How to Improve Cyber Security Awareness
How to Improve Cyber Security Awareness
How to improve cyber security awareness does not have to be all that hard. For example, you can get rid of up to 95% of cyber security risk if you adopt the Top 8 things recommended by all the experts. We call these the “MUST DOs”
If you are willing to put in a little “EXTRA”, you can really set your team apart. See our 2 “EXTRAS” to round out the Top 10
What is more, there are very good reasons to act now, according to this recent piece in Forbes
Ransomware on a Rampage; a New Wake-Up Call
“The Targets (and Costs) of Ransomware Attacks: The current state of cyber-affairs is an especially alarming one because ransomware attacks are growing not only in numbers, but also in the financial and reputational costs to businesses and organizations. Three statistics stand out that highlight ransomware trends and implications…”
The Forbes story has more details about how this may affect your organisation.
91% of all cyber attacks begin with a phishing email
(source: Deloitte)
Phishing attacks target individual staff members and have only one purpose, that is, to steal their password and user name.
Firewalls and anti-virus software can only go so far to prevent these attempts.
However, there are simple steps that you can take to improve cyber security awareness and eliminate up to 95% of cyber security risk.
The Top 8 Things to Improve Cyber Security Awareness – the “Must Do’s”
1. Build a Security Culture
A strong security culture starts at the top and includes all senior leaderss. Above all, it is not a problem left for the IT department to solve. It is a problem that requires every one to be engaged. Often times, the first step is to get the CEO, or the founder, warmed up about the problem and then, as a result, vested in the outcome. The aim is to create a security culture that involves all levels of the company.
2. Provide Frequent Training For Staff
Humans are the weakest link in cyber security. As a result, over 90% of cyber attacks begin with a “spear phishing” e-mail to an off guard employee. Attackers rarely bother trying to break through software barriers only. Today, attackers target people, as they are the easiest path into secure networks.
You can improve cyber security awareness by training employees on what to be alert for to avoid being hacked. However, the goal is to change employee behaviour. This requires frequent reminders of cyber tactics, as well as what employees must do to prevent attacks. Changing behaviour is about creating clear, real-life examples and showing how to avoid them. And, of course, don’t forget how potent a little bit of recognition can be. Heap the praise on those people who respond and adapt.
3. Use Strong Passwords
Passwords provide the first line of defence against wrongful access. Therefore, the stronger your password practices, the more protected your company will be from hackers and harmful software.
Thankfully, there are some forthright ways to make passwords as secure as possible and easy to recall.
THE BASICS
- Password length – The most vital factor is password length. Use at least 16 characters whenever viable.
- Complexity counts –Include Numbers, Symbols, Uppercase Letters, and Lowercase Letters. Always use at least one of each of these in every password.
- Change passwords on a regular basis
These basic rules should become fixed in your Security Culture.
If you would like to better grasp why these basics are so important, take a few minutes to explore the Brute Force Password Calculator at Gibson Research Corporation.
HOW TO MAKE STRONG PASSWORDS THAT ARE EASY TO RECALL
As a result of following the basics above, every employee can create easy to recall passwords simply by using sentences or phrases.
For example, How$ecureisMY1pw would be an easy password for most people to recall.
Look closely and notice that this password conforms to all the basic rules. In short, it contains 16 characters and includes a number, a symbol, uppercase letters, and lowercase letters.
So, how secure is it? According to security.org, it would take a computer about 1 trillion years to crack this password.
However, there are some things employees should consider when using sentences or phrases.
- Firstly, avoid using private data that others might know about them, or could find in their social media (e.g. address, phone number, birthdays, children’s names, pet’s name, etc.).
- Secondly, do not select words at random from a dictionary. Attackers have tools to run a dictionary attack.
- And, most importantly, test the password strength using an internal password metre or an external password strength service.
Lastly, if you get stumped and can’t think of any useful phrases or sentences, you can generate strong password examples that are easy to recall and unique at Data Overhaulers’ 5 Steps To Get an Easy-To-Remember & Strong Password
4. Require Multi-Factor Authentication
Multi-Factor Authentication is the second line of defence against wrongful access
As we all know, a password can be shared or stolen. However, you can strengthen your defences by using a second identification factor, such as biometric identification or a secondary personal device that receives a temporary passcode.
BioSig-ID Biometric Identification
CAN YOU CRACK THE BIOSIG-ID PASSWORD?
TAKE THE CHALLENGE
Duplicate the password “Mom” exactly as shown using the BioSig-ID draw pad, and, if you can validate correctly, we will pay you $500.
Click the Button to take the Challenge!
