Did you know Halloween isn’t the only event in October ready to send shivers down your spine? Each year, October is “National Cybersecurity Awareness Month” in the U.S. and “European Cybersecurity Month” in Europe. So, before we dress up as ghosts, vampires, or whatever, let’s have a quick look at some old and new cyber risks to be aware of and how to deal with them.
6 Cybersecurity Tips You Can Act On Now
- User training. Creating awareness. It never gets old! This is the Holy Grail in security. I’m not talking malicious insider threats (more on those later) but careless users. They click on cat pics all day. They click on weird emails. They download a nice desktop background that comes as an executable. Basically, we’re looking at the root of all evil.
I’ve recently noticed an increase in social engineering and/or phishing attempts. It starts harmlessly with emails supposedly sent by colleagues but from their private accounts. Maybe they’d like to work on a project but require a document right now. What could possibly go wrong?
- Ransomware is still a thing, but the impact can be easily prevented. It happens too quickly, and when we notice it, it’s often too late. The data is gone, and the machine is no longer usable. What to do now? Format C:\ and restore from backup. Oops, no backup? Well… End-user devices are low-hanging fruits for such attacks.
To prevent a disaster, make sure the home/user folders are either backed up to a remote server or synced with a SaaS solution. But also ensure the users understand vulnerable items outside those folders aren’t protected.
- Working from home can be risky. Since 2020, most of us have been working from home. From a security standpoint, this is extremely challenging and comes with loads of variables. Sure, IT still has control over the end device, but not the surrounding. It starts with insecure Wi-Fi connections and ends with all the IoT devices we use. Without deep investigation, we can’t know if and what data they pick up from the network, and if they do, where do they send it?
Unfortunately, minimizing the risk in such a situation isn’t easy. Still, a combination of enforcing VPN connections and multi-factor authentication to access the most critical business systems should be a requirement.
- Free tools and services, ever wonder why they’re free? This isn’t new but goes unnoticed most of the time. There are loads of free tools and web services singing their charming and useful songs. An automated, full-text translation into whatever language? A tool to merge two or more PDF documents? Another tool to create flowcharts and visualize business processes? We all use them, don’t we?
We cannot resolve to be sure what happens with all the information we give away voluntarily. An organisation needs a multi-layered approach to mitigate risk and help align with compliance requirements. This can start with implementing a stricter policy of blocking access, but the best idea is to provide such services more securely. Many PDF editors and flow chart tools are reasonably priced.
- Budget freezes and cuts. IT budgets have not typically been the biggest in an organization, but managers learned to juggle the money, and, for the most part, it’s worked out. Traditionally, finding and acquiring new talent was the bigger problem. Now, it seems that finding a suitable IT person is easier now, as many have lost or quit their jobs during the "Great Resignation," but there’s zero money to hire them. So, the headcount situation is the same, if not worse. What to do now?
The obvious answer is to rely more on technology, but it’s a bit more complicated. Most technology (read: tools) cost money, too, and where do we get the money if there’s none available? In many cases, freeware or open source could come to the rescue, and in other cases, it might be time to finally start looking into automating routine tasks. Start now.
- Insider threats, the malicious kind. Frustration, probably no bonus payments, and no pay rises for obvious reasons could be some of the factors leading to possibly creating a disgruntled employee—and there’s no higher security risk to any organisation.
An employee is considered trustworthy until something happens. There’s often no warning, and it’s almost impossible to interrupt an incident once it starts. Forwarding information, destroying data, destroying company property, you name it. But still, efforts to mitigate such incidents are required, like deploying a data loss prevention solution and ensuring the principle of least privilege exists and works. Double-check permissions.
So, what do we do now at Halloween? Perhaps dressing up as ransomware? Difficult, as no one knows what it looks like. Dressing up a virus? Well, it may still be too soon for that one. Maybe as a log? Chances are no one gets it—good ol’ UDP joke.
