third Cyber Security Assessment Netherlands - NCSC

Detailed section » 8 Vulnerability of the end-user
8 Vulnerability of the end-user
The end-user is often referred to as the weakest link in
security. However too much responsibility is placed on
the end-user. End-users are increasingly understanding
the risks of the use of IT, but have limited knowledge
and tools to tackle cyber security themselves. Rather
than being an issue of awareness, there is a limited
perspective for action.
End-users play an important role in making information chains
secure. End-users are personally responsible for the security of their
own IT, but can they accept this responsibility? This detailed section
looks at the interests, threats and vulnerabilities that concern
end-users.
8.1 End-users use IT both at home and for business
End-users are huge users of the internet, mobile devices and mobile
applications. According to research by the University of Twente,
87 per cent of Dutch citizens use the internet every day. [52: UT 2012] The
preferred location for use is still in the home, but mobile access is
increasing. The number of people owning a smartphone increased
by 1 million in 2012, to around 7 million by December 2012.
[19: IMGFK 2012]
While in 2011, 31 per cent of Dutch people had access
to the internet through a smartphone. This percentage rose to
42 per cent in one year.
The increased availability of the internet is also translating into
increased use of the internet. On a working day (including leisure
time) Dutch people spend on average 4 hours and 48 minutes on
the internet. The increase in duration of use goes hand in hand with
the increased popularity of online applications. Research by the
University of Twente [52: UT 2012] resulted in a top 5 of internet use:
»»
Information (looking for information)
»»
Entertainment (using the internet for pleasure)
»»
Interaction with friends (to maintain contact)
»»
Transaction (to make purchases)
»»
Personal development (learning through the internet)
End-users are increasingly storing their confidential data on
different devices (smartphones, tablets, etc.) and (online) applications
and their data is being processed electronically in increasingly
more places. End-users share this data, which is sometimes
necessary to access a service, with organisations providing online
services and data storage.
The number of devices in households with an internet connection
is also increasing without users even being aware of this. It is not
just smartphones and tablets that are online, so are printers,
network attached storage (NAS), media players, etc. For example
smart TVs use the internet for software updates or to retrieve
program information. Other intelligent devices such as thermostats
and security cameras also have an internet connection. Intelligent
energy meters are new devices that are increasingly being installed
in households. Currently, this is happening on a voluntary basis, but
these meters will replace existing meters as standard in the
foreseeable future.
8.2 End-users are at risk
End-users are bombarded with a raft of tools designed to get hold
of data and money. Relevant forms of this are:
»»
With phishing, malicious attackers search the internet in a
targeted way looking for information about their victims who are
then approached by telephone. In the past, this form of fraud was
targeted primarily at financial institutions. In 2012, the practice
was seen to extend to (software) suppliers.
»»
Installing malware means end-users can become part of a botnet.
An end-user’s computer can then be used for illegal activities
without the user being aware, for example to carry out DDoS
attacks or to spread spam. Other malware, for example banking
trojans, aim to cheat victims out of money when they use internet
banking.
»»
Ransomware (hostage software) hijacks the infected system’s
functionality, for example by encrypting files or blocking the
operating system from working. To regain access to the files, the
victim must pay for the code needed.
»»
A fake anti-virus product abuses end-users’ need for security with
the aim of installing malicious software on the computer. A
window appears on the user’s screen reporting that his computer
is infected with all sorts of viruses. This fake report is followed by
a request to pay a sum of money, supposedly to clean the
computer.
Data leaks also remain a threat to end-users. A hack at an online
service provider can result in confidential end-user data falling into
unauthorised hands. However end-users themselves are often
careless in handling privacy-sensitive data, for example by saving
log-in names and passwords insecurely. It appears that malware is
often looking for this information and thus ends up in the hands
of criminals. Data published on the internet, for example a user’s
online identity, can be used by other people to send email messages,
access social media or carry out (financial) online transactions.
»
91