This month is the 22nd annual Cybersecurity Awareness Month, cosponsored by the Cybersecurity and Infrastructure Agency (CISA) and the National Cybersecurity Alliance. CISA’s theme this year is “Building a Cyber Strong America.”
Cybersecurity awareness by all users is a critical part of effective cyber defense. CISA has reported that 90% of successful cyberattacks start with a phishing email. Verizon’s Data Breach Investigation Report has reported that about 60% of attacks involve a human element (excluding malicious misuse that would not be impacted by security awareness). User awareness can make a big difference in security.
Every user, from the newest hire to senior management, has a role in effective cybersecurity. Training is critical. The goal should be to promote constant security awareness, by every user, every day, every time they’re using technology, including staying focused and avoiding multitasking and distractions. Users should be aware of current threats and how to protect against them, know what to do if there’s an incident, and know how to get answers to questions.
This month is a good time to provide a refresher to users, followed by periodic repetition. This Cybersecurity Awareness Month is also a good time to review and update your training program (or to implement one if you don’t have a program). The review should include changes in applicable federal and state requirements and industry standards.
This year’s tips include:
- Update software
- Use strong passwords and a password manager
- Turn on multifactor authentication whenever possible
- Recognize and report phishing
These tips can explain these measures, why the business requires them, and how they promote security at home.
