{"id":10642,"date":"2024-11-27T12:34:12","date_gmt":"2024-11-27T11:34:12","guid":{"rendered":"https:\/\/www.ull.es\/portal\/noticias\/2024\/11\/27\/ciberseguridad-innovacion-retos-mundo-conectado\/"},"modified":"2026-10-28T11:12:05","modified_gmt":"2026-10-28T10:12:05","slug":"ciberseguridad-innovacion-retos-mundo-conectado","status":"publish","type":"post","link":"https:\/\/www.ull.es\/portal\/noticias\/en\/2024\/11\/27\/ciberseguridad-innovacion-retos-mundo-conectado\/","title":{"rendered":"Cybersecurity and innovation: challenges of a connected world"},"content":{"rendered":"

Hacker <\/em>versus cracker<\/em>. The conflict between white hats and black hats. Although society usually associates the hacker <\/em>with a criminal, this perception is wrong. In reality, the hacker <\/em>An ethical cybersecurity expert, known as a white hat, is dedicated to identifying flaws in systems altruistically or in exchange for rewards offered by companies, with the goal of improving cybersecurity. Thus, the hackers <\/em>Ethical people are what have helped the development of the internet. While the cracker<\/em>, or black hat, seeks to compromise systems for malicious purposes, such as attacking, threatening, and extorting.<\/p>\n

\u201c"The crackers <\/em>"They have become a major threat," he says. Knight Pine<\/a>, director of CryptULL: cryptology group<\/a> and the Cybersecurity Chairs at the University of La Laguna, sponsored by the National Cybersecurity Institute (Incibe) and Binter. He also points out that black hat cybercriminals no longer act solely for money, but also have other motivations, such as cyberterrorism. In this regard, Caballero states: \u201cWe need hackers <\/em>to protect ourselves from the crackers<\/em>\u201d.<\/p>\n

The researcher points out that, currently, crackers <\/em>They carry out numerous attacks on ransomware<\/em>, These attacks involve encrypting the victim's system\u2014whether it's a media outlet, a hospital, or a government agency\u2014and then demanding a ransom in exchange for the decryption key, supposedly to restore access. Petya, an example of this, was a malware <\/em>of type ransomware <\/em>launched in 2016 that affected public infrastructure.<\/p>\n

\u201cNormally, attacks by ransomware <\/em>\u201dPowerful ransomware uses encryption with current standards, which is very difficult to break, so system recovery is virtually impossible unless the key is provided,\u201d Caballero explains. He also warns against paying the ransom, as doing so makes the victim an ideal target for further attacks.<\/p>\n

\"Pino<\/a>Cybersecurity threats<\/strong><\/p>\n

Each year, the Open Web Application Security Project (OWASP) compiles a list of the top 10 cybersecurity threats. Caballero notes that in 2024, the top three are access control issues, cryptographic flaws, and malicious code injection attacks. Common problems, such as poor application design and the use of outdated components, are also included. Furthermore, Carlos Trincado<\/a>, A researcher in the area of Criminal Law at the University of La Laguna indicates that, in general, there are problems linked to massive data leaks, denial-of-service attacks, and ransomware<\/em>.<\/p>\n

The first case was recorded in 1988 malware <\/em>On the internet\u2014then known as ARPANET\u2014the Morris worm affected the 10% port of machines connected to the network. Following this incident, the Association for Computing Machinery (ACM) established November 30 as International Computer Security Day to raise awareness about the importance of protecting data in the digital world and being vigilant against potential threats.<\/p>\n

The biggest problem is human error. \u201cWe are the weakest link,\u201d says Caballero. \u201cIn cryptography\u2014the discipline that studies and develops techniques to secure information\u2014we can design perfect algorithms, but when it comes to implementation, it is humans who execute them and can make mistakes,\u201d he points out. The most common human errors are related to the creation and repeated use of weak passwords across all platforms, and attacks by phishing<\/em>, the outdatedness of software <\/em>and the misuse of computer tools.<\/p>\n

The director of CryptULL is annoyed by social engineering attacks like the phishing<\/em>, These scams aim to manipulate users into revealing confidential information. Currently, it's very common for individuals to receive phone calls requesting personal data. "It really angers me that people fall for these traps, because there's no way to defend themselves against such widespread ignorance." Cybercriminals are even using more advanced social engineering techniques. According to Trincado, the number of cases using generative artificial intelligence tools to commit cyber fraud is increasing. One example is a specific method where artificial intelligence modulates the voice of a company's CEO to impersonate them and instruct an employee to make a bank transfer.<\/p>\n

