Let’s start with the basics… Many of these items in the news are not master criminals hacking into a system to exploit the data. They are ransomware. The program arrives, often in an email, someone inadvertently clicks on it and it runs. The program basically scrambles all data it finds except the files needed to run windows, and then tells you how to pay for the decryption key. They aren’t downloading or analyzing data and copying the best stuff… it walks through the network looking for any shared files it has the authority to write to. Having done network setups for a lot of small to medium businesses - the problem is so many tend to bypass the security for convenience. (Seriously, how many have that “Are you sure you want to allow this program to make changes?” turned off?) Organizations make all their shares writable to everyone because it’s easier than managing tighter security, or because the people doing the managing don’t know how to enforce write restrictions. (“Program complains? Just make everyone an admin–level user”) Where the damage is particularly bad is when the backups are everyone-write. Tapes haven’t been able to keep up with modern data volumes; current backup tech tends to be portable hard drives. If your only backup is a public-writeable disk and it’s still plugged it, it will get scrambled too. Or… the backup has not worked properly for months and nobody noticed. (Of course, if it’s an administrator that falls for this, the damage will be especially bad - almost everything scrambled. If an individual loses their data - sucks to be them. If an organization is hit, it has the potential to destroy data for dozens or hundreds of people, make basic functions like accounting and payroll impossible, etc.
The next level is the hacker who wants to acquire and use your data. They use similar tricks, but 99% of the time the exploit arrives in email - if you don’t have a good mail filter on your email provider, you are seriously at risk. The latest one I saw is an email purportedly from a colleague or customer “Here, read this document about xxxxxxx” Click on it and what appears to be a legit Sharepoint or Email login pops up. If you don’t realize it, you are providing email and password to the hacker. they now have access to your email -so many organizations allow web or phone access to email from anywhere, so now the hacker can peruse your email and you are none the wiser. Once you’ve accumulated a few years of corporate email, so many never delete anything, pretty much everything about your business is there. Common follow-ups include acquiring your email contacts, anyone who has sent you or received an email. They can now send emails pretending to be you with this same exploit. (One version I saw, they add a rule to route all incoming email to trash, so any “Hey you’re sending out spam” emails, you don’t see. Another rule trick - CC any emails to a third party mailbox so they don’t need to login, and even if you change your password, they still see your email. they can find your corporate structure, to fake things like an email from CEO to Accounting, “please send this supplier a payment - here’s the wire transfer codes”. Also, some corporations have “login to your computer from home”. If they do, I bet the instructions are in your email somewhere. A lot of third party software and websites will reset passwords automatically after verify code is sent to your email. The damage is endless. Then they can login to a session on your computer if remote access is enabled - now the sky’s the limit. Download your computer’s SAM security database and do dictionary attacks to find passwords, search for financial data, etc.
you can defeat this with several options. Good spam blocking - essential. (As is common sense) If an email contains a link, hover the mouse over it and the name should pop up - does it look legit? A Microsoft or bank login link should not go to a place like barrollo.kraduchia.ru/spazi; longer passwords make it harder to guess other passwords. Changing passwords regularly (every 90 days, for example) means if someone does have your password, it will only work for a while.
Extended dictionary attacks basically take the security database, which can’t be decrypted - and try to match similarly encrypted words to see if they are the same; there are only a few hundred thousand words, fewer common ones. Try those. Try a list of common names. try adding one, two, three or four characters after. Try common substitutes like zero for oh. An full test “aaaaaaa”, “aaaaaab” etc will take the life of the universe. The dictionary can be done in hours, with characters added to the end, capitalization and so on, weeks or months to try every combination. Make a password out of combined words like “Born2BWild” and dictionary doesn’t work, make it longer, and it takes longer. If it takes so long your password has to change before the hacker is done, then it’s a lot more secure.
The latest and greatest is two-factor - when you login from a new device or after X hours, you will get a text and need t provide that to the computer as well. This has led to the next scan, SIM-swapping, where a perp persuades (bribes) and phone company employee to switch your phone numbe to a new phone so they get these verification messages. To go through the trouble of making something like this to work, the target has to be pretty valuable.
So the analogy is good - it’s like locking the house. You can lock the doors, bar the windows, put in an alarm system, have a safe for valuables, etc. Depends how badly the thief wants to get in. A swat team with no worry about police stopping them will always get it. the casual thief will go elsewhere if the door is locked.