Cybersecurity Awareness Month 2022

What is Cybersecurity Awareness Month?

Cybersecurity Awareness Month was founded in 2004 as a collaborative effort between the government and private industries to raise awareness about digital security and empower everyone to protect their personal information from digital forms of crime. It also aims to increase the resiliency of the country during a cyber threat.

Cybersecurity Awareness makes the community more aware to recognize, reject and report threats. Organizations can protect their users from being scammed and safeguard the organization.

When is Cybersecurity Awareness Month? 

October is known as National Cybersecurity awareness month. It's an international campaign.

What is the history behind Cybersecurity Awareness Month?

In 2004 the President of the United States and Congress declared October to be Cybersecurity Awareness Month, helping individuals protect themselves online as threats to technology and confidential data become more commonplace. The Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) lead a collaborative effort between government and industry to raise cybersecurity awareness nationally and internationally.

 Facts and figures

• 42% of schools have students or employees that circumvent cybersecurity protections (Impact My Biz)

• Nearly three-quarters (74%) of ransomware attacks on higher education institutions succeeded due to a lack of awareness (Inside Higher Ed)

• Ransomware attacks on U.S. schools and colleges cost $6.62b in 2020 (darkreading)

  • 95% of cybersecurity breaches are caused by human error. (World Economic Forum)

  • 69% of Companies’ Are Increasing Their Investments in Their Cybersecurity Budgets (Global digital Trust insights report

  • APWG (Anti Phishing Working Group) Reports That Website Phishing Attacks Have Tripled Since Early 2020

  • 88% of Businesses Experienced a Ransomware Attack

What are some examples of past Cyber-attacks?

The most recent well-known attack was the Colonial Pipeline (May 2021). The pipeline from Houston to the southeastern United States suffered a ransomware attack that took over key components of the computer software used to control the pipeline. This attack was singlehandedly the largest attack on oil and gas infrastructure in U.S. history. The attack led to panic buying of gasoline in the southeast, which caused shortages in some areas. Anthem (2015) a U.S. healthcare company, sustained what at the time was the biggest data breach in U.S. history. Hackers gained access to patient names, Social Security numbers, birthdays, addresses, emails, employment information and salary data.

The National Basketball Association (NBA) was hit with a cyberattack in 2021. In mid-April of 2021, the hacker group Babuk claimed to have stolen 500 GB of confidential data concerning the Houston Rockets. Babuk warned that these confidential documents, including financial info and contracts, would be made public if their demands were not met. As of this posting, no ransom payments have been made.

REvil, the same hacker group made headlines in July with an attack on Kaseya. Kaseya manages IT infrastructure for major companies worldwide. Similar to the attacks on Colonial Pipeline, this hack could potentially disrupt key areas of the economy on a large scale.

REvil carried out this attack by sending out a fake software update through Kaseya’s Virtual System Administrator, which infiltrated both Kaseya’s direct clients as well as their customers. According to REvil, one million systems were encrypted and held for ransom. Kayesa, stated that around 50 of their clients and around 1000 businesses were impacted. REvil demanded $70 million in bitcoin. To illustrate the impact of the cyber-attack, Coop, a Swedish supermarket chain, was forced to close 800 stores for a full week.

Soon after the attack, the FBI gained access to REvil’s servers and obtained the encryption keys to resolve the hack. Fortunately, no ransom was paid, and Kaseya could restore its clients' IT infrastructure. Although it started as one of the biggest ransomware attacks of the year, the situation was salvaged in the end.

 How should you and others stay safe?

·         Always use Antivirus

·         For younger kids use Parental Controls

·         Never download random files or software

·         When you can Use Two factor authentication

·         Keep your software up to date

·         Complex Passwords

·         Don’t click on any links or attachments in texts, emails, or social media posts

·         Don’t connect to unfamiliar Wi-Fi networks

·         Only visit secure websites (HTTPS)

·         Try not to overshare information (social media)

·         Use a VPN

Home Routers Major Weakness in Work from Home Revolution

‘Prepping’ for Work from Home

For the past few years employees and employers alike extolled the virtues of working from home (‘WFH’). We’ve heard the stories of how it leads to a happier and more productive employee, less overhead for the employer, and just more flexibility overall. Most people knew a shift would come eventually – kind of like the shift to IPV6- but it stalled and stalled. Then the pandemic happened and WFH had been thrust upon us with such force that businesses were, and still are, scrambling to get the pieces in place for an effective remote staff.

