Amniga internet-ka (cybersecurity)

Waxa guddiyadu raadiyaan

• Aasaas aad ku dhaqmi karto, ee aanad qeexi oo keliya: sirta (confidentiality), saxnaanta (integrity), helitaanka (availability), awoodda ugu yar ee loo baahan yahay (least privilege), iyo difaac lakabyo leh.
• Hab deggan oo dhacdooyinka lagu maareeyo: marka hore xakamee, ilaali caddaynta, soo celi, kadibna wax ka baro oo xidh daloolka.
• Akhrinta log-yada iyo digniinaha: kala saarista weerar dhab ah iyo buuq caadi ah, iyo garashada waxa kor loo gudbinayo iyo cidda loo gudbinayo.
• Xakamayn wax ku ool ah oo miisaaniyad yar ku habboon: patching, MFA, backup aan network-ga ku xidhnayn iyo wacyigelinta shaqaalaha ka hor qalab qaali ah.
• Daacadnimo iyo sir-haynta: waxaad arki doontaa xog gaar ah oo aad haysan doontaa awood admin, waana inay kugu aaminaan inaadan weligaa si xun u isticmaalin.
• U sharaxidda khatarta maareeyayaasha erayo fudud: waxa dhici kara, sida ay u dhow tahay, iyo waxa hagaajintu ku kacayso.

Su'aalaha ay weydiiyaan

1. 1“Waa maxay CIA triad? Qayb kasta tusaale uga bixi hay'ad dhab ah.”

   Sababta ay u weydiiyaan: Guddi kastaa wuu weydiiyaa. Waxay rabaan inay arkaan inaad saddexda fikradood ku dabaqdo nidaamyo dhab ah, ee aanad qeexid ka akhrin.

   Sida looga jawaabo

   • Confidentiality (sirta): dadka saxda ah oo keliya ayaa arka xogta, sida mushaharka ama diiwaannada bukaannada.
   • Integrity (saxnaanta): xogta lama beddelo oggolaansho la'aan iyo diiwaan muujinaya cidda beddeshay la'aantood.
   • Availability (helitaanka): nidaamyadu way shaqeeyaan marka dadku u baahan yihiin, sida maalinta mushaharka ama inta qaybin socoto.

   At a bank, confidentiality means only the right staff can see a customer's account and ID documents. Integrity means a balance cannot change without a record of who changed it and why, so a transfer of ten dollars cannot quietly become a thousand. Availability means the mobile banking system is up when customers need it, including on salary days. When I review a control, I ask which of the three it protects, and whether it weakens another one.

2. 2“Shaqaale ayaa soo sheegay email ka codsanaya inuu “xaqiijiyo” password-kiisa Microsoft 365. Kuwo kale ayaa laga yaabaa inay gujiyeen. Maxaad samaynaysaa?”

   Sababta ay u weydiiyaan: Phishing-ku waa weerarka ugu badan. Waxay hubinayaan inaad si degdeg ah u dhaqaaqdo, hesho qof kasta oo ay saamaysay, oo aad xidho jidka weeraryahanka.

   Sida looga jawaabo

   • U mahad celi qofka soo sheegay, kadib si ammaan ah u hubi diraha iyo link-ga adigoon gelin.
   • Ka hel isla email-kaas sanduuqyada oo dhan, tirtir, oo xannib diraha iyo domain-ka.
   • Qof kasta oo password geliyey: beddel, ka saar dhammaan fadhiyada (sessions), hubi MFA-ga iyo xeerarka gudbinta (forwarding).

   First I thank the person, because a fast report matters most. I look at the headers and the link without opening it on my own machine. Then I search all mailboxes for the same message and remove it. For anyone who clicked and typed a password, I reset it, sign them out of all sessions, and check for new forwarding rules, which attackers often add. I block the sender and the domain, then send staff a short warning with a screenshot of the fake email.

3. 3“Nala mari tallaabooyinka ugu muhiimsan ee ka jawaabista dhacdada amniga (incident response).”

   Sababta ay u weydiiyaan: Waxay hubinayaan inaad haysato nidaam aad raacdo marka cadaadis jiro, iyo inaad ka fikirto caddaynta iyo isgaadhsiinta, ee aanad hagaajinta oo keliya eegin.

   Sida looga jawaabo

   • Diyaar garow, kadib ogow oo falanqee: xaqiiji inay dhab tahay iyo inta ay le'eg tahay.
   • Xakamee, meesha ka saar sababta, oo ka soo kabso backup nadiif ah.
   • Ku dhammee casharrada laga bartay, oo maamulka warbixin sii tallaabo kasta.