Women, more vulnerable<\/strong><\/p>\n

Within the digital ecosystem, women are more vulnerable. \u201cUnfortunately, the digital environment is part of our world,\u201d Caballero points out. Thus, if the physical world is sexist, so is the digital one. Women suffer two types of cyberviolence: cyberbullying through misogynistic attacks and sexual harassment related to the dissemination of images. In this regard, Caballero notes that the best way for women to protect themselves is through training in gender equality and the use of digital media. \u201cIt has been shown that women are at greater risk of having their systems infiltrated,\u201d she states. For this reason, in Spain, Incibe is working to bring more women into the world of cybersecurity, a field in which they are very few. \u201cWe are victims, and we must become our own defenders,\u201d she declares.<\/p>\n

Currently, the technology of machine learning<\/em> Machine learning is widely used in cybersecurity, both for launching attacks and defending against them. In addition to detecting known attacks, it can identify new threats through learning processes. Its main advantage lies in its ability to handle large volumes of data. \u201cIt feeds on an enormous amount of information, from which it identifies patterns to draw conclusions and improve its learning,\u201d explains Caballero.<\/p>\n

On the other hand, the blockchain <\/em>Blockchain is another important technology in the field of cybersecurity. Its main use is for smart contracts. However, Caballero indicates that its use has declined. The researcher highlights the advantages of this technology, such as its equitable distribution and its solid cryptographic foundation, which guarantee the integrity of the stored information.<\/p>\n

\"Carlos<\/a>Quantum computing<\/strong><\/p>\n

\u201cA few years ago I participated in a TED Talk<\/a> \u201dIn which I treated quantum computing as a joke,\u201c Caballero admits. \u201dI eat my words,\u201c he confesses. Quantum computers are already a reality: \u201dThey are much more efficient and powerful than our traditional computers, which are now obsolete.\u201d Although quantum computing has applications in different fields, its impact is most notable in the area of cybersecurity, particularly related to cryptography.<\/p>\n

\u201cAs soon as we have quantum computers with sufficient power, it will be possible to break all the cryptographic systems we currently use to browse the internet, communicate via mobile phone, or carry out banking transactions,\u201d Caballero warns. Traditional computing cryptographic systems are based on complex mathematical problems, such as elliptic logarithms or the factorization of large prime numbers: \u201cFor a conventional computer, separating the product of two large prime numbers is very difficult,\u201d he explains.<\/p>\n

However, for a quantum computer, these problems are much easier to solve. For this reason, it will be necessary to replace all current cryptographic algorithms. Caballero points out that the technology company IBM Research is leading the development in this field: \u201cThey have promised that, in a few years, there will be a quantum computer capable of breaking all current cryptography.\u201d.<\/p>\n

In fact, outgoing US President Joe Biden, during his term, issued an executive order mandating that all government agencies replace their cryptographic algorithms within 18 months, a measure taken urgently in response to the rapid advancement of this technology. For its part, Europe also published a series of recommendations urging countries to update their algorithms to adapt them to quantum computers. Indeed, according to Caballero, the National Institute of Standards and Technology (NIST) recently published an announcement revealing that all current cryptography will be obsolete by 2030 and prohibited after 2035.<\/p>\n

Post-quantum cryptography<\/strong><\/p>\n

Thus, mathematics and computer engineering have worked together to develop post-quantum cryptography, resistant to quantum computers. This new cryptography must be based on mathematical problems different from those used in traditional systems. Caballero explains that, in one of her books, the first on cryptography in Spanish, she introduced the McEliece scheme, which is based on codes. However, this scheme has two drawbacks: it requires very large keys and its calculation is slow. The researcher has a more recent publication in which she proposes a modification of the McEliece scheme with shorter keys. The code system was proposed as a possible standard for post-quantum cryptography, but ultimately, lattice-based systems have been chosen.<\/p>\n

However, lattice-based cryptography is very difficult to understand. For this reason, the CryptULL group has developed educational tools to bring this knowledge into classrooms at schools and universities. \u201cWe have used tools from software <\/em>\u201dThey use tools like GeoGebra to introduce lattice theory and Scratch to teach programming and introduce quantum computing,\u201d he explains. They have also designed a card game related to quantum computing.<\/p>\n

All of these science outreach tools have been presented at international conferences and published in high-impact scientific journals. Caballero admits that staff from IBM Research and NIST have expressed interest in some of them. Furthermore, the director of CryptULL notes that they have implemented these activities in classrooms and analyzed how much students have learned with these tools, obtaining promising results.<\/p>\n

\"\"<\/a>Legal shield<\/strong><\/p>\n

The role of law in the field of cybersecurity is fundamental. Trincado, a researcher in the area of Criminal Law, points out that most crimes involve damage to and disruption of computer systems, regulated in Articles 264 and 264 bis of the Criminal Code. On the other hand, unauthorized access to confidential data contained in computer systems encompasses a range of offenses scattered throughout the document, including the crime of discovering and revealing secrets, improper access to personal data stored in computer files, crimes related to trade secrets, and offenses related to national security.<\/p>\n