5. Protect Mobile Devices
Every organisation should have a Mobile Device Policy that covers mobile devices such as laptops, mobile phones and tablets. This includes both company owned devices and Bring Your Own Devices (BYOD).
The crucial best practices for mobile security are:
- Every mobile device should authenticate the user before allowing access using either password, pin, or bio-metric identification.
- Operating System Updates should be installed without delay. It is good practice to have automatic software updates turned on.
- Above all, Remote Lock and Data Wipe should be included in your Mobile Device Policy to assure that you can protect lost data and devices, regardless of whether it is a company owned device or a BYOD.
- Do not allow mobile devices to use public wi-fi networks.
- Back up mobile data. Consider an automated backup solution with version selection options.
For more information about mobile device management you can download the Australian Cyber Security Centre’s Guidelines for Enterprise Mobility here
6. Apply Software Updates Promptly
There are lots of reasons why it is important to apply software updates. Here are the three most closely related to cyber security.
Software updates:
- Repair security weaknesses and flaws in operating systems and application programs
- Help protect your data by keeping hackers out
- Minimise the likelihood that your device gets a virus and passes it along to co-workers and customers.
7. Use a Firewall
Firewalls monitor who is trying to connect to your network. More importantly, they filter and block un-wanted traffic.
Without a firewall, you accept every attempt to connect to your network, including malicious attackers who could:
- gain control over your computer or network
- delete data
- commit identity theft or financial fraud, and
- shut down your network
8. Maintain Anti-Virus Software
Most importantly, you need both a firewall and anti-virus software?
To clarify, firewalls monitor “who” is attempting to connect. On the other hand, anti-virus software looks at “what” is being uploaded or transferred to your network or computer. Specifically, anti-virus software looks for threats and performs these key functions:
- Detection: detects the infected file or program.
- Identification: Identifies the type of threat, for example, virus, worm, trojan, etc.
- Removal: Anti-virus software typically quarantines, fixes, or completely removes an infected file.
That completes The Top 8 Things to Improve Cyber Security Awareness.
The 2 Extras to set your oraganisation apart
If you want to set your organisation apart, expand the list to the Top 10 and include the “2 Extras” below.
9. Conduct Spear Phishing Simulations
Phishing is the largest cyberthreat to businesses and consumers worldwide. Moreover, the number of recorded phishing attacks in Australia continues to grow exponentially.
Source: Australian Competition & Consumer Commission – SCAMWATCH
The most common type of deceptive phishing occurs when fraudsters pose as a valid company and, as a consequence, deceive employee’s into giving out private data or login details. The attackers often create a sense of pressing need which results in the victim complying with their request.
People are more likely to spot phishing attempts when they have seen real-life examples and understand the tactics that cyber criminals use. Coaching employees with simulated phishing attacks is a large part of any organization’s security awareness program.
PHISHING SIMULATION PLATFORM
Phishing is the largest cyberthreat to businesses and consumers worldwide, and the number of recorded phishing attacks continues to grow exponentially. Due to the nature of phishing, your colleagues and employees have become the weak link in cybersecurity and are the last line of defence in protecting your organization.
NINJIO PHISH is natively integrated into our NINJIO DOJO platform and allows you to test and quantify human vulnerability safely and proactively by sending benign simulated phishing attacks to your team, tracking their actions, and reporting results.
Find out how easy and affordable it is to get started with NINJIO Cyber Security Awareness Training including Phishing Simulation.
Get Information with Pricing
10. Conduct Penetration Testing
A penetration test (pen test) is a simulated cyberattack that is carried out using a mix of manual and automated technologies. The process attempts to breach e-mail servers, web servers, web applications, wireless networks, network devices, mobile devices and other points of entry.
The objective of pen testing is to find flaws or gaps in systems before attackers do.
Openings may exist in multiple places including:
- network configurations
- operating systems
- applications software
- server configurations
- data base configurations
- end-user behaviour or
- lack of adherence to security policies
The primary aim is to
- prioritise and implement effective security controls
- assure regulatory compliance
- improve cyber security awareness, and
- increase the organization’s ability to identify and respond to security incidents as they occur.
WHY NINJIO
NINJIO cybersecurity awareness training uses highly engaging, 3 to 4-minute animated micro-learning videos. In effect, we teach organizations, employees, and families how not to get hacked. As a result, individuals and organisations become able to defend against cyberthreats. In the final wrap up, employees become the first line of defence against today’s sophisticated cybercriminals.
Some of the largest companies in the world have used NINJIO to change the behavior of hundreds of thousands of employees through engaging, emotionally-driven storytelling.
Our philosophy? No more boring, check-the-box security awareness lectures.