According to research that has been done, 82% of breaches involved human error. Attackers target employees with phishing campaigns or through malware and many other techniques to achieve system penetration by bypassing all security, gaining access to sensitive data. As the Digital Security Authority we encourage a culture of cybersecurity awareness and it is important that employees are educated on cybersecurity best practices.
Here are 10 cybersecurity tips that every employee should know and practice:
1. Use strong passwords:We have all heard that it is important to have a strong password, but what qualifies as a strong password?
Strong passwords:
- They should consist of at least 16 characters and it is recommended that they not be the same characters in sequence.
- Contain and combine letters, symbols, numbers and special characters.
- Avoid using words, especially nouns.
- Never include personal identifying information.
- Do not reuse.
- If you create secure passwords, it may be difficult to keep track of them all. Using a password management application to store and manage different passwords can help keep you securely organized.
2. Use the SLAM method to identify suspicious emails: Phishing email attacks are a huge part of modern cyber attacks - some are highly personalized and may contain references to your colleagues, family members, hobbies and more. The best way to mitigate this is to raise awareness and keep up to date. Use the SLAM method to help detect phishing attacks:
- Sender: Check the sender's email address
- Links: Place your mouse pointer and check any links before clicking.
- Attachment: don't open attachments from someone you don't know or attachments you weren't expecting.
- Message: check the content of the message and watch out for bad grammar or spelling mistakes.
3. Secure your browser: Web browsers are often used on corporate and home devices, and attackers will try to exploit vulnerabilities and security holes in them to take control of some of your accounts (for example, this year's Google Chrome Zero-Day vulnerability). The best way to secure your web browser is to configure automatic updates, avoid storing passwords in your browser, use trusted web browser add-ons from web browser app stores, and limit the security and data settings exchanged with browser providers.
4. Keep the latest software on your smart devices: To prevent attackers from taking advantage of vulnerabilities in your smart devices, update phones, tablets, TVs, speakers, etc. with the latest available software. If an automatic update feature is available, turn it on. These devices can potentially be a source of infection just like any other computer.
To further secure your devices, make sure you use the screen unlock password features where available. Organizations should also consider mobile device management solutions to help increase the security of their mobile device environment to ensure device and application compliance and control the flow of data outside of trusted mobile applications and devices.
5. Use multi-factor authentication (MFA):For both corporate and personal applications, it is imperative to allow MFA to validate that the person logging is who they claim to be and prevent malicious hackers from authenticating to your network.
6. Secure your home network: If left unsecured, your home network can compromise both your personal and corporate data if you work remotely.
Here are some tips to secure your home network:
- Connect computers to your router, not your modem
- Change the default password on your router
- Make sure the firmware is up to date, choosing automatic updates if available
- Disable remote router management - no need to make changes when you are away and this increases security by removing an easy path to your device
7. Use a VPN: Virtual private networks (VPNs) provide a great way for employees to securely access remote resources from multiple locations by connecting two private networks securely over the Internet. Using public Wi-Fi at airports, hotels, and coffee shops without a VPN can inadvertently give away a lot of details about what devices you have and what you do on the Internet. In the hands of a hacker, this information can be used to formulate an attack.
8. Don't forget physical security: As more and more employees return to the office, it's important to remember that physical security in the office is also important.
Physical security reminders include:
- Lock your computer when you leave your office
- If your organization uses badge access, do not allow queuing - each person should scan their own badge
- Protect and lock paper files with sensitive data
9. Know what information you share on social media: Social media can be a great way to share information with family and friends, but are you also sharing information with attackers?
Scammers and attackers can use the information you post on social media to obtain PII about you that can be used against you. Check your privacy settings on a recurring basis, delete old and unused accounts, and check your foreground and background photos and videos before you post to make sure you're not sharing anything that could reveal key personally identifiable information.
Before you go posting on social media, ask yourself - could this information you're about to post be used against you?
10. If you see or do something, say something: Last but not least, if you notice something suspicious, whether it's an email, text message or unauthorized visitor to the office, or you end up accidentally clicking on a phishing link, alert your supervisor, IT department or company to ensure the incident is dealt with quickly and damage is kept to a minimum.
Cybersecurity affects us all, and it is incumbent on both employees and employers to stay up-to-date on cybersecurity best practices to protect ourselves and our companies from malicious attacks.
(MB/EXP)
Contents of this article including associated images are owned by PIO
Views & opinions expressed are those of the author and/or PIO
Source
