4. Digital competences

Data security is a central and overarching theme when it comes to building digital skills. Data and information are valuable currencies for many in our connected world. However, like any form of currency, data can also be stolen. This is as true in a private context as it is in a professional one. For example, if we google the best-Baked Beans recipe and thus out ourselves as a fan of English cuisine, that is one thing. But if we enter our bank account details on a fake website, that’s something else entirely.

The issue of data security is now becoming much more serious in the professional context – industrial espionage, hacker attacks and data theft occur again and again and can have serious economic consequences. The chain breaks at the weakest link. That is why every employee must at least understand the basics of data security.

Information is essentially the knowledge or details about things or processes.

Data is standardized or systematic (comparable) information for further processing and storage. They can be sorted, evaluated, and used or saved in different applications. In stored form, for example, you can use address data to create a form letter; with stored numerical data you can perform calculations.

Let us therefore first look at the three most important features of data security:

• Confidentiality
• Integrity
• Availability

Confidentiality means the protection of data from unauthorized disclosure. Professional as well as private information is always subject to a certain level of confidentiality. This means that it is only available to a limited or authorized group of people. Only authorised persons may view, process, and transfer confidential data.

Security Intelligence Investigator – Gigafactory Berlin-Brandenburg

Security Intelligence Investigators are responsible for the protection of Tesla’s intellectual property, trade secrets and confidential information. This role will conduct both proactive and reactive investigations and actively address internal and external threats to Tesla’s proprietary and confidential information. This role will report to the Manager for EMEA Investigations.

Integrity means ensuring that data is unchanged and complete and that all relevant systems function correctly. To guarantee the integrity of data, it must not be possible to change or manipulate it unnoticed – all changes that are made must be traceable and retraceable.

Availability means that data, networks, and software as well as hardware are always available when they are needed – for example during office hours. Necessary data must therefore not be able to be blocked by unauthorized persons.

Two other terms are also important: Authenticity ensures that the person originating or transmitting data is the person they claim to be. The authenticity of the person must therefore be verifiable.

Bindingness refers to the “non-repudiation” of data changes. This means that data is binding if the creation or modification can be clearly and undoubtedly attributed to a person.

By securing the above-mentioned features, one wants to secure data. Attacking or attempting to circumvent these features are essentially acts of computer crime – or cybercrime in English.

Cybercrime is a crime in the sense of the Criminal Code and includes all criminal offences committed with or against information or communication technology. This includes, for example:

• Computer fraud, i.e., any form of fraud committed via computers or the Internet.
• Spying on or intercepting data and reselling it
• Falsification of data or sabotage of computer systems
• Copyright and trademark infringements

The automotive sector is considered to be the largest sector in Germany, generating over 411 billion euro in revenue. Germany is the largest automobile manufacturing country in Europe, producing 30% of all passenger cars in the EU in 2021. Automotive companies, their employees and users have frequently become targets of cybercriminals aiming to perform various attacks. One of the recent examples is an info-stealing campaign that targeted customers of German companies, mainly car dealers, with phishing emails aimed to infect the victims with info-stealing malware.

Another recent cyberattack that occurred in March 2022, targeted a German subsidiary of Denso, a Japanese automotive supplier. The Pandora ransomware group announced that it compromised the network and shared screenshots of purchase orders, automotive technical diagrams, and emails on its blog. Moreover, the gang claimed to have stolen 1.4 TB of data from the company. Following the attack, Denso apologized for any inconvenience caused and confirmed that the German network was illegally accessed.

With more and more vehicles connected to the internet and using many digital functions, major automotive companies are exposing cars to additional malicious activities and increasing the risk of cyberattacks.

Source: https://ke-la.com/resource/german-automotive-sector-cybercrime-threats-landscape-report/

A term that naturally comes to mind about cybercrime is “hacking“. The word originally simply meant the identification of a creative solution process around a technical problem. In common parlance, however, hacking has become established in a rather negative sense, namely when someone gains illegal and unauthorized access to computer systems or networks.

Hacking, to classify the term in cybercrime, is therefore a criminal offence. This can affect private individuals whose credit card data or other personal information is stolen from their computers. But it also affects entire companies and even governments. Industrial espionage is common in highly competitive industries.

https://www.freepik.com/free-vector/data-stealing-malware-concept-illustration_18771508.htm#query=cyber%20crime&position=47&from_view=search&track=sph

A common hacker attack is so-called email phishing. Fake emails are sent in which the receiving person is tricked into entering personal or professional data (access data, passwords, etc.) or even clicking on links that then download unwanted software (often unnoticed).

1.The fake invoice scam

Let’s start with arguably the most popular phishing template out there – the fake invoice technique. Like many phishing attacks, this scam relies on fear and urgency, pressuring an end user to submit a payment for goods or services they’ve never even ordered or received.

2. Email account upgrade scam

Faced with having your account expire unless immediate action is taken, the email account upgrade scam can appear to come from trusted email providers like Microsoft and Google, or simply from your company’s IT department. A useful tip is to hover over the link itself when being asked to give personal details – as the text itself often doesn’t represent the true destination of the link.

3. PayPal scam

These emails often include the PayPal logo, plus a convincing chunk of fine print at the bottom of the email. Again, this scam tries to enforce panic mode into its victims, often with a “There’s a problem with your account, please click here to fix it” kind of message. Beware, they also contain legitimate-looking fine print.

Sometimes it is quite difficult to debunk such emails. These tips usually help:

• Disproportionate number of spelling and grammatical errors
• The use of a foreign language
• Impersonal salutation such as “Dear user” (Attention, sometimes phishing hackers can also find out real names, a personal salutation is, therefore, no guarantee for the correctness of an e-mail).
• You are urged to take an action, possibly even under threat (e.g., “enter your account details as soon as possible, otherwise the account will be blocked”).
• General requests to enter data, open a file or open any links

If you think you have received a fake email, report it immediately to your company. Under no circumstances reply to the e-mail, do not call any telephone numbers, and do not click on a link “on a trial basis”.

Of course, data can not only be stolen via the internet but must also be physically secured. Data loss can also occur when the hardware is destroyed, infected by a virus, deleted by mistake or deliberately, or when a device is simply stolen. There are various measures to physically secure devices such as laptops, company and private mobile phones and tablets:

• Always lock unattended rooms with hardware
• Do not let (especially portable) devices out of your sight
• Secure access to hardware rooms with magnetic card systems or passwords.
• Chain devices with safety cables
• Set up audible warnings, for example, if local hardware is moved away from the usual location or if the person using it moves too far away from the unit.
• Attach so-called M-DotDNA microdots (small dots of glue containing individual codes), which are used by the police to identify apprehended stolen property.

Another safeguard is to set up options for remote locking or deletion. This means that in the event of theft, the corresponding device can be locked from another device or the data on it can be deleted.