Today’s cybersecurity threat landscape makes training our user’s more and more critical every day. Verizon’s 2021 Data Breach Investigation Report (DBIR) shows that phishing is top of the list of issues. Phishing is involved in hacker actions nearly 40% of the time. Bad actors compromise our people more than any other asset. There is a connection from phishing to ransomware. If the hacker can get the user’s credentials or get the user to open the front door by clicking on malicious links, they can release ransomware.
Phishing is a form of social engineering where bad actors send emails to legitimate users. The goal is to have the user click on a link or open an attachment. Once the user clicks that link, the user connects to a bad actor’s website. Or the attachment is infected with some form of malware. The malware then allows the bad actors access, downloads a tool, or some other dangerous activity. One of the most prevalent today is ransomware. All of this puts our users on the front line of our defenses. Therefore, we must prepare our users to be in this position, or it will be challenging for them to resist, successfully, these phishing attacks.
What we need to address is how do we prevent phishing and ransomware. Unfortunately, there is some overlap between those two, and it starts with our users. Whether they like it or not, they must learn a few things about security. First, users must strengthen their ability to recognize malicious emails. It is a common way for hackers to gain access to our systems. Once they are in, then they can do all kinds of damaging things.
The emails used to be so much easier to spot with their bad English grammar. Unfortunately, the quality is improving. The users must now look even more closely at the email source address and the links they are enticed to click. So how do we help our users? Training is the answer to that. Knowbe4 has excellent resources and services. When it comes to training, allow your users to succeed. I have found that if you make training practical for their personal life, not just at the office, then the interest level goes up. Knowbe4 has some great recommendations that you can find here.
Ransomware is what is getting our attention. The solutions to our problems are the same things that I have been saying for decades now. Train the users in social engineering. Keep all systems patched. Protect your credentials. Passwords must be at least 20 characters long, in my opinion, and protected with a second factor of authentication. (I would prefer not to have to discuss passwords because we have moved on, but that is not the case.)
We need to patch our software. If we can get that process improved within the development process, that would happen immensely. The more that we look for and find our software flaws, the better our defenses will be in total. You must find the flaws in your software and get them fixed. Inspectiv is here to help with that.
Inspecitv works with 1700+ vetted security researchers to continuously scan and identify security vulnerabilities. Taking the perspective of an external attacker, Inspectiv identifies assets, continuously monitors for vulnerabilities, validates, deduplicates, and then provides this critical information in a streamlined and actionable format.
Contact us to discover how our crowdsourced security platform can aid in protecting your company from the ever-present threats and vulnerabilities to your online applications.
