4 Basic Practices To Reduce Your Cyber Risk

The frequency of cyberattacks continues to rise for organizations across industries. Specifically, organizations experienced a substantial increase in attacks involving the exploitation of vulnerabilities, according to the Verizon 2024 Data Breach Investigations Report. Vulnerabilities can include blind spots, gaps, and weaknesses in a network that put an organization at risk of a cyberattack. The report found that the number of vulnerability attacks increased 180% in the last year. 

Cybersecurity Awareness Month in October provides an ideal opportunity to remind organizations to practice cybersecurity awareness to safeguard against vulnerability attacks and all other breaches. Though there’s no surefire way to keep bad actors at bay, four basic practices — using strong passwords or a password manager, turning on multifactor authentication (MFA), recognizing and reporting phishing, and updating software — can substantially reduce your cyber risk.

Use strong passwords or a password manager

Using strong passwords is a simple way to protect your online accounts and apps. Pondurance recommends clients use passwords that are a minimum of 16 characters including uppercase, lowercase, numbers, and symbols. Also, clients should use a different password for every account. 

Of course, remembering all those passwords is practically impossible, and that’s where the use of a password manager is a smart idea. A password manager is a program that generates strong random passwords, stores them, and can even autofill your passwords, so you don’t have to remember your passwords or write them down. Just be sure to use a strong master password that you can easily memorize to secure the password manager account.

Turn on MFA

The implementation of MFA can make it more difficult for a bad actor to access an account, as MFA requires two or more authentication factors, such as a password, PIN, verification code, fingerprint, or voice recognition, to verify a user’s identity at login. That extra layer of protection can mean the difference between a bad actor exploiting a network and the continuation of business as usual. 

Organizations should have MFA properly implemented on each and every device; otherwise, they can be vulnerable to exploitation. As an example, the Pondurance digital forensics and incident response team has cited that a whopping 82% of virtual private network (VPN) for ransomware attacks occur when an organization has not implemented MFA on the VPN.

In addition, cyber insurance providers are increasingly requiring organizations to have MFA to qualify for cyber insurance and, more importantly, requiring that it is implemented on all devices. Answering questions on MFA implementation is now part of the application process.

“Early on, insurance providers would ask, ‘Do you have multifactor authentication?’” said Doug Howard, CEO at Pondurance. “Companies would answer ‘yes,’ but come to find out, the companies had it but never implemented it or implemented it only on VPN and no other system. Now, the questions on the insurance applications are getting deeper. Providers want to know that you’re using MFA in a way that will actually protect your company against bad actors.”

Recognize and report phishing 

In a phishing attack, a user receives an email or text from someone claiming to be a trusted source and is deceived into providing credentials or sensitive personal information, such as passwords or credit card numbers. The FBI receives more complaints about phishing/spoofing than any other type of attack. In fact, the total number of phishing complaints (298,878) is more than five times greater than any other reported attack, according to the FBI Internet Crime Report 2023.

The Pondurance security operations center (SOC) team agrees that phishing ranks as the top method of credential compromise. The team reports that phishing emails with a financial lure, particularly for tax rebates and refunds, are common schemes during tax season. Also, malware delivery via phishing emails is an increasing threat, occurring through links in the body of emails and attachments that lead to malicious websites. 

The use of artificial intelligence services, such as ChatGPT, is making phishing emails harder to detect due to more convincing language and correct grammar. To reduce the risk of an attack, the SOC team suggests setting inbox rules to detect any unauthorized activity and offering user awareness training to employees. User awareness training helps employees recognize phishing emails and learn how to report any suspected activity.

Update software

Updates, or patches, plug the holes in software and operating systems that make them vulnerable to bad actors. Updating can fix bugs, improve performance, protect against malware, add features, and more — and it’s of utmost importance to patch promptly. 

To help clients stay current on updates, Pondurance conducts a monthly SOC webinar to discuss notable vulnerabilities and the threat landscape. Each month, the Pondurance team reviews high-risk vulnerabilities, recent cybersecurity trends, and upticks in activity over the past month. The team explains how disclosed vulnerabilities occurred, recommends various updates and patches, and suggests ways clients can protect themselves against these new threats and possible future threats.

Conclusion

Every organization should practice cybersecurity awareness to safeguard against cyberattacks and breaches. Using strong passwords or a password manager, turning on MFA, recognizing and reporting phishing, and updating software are great first steps to substantially reduce your cyber risk during Cybersecurity Awareness Month and throughout the year. 

Find out how your organization can practice cybersecurity awareness, day in and day out, using Pondurance’s risk-based approach. Learn more.