Article

The following is a transcript of an interview conducted this month by Shegoftah Hasreen Queen of the Bangla Service, Voice of America, with Dr. Mansur Hasib, Program Chair of the graduate Cybersecurity Technology program at the University of Maryland University College.

Cyber​​security is not solely a United States problem; computer users all over the world are concerned.  Major companies, businesses, and governments, which are all dependent on computer technology, are worried.

We wanted to learn more about this issue from cybersecurity expert Dr. Mansur Hasib. Dr. Mansur Hasib is the Program Chair of the graduate Cybersecurity Technology program at the University of Maryland University College. He received the 2017 People's Choice Award in Cybersecurity.

Shegoftah Nasreen Queen (SNQ), Bangla Service, Voice of America interviewed him from the studios of Voice of America, Washington, D.C. The following is a complete translation of the interview, which aired on Voice of America on June 1, 2017.

Shegofta Nasreen Queen (SNQ) – Dr. Mansur Hasib. We consistently hear a word these days, especially as it relates to the internet. The word is “ransomware.” Could you please explain ransomware for our audience?

Mansur Hasib (MH) – Yes, certainly. First I wish to thank you for inviting me to talk with you. Similar to the way criminals hijack people or something valuable and then demand ransom in return for their release, in the case of ransomware, criminals take possession of valuable data or files belonging to individuals or businesses and then demand payment in the form of electronic currency called Bitcoin for their return.

SNQ – I see. So Bitcoin is something used for conducting commercial transactions on the Internet?

MH – Yes. Bitcoin is an alternative currency in electronic form. Just like dollars or takas are used as a currency to conduct business transactions, Bitcoin is an electronic currency used to conduct electronic business transactions.

SNQ – Okay. Recently, we have seen a dramatic rise in the number of ransomware attacks through the Internet. What is the cause of this dramatic rise in ransomware attacks?

MH – Yes. This is an excellent question. There are three reasons for the rise in ransomware attacks.

First, criminals have increased access to sophisticated technology to conduct these attacks. Even highly sophisticated tools developed by NSA and other similar advanced tools are now in the hands of criminals. Criminals are also making continuous improvements in such technology. Criminals have also banded together to turn this type of crime into an organized business.

Second, this business has become highly profitable. Therefore, highly talented programmers are choosing to make this their profession and they are making a lot of money in this profession.

The third reason, which in my opinion is the most important reason, is that individuals as well as organizations are not paying attention to continuous improvement or innovation in the technology that they use or in the various protection systems they have in place. Without innovation, they become sitting ducks. You know that shooting a sitting duck is much easier than shooting a flying duck. Without innovation, regardless of how good your technology is, hackers will eventually get in.

SNQ – So is this happening in the case of just companies or is this happening to individual computer users as well?

MH – It is happening in both cases. Because criminals have the probability of a higher payout with organizations, they are targeting organizations at a higher rate. However, normal everyday computer users are also being targeted.

SNQ – Okay. So how can this be prevented?

MH – The only way to prevent this is to understand the most important role of people in solving this problem. People use technology. However, they frequently do not learn enough about the technology. No one educates them in the proper use of the technology. The other problem is that organizations buy technology but do not hire qualified people to configure or maintain the technology.

Sometimes unqualified people are making the technology purchase decisions. They [may] think that bringing in technology will reduce their reliance on people and reduce their salary expenses. They view people as expenses. However, people are not expenses. People are the intellectual capital of organizations. Only people have the capacity to innovate. A machine does not have the capacity to innovate. Without continuous innovation you will definitely fall victim to hackers.

Another issue is that most people do not back up their valuable files. Without a backup, once your files are hijacked, and you fall victim to a ransomware attack, you are left with no choices. People should simply backup their valuable data files in one or two different locations. Backups can be done at very low cost. Even members of the public have access to inexpensive disks, which can be used to backup data. Simply backup to these disks, disconnect them, and store them safely. Then even if your computer is hijacked, you just restore from your backup. You will not need to pay ransom.

SNQ – I see. You work in the field of cybersecurity and you also teach this subject at universities. Could you please share more about your work in the field?

MH – Yes certainly. After leading digital strategy and cybersecurity for a wide variety of organizations for about 30 years, in 2013, I completed a doctoral degree in cybersecurity and then started teaching at universities. Right now, I serve as the Program Chair of the graduate Cybersecurity Technology program at University of Maryland University College. We have 12,000 women and men studying cybersecurity at our institution. We have over 410 cybersecurity faculty members and most of them are practitioner scholars. In other words, their knowledge isn’t purely from books. Like me they have extensive practical experience in cybersecurity and are now sharing their knowledge with students. Right now, we are the world’s largest cybersecurity education program. No other university has such a large cybersecurity education program. Therefore, our educational curriculum is now being licensed by universities worldwide.

