We talked earlier about an awareness program being timely. It's
always good to address what are the current threats. And some of
these, of course, can include ransomware.
We see an awful lot of that taking, should we say, advantage of
companies these days and costing a huge amount of money, as well
as a disruption to business operations.
We also have distributed denial of service attacks.
These have often come through unprotected devices on our networks,
but it is also good to discuss social media.
People post a lot of things on social media that probably
shouldn't be posted, things about their work,
their location, for example.
And it's really good to sort of address with people, hey, be careful what
you post because it could well be that you're opening yourself up to some
type of theft or, of course, other types of, should we say, problems. We
know that one of the big challenges is that people will have their
passwords stolen, and then a hacker could log in with that person's user
account and password.
This is why it's good always to discourage people from using the same
password for their online banking as they do, for example, when they're
doing shopping or on a social media account.
We see this quite often when the same password is used, both on
sensitive business applications, as well as social media.
We should advise people on how to create a good password and certainly
remind them again and again that when you get a link that has a
one‑time password as part of usually multifactor authentication that
should never be shared with anyone else.
Someone calls up and says you're going to get this
notification in just a moment, let me know what the code is.
That's certainly not a good practice.
One of the things we have to educate our staff about more than
anything else is that it's okay if you've had a problem.
Report it because if you report it, we can fix it.
If it doesn't get reported, it's probably going to get a lot worse.
But we see, in many cases, they don't even know who to report to.
Who do I go to if there's a problem? And this is where we should
advise people who to call in case they have a problem or even
just something that is suspicious.
You see something, as we said before, see something, say something.
Even if it's only suspicious and you're not sure,
it's better for us to take a look at it.
Now,
the problem with this is that very often organizations have a
blame culture. If you come to me with a problem,
you must be the problem.
If you've had a breach, well, you've done something wrong.
The point is that many people can become a victim of a breach
through really very little or no fault of their own.
We want people to know that if they call us about a possible problem,
it's not that we're going to be pointing blame and so on.
Instead, it's that this is what we need to know so that we can
help protect the organization. It's part of our culture we have
to create. The key points review.
The unfortunate reality is that security breaches cost
organizations enormous amounts of money every year. Not
only in repairing damaged systems, maybe even paying ransomware,
but also in downtime and operations that can affect even, in
some cases, thousands or millions of people.
The majority of breaches are due to human error.
We can see this that when they have looked at the breaches in the past,
it was because of an unpatched system or it was
because of a misconfigured system.
So it's really important here to have awareness programs so we can try to
reduce these types of mistakes. Through awareness, hopefully, we will not
only prevent many types of incidents, but will improve our detection and
reporting of those types of incidents as well.