Ransomware

Data breaches are occurring at an unprecedented rate, and there are no signs that they will slow down any time soon. If you’re one of the many organizations that store sensitive information online, then you’re at risk. Now is the time to learn more about the impending dangers businesses face and how to implement vital data protection practices.

In any instance, when information is accessed without authorization, it’s a data breach. The types of violations can vary and evolve as technology diversifies, but to put it simply, the information in the wrong hands constitutes a data breach. Information can become compromised in many ways now; a cyber-attack is only one. As the name implies, it’s a confirmed incident when an unauthorized entity has accessed confidential, sensitive, or protected information. Big data is now the norm, as more devices become connected. Those valuable connections also become points of weaknesses. Data breaches can wreak havoc on the reputations of businesses and induce a ripple of after-effects that can leave lasting repercussions.

For instance, a business may have to pay hefty fines due to a breach. Outside of regulatory penalties, they may have to compensate the victims whose data was compromised. Even a minor data breach could put an SMB out of business due to the financial constraints of fines, lawsuits, and loss of public trust. When someone steals secure data and publishes it on the web, it’s out there for the world to see. As more data becomes digitized, and we generate more original digital data, it’s logical that more data breaches will occur.

Recent History of Data Breaches

For the first time since 2013, this past year ransomware declined down 20 percent overall, but up 12 percent for enterprises according to Symantec. The most successful campaigns in 2019 involved ransomware that relies on open Remote Desktop Protocol (RDP) servers as the initial access point. Attackers more commonly use targeted, manual attacks instead of the one-two punch of malvertising exploits. The first quarter of 2019 saw the detection of several new ransomware families using innovative techniques to target businesses.

One of the most recent and significant data breaches occurred in September 2017 with the Equifax data breach, which exposed the personal data of 147 million people.

A few other prominent data breach examples include:

• Yahoo: Between 2013 and 2014, over three million user accounts affected.
• Marriott International: From 2014 to 2018, over 500 million of their user accounts were breached.
• Target Stores: In December of 2014, approximately 110 million of their user accounts got hacked.
• JP Morgan Chase: In July of 2014, around 76 million residential and seven million small business Chase customers had their financial records breached.
• A May 2019 ransomware attack on the City of Baltimore is expected to cost in excess of $18 Million to recover from.

The average cost per ransomware attack to businesses last year was $133,000. Attacks on Brittan’s National Health Service in 2017 cost nearly $100 Million in IT recovery services alone. Yet, the cost of customer confidence and company reputation can be unmeasurable.

Now that we know how data breaches and hacks can occur, we can look at why criminals are looking for a way to penetrate your firewalls. One major ploy cybercriminals use is Ransomware which is a form of extortion. It’s is a malware that infects, overtakes, and locks your data making it inaccessible unless a ransom is paid. The threat could be to publish a company’s data, erase it or perpetually block access to it, which can cripple a business.

The FBI warns not to pay a ransom, but many companies will be at a loss if they can’t access their sensitive data. Since ransomware is so profitable for hackers, attacks have skyrocketed. According to a Quickbridge study, over 4,000 separate ransomware attacks have occurred since 2016. Furthermore, they estimate the damages will reach around $11.9 billion globally.

It’s essential to know which types of information are the most valuable to cybercriminals. Cybercriminals may use programs that mine and lock your data, later using it for ransom. This attack is known as ransomware. Hackers can hold businesses hostage if vital information is leaked and user information exposed. Such an occurrence was the Ashley Madison hack of July 2015.

There are three main reasons a hacker wants your data:

• To sell it on the black market
• Identity theft
• Simply because they can

There’s no such thing as being ‘too safe’ in this digital era. One hundred percent secure may not exist as of yet, but you can take practical steps to mitigate the potential for massive data loss.

Here are some ransomware response strategies:

If you run a business, then it is likely you store personal information about your employees, customers, and others digitally or online. Since data breaches are on the rise, all organizations must start taking more detailed steps to prevent a data breach. By implementing protection best practices you will stay ahead of potential attacks and ensure the safety of your business.

Ransomware protection and response best practices were in focus of our recent webinar with Veeam. With October being National Cybersecurity Month, we thought it is the right time to revisit it.

Take a look at the recording below and get insights from William Bell, EVP of Products from phoenixNAP, and Brandon McCoy, Cloud Sales Engineer from Veeam.

Here is a detailed checklist we recommend you go through to start consolidating your online security:

Don’t click on email attachments

Spammers and hackers are becoming more ingenious in their attempts to trick people into open email attachments. It’s no longer the Nigerian prince asking you to wire donations to his kingdom. Now you get emails from the IRS, Social Security Administration, and sometimes even someone that looks like one of your relatives. Spammers find relatives by searching your name from any number of person search sites, or social media which display the names of your relatives.

Before clicking on any email attachment, stop and ask yourself if you know the person or organization, and were you notified of an incoming attachment? If you answer no to any of those two questions, don’t open the attachment. In essence, you should delete the email immediately.

When in doubt, you can do a little investigative work to check if an email is legit. For example, check to see if info@paypal.com does originate from the official site. How? In your email client, display the email header information. There, it will be evident if the email did not come from paypal.com. If there are links in the email, hover over one of them, but don’t click it! You should see a popup or hint that displays the full URL. If it doesn’t start with a paypal.com domain, it’s a fake.

Implement and use 2FA

2FA or Two Factor Authentication is a security method that verifies you. You’re already familiar with website logins. 2FA takes logins a step further. It does this by checking if it’s genuinely you that is logging in with your credentials. 2FA does this by asking for additional information. After you enter your login info, the 2FA scheme will send a text code to your verified phone number. Which in turn, you must enter into the login screen to gain access.

There isn’t a field on the login screen to enter your device’s phone number. That would defeat the purpose of 2FA since a spammer would be able to enter their mobile number and hijack the auth code. Instead, the mobile number you saved in your account is used. By involving another device that only you have access to, 2FA provides more confidence that the person logging in is you.

A 2018 study by Carnegie Mellon University found that over 75 percent of study participants thought 2FA made their accounts more secure, but 50 percent thought the process was annoying. 2FA also helped to stop dangerous security practices, such as credential sharing.

Never share your social security number

Most job applications will ask for your social security number to perform a background check. Outside of job applications and government organizations, there is no need to provide your social security number. Some companies may ask for it to set up an account for you. You can decline, and ask that the company uses another identifying number. After all, you have no idea what sort of security practices go on at any company.

Lockdown physical assets

Keep physical locks on any devices which contain sensitive data and are vulnerable to hacking.

Restrict access

Limit access to sensitive data, to employees on a straightforward need-to-know basis.

Update all your operating systems

Through cloud computing, these should be updated consistently and automatically. It’s always safer to ensure you have the latest versions with the most recent security fixes and patches installed.

Schedule regular updates for applications

Some apps will have to be updated manually, where others will be updated automatically. This rule is critical since earlier versions will have loopholes that hackers can exploit.

Use SSL in your email client

When using a desktop email client, the client connects to your email provider’s servers to receive and send emails. With some providers, you have the option to use a non-SSL connection. This can prove risky.

A non-SSL connection will send your non-encrypted email login credentials over the Internet. When you connect to a public or unsecured WiFi network (i.e., coffee shop or hotel), your email credentials will be vulnerable. Always use SSL when connecting to your email provider.

Use machine-generated passwords

With the advent of keyword loggers and even cameras spying on networks and devices, it’s imperative to use a machine-generated password.

Furthermore, hackers often play the guessing game too. One of the most popular passwords are names of personal pets. Using social media, it’s not hard to discover your pet’s name. For example, a simple Facebook search can give any hacker that type of personal information.

Play it safe by using something generated for you, and it is also completely random. If storage and memory pose an issue, then use a password manager.

Use Strong Complex Passwords

Don’t use the same password across multiple logins, even if you have used a password generator. Each login should be different. If one login is compromised, at least your other logins are safe – for now. By diversifying with strong secure passwords, you are essentially creating a firewall between each login.

Use a Credit monitoring service

Credit monitoring services can alert you to suspicious activity within your financial accounts. Credit monitoring services are convenient because you can monitor activity within all of your financial accounts, and through all three credit bureaus.

If you don’t want to pay for a monitoring service, most credit cards and bank accounts have alerts that inform you of suspicious activity. It’s triggered when a transaction exceeds a specific dollar amount, or a questionable purchase has been made on the card.

Contact your financial institution immediately

If you see suspicious activity on one of your business accounts, contact your financial institution right away. Your institution has protocols in place for events like these.

Train and educate your employees

The Office of the Future survey, Canon USA reported that more than one-third of respondents consider malware and ransomware a priority threat. Yet, 25% of respondents say that employees have limited to no security awareness, nor do they understand their role in prevention.

For better overall security, it’s essential to train your employees on your most recent security protocols. Create written privacy and data security policies. Educate your employees on those policies, and make them aware of their responsibilities for keeping company data secure. Offer this type of training at least two or three times per year.

If you’re self-employed, use an EIN instead of your social security number

If you are self-employed and have to fill out W-9s and 1099s, use a federal EIN. Using the Employer Identification Number means you do not need to use your social security number. And this protects you from becoming a victim of identity theft.

Data breaches are an unfortunate part of doing business online and participating in digital activities. In this article, you can learn to arm yourself and your business with protective knowledge and strategies and best practices to avoid data breaches. You can drastically reduce the possibility of your private data ending up online, or in hands, you don’t want it to be.

If you are still unsure about how to secure your business online, contact phoenixNAP today to get more information on how to develop your own strategy.

Corporate cybersecurity is a mindset as much as it is a strategy.

According to Verizon’s 2018 Data Breach Investigations Report, internal actors still account for an alarming number of data breaches. Last year, 28% of attacks involved insiders.

Although adequate security systems are vital, these findings point to the importance of educating employees on cybersecurity best practices. To efficiently protect their data, organizations need to develop a security culture throughout the company. The best way to do so is to introduce relevant, engaging, and regular security training for employees.

For those who tried to do so but failed and for those who are not sure how to start, we asked top cybersecurity experts for their best advice. Take a look at what they said and start implementing their tips today.

Cyber Security Awareness Training, Advice From Industry Experts

Mindfulness with safeguarding your Identity

An employees’ Corporate Identity is THE critical component to safeguarding all valuable top secret or highly classified documents, customer records, Intellectual Property, or design secrets.  Hackers will go to great lengths to trick employees/end-users to steal their access credentials.  This goes way beyond just making sure you update your password with strong alpha-numeric characters regularly per corporate password reset policy.  A good rule of thumb is to treat all the files, folders, documents, social media, corporate websites you have been granted access to as would your own bank account.  Sharing your corporate ID is never a good idea, even under temporary circumstances.  It’s also a good idea from time to time to check with IT to see what exactly you have access to.  Especially if you have been at the company for a long time.  Do you want access to systems you used 5 years ago?  This only creates risk, and it’s OK to ask for a list of things you still may be able to access and request that access be removed.

Attribution of all Business Communications

What is attribution?  Simply put, “Do I REALLY know who sent this message to me?  It’s important to train yourself to get into the habit of verifying the author or creator of a digital communication to you (via email, text, social media, automated message, website alert/notification, etc.).  This is an awareness technique that’s easy to adopt once you start to just ask the question.   With email, you can double-click on a name or hover your mouse on the From: field, and it will resolve to the actual email address.  SPAM, Phishing attacks and Malicious Ransomware messages often resolve to a string of characters that are easily seen as suspicious.  If the email doesn’t end in “companyname.com” you likely are being subjected to some sort of deceptive communication.  The same is true of malicious URL’s.  Instead of clicking on the link to find out what it resolves to, hover your mouse or right click to see what the whole string looks like.  These changes in behavior can really make a difference beyond just updating antivirus, OS patching, and firewall security controls.

Cyber Attitude

You can be your own best anti-hacking expert with these simple tips:

• Don’t leave your laptop or desktop alone with applications open. Make sure to have a password enabled screen saver activated any time you leave your workstation
• Don’t tailgate. Remember your Identity is critical, and this is true of your employee access badge.  It’s only meant to let you into the building, parking lot or server room.  Make sure you don’t just let people follow you as a matter of courtesy or convenience.
• Hackers love social engineering. They will call and posture as a co-worker or service agent. They can be very crafty about piecing together information to hack into systems or break or sneak into a building. So beware of those asking questions about scheduling and where people will be at what time. Safeguard information around people’s system access just like you do your own.
• Don’t even read it, delete it. And the worst thing you can do is forward it to others.
• Make sure you have a backup of your laptop or workstation’s data.  Ask the IT staff if your data is being backed up regularly.  This may be the only way to recover from severe ransomware attacks.
• Believe it or not, you can become a frontline defense security expert to assess whether any application or system you access is vulnerable to some attack.  Pay attention to irregular content that’s posted, the amount of time it takes to process information on systems or any strange errors reported in a business process flow. Hackers rely on a lack of incident response planning to have their malware spread and escalate access to damage or steal data so the sooner your report something that is not normal, the better.

Make Your Security Training Program More Personal

Training is much more effective following a social engineering test. If you can show them how you tricked them into letting you into the facility, the success statistics of a spear phishing attack, and/or the success of phone call social engineering, it leaves a big impact. Especially on the ones that know they were tricked. I never reveal who was to blame as I explain the test is not a witch hunt, but an awareness exercise.

I use colorful stories from my past exploits to make the lessons more enjoyable. They have just seen one example of a test, so I tell them some other ways an attacker might exploit them. My style is to lighten the mood and tell them from my perspective which makes it more cinematic in their mind. Like a good suspense thriller. Their responses range from amusement to frightened out how easy it is to con people. When I visit them for the next training (often a year later), my clients remember the old tales and tell me how they have seen similar things during that time, and are excited to learn some new stories. This keeps them much more attentive than just a boring statement of policy and procedures.

I don’t make it just about the company. I tell people about how they are tricked personally. How to avoid scams, credit card protection (how to avoid skimmers), and encourage them to share the material with their friends in family. I explain that if we can make ourselves safe, it is better for our employer, our family, and society in general.

If nothing else, no one wants a boring recitation of policy, procedures, and best practices. Liven it up, don’t speak in a monotone voice, and don’t just read bullet points. That applies to any presentation though.

Training Should Engage Staff

Training needs to be engaging to build internal expertise and competency. Here are four ways to keep cybersecurity training exciting for employees:

• Keep it Interactive: Leverage multiple types of interactions to keep learners engaged. Hands-on simulations/real-world training and tabletop exercises are influential in building offensive and defensive cybersecurity skills and help assess an organization’s situational preparedness. This supplemented with computer-based training, and reinforcement assets are effective in reinforcing lessons learned.
• Groom security champions: It’s much easier to get staff to jump on the security bandwagon if one of their own is driving the adoption versus having it come down as a “must-do” from high-level management.
• Motivate with incentives: From simple recognition to formal awards, incentive programs like belts, certificates, spot bonuses, gift cards, etc. help to facilitate progression and motivate employees to want to learn more. Role-Based: Security is a shared organizational responsibility, and there are many stakeholders including general staff, infrastructure, cloud, and development teams, and managers that need to write policy and ensure adherence to compliance and other mandates. Progressive topic-driven modules customized for specific roles are useful in building the required cybersecurity skills.

Use Real-Life Scenarios in Awareness Training

• Create consequences. If you are implementing new cybersecurity rules, create consequences for following or not following them. Whether its a reward or special monthly recognition, or if its some kind of punishment for not following your new security rules, give your employees a reason to get engaged.
• Use examples from real life cases. Yahoo, Blue Cross Blue Shield, Equifax and other large organizations have experienced devastating data breaches. Bring these cases to life with numbers and data proving the seriousness of the topic and showing that it can happen to the most sophisticated systems.
• People don’t like change, so if you are implementing new rules make sure to explain *why*, in simple terms that your employees will understand. You know your team better than anyone, explain the information in a way that makes them understand why behavior needs to change, so that even if they don’t like the changes, they understand that they are important.
• Make the information relevant. Too often these types of presentations aren’t industry specific and seem out of touch with what your employees do every day. Bring the information down to their level so that it is at the very least relevant.

Build each training session around a theme

• Basic email security. Never click on an email link or attachment you are not expecting. Email is the #1 delivery method for malware & ransomware. 60% of all successful hacks occur because of one person’s mistaken click.
• Never use personal email for work. Consumer email does not have business-grade security, backup & compliance features, and all of your emails could become discoverable in a lawsuit.
• Use complex passwords! Store your passwords in password management software and not on sticky notes attached to your monitor! (Begging you here.)

Use Current Events To Resonate

• Make the training engaging by using real-life scenarios. For example, drop a USB drive in the audience before the training and then during the class ask if anyone found it. Once they respond, ask them what they would do with it. The typical answer is ‘plug it into my computer to see what is on it.’ This is a great tool to show how social engineering works on the human gullibility to infect a machine and an organization.
• Make it relevant and use actual examples from recent current events. Technology is already complicated for non-technical employees to understand, the language is foreign, and most technology professionals are not proficient at translating critical technical terms into easy to understand and relevant business terms. Using actual present-day examples not only makes bridging the gap easier, but it also engages the audience in ways relevant to their experiences. One way is to show real examples of malicious emails and point to specific objects and pieces of information within each email that makes them illegitimate. I always include examples from the past 2-3 weeks to demonstrate what is happening now and also to show the importance of always being diligent.
• Make the presentation fun. This is probably one of the most challenging aspects of the training because nothing about cybersecurity is fun, but mixing in more light-hearted material, such as videos (from The Jimmy Kimmel Show in my example), change up the monotony of delivery and make use of humor to get the points across on serious topics.
• Make it collaborative. Many in the audience may be there because they were forced to, but there are always those wanting to learn and participate. Know the industry and business of your audience and ask them questions related to their specific industry, operational area, and even job type. Throughout ask what they have experienced and what they did about it. Include examples of real security incidents, breaches, ransomware and how those companies dealt with it and recovered. Understanding the amount of time, effort and money expended to recover from an incident is often hidden from employees is very eye-opening. Making cybersecurity ‘real’ will leave everyone more aware of the actual risks they will encounter both professionally and personally.

Context is the most critical aspect of security awareness training

Context means a few things to me:

– Why it matters to our company, not just generic statements about risk management.
– When the message is relevant to the employees.
– For whom the message matters most, i.e., vary the training content or its delivery by job role, as much as is practical.

Here are some examples of how we train employees:

I try and spend some time with each new employee to reinforce our security culture from the beginning. I hope that also helps the new hires see that my team is approachable and helpful. I also get a benefit from this, as I can learn what the security environment was like at their previous company. It is a great way to get new ideas and challenge the ones with which I am currently comfortable. And it is the right way for new hires from the get-go to understand the robust security and data protection culture we have at Anonyome, and thus what will be expected of them.32. Teaching employees how to detect a phishing email is very important, especially as the mailbox is so often the key to password recovery/password reset for other services.

What has been most impactful is showing people real phishing emails that have been received by our employees, as opposed to boilerplate examples. I try and share these examples through our intranet platforms as they happen, to try and capitalize when other employees may be receiving similar phishes.

For the developers in our company, security about our internal assets, but also how we build and operate systems for our products. The unfortunate data breach at Equifax became relevant for our product teams when they understood that the issues at Equifax were due to old, unpatched software. That was a reminder of why we have procedures around patching systems and keeping our use of open source software components up to date.

We keep formal, recurrent security training to a minimum to avoid cyber safety burnout from employees. However, we regularly check in with key account and data owners to ensure compliance and processes are being adhered to and of course answer any questions employees have.

• Keep it simple. Start with care and share to be prepared and expand from there. You have to make the case it is worth their time to care about cyber-security. Once you have made that case, persuade them to share what they learn.
• Make this happen by relating every concept you teach to real-world scenarios, ideally with stories that have protagonists, antagonists, conflict, and high stakes.
• Entertain. Boredom leads to apathy, which is your worst enemy.

Start sessions with relevant and scary cybersecurity statistics.

Facts like 46% of entry-level employees don’t know if their company has a cybersecurity policy or the fact that ransomware threats increased by 36% in 2018 or that 1 in 130 emails contains malware etc. It’s important for people to understand the risks of not being informed and educated regarding cybersecurity.

Secondly, always emphasize how destructive lack of knowledge and negligence could be. Finally, don’t forget to mention that most cyber-attacks could have been prevented if specific protocols would have been followed and that due diligence and staying alert represents the state of normality in today’s cybersecurity.

The biggest issue with any security awareness training program is that the people most qualified to teach it are the same ones who are most liable to talk above their audience’s skill level.

While many of the issues in online security are fascinating, it is easy to lose the attention of your team if you get too detailed.

• Keep it fun. Roleplaying phishing scenarios, talking through real work attacks, watching the Pwn videos from Rapid 7 that detail some of the ways they have successfully breached client’s security are all fun ways to engage the audience.
• Keep it actionable. Knowing the dangers of ransomware and identity theft is useless if your team members do not know what to do if they are suspicious of something. Have a point contact or shared email box where they can forward suspicious links.
• Do not victimize, or make examples out of your team. Phishing test exercises are a valuable tool to demonstrate vulnerabilities. However, your most vulnerable employees can feel victimized if they are publicly outed or shamed, which leads to a loss of engagement with the training. Instead of highlighting who failed the assessment, highlight who did the right thing, by forwarding the emails to IT or reporting an unsuccessful penetration testing attempt.
• Be consistent. Complacency is the biggest threat to security, no matter if it is physical security or computer security. Keep your staff up to date on new developments and tools, and make sure to run assessments and micro-training at regular intervals to keep your team vested in the process, and aware of new and emerging threats.

Cyber Security training should be personable and relatable

• Speak to the employees and how they can secure themselves in their personal lives, not just company policies. This gives them more buy-in and reason to pay attention as you are now delivering them value on what they can do to protect themselves and then translate that into how the same principles apply to the organization. I always give my audience a handful of tips they can use personally first, then move on to company policies and then connect the two. It comes back to the old what’s in it for me? If companies just speak about how employees should protect their business, there is less interest, but if you give them personable tools and tips that also relate to the business, you will find greater success.
• Find engaging content. Videos are best in this day in age. I use videos that demonstrate how easy it is for criminals to hack and gain access to personal information. The videos need to be entertaining not lecturing.
• Get out of the classroom/meeting room and get hands-on. We provide a service (and several companies do) that provide real-life employee awareness training that involves sending fake malicious phishing emails to our clients’ staff. The emails do no harm, but replicate what actual bad emails do. When employees fall for our emails, they are kindly told that they failed and need to watch a video on what key points they missed. We provide owners and management reports on their companies phish prone score which gets improved quickly (30 days) with testing and sending these emails and watching the videos. This becomes more random and on-demand training that can be as little as 1 minute to 15 minutes but is consistently ongoing and raising awareness amongst the team.

• Shorten the length of training sessions to under 1 minute to accommodate short attention spans.
• Simplify messaging to its bare essentials and do not cover more than one topic in a single security awareness program.
• Phish users on a weekly basis.
• Capitalize on just-in-time training by educating at the moment a mistake is realized.
• Anchor lessons in emotion.

Most cybersecurity security awareness training conducted for employees is related to email phishing, specifically providing tips and tricks for how business workers can better identify a malicious email. In theory, this is a sound investment. With nine out of ten attacks beginning with phishing, there is a human vulnerability that needs to be addressed.

The challenge is that today’s attacks are so sophisticated and complex that even hyper-phishing aware employees cannot identify them. As an example, 1 in 3 workers in the utility industry in Michigan recently opened a fake phishing email even though those people are mandated to go through security training. In fact, Verizon estimates that only 17 percent of phishing attacks get reported.

So what should companies do?

For starters, if they are going to invest in phishing training, then they should adopt tools that are gamified and tailored to each user’s specific level of awareness. This method is proven to keep people’s attention spans longer and help trigger information retention. Secondly, and most importantly, organizations must realize that humans alone – no matter how much training – can never be relied upon as an actual security safeguard. Instead, companies should look for ways to have humans and machines work together in layers so that when one misses an attack, the other has its back. In this scenario, each time there is an attack, both the human firewall and the machine get a little smarter, further reducing the risk of future phishing emails being successful.

Improving cybersecurity awareness requires cultural changes

Employees need to better appreciate the potential business impacts of their actions, and they need to be held accountable. Until that happens, training is just something employees have to suffer through, rather than being something they understand they need to do. Accountability does not mean the company focuses on punishing those who do not comply. It can also reward those who do.

This can be achieved, for example, through gamification, with employees who do comply receiving positive rewards, such as Starbucks or Panera gift cards if they achieve and maintain certain scores. These kinds of positive reinforcements help move security from being an afterthought to the forefront of employees’ minds, which in turn helps security become part of the culture.

• Actually do training. Even boring training is better than no training. If you do not have the resources in-house, seek outside sources. There are many.

• People enjoy videos these days. There are lots of them out there that help emphasize the severity of the issues. Believe or not NOVA (PBS) has some excellent ones on YouTube. Cisco and others have videos that can be used in training.

• I give out candy when someone answers a question posed to the group. it is not a lot but it gets people involved.
• Once a year is not enough. You cannot train one time and expect people to remember everything. The threat landscape continues to change and training needs to evolve to keep up.

Test The Effectiveness Of Your Staff Training

• Make it interactive.  Whether the training is online or in a classroom, it must be interactive and engaging. Watching videos, hours of powerpoint, or even mindless cartoons does not work. Any training, regardless of media, must require the end user to engage the instructor, scenarios on the screen, and provide feedback. Making it fun is important but making it positively interactive is critical.
• Make it real-world. Too often training is based on what-if use cases. If you click on this link, if you open this email, if you share your password, etc. this will happen. While these are informative, good cybersecurity training includes real-world examples from other companies (or from within your own) of people doing bad things and the real-world ramifications. If it included the public details from Uber, Equifax, Ashley Madison, Delta, etc. – then employees can relate better to their own experiences.
• Include role-playing and testing. Employees will learn best if they are placed in actual situations that reinforce what they just learned. While standard role-playing is good, testing and cybersecurity certification are required. There is no reason that security teams should stop there. They should perform a light-hearted pen test after training. This could sample phishing emails; a few loosely dropped USB thumb drives or even fake phone calls. People always remember training best when tested with real-world role-playing and testing.
• Do not do it in isolation. Any staff security awareness and training should not be from a person’s desk. It should have dedicated time and location even if it requires them to use their own laptop. There are too many distractions.

More useful than training videos are actual tests or exercises.

For example, a phishing exercise where employees are sent random phishing emails to see if they click on links or attachments provides valuable feedback to both the IT department and the employees. A contest amongst employees to see who can spot the most phishing emails (by forwarding them to an alias) puts some friendly competition into the mix while providing a valuable exercise. Rewards can be simple gift cards or a more complex points program which can be redeemed for prizes. Similar activities can target mobile devices or laptops by asking employees to download unauthorized software.

• Social engineering attacks are the most insidious. You must educate and train your employees on what phishing attack emails may look like including official-looking logos, a sense of urgency, the need to wire funds or check account or package tracking information immediately.  By hovering over the links in a message and noting the URL that appears, many of these phishing attacks can be thwarted. When in doubt, look up the company’s phone number or customer support email on your own and do not rely on the contact information in the email to ascertain validity.  However, more and more various websites are hacked, and code installed on them that the site owner is unaware of. Just visiting a compromised site can allow malware to get into your systems.
• A great exercise is to have your employees try to spot fake vs. valid emails and to make a game out of it.  Divide employees into teams, and then have them mark which emails are legitimate and which are not. The winning team gets a prize (lunch, leave work early, PTO time, etc.)
• Passwords are one of the easiest places to gain entry into a system. Stress the need for strong password security. Use passwords that are LONGER and not necessarily complex. Any password that is 12 characters or longer is almost uncrackable. It would take too much time for a computer/hacker to crack it. Teach them to use easy to use phrases as passwords such as turning vacation time in Aruba into Vaca710n71m31nAruba! which makes an easy-to-remember phrase into a super strong 20 character password.
• Drill into your employees the need to be vigilant and not complacent. Just because they (or your company) have not been hacked before, does not mean it cannot happen. A recent survey by the National Small Business Association found that 50% of businesses they surveyed had reported being victims of cyber attacks, and 3 out of 4 were small businesses with less than 250 employees.  The average cost of a cyber attack is around $21,000, and within six months, 60% of those attacked go out of business.  Let your employees know that if they want job security, they need to help contribute to your company’s security!
• The apparent need for a robust and centrally managed antivirus solution on all your servers and workstations is a must. Besides, your router’s firewall must be hardened by an expert who knows exactly what the best practices are.  Having a solution that combines the two is an excellent option for small businesses.

• Ensure cybersecurity is a part of every employee’s performance goals.
• Gamify the security awareness training program, so there are points amassed, a leaderboard or prizes.
• Ensure the situations reflect real-life concerns of the enterprise. Rather than using generic scenarios, show how a loss of control, loss of personal information, loss of client sensitive information, intellectual property or similar related to the business affects the bottom line, company profits, reputation, stock price, etc.

Information security awareness requires hardening the human element

While there are countless strategies for making a data security program useful, to transform a compliance checkbox into a strong security posture.

• Security Awareness training should be a constant presence in the lives of employees. To be effective, a program cannot merely be a quarterly, semiannual, or annual gathering of employees to be lectured on not clicking a link. Instead, it is essential to create an iterative and dynamic process that tests employee through various types of cybersecurity attack vectors, pair that with general education, and finally, to develop specific interventions for ‘habitual clickers’ and other weak links in the organization.
• In the same spirit as the previous tip, small nuggets of knowledge dolled out regularly are far more effective than drawn out lengthy presentations that are spaced over time. 2-3 minute refreshers or targeted lessons with a specific purpose (risk of phishing, operational security, specific compliance issues, etc.) are far more effective than lumping everything together into a single hour-long (or often longer) session.
• Gamification. The average person is more interested in clicking a link than protecting their company from abstract threats. Thus it is vital for a cybersecurity awareness program to change that dynamic. One of the most useful tools for doing that is gamifying security awareness programs. Gamification refers to the process of turning a mundane task into a game. How to gamify security awareness training is a question that involves creativity and an understanding of the employees of the organization. Depending on the scale of the organization and the resources available, gamification can be something as simple as publicly calling out good acts of security awareness such as reporting a phishing link or completing a training course. For a more intricate and involved solution, an organization can create a public point system that rewards proper conduct and punishes poor practice. The company can give rewards and other benefits to top scorers while hoping that poor performers are encouraged to step up their training.

