Workplace Cybersecurity Is Everyone’s Responsibility
The cyberthreat landscape is changing. An increasing number of cyberattacks are executed using sophisticated tactics. Earlier this year, SonicWall warned that malware volume increased 102 percent in the first half of 2018 compared to that of 2017.
The report also notes a significant increase in cyberattacks that leverage new variants of malware, including ransomware and encrypted threats. Further, attacks are becoming highly targeted, for example baseStriker and PhishPoint target Office 365 users.
Attackers are evolving to take advantage of workplace technology trends, including the cloud and BYOD. These trends empower workforces to be mobile and productive as demanded by today’s 24/7 hyper-connected reality. Unfortunately, these behavior changes are significantly expanding the attack surface area for cybercriminals to exploit.
“Attackers are evolving their tactics to take advantage of workplace technology trends, including the cloud and BYOD.”
Today, network security means more than just safeguarding data, applications and infrastructure. Employees are not only resources that need protection, but also weaknesses or valuable assets for a stronger cybersecurity posture.
It is, of course, essential for organizations to have necessary security in place to monitor and protect attack surface areas. But no security product can be a silver bullet to stop all cyberattacks. It is necessary to educate and empower the last and most crucial line of defense: your employees.
Build a Culture of Cybersecurity Awareness
Employees are a key resource for an organization. As driving revenue is the primary objective, safeguarding the organization must also become one of the main responsibilities for employees. With the right frameworks and security awareness training programs in place, they can also be an effective layer of defense — a human firewall.
By extending these responsibilities to all employees, organizations can prevent sophisticated cyberattacks, saving the organization from financial, legal and reputation damages.
Creating cybersecurity awareness and training programs must include what employees must be aware of, what they need to watch out for, what best practices should be leveraged and how to follow them. It also must be easy to report security incidents. These programs must be delivered efficiently, measured and be easy to use.
Since the cyber threat landscape is evolving, the “human firewall” needs continuous signature/intelligence updates in terms of the new threats and how to identify and stop them. This is modern cybersecurity awareness.
Stop the No. 1 Cyberattack Vector: Email
But cybercriminals also know to target the human element to execute attacks. Email is the No. 1 threat vector used by cybercriminals today; more than 90 percent of attacks start with a phishing campaign.
Modern phishing tactics can trick even the savviest users. Attacks that use fake login pages, impersonation and business email compromise (BEC) are difficult to detect and block as these emails do not contain malware.
Organizations would benefit from taking a human-centric approach to email security and include user training and awareness to spot and avoid clicking on phishing email threats. Organizations should train employees to:
| Embrace security as one of their key responsibilities. | Beware of sudden changes in business practices. For example, email requests for transfers of funds. |
| Treat any suspicious email with caution. | Review the signature and legitimacy of the request. |
| Look at domain names from suspicious emails. | Confirm requests for transfers of funds or confidential information, such as W-2 records. |
| Exercise extra caution if an email is from a free, web-based account. | Do not use the “Reply” option to respond to any business emails. Instead, use the “Forward” option and either type in the correct email address or select it from the email address book to ensure the intended recipient’s correct email address is used. |
| Check for spelling mistakes and grammatical errors. |
Spot Sophisticated Phishing Attacks
Want to brush up on your ability to spot a phishing attack? Take SonicWall’s quick Phishing IQ test or download our exclusive brief, “How to Stop Email Spoofing.”
Monitor and Manage Shadow IT
According to Gartner, by 2020 one-third of security breaches will be the result of shadow IT. The ease of SaaS adoption and deployment leads to the following problems:
- Losing control over sensitive corporate data traversing through public or hybrid clouds and data centers introduces new risks such as unauthorized access, malware propagation, data leakage and non-compliance.
- Balancing security budgets, shadow IT practices and employee productivity.
To address the above challenges, IT administrators need Cloud Access Security Broker (CASB) solutions to provide visibility for what applications are being used and where. This will help them better understand the overall risk posture.
To mitigate the risks of shadow IT and embrace productivity, both organizations and employees must understand the agreement on what constitutes a legitimate application allowed for official use. Employees must be trained to use judgement so that they do not upload sensitive or confidential data into cloud-based applications.
Protect Endpoints, Especially When Outside the Perimeter
Workforces today rely on the same device for business and personal use, resulting in intermingling of business and personal data and applications. This creates an increased risk of security breaches for organizations, including:
- Unauthorized users gaining access to company data and applications
- Malware-infected devices acting as conduits to infect company systems
- Interception of company data in transit on unsecured public Wi-Fi networks
- Compliance with audit and regulatory requirements
- Loss of business data stored on devices if rogue personal apps or unauthorized users gain access to data
To ensure proper safety, employees must be educated on the risks an endpoint poses to an organization, especially when those devices are frequently used from home, mobile or public networks. This can start with the basics such as:
- Lock mobile devices when not in use.
- Don’t use USB drives you don’t trust.
- Update all software, operating systems and malware signatures.
- Use secure VPN connections when accessing corporate resources over unsecured networks.
- Install next-generation anti-virus (NGAV) to stop the latest threats.
Cybersecurity: Our Shared Responsibility
As cyberattacks evolve, organizations need to take a human-centric approach to security. Cybersecurity is everyone’s job. It’s a shared responsibility. It’s critical that structures, guidelines and processes are in place to make employees care and be responsible to remain safe online while at work.
Organizations will greatly benefit by incorporating user awareness and training programs to educate and empower employees who will form a critical line of defense. Cybersecurity is never finished. Make it core to company culture.
About Cybersecurity Awareness Month
The 15th annual National Cybersecurity Awareness Month (NCSAM) highlights user awareness among consumers, students/academia and business. NCSAM 2018 addresses specific challenges and identifies opportunities for behavioral change. It aims to remind everyone that protecting the internet is “Our Shared Responsibility.”
In addition, NCSAM 2018 will shine a spotlight on the critical need to build a strong, cyber secure workforce to help ensure families, communities, businesses and the country’s infrastructure are better protected through four key themes:
- Oct. 1-5: Make Your Home a Haven for Online Safety
- Oct. 8-12: Millions of Rewarding Jobs: Educating for a Career in Cybersecurity
- Oct. 15-19: It’s Everyone’s Job to Ensure Online Safety at Work
- Oct. 22-26: Safeguarding the Nation’s Critical Infrastructure
Learn more at StaySafeOnline.org.