It is no longer a secret that WFH is here to stay. Many businesses including Fujitsu and Twitter have just gone ahead and implemented WFH ‘forever’. With this change come challenges. One of those is the security of routers in the millions upon millions of homes that now serve as working offices.  According to a study by Germany’s Fraunhofer Institute for Communication, vendors have failed to fix hundreds of vulnerabilities in their consumer-grade routers, leaving hundreds of thousands of users exposed to a wide range of attacks. "Nearly all were found to have security flaws, some of them very severe," the Fraunhofer Institute said in a press release. "The problems range from missing security updates to easily decrypted, hard-coded passwords, and known vulnerabilities that should have been patched long ago."

 Advice on next steps

So what should we do? The first step is to know the make and model of your router. Research it for any known vulnerabilities, as there may be some cases where the device is so insecure that even patching it still leaves it vulnerable. Once you’ve decided if it is worth keeping the device make sure that it automatically installed firmware updates. If not you may need to manually update it. A task that is well worth the effort. Another task is to make sure that the administrator password for the router has been changed from the default admin password. Many routers now have unique default passwords for their routers- but there are still plenty out there that don’t.

WFH Users should use complex passwords on their routers including:

·         Uppercase and Lowercase

·         Numbers and Symbols

·         At least 8 characters long

You should also use the strongest Wi-Fi encryption your router supports. WPA3 (Wi-Fi Protected Access Version 3) is best.

You may have children working, playing, and streaming while you are home. Ensure they use their own devices and do not surf on your work devices.

Router configuration and device hardening are just one of the many layers of security that businesses need to adapt and expand to their remote workforce. We here at CyberSecOp would not be surprised if, sooner rather than later, companies begin purchasing, installing, and administering home routers to ensure a secure endpoint to endpoint networking. Until then remain vigilant and patch patch patch!

Author: Carlos Neto

Achieve an Effective Security Awareness Program

For any company, especially technology-oriented ones, being aware about the cyberthreat landscape is critical. There is often the mindset that most cyberattacks can be warded off by procuring and implementing the latest security technologies, and relying on consultants and internal resources to police implementation.

While this passive strategy may yield a certain level of effectiveness, it also takes a high level of active, participatory security awareness on part of both employees and management in order to 100% fortify the lines of defense around the business or corporation.

STEPS TO ACHIEVE AN EFFECTIVE SECURITY AWARENESS PROGRAM

1.     The Major Orienting Components – A comprehensive, participatory information security awareness program should have as its three foundational pillars the principles of confidentiality, integrity, and availability.  While the first two terms speak for themselves, the third is often misapprehended.  Here, it refers to the organization maintaining a comprehensive system of controls over information security such that employees can be assured of having access to all information necessary to perform their roles without risk of breach.

2.     The Protection of Corporate Resources - “Corporate resources” does not just refer to digital assets — it also refers to physical assets, such as paper documents. A security awareness checklist should include the proper usage of document-shredding machines and how the shredded documents should be disposed of.

3.     Protection of Corporate Facilities - Employees should be trained not only in how to look for suspicious behavior from the outside, but from the inside as well.  This will ensure against unauthorized personnel gaining access to the premises for purposes of mounting internal attacks against the information infrastructure.

4.     The Formal Security Awareness Training Program – The corporation should maintain a comprehensive security awareness training program and all employees, irrespective of position with the organization and/or function, should regularly participate.

5.     Determining Levels of Responsibility and Segregation of Duties – All employees involved in the day to day management of security over the corporation’s digital and physical information assets should have their roles clearly defined and responsibilities enumerated and documented in a comprehensive ‘R & R’ policy.

CyberSecOp Security Awareness Courses specializes in helping employees understand the mechanisms of spam, phishing, spear-phishing, malware, and social engineering and are able to apply this knowledge in their day-to-day job. Our Security Awareness training solutions effect meaningful, sustainable changes in any workforce. With CyberSecOp Security Awareness Training, employees are not just aware of the dangers presented by an ever-changing threat landscape: they’re empowered to protect your organization from them.

AUTHOR: RICH FIORE