4. 4“Ransomware ayaa qariyey (encrypt) fayl-yada ku jira shared drive-ka. Waa maxay tallaabooyinkaaga ugu horreeya?”

   Sababta ay u weydiiyaan: Waxay tijaabinaysaa inaad si degdeg ah u xakamayso khasaaraha, ilaaliso backup-yada, oo aad maamulka ku darto, halkii aad argagixi lahayd.

   Sida looga jawaabo

   • Isla markiiba ka jar qalabka ay saamaysay network-ga, laakiin ha tirtirin.
   • U sheeg maamulka, ogow inta ay gaadhay, oo backup-yada offline-ka ah ka sii fogee network-ga.
   • Nadiifi, beddel password-yada, soo celi xogta, kadibna hel oo xidh jidkii uu ka soo galay.

   I would disconnect the affected computers from the network straight away, cable and Wi-Fi, but not wipe them, so we keep evidence. Then I tell management, because this quickly becomes a business decision. I find out how far it has spread: which machines, which accounts, and whether the backups were touched. The offline backup stays disconnected until the infection is removed. Before restoring, I reset passwords for the accounts involved. Afterwards we write up how it got in and close that gap.

5. 5“Boqollaal update ayaa sugaya. Sidee u go'aamisaa waxa marka hore la patch-gareeyo?”

   Sababta ay u weydiiyaan: Patching-ku waa shaqo amni oo maalinle ah. Waxay rabaan mudnaan ku salaysan khatarta iyo hab ammaan ah, ee ma aha “caawa wax walba rakib”.

   Sida looga jawaabo

   • Marka hore: nidaamyada internet-ka u furan iyo daldaloolada ay weeraryahannadu hadda isticmaalayaan.
   • Kadib server-yada iyo nidaamyada muhiimka ah, kadibna kombiyuutarrada shaqaalaha, iyadoo loo eegayo culayska.
   • Ku tijaabi dhawr qalab, inta kale u qorshee, oo hubi in patch-ku si dhab ah u rakibmay.

6. 6“Log-yadee ayaad eegi lahayd si aad u ogaato in akoon la la wareegay, maxaase shaki kugu abuuri lahaa?”

   Sababta ay u weydiiyaan: Waxay hubinaysaa inaad taqaanno meesha caddayntu taal iyo sida caadiga ahi u eg yahay, taasoo ah udub-dhexaadka shaqada SOC-ga iyo falanqeeyaha.

   Sida looga jawaabo

   • Log-yada gelitaanka: isku-dayo badan oo fashilmay kadib mid guulaystay, dal cusub, safar aan suurtoobin, saacado aan caadi ahayn.
   • Isbeddellada gelitaanka kadib: xeerar cusub oo sanduuqa email-ka ah, MFA la beddelay, awood admin oo cusub.
   • Sharax in SIEM uu log-yadan meel keliya isugu keeno oo uu digniin ka bixiyo qaababka shakiga leh.

   I start with the sign-in logs for that account. Warning signs are many failed attempts followed by a success, a sign-in from a country where we have no staff, or two sign-ins from far-apart places within an hour. Then I look at what happened after: a new rule forwarding email outside, a changed MFA method, or new admin rights. In a SIEM I would build an alert for exactly that pattern, and check it against the user's normal working hours.

7. 7“Maareeye sare ah ayaa kaa codsaday inaad si qarsoodi ah u akhrido email-yada shaqaale kale. Maxaad samaynaysaa?”

   Sababta ay u weydiiyaan: Tani waa su'aasha anshaxa. Awoodda admin-ku waxay ku siinaysaa awood xog gaar ah, waxayna rabaan inay ogaadaan inaad u isticmaali doonto oo keliya oggolaansho sax ah.

   Sida looga jawaabo

   • Si edeb leh u diid codsi afka ah, cid kasta oo ha ka yimaaddee.
   • Sharax jidka saxda ah: codsi qoraal ah oo HR ama qaybta sharciga maraya, la oggolaaday lana diiwaangeliyey.
   • Haddii la oggolaado, gal waxa la cayimay oo keliya oo sir ahaan u hay.

   I would say politely that I can't do that on a verbal request, even from a senior manager, because reading someone's email without authorisation goes against our policy and the staff member's privacy. If there is a real concern, such as suspected fraud, I would explain the proper route: a written request through HR or legal, approved by the right person and logged. If it is approved, I access only what is specified and keep it confidential. Admin access only works if people can trust it.