The pace of change within and outside of an organization is staggering. Many businesses are in the process of digital transformation where applications and the APIs that connect them are becoming the digital fabric connecting the world. No longer is it taking months or years to build out IT infrastructure and applications. In many businesses today, it might be just a matter of days or hours. We have customers who are pushing application updates multiple times a day.

Cybercriminals are staying on top of this change too, evolving their capabilities at a similar pace. Organizations and individuals must be vigilant when it comes to security education and training, and security vendors need to make it as easy as possible for businesses and consumers to get the training and education they need to stay current on potential cyber threats.

To stay ahead of security risks, here are the top three practices to put in place:

• Enroll in Training Programs: People’s understanding of Security generally falls in two buckets: either the person is uninformed, or the person is informed but their knowledge quickly goes stale. A big part of thwarting attacks is to keep the team trained. There are training programs, some even free such as the WhiteHat Certified Developer Program, that can add to a company’s training and education arsenal and help both security teams and IT/development teams learn valuable secure coding skills and how to secure applications through the entire software development lifecycle.
• Phishing Training: People rely on emails and websites to function on a day-to-day basis, and phishing continues to be an effective means of victimizing users. According to the Verizon Data Breach Investigations Report, 30 percent of phishing messages were opened, and around 12 percent then actually clicked the malicious link or attachment. The best phishing attacks target something that you rely on, whether it be online banking, email or credit cards. Continued education and possibly warnings before executing the links are the best way to combat phishing attacks. Two-factor authentication is a great barrier for anyone attempting to hijack your account. Not only will an attacker need to compromise your username and password, but they will also need to compromise a device as well.
• Security in Context: Covering general security topics will only go so far. Optimal training programs provide curriculums that are tailored to the roles and responsibilities of the individual partaking in the curriculum. By way of example, Software Engineers need to have an understanding of the security implications of clicking an untrusted link, and they must also have an understanding of the security implications of building SQL queries at runtime using user-data.

Companies should include information on general security threats, how hackers compromise systems (social engineering, malware, etc.), top hacker targets (Facebook, Twitter, LinkedIn), defense techniques, an overview of the hacking ecosystem, and the cost of lost data to the organization.

Initially, training should be done in-person with a presenter. A slide presentation with topics that highlight how hackers affect the specific organization’s industry should be included. Live websites and video should be used to keep the audience engaged.

Follow-up security awareness presentation can be via a recorded webinar that is updated to reflect the changing threat landscape. After the recorded session there should be a quiz to measure how effective the presentation was with the target employees.

Also, the Information Security group can send out regular email blasts on threats and create a monthly newsletter or blog to keep security in the forefront of employee’s minds.

The best way for organizations to protect their data and keep their employees from compromising security is to train them on information security best practices. This must be done on a continual basis, in layman’s terms and at a minimum of six-month intervals. Sixty to seventy percent of data breaches are due to social engineering and hardware theft; an issue best addressed by training.

If an organization keeps the issue of information security in front of employees, makes it engaging and keeps the organization informed on how threats are impacting the company, then the employees with have a reference point on how their behavior is or could impact the company.

People love hacker stories. As part of our business we handle data breaches for companies, so we have plenty of stories on how hackers broke into organizations and what they did once inside the network. Many of these stories are relatable and get people interested in the topic. Often we will have 2-3 hacker stories in a briefing to introduce better security practices or ideas.

People like to talk about themselves. I make sure that I provide plenty of time for people to ask questions about their personal cybersecurity concerns related to their email, social media and smartphone use. The concerns that are typically expressed by one person in the group are usually shared by others and always leads to lively discussion and better training.

• Avoid cyber security courses where IT teams are scolding employees for being careless about their use of IT assets. While the 1990’s SNL skit with Jimmy Fallon (Nick Burns, Your company’s computer guy)  is sure to be an excellent icebreaker for what your IT team shouldn’t be acting like, it’s far better to infuse a tip or two into other company meetings that employees want to attend.
• Use stories/videos to drive home the point. A few minutes on YouTube, looking for current events about breaches should yield plenty of  2-5 minute videos worth watching. For example, it’s widely known that a  very high-ranking 2016 U.S. presidential campaign manager was compromised over essentially not having two-factor authentication turned on. (which  brings me to my next point)
• Accept that shadow IT exists and provide department/application-specific advice. For example, show what should be done in settings to protect against the basics: turning on two-factor authentication, enforcing strong passwords, and forcing SSL usage in webapps. A tech-savvy power user in finance or marketing can often be a  great person for your IT team to partner with on these efforts.
• Point out the dangers of public WiFi and why VPN software is so critical. Anyone with young kids, or who remembers being a kid, can relate to the telephone game, where you whispered in your friend’s ear to reveal a secret. This is an excellent analogy for this topic.

Some general “rules of thumb” about emails that ask you to pay for invoices or to send out financial or client data:

• The same rule as you would use for a phishing email: Be very skeptical.
• If you have an admin handling your mail, make sure they ASK directly, or by phone or text, before they take any action.
• If the email is from someone you know, call them to double-check.
• If the email is from someone you do not know – do NOT call them. It is likely that they will try to use social engineering to convince you to send it.
• Do NOT send attachments if you do not know who requested them
• If you are at all uncertain about the email’s legitimacy, delete it. If someone really and truly needs something – they will get back to you!

