Types of Cybersecurity Risks and Threats to Personal Data

Cyberattacks are attacks carried out via the internet or digital systems with the aim of stealing data, compromising functionality, or disrupting system operations, extortion, or espionage.

A characteristic example of such an attack occurs when an attacker manages to insert malicious software that locks (encrypts) all files on an educational institution’s server and demands money for their decryption. This type of attack is known as a ransomware attack and has been considered the most serious form of attack over the past decade.

Figure 2: Types of cyber risks and threats to personal data

Some of the following links and documents are available in Croatian only. Participants may use free AI-powered translation tools to access the provided materials.

Further explore additional sources:

• The website CARNET - CERT – National Authority for Prevention and Protection from Cyber ​​Threats to the Security of Public Information Systems in the Republic of Croatia 

• web hero – strengthening the capacity of the police to combat cybercrime

• Europol's explanation of cyber threats (for those who want to know more).

Multi-factor authentication (MFA) is increasingly becoming an integral part of all authentication systems, and passwords, as one of the authentication factors, continue to represent one of the key components of protecting user accounts. Given that the average user manages almost 100 passwords,¹ the need to use a password manager arises.

A password manager is a tool that securely stores and automatically enters strong and unique passwords for different accounts, making them easier to use and reducing the risk of forgetting or repeating passwords.

Instead of remembering 10 or 100 different passwords, with a password manager, we remember one master key. Applications like Bitwarden or Keepass are examples of password managers. Bitwarden and Keepass are free to use.

Source:
1. How many passwords does the average person have in 2024?

Security policies are rules and guidelines that organisations set to manage information security, including data access, use of digital devices, and responsible user behaviour within organisations.

More information on creating security policies can be found at:

• CARNET security policy template for higher education institutions. 

The previous link is available in Croatian only. Participants may use free AI-powered translation tools to access the provided materials.

The most common forms of malware include:

• viruses – self-replicating programs that attach themselves to other files and spread without the user’s knowledge;

• worms – spread independently over a network, often without the need for user action;

• trojan horses – disguise themselves as legitimate programs but allow unauthorised access to a system;

• ransomware – locks down data or entire systems and demands a ransom to regain access. The most serious threat to information systems in recent years;

• spyware – secretly collects information about the user without their knowledge, often for the purpose of identity theft or activity monitoring.

Effective defense against malware includes regular data backups, up-to-date antivirus software, regular system updates, safe user behaviour, and network segmentation.

Free antivirus tools:

• Avast Free Antivirus

• Bitdefender Free

Insecure Wi-Fi is most often wireless networks without a password, with weak encryption, or inadequate protection in cafes, shopping centers, or other public spaces, and are a serious security risk. Such networks allow attackers to easily connect and access other devices on the same network, without the need for authentication and authorisation.

On unprotected Wi-Fi networks, it is possible to:

• intercept (sniff) network traffic and "eavesdrop" on user activities;

• collect sensitive information such as usernames, passwords, email content, payment information, or VPN network parameters that the user has written in the computer configuration;

• perform man-in-the-middle attacks, manipulating the communication between the user and the server.

Example: 

If a user connects to an open network in a mall and visits websites that do not use HTTPS, an attacker can intercept and analyse the traffic and potentially reveal user information, including passwords.

VPN (Virtual Private Network) is a technology that creates a secure, encrypted tunnel between the user's device and the internet, thereby protecting data from eavesdropping and enabling secure connections, especially when using public networks.

Free VPN to protect:

• ProtonVPN (basic version)

Advice:

Do not enter passwords on public networks or use banking services without a VPN.

Files and information stored in the cloud without adequate protection - such as encryption, strong passwords, or properly set access rights - are a serious security risk because they can be exposed to unauthorised access, theft, or data leakage. For example, documents on services such as Google Drive or Dropbox that are shared with "anyone with a link" and without additional protection can become easily accessible and misused.

Data in the cloud can be unintentionally shared in several ways, most often due to incorrect settings or user carelessness:

1. unrestricted links – when the file or folder is shared via a public link ("anyone with a link can access"), the content may reach unauthorised persons;

2. incorrect access rights – granting editing rights instead of just viewing can allow others to change or download data;

3. sharing with the wrong people – by entering the wrong email addresses or sharing with a large group without checking who the recipients are;

4. inconsistent device sync – automatically syncing files with personal or public devices can lead to other users unintentionally accessing that data;

5. lack of password or two-factor authentication – leaving accounts unprotected allows attackers to access user data if they get their hands on it.

The examples provided show that it is important to regularly review sharing settings, use strong passwords, and control who has access to which data.