Until now, I don't think I've touched on one of my favorite topics, cybersecurity , and I think that's what I'm going to talk about today. I hope that after this short article you'll have a better idea of ​​what can help you have better control of your risks and how to mitigate many of them at the same time.
Risks everywhere
It's inevitable; this year alone, we've already discovered and publicly assigned over 15000 vulnerabilities . How do I know? Because part of my job is to check CVEs in the programs we use in Gentoo to see if we're running vulnerable software. This way, we can update it and ensure that everyone in the distribution has secure machines.
CVE
Common Vulnerabilities and Exposures (CVEs) are the unique identifiers assigned to each existing vulnerability. I'm very happy to say that several Gentoo developers are contributing to the good of humanity by researching and publishing their findings so that vulnerabilities can be fixed and patched. One of the most recent cases I had the pleasure of reading about was Optionsbleed, a vulnerability that affected Apache servers worldwide. Why am I proud of this? Because they are doing good for the world. Keeping vulnerabilities secret only benefits a few, and the consequences can be catastrophic depending on the objective.
CNA
CNAs are entities responsible for requesting and/or assigning CVEs; for example, we have the Microsoft CNA, responsible for grouping its vulnerabilities, resolving them, and assigning them a CVE for subsequent registration over time.
Types of measures
Let's start by clarifying that no equipment is or will be 100% safe, and as a fairly common saying used to say:
The only 100% secure computer is one that is locked in a vault, disconnected from the internet and turned off.
Because it is true, the risks will always be there, known or unknown, it is only a matter of time so in the face of risk we can do the following:
Mitigate it
Mitigating a risk is simply reducing it ( not eliminating it). This is a very important and crucial point, both at a business and personal level. Nobody wants to be hacked, but the truth is, the weakest link in the chain isn't the equipment, the software, or even the process—it's the human element.
We all have a habit of blaming others, whether people or things, but in computer security, the responsibility is and will always be the human being's. It may not be you directly, but if you do not follow the right path, you will be part of the problem. Later on I will give you a little trick to stay a little safer 
Transfer it
This is a well-known principle; think of it like a bank . When you need to protect your money (I mean physically), the safest thing to do is leave it with someone who can safeguard it much better than you can. You don't need your own vault (although that would be much better) to keep things safe; you just need someone (you trust) to store them better than you can.
Accept it
But when the first and second options don't apply, that's where the really important question comes in. How valuable is this resource/data/etc. to me? If the answer is "a lot," then you should consider the first two options. But if the answer is " not that much ," perhaps you should simply accept the risk.
You have to face it, not everything is mitigable, and some mitigable things would cost so many resources that it would be practically impossible to apply a real solution without having to change and invest a lot of time and money. But if you can analyze what you are trying to protect, and it does not find its place in the first or second step, then simply take it in the third step in the best way, do not give it more value than it has, and do not mix it with things that really they have value.
To keep up to date
This is a truth that eludes hundreds of people and businesses. Cybersecurity isn't about passing your audit three times a year and hoping nothing happens for the other 350 days. And this is true for many system administrators. I recently finally got my LFCS certification (I'll leave it to you to find out where I did it 😉) and this is a critical point during the course. Keeping your equipment and software up to date is vital, crucial , to avoid most risks. I'm sure many of you will say, " But the program we use doesn't work in the next version ," or something similar. Well, the truth is, your program is a ticking time bomb if it doesn't work in the latest version. And that brings us back to the previous section: Can you mitigate it? Can you transfer it? Can you accept it?
To be honest, just to keep in mind, statistics show that 75% of cybersecurity attacks originate from within the company. This could be because there are unsuspecting or malicious users within the company, or because its security procedures haven't made it difficult for a hacker to break into its premises or networks. And almost 90% of attacks originate from outdated software, not from zero-day vulnerabilities.
Think like a machine, not like a human
This will be a little advice that I leave you from here on:
Think like machines
For those who do not understand, now I give you an example.
Let me introduce you to John. Among security enthusiasts, he's one of the best starting points when you're getting into ethical hacking . John gets along famously with our friend Crunch . Basically, he takes a list he's given and starts trying combinations until he finds a key that solves the password he's looking for.
Crunch is a password generator. This means you can tell Crunch you want a password that's 6 characters long, containing both lowercase and uppercase letters, and Crunch will start trying them one by one… something like:
aaaaaa,aaaaab,aaaaac,aaaaad,....
And you might be wondering how long it takes to go through the whole list… it doesn't take more than a few minutes . For those of you who were left speechless, let me explain. As we discussed earlier, the weakest link in the chain is man, and his way of thinking. For a computer, testing combinations isn't complicated; it's extremely repetitive, and over the years processors have become so powerful that they don't need more than a second to make a thousand attempts, or even more.
But now for the good part, the previous example was with human thought, now let's look at machine thought :
If we tell Crunch to start generating a password with only 8 digits, under the same requirements as before, we've gone from minutes to hours . And guess what happens if we tell it to use more than 10? It becomes days . For more than 12, we're already talking about months , in addition to the fact that the list would be of proportions that couldn't be stored on a normal computer. If we reach 20, we're talking about things that a computer won't be able to decipher for hundreds of years (with current processors, of course). This has a mathematical explanation, but due to space constraints, I won't explain it here. But for the more curious, it has a lot to do with permutations , combinatorics , and combinations . To be more precise, it has to do with the fact that for each letter we add to the length, we have almost 50 possibilities, so we'll end up with something like:
20^50 possible combinations for our last password. Enter that number into your calculator to see how many possibilities there are with a key length of 20 symbols.
How can I think like a machine?
It's not easy, many will tell me, to think of a 20-letter password, especially with the old concept that passwords are keywords . But let's look at an example:
dXfwHd
This is difficult for a human to remember, but extremely easy for a machine.
caballoconpatasdehormiga
This, on the other hand, is extremely easy for a human to remember (even fun), but it's a nightmare for crunch . And now more than one of you will say, "But isn't it also advisable to change passwords frequently?" Yes, it is advisable, so now we can kill two birds with one stone. Let's suppose that this month I'm reading Don Quixote, Volume I. For my password, I'll put something like:
ElQuijoteDeLaMancha1
20 symbols, which is pretty hard to figure out without knowing me, and the best thing is that when you finish the book (assuming you read consistently  ) you'll know you need to change your password, even changing it to:
ElQuijoteDeLaMancha2
This is already progress  and will surely help you keep your passwords safe while reminding you to finish your book.
I've written quite a bit already, and although I would love to be able to talk about many more security issues, we'll leave that for another time  Regards