The challenge of protecting personal data in cyberspace

Organized, professional data trading

At the workshop, Lieutenant General Nguyen Minh Chinh, Director of the Department of Cyber ​​Security and High-Tech Crime Prevention (A05, Ministry of Public Security), Vice Chairman of the NCA, said that recently, the Ministry of Public Security discovered hundreds of individuals and organizations involved in buying and selling personal data.

Several large-scale data appropriation and trading lines in Vietnam have been discovered, fought, and handled. The amount of personal data illegally collected and traded has been discovered to be up to thousands of GB of data, including many internal, sensitive personal data. Data security risks continue to exist, challenging protection efforts.

In 2023, the buying and selling of personal and sensitive data continued to be complicated with many sophisticated methods and tricks. The Ministry of Public Security has proactively detected, investigated, and verified 16 cases of disclosure and sale of information, state secrets, and internal data on cyberspace.

Conference scene. Photo: TRAN BINH

Commenting on data security risks, Lieutenant General Nguyen Minh Chinh said that personal data disclosure is common in cyberspace. Users are not aware of protecting personal data, posting it publicly or exposing it during the process of transferring, storing, exchanging for business activities or due to inadequate protection measures leading to its appropriation and public posting.

The buying and selling of personal data is currently widespread and public, with raw data and processed personal data, many acts have not been processed due to lack of legal regulations. The buying and selling of personal data does not only occur individually, between individuals, but also involves the participation of companies, organizations, and businesses.

“Some newly established companies invest in building and operating technical systems that specialize in illegally collecting personal data for business profit; build software that specializes in collecting personal information, hidden in websites to automatically collect information, analyze it into valuable personal data files; distribute malicious code that collects personal data on the network environment; organize attacks and infiltrate computer systems of agencies, organizations and businesses to appropriate personal data,” said Lieutenant General Nguyen Minh Chinh.

Mr. Le Quang Ha, Deputy Director in charge of technology at Viettel Cyber ​​Security Company, said that in the first 6 months of 2024, Viettel Cyber ​​Security Company's system recorded 46 cases of data leaks and sales, 13 million records were sold, 12.3 GB of source code leaked, 10 cases of data encryption attacks demanding ransom, and 56 organizations showing signs of data encryption attacks. In addition, there were 495,000 DDoS attacks, 2,364 phishing domains, 7 targeted cyber attack groups (ATP) were discovered, 17,648 new information security vulnerabilities were discovered, and 2,139 IP addresses connected to phishing domains... "A professional cyber security extortion industry has now been formed," Mr. Le Quang Ha commented.

Building a cybersecurity information sharing platform

At the workshop, experts all agreed that data management in Vietnam still has many shortcomings and limitations. Accordingly, some organizations and businesses do not have or have inadequate infrastructure to deploy core information technology systems to serve data collection and management.

Many databases are collected, stored in duplicate, overlapped, and inconsistent in terms of shared data categories, making it difficult to connect, share, and exploit data. Investment in data centers is not synchronous, inconsistent in terms of standards and technical regulations, and is not regularly checked, maintained, or upgraded, leading to the risk of not ensuring system security and safety. Some organizations and businesses that rent information technology infrastructure services pose many potential risks to information security and safety because they have not truly managed and controlled the data on the enterprise's infrastructure.

Challenges and risks to data security in cyberspace. Photo: TRAN BINH

Mr. Vu Ngoc Son, Head of the NCA Research, Consulting, Technology Development and International Cooperation Department, said that the trend of cooperation and sharing of cybersecurity data has been and is being implemented very effectively in many places around the world.

“Sharing information is the best way to help members of the Association get a complete picture and update the latest cyber security intelligence. This helps organizations identify new risks and proactively strengthen and ensure security,” said Mr. Vu Ngoc Son.

Therefore, NCA will take the lead in building the platform, connecting and receiving data shared from the Ministry of Public Security, the Ministry of Information and Communications, the State Bank as well as connecting with Vietnamese cybersecurity companies, international cybersecurity organizations and independent cybersecurity experts. The platform can share the latest attack signs collected through investigated cases, such as malware identification information, control server addresses, network characteristics or server memory if attacked. This information helps administrators quickly deploy cybersecurity rules to detect and prevent attacks across the entire system, while also reviewing and cleaning servers and workstations to detect whether they have been compromised or not.

According to Mr. Vu Ngoc Son, this platform will give early warnings to organizations when detecting data leaks. The data that is warned about leaks includes internal data, customer information, software source code, accounts, passwords, etc.

“Actual statistics show that the average time for an organization to detect a data breach is up to more than 200 days. Early detection not only helps organizations quickly activate response scenarios to minimize damage and shorten recovery time, but also helps prevent the risk of further data breaches,” said Mr. Vu Ngoc Son.

TRAN LUU

Source: https://www.sggp.org.vn/thach-thuc-bao-ve-du-lieu-ca-nhan-tren-khong-gian-mang-post749620.html