By Kovelin Naidoo, chief information officer at Internet Solutions

Cyber security is an ongoing war that takes place on many different battlefields, with threats primarily coming from three main sources: nation states, hacktivists, and organised crime.

When it comes to nation states, you’re looking at concepts like cyber warfare, espionage and the cyber arms race, where countries need to have an army of cyber warriors in place in addition to their traditional military! Nation states have sophisticated constitutions, with their first priority being to protect their sovereignty. This means that they need to have laws in place to give them the right to take action against violations of their cyber integrity, but it also means that they need elements in their law that give governments the latitude to infringe on some basic freedoms, if they feel that state security or sovereignty is under threat.

This is a touchy area for many, as the challenge is to find the tricky balance between state sovereignty and individual rights – seldom as clear-cut as this may seem. If a state organ believes that there’s an active threat, many feel that the security arms of government have justifiable cause to waive the rights of privacy in the interests of the state.

There needs to be a relationship of trust in government for citizens to accept this, but this element is sadly lacking in many environments, leading to the critical commentary around proposed legislation like the Cyber Crime Related Matters Bill, which affords the Cabinet Minister responsible for State Security the ability to ‘declare any information infrastructure, or category or class of information infrastructures, or any part thereof, as National Critical Information structures,’ (Section 58 of the Bill). While the Bill does describe conditions under which this may happen, critics note that the definitions of those conditions are lacking, or too broad.

Hacktivists, also known as grey hats, are essentially breaking the law, but they believe that they’re committing their crime for a greater cause. These are they guys that were behind many of the online initiatives during the Arab Spring, and they’re the types of people who were behind the recent Ashley Madison hack. The latter action was ostensibly to our people cheating on their spouses and to blackmail similar sites into shutting down, but it had the (one hopes) unintended consequence of many exposed people committing suicide.

Hacktivists typically think that they’re using their substantial cyber skills for the greater good of humanity, but they’re breaking the unofficial self-regulation ethos of the online world. Many of these “black hat” hackers operate in the ‘deep web’, where they’re set a bounty for customising malware that harvests personal data, for example.

Organised crime is the other player that compromises cyber. For example, around five years ago, criminals in South Africa realised that they didn’t need to go to the trouble of blowing up ATMs to steal money; they can achieve better results by slipping spyware onto personal computers and networks with the help of syndicate organization and financing. This looks at users’ online interactions, analyses their data, and learns their whole profile, including banking transaction thresholds. It goes as far as intercepting SMSes (easier on Android devices due to poor device patch management and higher variations of the OS), and over time, can siphon amounts out of bank accounts without account owners realising until it’s too late.

By pulling out amounts as small as R200 from hundreds or thousands of bank accounts without account holders or banks realising it can yield great results for these criminals. In these examples the banks are not compromised - rather it is the user’s PC or computing device that falls victim to the likes of Spyeye Malware.

So what can private or enterprise level players in the online world do to protect themselves from being hacked? There are some simple choices everyone can make, and some simple steps that everyone can take, whether they’re accessing online from their mobile phone, or whether they’re part of an enterprise-wide network:

• Accept and install security patches from recognised software and hardware manufacturers. You service your car regularly to make sure that it’s safe to run, so afford the same courtesy to all your tech hardware and software too.
• Set up two-step authentication on all your social media accounts, including Twitter, Facebook, Evernote, Dropbox and LinkedIn, to avoid malware sneaking in through these products. Never forget that if a service is free for you to use, you’re most likely the product – so make it as difficult as possible for anyone to ‘sell’ you and your information.
• Be wary of torrenting content, as this is one of the most common ways that malware is introduced into a system. Rather choose commercial streaming services – many of which entered the local market recently – as they provide all the content you need, through secure streaming solutions and purchase software through legitimate channels.
• This applies to anything in your home that has an IP address – whether it’s your phone or fridge. You may wonder what harm can be done by someone knowing how many groceries your fridge suggests you order, but malicious data mining can harvest financial information, regular behaviour, or information about your whereabouts (and that of your children through products like GPS watches that allow you – and other people – to track your family).
• Don’t panic that every device you own is someone else’s weapon in your hands. Educate yourself about the pros and cons of every device you own – and educate your family about how to use their technology securely. Remind your children that once something is out there in cyberspace, it’s there forever – so emphasize prudence in posting content. If you don’t want to see information on the front page of the newspapers, don’t publish it anywhere online!
• If you didn’t go looking for it – don’t download or click on it

Regardless of whether you’re a private user or an enterprise, whether you’re storing information on your own computer or in the cloud, the principles for sound cyber security are the same: make your privacy settings as rigid as possible, keep up to date with security updates, and be responsible with how you protect and share your information, whether that’s in a social environment like Facebook or Twitter, or on any other types of networking or information sharing websites.