Sure, we address the fact that cybersecurity concerns are a real and potential threat. And we have discussed the consequences of large-scale cyberattacks. However, some questions remain. Is the wider public thoroughly aware of the cybersecurity risks that exist, and if they are, are the next steps for addressing them really understood?
As cybersecurity hygiene worries rise with the return to in-person work, there may be an even broader issue to tackle. Among the 2,000 end users surveyed by Armis in the United States, 71% planned to bring their personal or work from home devices back to the office. Only 54% reported associating any sort of risk with doing so though. According to the survey, as reported by ThreatPost, the lack of awareness extends beyond personal devices. Over 20% of the survey participants revealed that they had not heard of the Colonial Pipeline attack, and 45% were unaware of the attempted attack on Florida’s water supply.
Aside from a general understanding of the current affairs and concerns defining the cybersecurity landscape, it can be argued that there is a sort of confusion over where to even begin when looking to build solutions. In one effort to address this, the Cybersecurity and Infrastructure Security Agency put out two bad practices to absolutely avoid. As Nexgov explains, those practices consist of using unsupported or “end-of-life” software, and using known, fixed or default passwords and credentials. “Addressing bad practices is not a substitute for implementing best practices, but it provides a rubric for prioritization and a helpful answer to the question of ‘what to do first,” stated CISA Executive Assistant Director Eric Goldstein. The CISA created a web page for cataloging such bad practices and plans to carry out regular updates on it.
Although reactions the CISA guide were a bit mixed, there are other suggestions being made available for organizations figuring out the best way to go about enhancing their cybersecurity approaches. An article for FedTech Magazine recommends starting with a cybersecurity audit. As SecurityScorecard describes, a cybersecurity audit differs from a risk assessment because it “act[s] as a checklist that organizations can use to validate their security policies and procedures.” This allows organizations to analyze whether they have the proper mechanisms in place, ensure that they are following regulations and guidelines and proactively design policies. While SecurityScorecard emphasizes conducing such an audit with the help of a third party, it can be done in-house. Steps within the audit include but are not limited to reviewing cybersecurity policies, outline such policies into a single list for departments to reference and gathering the details of network structure. Such audits should be conducted at least once a year, but more frequently if budget allows according to the article.
Key Takeaways:
“Users Clueless About Cybersecurity Risks: Study” – Becky Bracken, ThreatPost
https://threatpost.com/users-clueless-cybersecurity-risks-study/167404/
- Among the 2,000 end users surveyed by Armis in the United States, 71% planned to bring their personal or work from home devices back to the office.
- Only 54% reported associating any sort of risk with doing so though.
- A portion of the respondents were also unaware of recent large-scale cyberattacks. Over 20% of those surveyed revealed that they had not heard of the Colonial Pipeline attack.
“The agency plans to keep updating the narrow list based on feedback from cybersecurity professionals.” – Mariam Baksh, Nexgov
- The Cybersecurity and Infrastructure Security Agency released two bad cybersecurity practices for organizations to avoid.
- The practices consist of using unsupported or “end-of-life” software, and using known, fixed or default passwords and credentials.
- “Addressing bad practices is not a substitute for implementing best practices, but it provides a rubric for prioritization and a helpful answer to the question of ‘what to do first’,” stated CISA Executive Assistant Director Eric Goldstein.
“What Is a Cybersecurity Audit and Why Is It Important?” – Phil Goldstein, FedTech Magazine
https://fedtechmagazine.com/article/2021/06/what-cybersecurity-audit-and-why-it-important-perfcon
- As SecurityScorecard describes, a cybersecurity audit differs from a risk assessment because it “act[s] as a checklist that organizations can use to validate their security policies and procedures.”
- This allows organizations to analyze whether they have the proper mechanisms in place, ensure that they are following regulations and guidelines and proactively design policies.
- It is recommended that such audits be conducted at least once a year, but more frequently if budget allows.