Cybersecurity is not just a technical matter, but a human one. Every employee, regardless of their role or industry, needs to have some basic cybersecurity skills to protect themselves and their organization from cyber threats. In this article, we will cover six cybersecurity skills that every employee needs to have and how to develop them.
One of the most common ways that hackers gain access to sensitive data or systems is by cracking weak or reused passwords. Password management is the skill of creating and managing strong and unique passwords for every account and device. You can use a password manager tool to generate and store your passwords securely, and enable multi-factor authentication whenever possible. You should also change your passwords regularly and avoid using personal or predictable information in your passwords.
Creating and maintaining a culture of persistent cybersecurity awareness is important and applies to all employees. Boiling it down to something very basic, "think before you click". This applies to passwords, links, MFA prompts, everywhere!
Passwords managers are great and I've been using one for years now. All my passwords are highly random, >12 chars, and contain multiple special characters. 2FA is enabled on everything that I consider critical. The real problem that I've seen in many companies is that they don't offer password managers to their employees. So in practice, even if the employees understand the best practices around password management they don't have the proper tools and support to put them into practice. Hence why we are where we are and you see all these breaches caused by poor secrets management (passwords stored in clear text files, weak passwords, re-used passwords etc)
Password management is very important to build a foundation in security. Every employee should undertand the importance of choosing strong passwords, using unique passwords and MFA. However they should also have support from their employer in the form of a password manager that they could use on their devices - this is something that I've not seen yet implemented in many of the companies I've personally dealt with. Without having a password manager that employees can use, this discussion is pretty pointless and you end up with employees reusing the same password everywhere or with passwords stored in plaintext files which is something we commonly see during our penetration tests.
Users should have an understanding of password hygiene (complexity, avoiding password reuse, using password managers for storing passwords, using multifactor authentication (MFA)) and should understand how to protect their passwords. Ideally, this becomes more of a culture of cybersecurity rather than just an annual training, where users understand their expectations regarding their identities and credentials.
The security function should establish baseline standards and guardrails that ensure employees aren't able to ignore, undermine or circumvent key controls. For example, an authentication system should not permit the creation of weak passwords. Where MFA is required it should be mandatory not optional. Make sure employees have ready access to a quality password manager, or better yet encourage system owners to adopt SSO to minimise the reliance on multiple passwords. The security responsibilities tasked to employees should be minimal, and only where they are intrinsically the actions of the individual such as password re-use. This reduces human error, allows more focused awareness campaigns, and reduces security fatigue.
Phishing is a type of cyberattack that uses fraudulent emails or websites to trick you into revealing your credentials, downloading malware, or transferring money. Phishing detection is the skill of identifying and avoiding phishing attempts by looking for signs of deception, such as spoofed sender addresses, spelling and grammar errors, urgent or threatening language, or requests for personal or financial information. You should never click on links or attachments from unknown or suspicious sources, and always verify the legitimacy of the sender before responding.
Phishing detection is just getting harder and harder. The classical spelling errors are not as common as they used to be and at the end of the day anyone can make a spelling error. Use of AI has also started being used by attackers to write better phishing emails, so a lot of the common hints of a phishing email are not so relevant anymore. When you have a company with 00's or 000's of employees, even if a very small percentage clicks on the link you still get access as an attacker. The question then becomes, how good is your SOC at detecting attackers once inside your network? A multi layered approach is needed to contain phishing: employee training, software updates, effective EDR, effective SOC team and ofc simulated phishing exercises.
Phishing detection is a critical cybersecurity skill for all employees. Phishing emails aim to steal personal information or trick users into clicking malicious links. These emails may contain grammatical errors, create a sense of urgency, or request confidential information. Employees who are aware of these red flags can help prevent cyberattacks by reporting suspicious emails to the IT department.
Make it easier for employees to report phishing attempts. Some e-mail services provide a "report a phish" type of button which can then route these potential attacks to the cyber security team who may be able to investigate the phishing attempt.
First, revisit whether everybody needs to receive external emails for their job role. If not, turn it off. Second, of those that do need to receive external emails, ask whether they need unconstrained emails or whether a curated approved list is feasible. Pushing back on the assumption that everybody needs open access can stop phishing emails from ever reaching the inbox, and the effort is paid off in not having to deal with the fallout. For the remainder, apply filter tags such as 'internal or 'known sender' that make it easier for the recipient to gauge the level of risk. The focus should be on reducing the burden on the employees and making vigilance easier by spotting anything out of the ordinary.
Here's something you might not know about Phishing's future: Currently, a few telltale signs of Phishing emails are threat actors often making common grammatical errors. However, lately, threat actors have started using AI to generate phishing emails, and you can't rely on this factor to quickly discern a phishing email from a legitimate one. Therefore, it's important to always think before clicking a link in an email. Especially if you weren't expecting the email or if it promises monetary/personal gain.