\u201cThe issue is that many of these crimes go unreported, a term that refers to the high frequency of certain offenses whose true incidence is not reflected in official statistics,\u201d he explains. This occurs because it is very difficult to identify and prosecute cybercriminals. Thus, reported crimes often go unpunished, and the perpetrators do not receive their respective sentences. \u201cIn contrast, other crimes, such as scams or online fraud, result in a higher number of convictions, since it is easier to identify those responsible,\u201d Trincado explains.<\/p>\n

Regarding crimes against access to confidential data in computer systems, society tends to imagine the perpetrators as crackers <\/em>in a dark room in front of a computer screen with a few lights. However, court statistics reveal that a large proportion of cases involve company employees or public officials accessing files from computers that probably don't even start up.<\/p>\n

\u201cThis happens because government agencies exercise very strict control over who accesses computer systems and how,\u201d explains Trincado. \u201cIn the public sector, there are numerous court rulings convicting officials for improperly accessing medical records and police files, among other things,\u201d he adds. From a legal standpoint, the key point is that it is not only necessary to establish security measures against external threats, but internal ones must also be considered.<\/p>\n

And how can the law adapt to the frenetic pace of the digital world? \u201cAccess to confidential data is possible both in computer systems and in physical files or storage facilities,\u201d he states. Thus, the interpretation of these crimes can generally be subsumed under existing ones. However, some actions, such as the non-consensual dissemination of intimate images\u2014sexting<\/em>These crimes have had to be incorporated into the Penal Code due to their increasing frequency in the digital world. Regarding jurisprudence, it is true that some judges, especially the more purist ones, may lack specific training in new technologies, which influences how they interpret certain terms. However, this does not imply poor administration of justice: \u201cJudges rely on reports from experts and specialists, as is the case in other technical disciplines,\u201d explains Trincado.<\/p>\n

Regulating AI<\/strong><\/p>\n

The problem with artificial intelligence lies in its definition, as neither technology nor computer science experts can agree. From a legal standpoint, this presents an obstacle, since laws require precise definitions. \u201cUsing a very broad definition can create problems in the application of the law,\u201d he states. In June 2024, the European Union (EU) approved a regulation governing artificial intelligence. Regarding this, the researcher maintains: \u201cA consensus was reached which, although generally correct in its definition, still presents the problem of remaining too open and ambiguous.\u201d.<\/p>\n

Although there is little doubt that advanced systems like Chat GPT can be considered artificial intelligence, the definition proposed by the EU could encompass these systems as well as others. software <\/em>more traditional. \u201cThe EU has tried to avoid this by introducing some modifications, but experts continue to question it,\u201d he says.<\/p>\n

Trincado himself still has doubts about how to clearly differentiate between an artificial intelligence system and a software <\/em>traditional interpretations stem from the proposed definition. \u201cA broad interpretation could unnecessarily regulate systems that do not present the risks associated with artificial intelligence,\u201d he states. But the opposite could also occur: \u201cA definition that is too narrow could exclude systems that pose the very problems the regulation seeks to prevent.\u201d Thus, a broad definition could hinder technological innovation, as systems would have to comply with the obligations established in the regulation, which would have economic and temporal consequences.<\/p>\n

(This report is an initiative framed within the InvestigaULL Commemorations Calendar, a scientific dissemination project promoted by the University of La Laguna).<\/p>\n

Scientific Culture and Innovation Unit (Cienci@ULL)<\/strong><\/p>","protected":false},"excerpt":{"rendered":"

Hacker versus cracker. El conflicto entre sombreros blancos y negros. Aunque la sociedad suele asociar al hacker con un criminal,…<\/p>","protected":false},"author":15,"featured_media":10647,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[949,33,175,37,51],"tags":[4415,954,955,1416,2683,4416,4417,2684,4418,1293,271,961],"class_list":["post-10642","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-catedra-ciberseguridad-binter","category-catedras-institucionales-y-de-empresa","category-ciencia-ull","category-investigacion","category-protagonistas","tag-carlos-trincado","tag-catedra-de-ciberseguridad-binter-ull","tag-ciberseguridad","tag-cienciaull","tag-computacion-cuantica","tag-crackers","tag-criptografia","tag-cryptull","tag-hackers","tag-ia","tag-inteligencia-artificial","tag-pino-caballero"],"acf":[],"primary_category":null,"featured_image_thumbnail_url":"https:\/\/www.ull.es\/portal\/noticias\/wp-content\/uploads\/sites\/2\/2026\/10\/Entrev-Dia-Ciberseguridad-04-300x200.jpg","_links":{"self":[{"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/posts\/10642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/comments?post=10642"}],"version-history":[{"count":1,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/posts\/10642\/revisions"}],"predecessor-version":[{"id":10646,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/posts\/10642\/revisions\/10646"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/media\/10647"}],"wp:attachment":[{"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/media?parent=10642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/categories?post=10642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ull.es\/portal\/noticias\/en\/wp-json\/wp\/v2\/tags?post=10642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}