With more than 3.5 billion internet users worldwide, cybersecurity is a hot topic. And implementing ethics and best practices in cybersecurity is more important than ever.
The sheer volume of accounts available for hacking is jaw-dropping:
Each one of these provides cybercriminals with an opportunity to attack and exploit personal accounts as well as the accounts of organizations.
Before we reveal the 8 cybersecurity practices you simply cannot ignore it helps to understand why cybercrime is on the increase, and how easy it is to put your personal information right into the hands of a cybercriminals.
Or, click here to scroll straight to the 8 best practices!
Based on the number of cyber breach reports in 2016 we know it was a busy time for cybercriminals. Public reports described more than 500 data breaches and more than 2 billion records stolen and exposed. In 2016 The Identity Theft Resource Center recorded 980 breaches in the categories of banking and financial, business, educational, government and military, and healthcare. And we all know what happened over at Yahoo!
As a digital social society, we are sharing more information in more different cyber venues than ever before. Every day billions of us power up our devices and connect to the internet to access online services so we can get the latest news, shop for the best deals, chat and connect with friends, stream music and videos, get health advice, look for jobs, share our thoughts and access our financial information.
As more people and businesses use online services, more entities become available for cybercriminals to target. So we are increasingly more exposed to social engineering and targeted spear-phishing attacks, and vulnerable to financial fraud and identity theft.
When an identity is stolen it provides the attacker with the ease of bypassing traditional security perimeters undetected. And if the stolen identity has access to privileged accounts, the attacker can easily carry out malicious attacks on the victim, or even the organization where the person works.
If you use the internet in either a personal or business capacity it is essential that you understand exactly how you might be targeted, and what you can do to reduce the risk. Armed with this knowledge you can make it more challenging for attackers to steal your personal information, your identity, or your money.
Behind most breaches you’ll find one or more of three major factors:
When using services like social media you are sharing more and more of your personally identifiable information (PII). This is your physical and digital identity with information like full name, home address, telephone numbers, IP address, biometric details, location details, date of birth, birthplace, and even family members’ information.
As you provide more information about yourself online, the higher the likelihood that a cybercriminal will encounter that useful info and use it to make you the next victim of cybercrime. Cybercriminals spend up to 90% of their time performing reconnaissance of their target before acting. This means they typically have a complete blueprint of their target by the time they’re ready to attack. They gather as much personal information as possible by using a variety of online resources, like social media, or Google ‘dorking’—a technique that can take down entire companies—as well as other search engine resources.
Any time you go online follow the National Cyber Security Alliance’s (NCSA) advice:
Stop. Think. Connect.
And to help you with the ‘Think’ part, here’s our checklist of cybersecurity best practices to think about:
How do you rate compared to this checklist?
Whether you are about to create a new social media account or you already have one, only enter the basic information required to get the account activated and never provide excessive information that could put you at risk. Many social media services will tempt you to enter information like date of birth, home address, location details, and mobile numbers to make it easier for other people to find you. But this dramatically increases your cybersecurity risk as cybercriminals find ways to locate this information. If you’ve already added this information set it to hidden; or better still, remove it from your profile.
Many social networks are open by default, privacy is basic or turned off, and security is optional. Review the privacy and security options available to you and enable them. Don’t be afraid to make your account less visible. If multi-factor authentication is available—use it! Use an Authenticator application like Google, Microsoft, Symantec, or Authy to SMS. Enable alerts and notifications on your accounts so you are quickly advised of any suspicious activity. Get notified when anyone attempts to tag you.
When choosing a password make it long, strong, and unique to that account. (Generate a strong password here..) Then change it at least once per year. The average age of a social media password today is years, and social media platforms don’t do a great job of reminding you how old your password is, pointing out how weak it is, or telling you when it’s a good time to change it. It’s entirely up to you to protect your account—so do it wisely. If you have many accounts and passwords, use an enterprise password and privileged account vault to make it easier to manage and secure them. Never use the same password multiple times.
Where possible, log into original accounts using the unique login you created for that account rather than using social logins. Sure, it’s quick and convenient to ‘login using Facebook’, but when Facebook gets hacked it means that the cybercriminal could cascade to all of your accounts using that social login.
Create multiple accounts to de-risk your information. Set up multiple email accounts with different purposes: use one email address for low-risk communication; one for subscribing to online newsletters, airport Wi-Fi, and other services that require an email address; one for shopping online, and another for resetting passwords (which has higher security settings). This lowers the chance that your information will be compromised, and limits the risks associated with having all your eggs in one basket.
a. It’s best not to use a public Wi-Fi network without a VPN. Rather use your cell network when security is important (3G/4G/LTE).
b. When using public Wi-Fi ask the vendor for the correct name of the Wi-Fi Access point and confirm that it has security. It is common for cybercriminals to publish their own Wi-Fi SID with similar names.
c. Disable Auto-Connect Wi-Fi or enable Ask to Join Networks. Cybercriminals use Wi-Fi access points with common names like ‘Airport’ or ‘Café’ so your device will auto-connect without your knowledge. Never opt to remember the Wi-Fi network on public access points.
d. Use the latest web browsers as they have improved security for fake websites. This prevents someone from hosting their own ‘Facebook’ website, for example, waiting for you to enter your credentials.
e. Do not click on suspicious links like videos, even via social chat.
f. Beware of advertisements. They could direct you to compromised websites.
g. Use a least privilege user or standard user while browsing as this will significantly reduce the possibility of malicious malware being installed.
h. Always assume someone is monitoring your data over public Wi-Fi.
i. Do not access your sensitive data like financial information over public Wi-Fi.
j. Do not change your passwords, and be wary of entering any personal credentials while using public Wi-Fi.
k. If you have a mobile device with a personal hotspot function, choose this over public Wi-Fi where possible—but still be cautious.
If you’re a frequent user of any social media platform be aware of the risks of liking posts, following pages, or allowing different applications to access your profile. You’re accumulating a trail of activity that is time-consuming, or even impossible to reverse.
When you grant access to a social media app you must practice good cyber hygiene—remove the app’s access when it’s no longer required. Apps may share your information (and sometimes that of your friends) and unless you revoke access the app will continue to have access to your profile data and more. On occasion, go into your account and review which apps have your approved access and revoke access if you no longer need the app.
We are a society of clickers; we like to click on hyperlinks. But be cautious of any message you receive that contains a hyperlink, even if it looks like a legitimate message from a friend or a trusted organization.
Stop and ask yourself if the message was expected. Do you know the person who sent it, and is it really from them? Or could they have been hacked? Could it be a phishing email—a message that looks exactly like the one you might receive from a familiar organization but is really a set-up to get your information.
If you’re unsure of the authenticity of the message, contact the sender by phone or via a new message and ask if they sent you the link. It could be malware, ransomware, a remote access tool, or something that could steal or access your data. Nearly 30% of people will click on malicious links. We all need to be more aware and cautious. Before clicking, stop and think.
Stay safe online with these cybersecurity best practices and avoid becoming the next victim of cybercrime.