{"id":31885,"date":"2020-02-10T15:30:49","date_gmt":"2020-02-10T15:30:49","guid":{"rendered":"https:\/\/www.intelligentcio.com\/africa\/?p=31885"},"modified":"2020-02-10T15:50:32","modified_gmt":"2020-02-10T15:50:32","slug":"five-critical-elements-for-any-cybersecurity-awareness-programme","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/africa\/2020\/02\/10\/five-critical-elements-for-any-cybersecurity-awareness-programme\/","title":{"rendered":"Five critical elements for any cybersecurity awareness programme"},"content":{"rendered":"\n

To combat mobile\u00a0cyber threats<\/a>, organisations must educate employees about the risks associated with accessing critical business apps on personal devices. Doros Hadjizenonos, Regional Sales Director at Fortinet, \u00a0explores the five critical elements that\u00a0CISOs<\/a>\u00a0should include in any cybersecurity awareness training.<\/strong><\/p>\n\n\n\n

While nearly nine in 10 companies not only allow, but actually rely on their employees to access critical business apps using their personal devices, according to a recent Fortinet Threat Landscape Report<\/em>, Android-based malware now represents 14% of all cyberthreats. And in addition to direct attacks, the number of compromised web sites, email phishing campaigns and malicious access points continue to grow exponentially, infecting unsuspecting users \u2013 regardless of their devices \u2013 with spyware, malware, compromised applications, and even ransomware.<\/p>\n\n\n\n

And whenever a personal device of any of your employees becomes\ncompromised, they can represent an increased risk to your organisation as well.\nIn addition to deploying mobile device management software and security clients\nto your employees, it is critical that you establish a cybersecurity awareness\nprogramme that provides critical insights into how they can avoid these risks.<\/p>\n\n\n\n

Here are five critical elements that ought to be part of any cybersecurity\nawareness programme.<\/p>\n\n\n\n

1. Beware of public Wi-Fi<\/strong><\/p>\n\n\n\n

While most public Wi-Fi access points are perfectly safe, that\u2019s not\nalways true. Criminals will often broadcast their device as a public access\npoint, especially in public locations like food courts or at large events.\nThen, when a user connects to the Internet through them, the criminal is able to\nintercept all the data moving between the victim and their online shopping\nsite, bank, or wherever else they browse to.<\/p>\n\n\n\n

Many smart devices will also automatically search for known connection\npoints, like your home Wi-Fi. Newer attacks watch for this behaviour and simply\nask the device what SSID they are looking for. <\/p>\n\n\n\n

When the phone tells them it is looking for its \u2018home\u2019 router, the\nattack replies with, \u201cI\u2019m your home router,\u201d and the phone goes ahead and\nconnects. Smart devices will do the same thing with Bluetooth connections,\nautomatically connecting to available access points.<\/p>\n\n\n\n

To combat these issues, it\u2019s a good practice for users to turn off Wi-Fi\nand Bluetooth until they are needed. In the case of wireless access, they\nshould verify the SSID of a location, often by simply asking an establishment\nfor the name of their Wi-Fi access point before connecting. Users should also\nconsider installing VPN software so they can ensure they only make secure,\nencrypted connections to known services.<\/p>\n\n\n\n

2. Use better passwords<\/strong><\/p>\n\n\n\n

Another mistake users make is using the exact same password for all\ntheir online accounts, usually because remembering a unique password for each\nsite they have an account on may be impossible. But if a criminal manages to\nintercept that password, they now have access to all of the user\u2019s accounts,\nincluding banking and shopping sites.
\n
\nThe best option is to use a password vault that stores the username and\npassword for each account, so all that needs to be remembered is the password\nfor the vault. Of course, extra care must be taken to ensure that the vault\npassword is especially strong and easily remembered. One trick for creating a\nstrong passwords is to use the first letters of a sentence, song lyric, or\nphrase, insert capital letters, numbers and special characters, and you\u2019ve got\na pretty secure password.
\n
\nTo be even more secure, consider adding two-factor authentication for any\nlocation where sensitive data is stored. It\u2019s an extra step in the login\nprocess but will significantly increase the security of their account and data.<\/p>\n\n\n\n

