Every year, the number of cyberattacks continues to grow. According to the FBI’s 2020 Internet Crime Report, there was an almost 70 percent increase in cybersecurity complaints between 2019 and 2020.
But what exactly is a cyberattack? And what are some of the things you can do to prevent it?
Put simply, a cyberattack is an attempt to steal data, disable computers, or compromise other computers to launch further attacks. An example of a cyberattack was the successful attack on T-Mobile, which compromised data on millions of their customers.
Other examples of cyberattacks and data breaches include:
- identity theft, fraud, or extortion
- stolen hardware, such as mobile phones or laptops
- access breach
- system infiltration with possible exfiltration.
So, the question is, what’s our role in preventing cyberattacks? There is no magic bullet that can guarantee 100 percent safety against cyberattacks. But, even though an attack can happen, that doesn’t mean it has to be successful and incur a lasting loss. The following are some things you can do to reduce the likelihood of being a victim of a cyberattack.
Train yourself and your staff to pay attention
It is easy to click on links in an email or website. Most of us do it many times a day. But bad actors are becoming more sophisticated all the time. We shouldn’t be on autopilot when reviewing emails, speaking on the phone, or visiting websites.- When on a phone call, never give out personal information unless you are sure who is on the other end of the line and you are certain they need to have that information.
- When receiving emails, check for the following:
- Look at the format and body of the email. Does it have an unusual format? Are there spelling errors? Does it include an attachment that you weren’t expecting?
- Look at the email address. Is the sender unknown to you, or does the email address not match the usual email for that sender?
- Is the email making a request that is out of the ordinary? A quick phone call to verify the request can save you a ton of grief later.
Keep your software and systems fully updated
Often, cyberattacks happen because your systems, whether software or hardware, aren’t fully updated with the latest versions from the publisher or hardware manufacturer. Attackers use unpatched systems to exploit vulnerabilities and gain access to systems so they can steal information, hijack systems, or steal data. Once a bad actor has access, it’s usually too late to take preventative action.An example of this happened in December 2021 when businesses around the world were notified of vulnerability in a software package called Log4j or Log4jShell. It was one component usually included as part of other software. It was deemed a critical-level issue by the National Institute of Standards and Technology (NIST), and the first security patch of the system was issued shortly after. Unfortunately, the first patch was flawed, and, as of this writing, at least two more patches were released within days of each other to address the flaws in the previous patches. In this case, it was critical that systems be scanned and patched as soon as possible to reduce the likelihood of someone successfully hacking their system.
On an individual level, keeping your computer operating system (such as Windows or MacOS) updated and making sure all the programs you use are up to date are critical steps for you, as well as for your organization.
Back up your data
It is always a good idea to back up any important data you have. This is especially true in a ransomware attack when the data is encrypted and held for ransom. But just backing up your data, while a good first step, shouldn’t be your only step. Ideally, the rule of thumb for backups is the 3-2-1 rule, which states that you need:- three copies of data
- two copies must use different media
- one copy must be off-site
Finally, a backup is only as good as the data on it. If you can’t read your backup, then it will be useless to you. It’s important to periodically verify that you can still read and restore your backed-up data.
Use strong passwords and two-factor authentication
Passwords are important for keeping your data safe, but too often users choose passwords that are easy to guess. Using simple, easily guessable passwords increases the chances of bad actors gaining access to your systems and accounts.The NIST has written federal guidelines that many consider the go-to standard for password security. Even though these guidelines are only required for federal agencies, they are applicable to organizations and individuals in the private sector as well. One of the most important features is password length. The greater the length of your password, the harder it is to guess. Make sure you also include some complexity:
- Add uppercase and lowercase letters.
- Don’t repeat simple words or common phrases like “hellohello” or “Iloveyou.”
- Use random, common words.
- Use a minimum of eight characters, but, if possible, use a longer length.
- Add a special character (e.g., @,#,$,%).
- Don’t use a password that is the same as, or similar to, one you use on any other website.
For another layer of protection, enable two-factor authentication (TFA) on sites you use or are responsible for.
TFA is a two-step login process that uses more than a typical username and password/PIN. TFA requires a second layer of verification in addition. It could be physical verification where a person (worker or customer) uses a key, smart card, fob, or USB token. A smartphone can also be used as the physical factor, using a time-sensitive code that is sent to the device during login. In some more sophisticated setups, fingerprints or facial recognition is used.
Because of the growing number of passwords you have to remember, a password manager is also recommended. A password manager will help you manage your passwords by securely storing site passwords and other sensitive data. And with a password manger, you only need to remember one password, the one used to get access to your stored passwords and data. Of course, you need to remember that the one password you do use needs to be complex too!
Cyberattacks are growing year by year. Fortunately, by being careful, keeping your system updated, having backups, and using two-factor authentication, you can do your part to prevent or mitigate the impact of cyberattacks should they happen to you.
Reference
- Internet Crime Report 2020 - https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf
