Are You Cyber Smart? Five Tips to Boost Your Cybersecurity Awareness

Every October, for the past 18 years, the cybersecurity industry recognizes “Cybersecurity Awareness Month.” This is an excellent opportunity for experts and organizations to share their insights and best practices to help educate others in staying cyber smart. CISA and the National Cyber Security Alliance (NCSA) continue to support this overarching theme and raise awareness about the importance of cybersecurity and ensure resources are readily available to enable others to stay safe and secure in today’s digital world. ZeroFox is happy to support this initiative in multiple ways, be sure to stay tuned! To kick off the month, we will review five tips to boost your cybersecurity awareness and resources to help along the way.

Cyber Smart Tip #1: Know What a Cybersecurity Attack Is

A recent Bloomberg article notes, “increasingly tech-savvy criminals are turning to fake websites, online dating profiles and even impersonating your boss to trick [consumers] into authorizing fraudulent payments. Losses related to such tactics -- known as authorized push payment scams -- rose 71% in the first half of the year to 355 million pounds ($485 million). Cases rose 60% to 106,164.” However, these numbers focus on this specific set of tactics alone. Numbers related to ransomware attacks and more are also spiking at an exponential rate.

Provided the breadth and depth of the range of cybersecurity attacks are quite extensive, it’s essential to know just what constitutes an attack and what you should know. A cybersecurity attack is an effort by a malicious threat actor to gain unauthorized access to a computer information system, network, database or personal computing device. Cybersecurity attacks may be perpetrated by individual attackers, organized groups of cybercriminals or by state-sponsored threat actors.

The goals of a cybersecurity attack typically include one or more of the following:

• Stealing or destroying sensitive data or information,
• Stealing financial resources,
• Exposing confidential information,
• Altering information in secure databases,
• Disrupting the integrity or authenticity of data,
• Disabling IT infrastructure and
• Damaging the target’s reputation.

Cyber Smart Tip #2: Know How Attacks Work

Cybersecurity attacks are as versatile as the applications, networks and endpoints that organizations depend on daily to do business. However, there is a general pattern when threat actors execute these attacks:

To effectively defend against cybersecurity attacks, anyone that is digitally connected should be fully aware of the various modalities and techniques used by threat actors to gain unauthorized access to target systems. 

Cyber Smart Tip #3: Know Attack Techniques

Simply put, modalities are just ways of doing something or carrying out a task. Most threat actors utilize either social engineering or bug exploits (or both) as they attempt to gain unauthorized access to computer systems. Social engineering takes advantage of human nature by tricking or manipulating the target into sharing sensitive information, sending fraudulent payments or compromising access credentials for a secure system. Bug exploits are pieces of software or malicious code that exploit known bugs or vulnerabilities in target applications, networks and systems. When attempting to attack large, complex or well-protected organizations, threat actors pivot to use supply chain attacks as an alternative. A supply chain attack takes place when threat actors attempt to harm an organization by targeting other companies in their supply chain with cyberattack methods.

Threat actors have developed many different cybersecurity attack techniques in their attempts to bypass threat detection systems and steal data from their targets. The most common techniques include:

• Malware attacks attempt to infect the target network or device with a malicious software program. Malware attacks may steal data, damage systems or grant the threat actor direct access to the network. Ransomware attacks fall under this category and are a popular reference among news outlets. These attacks use malware to gain control of a device, network or database. Next, the attackers demand a ransom from the target in exchange for restoring the network. Ransomware attacks fall under this category and are a popular reference among news outlets.
• Phishing attacks are social engineering attacks that contact a target (using email, telephone, text, social media profiles and more) as a fraudulent entity posing as a familiar and trusted one. This trust is then used to manipulate the target into acting, which typically entails sharing sensitive data or credentials. There are various forms of phishing as well. For example, spear-phishing is a highly targeted phishing attack aimed at a specific, well-researched victim. 
• Malicious apps are coded by threat actors to capture sensitive data from users and distribute them through third-party app stores. Malicious apps may be designed to impersonate trusted brands and steal their customers’ personal information or financial data.
• Domain spoofing involves building a fake website and impersonating a trusted brand to steal data from its customers. Alternatively, but closely tied, attackers leverage email spoofing to manipulate an email to appear as if it came from a trusted source. Phishing emails often deploy email spoofing techniques to fool victims and gain their trust. 

Download our white paper on A Taxonomy of Digital Threats for a deeper analysis of the digital threat landscape and how ZeroFox can help secure your assets and data against cybersecurity attacks.

Cyber Smart Tip #4: Know How to Protect Against Attacks

Fortunately, methods to protect against cybersecurity attacks continue to evolve and roll out almost as rapidly as threat actors invent new methods and techniques. One of the leading efforts often includes robust cybersecurity awareness training programs. Organizations can protect against cybersecurity attacks by initiating a cybersecurity awareness training program for their digital workforce. The training may be delivered by an enterprise SecOps team or by external vendors or consultants. Awareness training aims to educate the workforce about common cybersecurity attack techniques and the related risks and avoid becoming a victim.

Additionally, a multitude of cybersecurity software solutions is available. Enterprise SecOps teams can deploy a variety of software solutions to help protect against cybersecurity attacks. These include, but are not limited to, solutions for threat monitoring, security intelligence, brand protection and security event management. ZeroFox provides enterprises with protection, intelligence and disruption to dismantle external threats to brands, people, assets and data across the public attack surface. The ZeroFox Platform identifies and remediates targeted phishing and spear-phishing attacks, credential compromise, brand hijacking, domain and email spoofing attacks, and more.

Cyber Smart Tip #5: Know the Resources Available to You

In today's digital age, the risks facing your organization are constantly evolving but so are the litany of resources to help you navigate them. However, it can be challenging to know where to start with the amount of information available. Here are three categories we suggest as your first steps:

• National Resources: For this year’s cybersecurity awareness month, CISA offers a suite of vetted tip sheets ranging from instilling cybersecurity at work, employing Multi-Factor Authentication (MFA), knowing your online privacy, creating strong passwords, using social media and more. The National Cybersecurity Alliance has a cybersecurity basics tip sheet that highlights key pointers too.
• Test Yourself: Phishing is also a great place to prioritize leveling up your cybersecurity knowledge as this is a primary attack method targeting a wide range of unknowing victims. The ZeroFox team created a quiz using genuine fake profiles found across social networks to test your knowledge. Take “Find the Fake” and see if you can distinguish a phony celebrity profile from a real account. Google also has a phishing quiz worth checking out. Aside from phishing assessments, you can also take our Digital Risk Assessment to uncover your digital exposure, identify risks and walk away with a plan to protect your organization better.

• Browse Our Catalog: ZeroFox offers an entire catalog of free resources ranging from research reports, whitepapers, webinars and more. Browse this central repository to choose which resources suit your needs in leveling up your cybersecurity awareness. 

• Attend Webinars and Educational Events: Keep an eye on our webinars and other events as they often showcase leading experts and panel discussions on current challenges and risks. Two excellent opportunities, in particular, are just days away. 
• Join our partner, GuidePoint Security, for their 3rd annual GPSec Cybersecurity Forum on November 4th. This educational cybersecurity forum offers over 15 seminars on industry topics and the opportunity to interact with cybersecurity influencers. 
• In recognition of the cybersecurity awareness theme next week, ZeroFox is offering a webinar on phishing kits, where our experts will review a year’s worth of phishing kit research, outline organized crime groups behind these kits and more. This is a free webinar you don’t want to miss, but we typically offer our webinars on-demand as well for those busier schedules.

Stay tuned for more resources on the way to finish out cybersecurity awareness month and stay cyber smart!