SNQ – University of Maryland has many locations and branches. Which locations specialize in teaching this program?

MH – Our university has locations worldwide. We are headquartered in Maryland and we have two major centers in Maryland and several smaller centers in a variety of locations. However, 90% of our education is done online. So you can study with us from any location in the world. For example, out of our 12,000 cybersecurity students almost 4,500 to 5,000 are located outside of the USA. Our student​s​ reside worldwide. Even our professors are located worldwide. Our program is technology powered. So, you do not necessarily have to come to [a center] to study. A lot of people complete 100% of their education purely online. Furthermore, we have hybrid classes for those who wish to get some extra personal coaching and in-person interaction with students and faculty. These students get some extra coaching from our faculty during in-person classes.

SNQ – What is the future of cybersecurity?

MH – The future depends​ on us. Cybersecurity is powered by human brains. For any country, everything depends on the number of brains engaged in innovation. Think about it. If we engage one brain toward a task, the task may not be done so well. Instead, if you engage a hundred, a thousand, or even ten thousand brains toward a purpose, the quality will be much better. So whichever country engages the highest number of brains in this endeavor, the more advanced that country is likely to become in this field. We often think of America as the most advanced country. American advancement happened because, compared to other countries, a higher proportion of the American population was engaged in innovation. This is because of the most important promise of capitalism, which guarantees that we will get to enjoy the fruits of our innovation—something that does not happen in many countries. However, we now see that other countries have recognized this principle. Therefore, we see that governments of other countries are engaging thousands of their people in this manner. For example, China and Russia have advanced dramatically in these areas by engaging lots of people in this endeavor.

SNQ – I see. So can various governments or countries control or prevent hacking?

MH – Of course. Think of it—all humans all over the world have brains. The governments of several countries are laser focused in the effort of engaging lots of people and lots of brains in this endeavor. Therefore, many countries have not only become advanced in cybersecurity knowledge and technology, they also are using cybersecurity knowledge and technology as weapons of war. You can already see that cyber attacks are possible from far away locations and at very low cost. Even the politics of a country as powerful and advanced as the United States of America can be changed through the use of cyber weapons. This is an amazing thing.

SNQ – We see that many countries are taking advantage of computer hacking. We know the names of several countries. We sometimes hear that an attack started from a country like North Korea or it could be Russia. We hear of this in the news. So is ​it ​possible for various countries to collaborate in solving the problem?

MH – Yes, of course. Collaboration and cooperation is extremely important. You already know of the importance of international collaboration and cooperation in the field of crime. This is also a crime. We already know of the important role of organizations such as the Interpol. Similarly, this is a new form of crime. So intelligence sharing and cooperation among countries is very important in tackling this form of crime. When communications occur outside the realm of intelligence sharing networks, catching criminals becomes more difficult. So the more countries we have engaged in cooperating and collaborating in this effort, the easier it will be to tackle this form of crime.

SNQ – Okay another question, which I could not avoid asking. In America we often hear of the word privacy. People are always worried about their privacy. They are worried about who viewed​ their computer files. Just like me, many people are concerned about the privacy of their information. How can government regulate privacy?

MH – If anything resides on a computer, maintaining its privacy is quite difficult. Even though many laws exist, enforcement and penalties behind these laws are very weak. We have many laws related to privacy. However, when privacy is violated, penalties for violation are very weak. For example, the sensitive information of twenty million American people with the highest levels of security clearance were lost from the OPM organization. However, what were the consequences for allowing such a loss? Perhaps one person lost their job. Other than that not much has happened. And those who have been harmed by this breach have not been compensated for their damages. Until the laws governing compensation for digital harm are strengthened, I do not see much hope in this area. The laws in this area are very outdated. This is the main problem. Furthermore, look at the major breach at Yahoo! Half a billion records have been lost. Has anyone received any compensation for their damages? Has anyone lost his or her job as a result of the breach? Have any CEOs lost their jobs? Until CEOs start to be held accountable for breaches, it will be very difficult to improve the safety of information.

SNQ – Dr. Mansur Hasib, many thanks for giving us your time and enlightening our listeners on this issue.

MH – My thanks to you also for inviting me. Thank you.