There is much talk about cybersecurity, its concept, objectives, and awareness of the strategies upon which this global system is built. All organizations and countries strive to understand it and apply its various and constantly evolving concepts and methods, given the continuous development of technology. However, the fundamental pillar of this security is the individual's technical awareness, first and foremost, and their understanding of their personal responsibility towards protecting themselves, their systems, and the community to which they belong. This is regardless of organized breaches, advanced programs, and attacks by elite hackers, which are often countered and neutralized by major technology and information security companies. This is because attacks and the theft of personal information and data are carried out in a simpler and less technically complex manner, making the targeted person do what the fraudster wants, such as disclosing sensitive information like banking details and passwords, installing viruses, or clicking on a link containing malware. To delve deeper into this field, we met with one of the pioneering Saudi women passionate about cybersecurity, Professor Rakhaa Ahmed (Master's in Information Security - USA). To tell us more about cybersecurity and the latest global reports and findings on it.

• To begin with, what does the term "cybersecurity" mean?

•• It is about how to protect all types of data from hacking, which is part of our daily work, whether at the individual level or at the level of all organizations and governments in all their military, political, administrative and financial sectors, and all institutions from cyber attacks, malware (“viruses”), or even from technological warfare.

We live in a time that requires cybersecurity protection at all levels, for individuals and groups alike. Cybersecurity has become an integral part of our daily lives, essential for living in peace and security in a world teeming with challenges and dangers. Every day, the world faces new challenges from hackers who circumvent system restrictions after updates; therefore, we can say that cybersecurity is an absolute necessity for living in safety and peace.

• How serious are cyber threats and hacking to society?

The entire world is engaged in fierce technological competition. For every new technological advancement, there is a corresponding development of viruses designed to exploit vulnerabilities and create cyber threats, causing significant damage or financial losses that tarnish the reputation of companies and organizations and undermine customer trust. This applies to the financial sector, for example, and the same can be said for all other sectors and their various activities.

In my opinion, cybersecurity is similar to medicine. At any time a disease may appear, and a cure must be found to prevent it from spreading and affecting the person, work, or life, materially or morally.

• What are the personal or psychological harms of cyber hacking?

Cyberattacks have psychological effects on victims. Privacy is a fundamental human right, and trust of all kinds is built upon it. The loss of an individual's or group's ability to protect their privacy and information has long-term psychological consequences. The impact of cyberattacks can be extremely painful, ranging from identity theft and the compromise of personal accounts to blackmail attempts. Users often underestimate the seriousness of the issue and only realize it when it's too late.

Cyberattacks also endanger lives. In 2011, patients in a hospital were harmed by a hacker who was able to remotely control the air and heat systems, damaging and spoiling medicines stored in the hospital.

• In terms of the work system and the economic cycle, where does the danger of breaches lie?

Cyberattacks often result in data loss due to the theft or deletion of sensitive information. The severity and intensity of an attack depend on the sensitivity of the information. Extortion through threats to leak highly confidential information often causes significant security problems and substantial financial losses. Moreover, the consequences can be numerous and far-reaching. For example, consider the Colonial Pipeline cyber attack in the United States. Colonial Pipeline reported that its computer networks were targeted by ransomware. The cyberattack halted all pipeline operations, and the attackers stole approximately 100 gigabytes of data, threatening to release it online unless the ransom was paid. Imagine the financial losses and the resulting erosion of investor confidence in the affected companies and the stock market, not to mention the countless bank breaches.

Nor can we ignore its political impact. Everyone is aware of the conflict that occurred through America's accusation against Russia of hacking and attempting to interfere in the results of the US presidential elections, Russia's denial, and the tension in relations between the two countries that we observe every day.

Where does Saudi Arabia stand in the world of cybersecurity?

•• The Kingdom, thanks be to God, is among the leading countries in the field of cybersecurity. I say this with pride, and I am not exaggerating, having lived abroad for over 20 years. Our country, thanks be to God, is at the forefront of the world in the field of electronic services; therefore, it is imperative that cybersecurity be synonymous with the tremendous development in the field of electronic services.

In addition, there are the efforts of the National Cyber ​​Security Authority (NCA), which has achieved global successes by holding conferences and establishing centers to educate young men and women and providing them with scholarships for studies, out of its belief in the importance of this field.