3. Recognise phishing<\/strong><\/p>\n\n\n\n

You\u2019ve probably repeated to your users to never click on links in\nadvertisements sent to their email or posted on web sites unless they check\nthem first. There are a lot of tells, such as poor writing or grammar, complex\nor misspelled URLs, and poor layout that can be a key giveaway that an email is\nmalicious.<\/p>\n\n\n\n

But it turns out that there will always be someone who can\u2019t resist\nopening an email, launching an attachment from someone they don\u2019t know, or\nclicking on a link on a website \u2013 especially when it includes an enticing\nsubject line. Which is why any educational efforts need to be supplemented with\neffective Email Security Gateway and Web Application Firewall solutions that\ncan detect spam and phishing, validate links and run executable files in a\nsandbox \u2013 even for personal email \u2013 to ensure that malicious traps simply do\nnot get through to an end user.<\/p>\n\n\n\n

4. Update devices and use security software<\/strong><\/p>\n\n\n\n

Users should have a corporate-approved security agent or MDM solution\ninstalled on any device that has access to corporate resources. This software\nalso needs to be kept updated and device scans should be run regularly.<\/p>\n\n\n\n

Similarly, endpoint devices need to be regularly updated and\npatched. Network Access Controls should be able to detect whether security\nand OS software is current, and if not, users should be either redirected to a\nremediation server to perform necessary updates or alerted as to the unsecure\nstatus of their device.<\/p>\n\n\n\n

5. Monitor social media<\/strong><\/p>\n\n\n\n

Criminals will often personalise an attack to make it more likely that a\nvictim will click on a link. And the most common place for them to get that\npersonal information is from social media sites. The easiest way to prevent\nthat is to simply set up strict privacy controls that only allow pre-selected\npeople to see your page. Individuals wanting an open social media profile need\nto carefully select who they will friend. If you don\u2019t know someone, or if\nanything on their personal site seems odd, dismiss their request. And even if\nthe person is someone you know, first check to see if he or she is already a\nfriend. If so, there\u2019s a significant possibility that their account has been\nhijacked or duplicated.<\/p>\n\n\n\n

Keep training messages short, clear and regular<\/strong><\/p>\n\n\n\n

It is essential that you develop a comprehensive and effective security\nstrategy for your users who have personal endpoint devices connected to your\nnetwork. But don\u2019t make the mistake of burying them in information. Break\ninformation down into easily digestible chunks. Provide a daily security tip.\nPost messages around the company, such as in the hallways or break room. Get\nthe executive team to mention it in staff meetings. And provide checks, such as\nyour own phishing emails, to help identify users that might need additional\nattention.<\/p>\n","protected":false},"excerpt":{"rendered":"

To combat mobile\u00a0cyber threats, organisations must educate employees about the risks associated with accessing critical business apps on personal devices. Doros Hadjizenonos, Regional Sales Director at Fortinet, \u00a0explores the five critical elements that\u00a0CISOs\u00a0should include in any cybersecurity awareness training. While nearly nine in 10 companies not only allow, but actually rely on their employees to access […]<\/p>\n","protected":false},"author":25,"featured_media":31886,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4950,5,136,103,10675,13],"tags":[97,1193,7348,153,332,12555,35,101,12556,12557,1415,277,898,12553,12554,1240,1525,83],"class_list":["post-31885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-analysis","category-enterprise-security","category-industry-expert","category-mobile","category-thought-leadership","category-top-stories","tag-android","tag-bluetooth","tag-cisos","tag-cyber-threats","tag-doros-hadjizenonos","tag-email-security-gateway","tag-fortinet","tag-malware","tag-mdm","tag-network-access-controls","tag-phishing","tag-ransomware","tag-spyware","tag-ssid","tag-urls","tag-vpn","tag-web-application-firewall","tag-wi-fi"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/31885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=31885"}],"version-history":[{"count":3,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/31885\/revisions"}],"predecessor-version":[{"id":31889,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/31885\/revisions\/31889"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/31886"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=31885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=31885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=31885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}