 |
| Denar Regata Akbi, S.Kom., M.Kom. a lecturef from UMM Informatics (Photo : Special) |
The news about the National Data Center being hacked has made people wonder, how exactly is the security of Pusat Data Nasional (PDN) (trans: the national data center) which contains millions of people's personal data? Ir. Denar Regata Akbi, S.Kom., M.Kom. lecturer in informatics, explained that a data center is a room that has its own specifications for placing a server. Starting with electricity, cooling, network devices, and perimeter security. This room must be prepared very safely because it contains countless data points. The data center itself has the task of providing services to users who need them.
The security system in the data center room is both non-digital and digital. Non-digital means there is a tangible form, such as the use of identification or other identity to enter the room. While digital security means password security that must be inputted first to access or connect directly to the server.
"All aspects related to this matter must be stabilized. Problems with electricity ups and downs can cause immigration data errors. Likewise, when the server goes down. Therefore, a data center must have high availability. Whenever we need data, it must be able to provide it because the data is already stored there. It cannot be dead or damaged," explained Denar.
Furthermore, Denar said that data centers are interesting to break into for many reasons, one of which is the motivation to take advantage, such as cases that occurred in Indonesia where data centers were indicated by malware. Malware, or "malicious software," is software designed to cause harm to data managers. The other reason is because of the amount of data that attackers can retrieve from the data center. Then there is an opportunity for them to sell the personal information.
Denar, who is also a member of the IHP (Indonesia Honeynet Project) forum, cannot provide a definitive answer as to why Indonesia's central data could be breached by attackers because he and his team have no idea what their perimeter security is. Yet when it comes to the perimeter in theory, there are several predictions that come to mind. First, there is a security inequality between the data center and other supporting systems that should be interrelated. The second is a software vulnerability, which can be caused by bugs caused by not updating the security system.
Third, human error is the most potential part to be exploited. For example, consider the cases of social engineering and phishing (a digital crime to get someone's sensitive data). According to him, human resources in charge of non-digital security at the data center must be given education so that they do not easily trust anyone and are careless about the exploitation of attackers. Human error is also related to third parties or vendors who market various products such as routers, switches, cables, and so on. However, it is important to be able to control the data center from a distance, even if you don't have to go into the data center room.
Fourth, the insiders. Let's say someone works for a company, but he doesn't feel comfortable with the work environment. Finally, he cooperates with the attacker to break data related to the company, for example, in terms of digital security. Fifth, a weak network can be fresh food for attackers to perform their mission.
"From this case, there are several things that can be done to minimize the security of central data that has been hacked. It is by discussing with various related parties that we can create a ready-made security system. There must be a clean firewall, conduct regular security audits, and train employees on existing security systems. You can also form a CSIRT (Computer Security Incident Response Team), which will be responsible for being alert if there is a similar case," he added.
Read more: The Polemic over Tapera, Here's an Explanation from UMM Lecturer
Finally, while learning from this mistake, Denar encouraged the public to be more aware and increase literacy related to digital security. In many cases, the average public is easily exposed to phishing and social engineering. He suggests using two-factor authentication (2FA) to minimize account breaches. "Finally, don't share anything on social media, because any information can be easily obtained by an attacker if you are not careful," he concluded. (dit/wil/put)