In addition to establishing a document to develop fundamental cybersecurity controls (2018: 1 ECC), the implementation of best practices and controls for enhancing and developing cybersecurity within government entities—including ministries, agencies, institutions, and every sector possessing critical national infrastructure—is a significant step that contributes to building future-proof institutions with national expertise across various sectors to protect data from cyber threats, both internal and external. This demonstrates to everyone the strength, independence, and rapid, well-planned, and regulated development of our beloved Kingdom.

• Summarize phishing for us... and how can the user be protected from it with the simplest solutions?

This is considered a type of "social engineering," which involves attempts to uncover sensitive personal information such as national ID numbers, bank details, or passwords for the purpose of extortion or theft. This is typically done through emails, fake advertisements, or fraudulent websites that closely resemble well-known and reputable sites. For example, a hacker might send you a fake email that appears to be from a trusted source or your workplace, tricking you into clicking on a malicious link or attachment to reveal personal information, leading to cyberattacks and phishing.

As for how to protect users from this in the simplest way, it involves educating and warning them against accessing suspicious websites or accepting enticing advertisements that may be attempts to breach their privacy and steal their sensitive information. In short, it's about increasing awareness and warnings for all internet users, everywhere and in every field.

• Where does the cyber attacker get the victim's information from?

•• The main information center that the hacker resorts to is social networking sites such as Facebook, Twitter, or LinkedIn, to name a few. The attacker gathers the largest amount of information about the victim, then creates a targeted attack through a fraudulent email that is difficult to doubt its credibility, and is often a link or malicious files as bait for the victim. So simply avoid giving any information that may be used against you.

• What things should you check when receiving an email?

•• First: Verify that the email address matches the sender's name. Note that the presence of the organization's logo does not always guarantee the message's authenticity.

Second: Fraudulent emails often contain a basic trap, either an attached file or a malicious link. Verify the link description by hovering your mouse over the link before clicking on it. This will ensure that the link description matches the link itself or the sender.

Third: One of the signs of fraudulent messages is the use of phrases that exploit emotions by intimidating or enticing people to click on the link without hesitation.

Fourth: The presence of spelling mistakes and unusual or inappropriate additions to the email content means that there is something suspicious that needs to be checked first.

• What should you do if you notice that you have fallen victim to phishing?

•• If you suspect that you have fallen victim to phishing, there are some necessary steps you should take.

First: Immediately change all your passwords, starting with the account that was attacked and ending with all accounts that use the same hacked password.

Second: Create strong passwords and use a unique password for each account. Make sure to enable multi-factor authentication, which is a two-step verification process for logging in that is now available in most applications.

Third: Immediately and without hesitation inform your company's IT support team or the relevant organization. Always remember the seriousness of a security breach, so seek help and warn others to avoid falling into the same trap.

Fourth: If the attack is related to your bank account, you should notify your bank immediately to freeze your account. Everyone should be wary of phishing scams targeting banks and card numbers. Banks already know all their customers' account information and have no need to obtain it in this way.

Fifth: The national identity number is considered sensitive information, and sharing it with others exposes you to falling victim to identity theft.

• How can we be sure that this advertisement doesn't have scammers and tech thieves behind the scenes?

•• By verifying the source..

If you come across an advertisement or enticing offer from a dubious or unfamiliar source, do some digging before clicking on the link!

Check the web addresses of the page you are reading. Pay attention to spelling mistakes in company names, or unusual domain names; for example, if you find Zara.offer instead of Zara.com, the source becomes suspicious.

Be aware that people who spread fake ads or news also create fake websites or images that look official but are actually malicious. So, if you see a suspicious ad that appears to be from a well-known brand, check their official website by typing in their address and searching to verify that it actually exists.

Also beware of free offers such as winning a trip to the Maldives or Hawaii, or getting valuable incentives just by participating and entering, or by clicking a button, as they say.

• Children’s games and electronic programs occupy the minds of families to protect them from the dangers of electronic hacking, fraud and blackmail. What is the role of families and society in protecting them and raising their awareness of technology?

Firstly, the family is the cornerstone of society, and its role is fundamental and essential in protecting future generations. Societies build their successes upon families improving how they raise their children and protect them from dangers, especially the risks associated with electronic technology, shielding them from its negative aspects and guiding them to reap all its benefits. Children's attachment to technology should be harnessed, and they should be guided on how to use it in the best and most effective ways.

Unfortunately, there is some shortcoming in raising awareness about fraud and cybercrimes. In my opinion, we must intensify awareness campaigns about the dangers of fraud and extortion to educate all families and their members in order to reach a conscious society that is aware of the dangers of technology before its benefits.