Data protection is the skill of handling and storing sensitive or confidential data in a secure and compliant manner. You should be aware of the types and sources of data that you work with, and follow the policies and procedures of your organization for data classification, encryption, backup, retention, and disposal. You should also avoid using unsecured networks, devices, or applications to access or share data, and report any data breaches or incidents to your IT department or manager.
Data protection starts with data classification. Data classification ensures that those who own the data know how, when, and why the access to data is needed making it easier to secure. This practice also ensures that as data is consumed it remains in a state of being properly authorized and protected.
As an expert, I would emphasize the critical importance of data protection in the current digital landscape. Safeguarding sensitive and confidential information is not only a skill but a responsibility integral to maintaining trust and compliance with regulations. Staying well-informed about the types and sources of data being handled and strictly adhering to organizational directives and procedures for data management is imperative. Additionally, avoiding insecure networks, devices, or applications is fundamental to preventing unauthorized access or data sharing. Prompt reporting of any data breaches or incidents is crucial for swift response and mitigation.
Access to information should be granular, and authorization to view it should be evaluated based on a deep understanding of both the business and process requirements of the organization. This requires a properly unified review board with representation from all areas that have a stake in what's being provided (especially executive data owners as they will ultimately dictate true business worth, and take responsibility for deficit in due care). Publicly viewable files do not need the same level of control as your corporate secrets or fiscal reports. It's all rooted in understanding your assets, your data, their business impact, your personnel, and available mediums for connecting/interaction
Notwendig für die Umsetzung ist hier die Etablierung einer Datenklassifizierungs-Richtlinie, welche Informationen in die bekannten Kategorien ?ffentlich, intern, vertraulich und geheim. Entsprechend ist auf die Klassifizierung von Informationen ab Erstellung zu achten.
Data protection is the ability to handle and store sensitive or sensitive data in a secure and compliant manner. You should be aware of the types and sources of data you work with and follow your organization's policies and procedures for classifying, encrypting, backing up, retaining and deleting data. You should also avoid using unsecured networks, devices or applications to access or share data and report any data breaches or incidents to your IT department or manager.
Device security is the skill of keeping your devices, such as laptops, smartphones, or tablets, safe from physical or digital threats. You should use antivirus software, firewalls, and VPNs to protect your devices from malware, hackers, or unauthorized access. You should also lock your devices when not in use, and update your software and applications regularly to fix any vulnerabilities. You should also avoid using public or shared devices or USB drives to access or store sensitive data, and wipe your devices before disposing of them.
As with password management, most of these things should not be in the hands of the employee. They should be mandated, automated, and out of their control. Don't want employees using USB drives? Disable the use of USB drives. Want employees to use a VPN when working remotely? Deploy an always-on VPN that doesn't require user interaction. Minimise the security responsibilities expected of employees and focus on the things that only they can do, such as locking the screen and not leaving a laptop unattended. The fewer tasks you assign to employees, the higher the success rate you're likely to see.
While I can agree with these areas as being important, simply having these things in place is not enough. In addition to implementing these various technologies to protect our devices or digital presence, we must also ensure that they are properly configured, aligned with industry best practices and most importantly, the behaviour of the users must be cultured in a way where security is taken seriously as an individual responsibiity.
In today's day and age everything is available with a click of a button on a user's mobile phone. By taking extra steps to protect the mobile device goes a long way and would protect their information and assets.
Device security is the ability to safeguard your devices, such as laptops, smartphones, or tablets, from both physical and digital threats. Employing antivirus software, firewalls, and VPNs is essential to protect devices from malware, hackers, or unauthorized access. Additionally, it's crucial to lock your devices when not in use and regularly update software and applications to address any vulnerabilities. Avoiding the use of public or shared devices and USB drives for accessing or storing confidential data is recommended, and erasing devices before disposal is a key practice to ensure data security. Taking a comprehensive approach to device security is vital in today's interconnected and digitally reliant environment.
Online finden sich zahlreiche Hartungsleitf?den, welche bitte angewendet werden sollten. Zus?tzliche Hinweise findet man in g?ngigen Standards. Ein moderner Ansatz w?re das Zero Trust Modell zu implementieren, welches Allesdings einen h?heren Administrationsaufwand mit sich bringt.
Social media awareness is the skill of using social media platforms responsibly and cautiously. You should be careful about what you post, share, or comment on social media, as it may expose your personal or professional information, opinions, or activities to cybercriminals, competitors, or other malicious actors. You should also review your privacy and security settings, and limit who can see or contact you on social media. You should also avoid accepting friend requests or messages from strangers, and report any suspicious or abusive behavior.
Skip the fine print? Fair enough. Just don't forget to fine-tune your privacy and security settings now and then. Share wisely on social media—just the basics, nothing that gives you away. Stay savvy, stay safe.
Der Umgang mit Social Media als Mitarbeiter sollte über eine Richtlinie geregelt sein. Dort dürfen keine sensiblen Informationen oder unvorsichtige Bilder des Arbeitsplatzes geteilt werden. Zus?tzlich sollte das Thema Bestandteil der j?hrlichen Security Awareness Schulung sein.
It's crucial to exercise care in what you post, share, or comment on social media, as these actions can expose personal or professional information, opinions, and activities to cybercriminals, competitors, or other malicious actors. Reviewing and adjusting privacy and security settings is essential, limiting who can view your profile or communicate with you on social media. Additionally, avoiding acceptance of friend requests or messages from strangers and promptly reporting any suspicious or abusive behavior contribute to maintaining a secure online presence. Being mindful and proactive in your social media usage is fundamental for safeguarding personal and professional information in the digital landscape.
Be aware that even when not using social media, those companies are still gathering information about you from browsing and internet tracking cookies. What you view adds data to your “social graph” which is then used by companies to tailor advertisements based on your online activity.
Try not to overshare on social media. Never share work snaps that have sensitive information in frame, no matter how tempting.
Cybersecurity culture is the skill of fostering a positive and proactive attitude towards cybersecurity in your organization. You should participate in cybersecurity awareness and training programs, and stay updated on the latest trends and best practices in cybersecurity. You should also communicate and collaborate with your colleagues, managers, and IT department on cybersecurity issues, and share your feedback and suggestions. You should also promote and support a culture of accountability, transparency, and trust in your organization.
Culture eats strategy for breakfast! Having a strong cyber culture that starts from the top down is paramount to a successful and strong cybersecurity culture. Top leaders who take cybersecurity seriously understand the businesses advantages of running a clean and healthy shop, and that permeates throughout the organization. Ditch the idea that “people are the weakest link” and make your people you strongest line of defense by establishing a strong culture of cybersecurity.
Cybersecurity culture starts from the top levels of management and requires appropriate executive support. Leading by example is an impactful way to affect change in an organization.
The cybersecurity culture is the ability to promote a positive and proactive attitude towards cybersecurity in your organization. You should participate in cybersecurity awareness and training programs and stay up to date on the latest cybersecurity trends and best practices. You should also communicate and collaborate with your colleagues, managers and IT department on cybersecurity issues and share your comments and suggestions. You should also promote and support a culture of responsibility, transparency and trust in your organization.
Engaging in cybersecurity awareness and training programs and staying updated on the latest trends and best practices are essential components. Effective communication and collaboration with colleagues, managers, and the IT department on cybersecurity matters, as well as sharing feedback and suggestions, contribute to a robust cybersecurity posture. Additionally, promoting and supporting a culture of responsibility, transparency, and trust within the organization enhances overall cybersecurity resilience. Embracing and embodying these principles collectively establishes a strong foundation for a cybersecurity-aware workplace.
It is important to develop a cybersecurity culture. Like I always tell my juniors, and whoever cares to listen: "always assume breach". Be suspicious of everything, everyone. Whatever you do, from the use of technology (app installations, web browser activity, authentication) to your conversations and communication, always take a pause to consider the implications of anything going wrong - 1- downloading/installing malware 2 - submitting credentials to a fake page 3 - disclosure of confidential information Etc
In my search for talent, when it comes to IT in general, I look for two things: humility and curiosity. The capacity to admit they don't know something and the perpetual interest in understanding how things work. An ideal candidate is not so much an expert in a field defined by a vendor, but rather has the potential to be vendor agnostic. However, for cybersecurity, I would also add imagination: the ability to think like a rogue actor, a stubborn client and an unsuspecting user.
Technical cybersecurity skills can be learned in most scenarios, but soft skills such as being able to be adaptable to new technologies, tools, and processes are absolutely critical. Once you have foundational cybersecurity knowledge it is very important that you find comfort in being slightly uncomfortable so that you are constantly learning new things and at the same time understanding there are multiple “right” ways to solve a problem.
While professionals must continually acquire skills and approach security implementation with innovation, and adapting to the evolving threat landscape. A crucial standout consideration is understanding risk , its impact on business and implemented controls. Cybersecurity principles should support business goals, however there's a tendency to overlook this broader perspective, particularly the relationship between cost (Controls) and business objectives, which professionals sometimes neglect this aspect. In this context, risk emerges as a pivotal factor. Risk enables professionals to assess potential impact and considerations which ensures that controls showcase value by contributing strategically to the organization's objectives.
Critical Thinking. Whether from a protection/detection, active incident or post incident position, thinking critically is the most important skill in my opinion. It applies to all the skills mentioned here.
Continuous learning and staying updated with the latest security trends and threats key to success, given the field’s rapid pace of change and evolving threats.