It’s time to take cyberthreats personally

The digital age has brought with it a whole host of new challenges, especially the unwelcome and relentless assault from ransomware and other threats. This has been compounded by pandemic and the hybrid workplace, which has broadened the attack surface for phishing and other social engineering attacks that target employees’ home offices and data.

It’s not just business, it’s personal.

As Security and IT professionals, we’ve done what we can to harden our environment accordingly. We’ve strengthened our perimeter, stayed on top of our endpoint controls, security patching, embraced zero-trust guiding principles, and introduced more proactive and rigorous data protection strategies. It’s a constant evolving battlefield with complexities and challenges. We do this at the speed of business while being mindful of our spend to manage risk and deliver great service to our customers.

But let’s face it. Today, in most cases, you are your family’s Security or IT practitioner. And data (and the subsequent threats) goes wherever our employees go, which is all the more reason to extend cybersecurity awareness education and training programs outside the office to ensure our people are ready to be our first line of defense.

As a CISO, here are my recommendations for doing this:

First, if it isn’t already, investing in ongoing awareness programs needs to be one of your priorities in 2023. Protection is not limited to one person or one team. A CISO and its team of security practitioners are core to a Security program, however the true strength is in numbers. In other words, by educating and engaging the entire organization on online safety protocols, businesses can be better equipped for cyberthreats. This starts with teaching them how to recognize phishing emails or malicious links containing malware; identity theft prevention techniques; and use encryption and password best practices.

Next, you need to encourage them to take proactive steps to protect their home and office networks, which includes physical security vigilance by protecting their devices and being vigilant of their surroundings. Maintaining regular software updates and security patches; securing their home wireless networks; encrypting sensitive data and files to ensure authorized access; setting strong and unique passwords; and using multi-factor authentication as an extra layer of protection. Frankly, it’s good hygiene for work and for home.

Last, but certainly not least, as a CISO or IT professional, you too need to get personal by creating an atmosphere where employees feel comfortable asking questions about data protection. This comfort, trust, and open line of communication is critical to engage with your workplace and for employees to own their safety measures.

It’s not enough to hope that you aren’t impacted by an incident or breach. It’s improbable. After all, it’s just a matter of time until you are attacked. And cyberattacks have become increasingly sophisticated, with malicious actors using a range of tactics to gain access to your assets and sensitive information to disrupt your business or personal life. Phishing emails, ransomware campaigns, and malware downloads are just the start, so make sure your employees are educated, engaged, and ready for whatever little devil arrives at home, in the office, or on the road.