Archaeology isn’t much like the Indiana Jones movies; it’s much less dangerous and requires a lot more patience and attention to detail.
But it is about finding ‘hidden’ treasure, even if that treasure is a shard of broken pottery, discarded shells and bones, or an arrowhead. That treasure may not be valuable in itself, but it might reveal new information about the people living at that time.
OK – but exactly how is archaeology related to cyber security?
It is International Archaeology Day on October 21, and that got us thinking…
You’ve probably heard the saying that the internet never forgets. While that’s not quite true, it is hard for information to be completely lost or forgotten, which means that people with bad intentions can dig around and turn up little snippets of information. By putting these snippets together, they can learn quite a lot—just like archaeologists.
Rather than learning a lot about a culture, though, these people might be learning a lot about you, your business, or your employees. This information might be just an embarrassment (such as old ‘bad haircut’ photos) but could be hidden treasure for an attacker and used to craft an attack against your business.
How?
The attacker could use the information:
- to guess passwords that are too simple (dog’s name, mother’s maiden name, street where they first lived, and so on)
- to get into your building using that information to persuade people they have the right to be there (colleague’s names, events at the last company do, information from photo backgrounds and so on)
- to write emails, using that information to pretend to be a colleague, and persuade people to share information, redirect payments or change other details in the company’s systems
- to blackmail an employee into giving out confidential information.
You might think that information from years ago wouldn’t be found or couldn’t be associated with you, or with other snippets of information—but some people have a great deal of skill in this kind of work. Just like archaeologists, but they don’t get so muddy.
What should we do?
Once information is out in the wilds of the internet, there’s not much you can do.
You might think that you can ask search engines and site owners to remove the information about you—and you can, but this isn’t easy either. Search engines can remove links to the information from their search engine results, but they don’t control the information itself. Website owners can be asked to remove the information—but only law-abiding websites will do so. And then there’s the Streisand effect, in which attempts to remove or censor information online result in increasing spread and awareness of that information.
We suggest that you talk to your staff (and your family and friends) about the risks of sharing too much information online. Remind everyone about the need to use strong passwords (not their dog’s name) and provide awareness training, so people are more likely to detect if something isn’t right. And put security controls in place to reduce the risk to your business if an attacker does manage to sneak past your employees.
Need some help? Call us on 0 113 733 6230 or contact the Click and Protect team via our online contact form.
