbing you. Shaming you. Exposing your intimate details (“Enter the next level: Doxware”; ). This is why, assuming that you value your privacy and prefer to avoid problems, it is essential to be vigilant when browsing the web, to STOP – THINK – DON’T CLICK on links and URLs received from unknown people, and to pay additional attention when answering e-mails, clicking the links therein, or opening any attached documents (“Click me – NOT!”; ).
So what about CERN? While CERN has many protective measures in place () to avoid large scale infections of CERN-hosted PCs, laptops and smartphones, and while CERN’s central storage system should provide sufficiently secure and independent back-up solutions for you and your professional data (), the ultimate security of the Organization depends also on you: Sec_rity is not complete without “u”! In particular, attackers have now started to deliberately target companies, enterprises and organisations, and blackmail them by threatening not only to encrypt their (confidential) business data, but to expose that data on public webpages if the affected company does not pay the requested ransom (… Admittedly, if they want to expose our physics data, we might even want to help them, but CERN also holds some confidential business data (contracts, NDAs), personal data and the like (“Coming soon: A pragmatic Data Protection Policy for an open Organisation”; ) that is worth protecting.