Tusaalooyinka jawaabaha waa English, luqadda guddiyada badankoodu isticmaalaan. Adigu erayadaada ku sheeg.

Mawduucyada dib u eeg

• CIA triadConfidentiality (dadka saxda ah oo keliya ayaa xogta arka), integrity (xogtu way sax tahay, isbeddelladuna waa la diiwaangeliyaa) iyo availability (nidaamyadu way shaqeeyaan marka loo baahdo). Xakamayn kastaa waxay ilaalisaa mid ama in ka badan. Waxay ku weydiin karaan midka weerarka DDoS saameeyo: waa availability.
• Least privilege and access reviewsAkoon kastaa wuxuu helaa gelitaanka shaqadiisu u baahan tahay oo keliya. Maamulayaashu waxay shaqada admin-ka u isticmaalaan akoon admin oo gooni ah, email-kana akoon caadi ah. Dib u eeg cidda gelitaanka haysata dhawr bilood kasta, oo ka saar kuwa taga maalintooda ugu dambaysa. Su'aal: yaa gelitaan u leh fool-ka mushaharka?
• MFA (multi-factor authentication)Caddayn laba nooc oo kala duwan ah: wax aad taqaanno (password), wax aad haysato (taleefan, fure), iyo wax aad tahay (farta). App authenticator ah ayaa ka xoog badan SMS, maxaa yeelay SIM swap wuxuu xadi karaa koodhadhka SMS-ka. Ogow “MFA fatigue”: weeraryahannadu waxay diraan codsiyo push ah oo badan iyagoo rajaynaya in isticmaaluhu riixo Approve.
• Phishing and business email compromiseEmail, SMS ama wicitaanno been ah oo dadka ku khiyaaneeya inay bixiyaan password ama lacag. Calaamadaha: degdeg, domain wax yar khaldan, lifaaqyo aan la filayn. Business email compromise waa email been ah ama la la wareegay oo maaliyadda ka codsanaya inay beddelaan xisaabta bangiga ee alaab-qeybiye; xalku had iyo jeer waa in lagu hubiyo taleefan lambar la yaqaan ah.
• Patch management (CVE, CVSS)CVE waa lambarka aqoonsiga ee dalool la yaqaan; CVSS-na waa dhibcaha culayskiisa oo u dhexeeya 0 ilaa 10. Marka hore patch-garee nidaamyada internet-ka u furan iyo daldaloolada hadda la isticmaalayo, tijaabi ka hor intaadan si ballaadhan u faafin, oo hubi natiijada. Nidaamyada aan hadda update helin, sida Windows 7, waa khatar la magacaabo oo la qorsheeyo in la beddelo.
• Incident response stepsQaab caan ah wuxuu leeyahay lix tallaabo: diyaar-garow, ogaansho iyo falanqayn, xakamayn, cidhib-tir (eradication), soo-kabasho, iyo casharrada laga bartay. Xakamayntu waa joojinta faafitaanka, tusaale go'doominta laptop. Waxay ku siin karaan xaalad oo ku weydiin karaan tallaabada aad ku jirto.
• Logs and SIEMLog-yadu waxay diiwaan geliyaan dhacdooyinka: gelitaanka, taraafikada firewall-ka, isbeddellada server-ka. SIEM (tusaale Microsoft Sentinel, Splunk ama Wazuh oo bilaash ah) ayaa meel keliya isugu keena oo digniino bixiya. Ogow Windows event ID 4624 (gelitaan guulaystay) iyo 4625 (gelitaan fashilmay), iyo waxa false positive yahay.
• Ransomware and offline backupsRansomware wuxuu qariyaa (encrypt) fayl-yada, badanaana marka hore wuu xadaa. Backup-yadu waa inay ahaadaan offline ama aan la beddeli karin (immutable), haddii kale weeraryahanku iyagana wuu qarinayaa. Jidadka caadiga ah ee uu ku soo galo: phishing, Remote Desktop internet-ka u furan, iyo VPN aan patch lahayn. Tijaabi restore-ka si aad u ogaato inta soo-kabashadu qaadanayso.
• Firewalls, VPN and exposed servicesFirewall-ku si caadi ah wuxuu xannibaa dhammaan taraafikada soo gelaysa, wuxuuna furaa waxa loo baahan yahay oo keliya. Weligaa ha u furin Remote Desktop (port 3389) internet-ka; beddelkeeda isticmaal VPN leh MFA. Caado wanaagsan: hubi waxa IP-gaaga dadweynaha ahi dibadda u muujinayo, adigoo oggolaansho haysta.
• Encryption at rest and in transitIn transit (socdaal): xogta network-ga dhex socota waxaa ilaaliya HTTPS ama TLS. At rest (degan): xogta diskiyada ku jirta waxaa ilaaliya BitLocker ama FileVault, taasoo muhiim u ah laptop-yada u safra goobaha. Furayaasha soo-celinta (recovery keys) meel ammaan ah ku hay, haddii kale laptop xidhan wuxuu noqonayaa xog lumay.
• Authorised access and ethicsWaxaad baadhi, tijaabin ama akhrin kartaa nidaamyada iyo xogta oo keliya markaad haysato oggolaansho qoraal ah iyo xad cad. Jabsasho “anshax leh” oo aan oggolaansho lahayn weli waa jabsasho. Guddiyadu tan waxay u weydiiyaan inay ogaadaan in lagugu aamini karo awood admin iyo xog gaar ah, ee ka jawaab adigoon ka labalabayn.