I realize that this last one flies in the face of all social contracts. But each of you has to weigh how much you value your businesses’ security program over some possibly ruffled feathers.

Build A Powerful In House Defense Against Cybercrime

• Arm employees with the required knowledge to thwart information security intrusions designed to help train, educate and reinforce a security-aware employee base.
• Use All Tools Available to Fight Hackers – Kick off a new way of training and create maximum excitement and support by leveraging a fun and enjoyable staff security awareness program.
• Improve Your Team’s Security IQ – Easily deploy fun and engaging animated videos to all employees regardless of keeping security awareness top of mind. Easy and convenient, these videos will be accessible from multiple platforms (PC, laptop, iPad/tablet or mobile device).

• Employees need to be educated on what a phishing email looks like and why they are BAD. We do this by sending out test phishing emails and track which employees click on the link in the test email, and then we can educate that employee on a personal level.
• Another great tip is to not use or connect your devices to public WIFI. (i.e., hotels, airports, Starbucks, etc.) use your phone’s hotspot, so you are not allowing other devices to view your network access.
• Sessions are often boring wastes of time, both for employees and the IT teams responsible for them. How do you avoid this? – Whether we are educating our clients or presenting at a cyber security conference, we always do 2 things to make the event not a boring waste of time 1.) FOOD – we always have food and provide catering at our events and 2.) Giveaway gift cards throughout the presentation and at the end. Ask questions to get audience participation and give away $$. The bottom line on cybersecurity and reducing your risk is TRAINING/EDUCATION. You have to make it a priority to educate your employees.

Start an Employee Security Awareness Program ASAP

The secret sauce for cybersecurity is focusing on two simple things – Talk about it and think about it. The reality is that dealing with security is a business issue (not an IT issue) and it involves hundreds of little things (usually not expensive or time-consuming) and not just the several big things you think you need to be doing (which can be costly and time-consuming).

Talk about it. We have found great success just getting people in the same room and telling stories. Call it a lunch and learn or do it in the afternoon and call it a snack and learn. The company buys some food, and everyone has to show up. Takes an hour or less and have someone come prepared with some best practices and stories of how people have made poor security decisions (we play this part for our clients). It is amazingly powerful seeing one employee explain how they got a phishing email and how they fell for it and say how they avoid it in the future and then hearing weeks later that someone else in the room saw the same thing but were not a victim because they listened to that story. It is super simple and really works. Just talk about it.

Think about it.  Most people do not want to bother thinking about security. It is easier to turn a blind eye and think nothing bad will ever happen to you. All the business person needs to do is to make a conscious effort to think about security. Ask their IT for information about their business applications and such – manage who has access with privileged access management, what rights do users have, what is the password policy (complex and expire after X months), should you be using MFA (Multifactor Authentication), reports for antivirus and software updates, etc. Also think about if there are any concerns with other business areas – physical access control, third parties like banks, etc. Think about it and you will be more secure.

Train your staff and test your employees

• After presenting information about security awareness, come up with a scheme to set up a situation where employees are given the opportunity to open a very alluring link in their email. This is called a “phishing simulation.” This link will actually take the worker to a safe page, but you must make the page have a message, such as “You Fell For It.” You should also make sure that these emails look like a phishing email, such as adding a misspelling. The people who fall for this trick should be tested again in a few days or weeks. This way, you will know if they got the message or not.
• Do not make it predictable as to when you are giving out these tests. Offer them at different times of day and make sure that the email type changes.
• Consider hiring a professional who will attempt to get your staff to hand over sensitive business information over the phone, in person, and via email. This test could be invaluable, as it will clue you into who is falling for this.
• Quiz your staff throughout the year, to allow you to see who is paying attention. You want to focus on educating your staff, not disciplining them. They should not feel bad about themselves, but they should be made aware of these mistakes.
• Make sure your staff knows any data breach could result in legal, financial or criminal repercussions.
• Schedule workstation checks to see if employees are doing things that might compromise your business’ data, such as leaving sensitive information on the screen and walking away. Explain how important security is to your business and encourage staff to report any suspicious activity.

• Make a game out of it. Provide your employees with security basics of identifying social engineering through a quick read or cheat sheet and then incentivize them to put their knowledge to the test. Consider something like a department-wide game of Jeopardy. This method eliminates the boring lecture and boosts employee morale.
• Train employees as they come. Create material for training employees as they join the company. This will eventually cancel out the need for a large group training and ensure employees are properly vetted from day one. A quarterly quiz could help ensure their cybersecurity knowledge stays fresh and relevant.
• Create entertaining literature. Using the good old ambient marketing method, consider printing bathroom literature that provides employees with some easily consumable content. Taking a humorous tone, inform employees of current cybersecurity risks and tips, or company security news with a weekly, bi-monthly or monthly print which is then displayed on the back of stall doors. Create a simple template that requires little time to update with new info.

Cybersecurity awareness sessions for employees can often be boring wastes of time.

Combat the snooze fest of employee education sessions by making them engaging. This can be done by making the courses relatable. Create cybersecurity scenarios that employees can easily understand.

Utilize games, trends, gifs, memes, etc. whatever you need to convey your cybersecurity message. Understand your environment and hone in on whatever applies to your employees. You can easily incorporate funny and relatable scenarios to keep your employees attention all while helping them understand why cybersecurity is vital.