THE WEAKEST LINK: A CYBERSECURITY STORY

FROM WHERE WE SIT

“STRANGE,” he thought, eyeing this?”

Paul examined the 64-gigabyte device for its name label. He rotated it on his hand. None. Completely generic. “Amazing how they get tinier and tinier,” Paul mused, as he proceeded to plug the smaller-than-his-thumb flashdrive into his four-year old Windows-run machine.

He was being relentlessly badgered by the tech guys to upgrade his laptop for over a year now. But policies and procedures be damned! He was generating more than P200 million in projects every year, so both the sales director and the CEO did not make a fuss but turned a blind eye to the minor company policy infractions. Besides, his old reliable laptop contained all his important files—draft proposals, contracts, feasibility reports, customer lists, torrented TV shows, and some rather raunchy photos of him and his wife from their last Palawan trip. In no way will he be sending his laptop to IT without doing some housekeeping his stuff in case the tech guys again last upgrade.

He proceeded to type in his password, and tapped the “Enter” key. The cursor remained blinking in the again,” Paul angrily realized. With so many passwords to remember, he frequently forgot which password went where. He tried again and was greeted by his haphazardly organized

- cations at him, one after the other: Windows updates available. Antivirus engine is outdated. He ignored them all, tapped on the “X” to close all the

mp4”.

Paul stood up in his cubicle and surveyed the room. It was 8:30 p.m. Ross and Lui were still there, busily pecking at their keyboards. The director’s door was still ajar, his lamp slashing a path of light in the dim hallway across. The percolator hissed occasionally as the scent of stale coffee wafted through the room. All clear.

He plugged in his earphones and - tion. Nothing. Another click. No response. mouse over the close button, and, as he did so, his virtual desktop slowly began to shrink, its edges squeezing the frame from all sides until his open vanished into a glowing point at the screen’s center, like an old cathode ray TV would do when turned off.

In a combination of surprise, befuddlement and panic, Paul swiped like a sword slashing uselessly in the darkness.

From deep in the bowels of his laptop, the Trojan horse had begun its nefarious work as soon as Paul a keylogger began capturing keystrokes as Paul entered his password. Then it started looking for network connections and access to the in in open folders throughout the network, the Trojan started uploading the contents of Paul’s 500-gigabyte hard drive over the internet to a server outside the country. This continuous stream of data began clogging the company’s internet connection.

“Lui, look at this. My screen just went blank!” Ross said aloud.

- bicle, the director peeked out from his room. “Are your connections ok? I can’t seem to access anything on the web. I think our website is down, too. Can’t access it on my phone. Is IT still around?”

Paul began to mash the buttons on his keyboard, hoping for a response from his computer. Then, just as he was about to give up all hope, a parade of dancing symbols and letters appeared from the left edge of the screen settling in the middle of the display in a familiar pattern—the ASCII characters had formed a crude graphic of a skull and crossbones. And directly underneath the symbol, it demanded that Paul “Press Any Key.”

the Enter key. “What have I done?” Paul asked himself, still uncertain if he should do as his screen instructed. He hesitatingly tapped on the key.

Further instructions appeared in that same crimson background: “The hard disks of your computer have been encrypted with a military grade encryption algorithm. There is no way to restore your data without a special key. You can purchase this key on the

- lion project proposal due tomorrow. My wife’s photos. Ross’s computer. No internet. Our website is down.” Realization now crashing into his consciousness in an endless stream of profanities, regrets and opportunities lost. And guilt.

And as he ran to the director’s room, it came to him again: the chilling blood red macabre symbol

*** This short story has been adapted from real events, with creative liberties taken to keep the names and nature of is real and is here right now in the Philippines, and people are often the weakest link in any organization’s security layers. Why did Paul plug in to upgrade his machine? Why did his superiors not insist on enforcing the policy? Why did he ignore the operating system and anti-virus update the answers to these questions, but running regular security awareness programs so that all personnel are aware of the potential consequences of their actions can help mitigate these