Hawlaha la sameeyo ee laga yaabo in lagu siiyo

1. 1Dib-u-eegista log-yada: waxay ku siinayaan log gelitaan ama firewall ah, badanaa Excel ku jira, oo ku weydiinayaan waxa shakiga leh. Raadi gelitaanno badan oo fashilmay kadib mid guulaystay, dalal ama saacado aan caadi ahayn, iyo akoonno admin ah oo cusub. Ku tababar tusaalooyin log-yada Windows ah iyo xog tababar oo dadweyne ah.
2. 2Falanqaynta phishing: email u eg mid dhab ah oo shaashad ama warqad ku jira. Tilmaan domain-ka diraha, meesha link-gu dhab ahaan u socdo, cadaadiska ku jira erayada, iyo waxaad samayn lahayd marka xigta. Ku tababar adigoo akhrinaya header-yada spam-ka ku jira sanduuqaaga.
3. 3Xaalad miis-ku-dul ah (tabletop): “Laptop-ka sarkaalka maaliyadda wuxuu muujinayaa fariin madax-furasho (ransom).” Tallaabooyinka u kala horreysii adigoo sheegaya cidda aad u sheegayso iyo waxa aanad samaynayn: tirtirid, lacag bixin, ama qarin. Isu diyaari adigoo qoraya qorshe jawaabeed hal bog ah oo xafiis yar ah.
4. 4Hawl qoraal ah: taxa shanta khatar ee ugu waaweyn xafiis NGO oo 40 qof ah, mid kastana hal xal u sheeg, ama qor siyaasad gaaban oo password iyo MFA ah. Ka dhig mid mudnaan leh oo luqad fudud ku qoran oo agaasime ku dhaqmi karo.
5. 5Akhrinta natiijada baadhista: natiijo Nmap ah oo muujinaysa port-yada u furan server. Sheeg port-yada aan internet-ka u furnaan karin iyo sababta. Ku tababar baadhista shaybaadhkaaga oo keliya ama nidaamyo aad oggolaansho qoraal ah u haysato inaad tijaabiso.

Khaladaadka ka fogow

• Inaad taxdo qalab sida Kali, Metasploit iyo Wireshark laakiin aadan sharxi karin least privilege ama patching.
• Inaad ka sheekayso nidaamyo aad gashay oo aadan oggolaansho u haysan inaad tijaabiso. Guddigu wuxuu maqlayaa khatar, ee ma aha xirfad.
• Inaad su'aalaha dhacdooyinka uga jawaabto “wax walba dami” ama “bixi lacagta madax-furashada” halkii aad ka bixin lahayd jawaab deggan oo habaysan.
• Inaad soo jeediso alaab qaali ah ka hor aasaaska: patching, MFA, backup offline ah iyo tababarka shaqaalaha.
• Inaad eedayso isticmaalayaasha wax gujiyey. Guddiyadu waxay rabaan qof ka dhiga shaqaalaha kuwo si degdeg ah u soo sheega iyagoo aan cabsanayn.
• Inaad ilowdo inaad sheegto cidda aad u sheegi lahayd: maamulka, milkiilaha xogta, iyo qof kasta oo xogtiisa ay saamaysay.

Hubin degdeg ah

5 su'aalood. Mid kasta ka jawaab si aad u aragto sharaxaadda.