{"id":55475,"date":"2022-08-13T09:22:29","date_gmt":"2022-08-13T01:22:29","guid":{"rendered":"https:\/\/version-2.com\/?p=55475"},"modified":"2022-12-02T18:13:46","modified_gmt":"2022-12-02T10:13:46","slug":"cybersecurity-awareness","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/08\/cybersecurity-awareness\/","title":{"rendered":"Cybersecurity Awareness"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n\n

Ideally, we should all know this stuff by heart, but as you know that\u2019s just not the case. It\u2019s far from it. Cybersecurity awareness is an expression that probably bores people to death when they hear it \u2013 and rightly so! We are the ones that gave it a bad name, by doing weird and unnatural tests on our users, usually to please auditors\/upper management\/c level.<\/p>

This notorious term usually means your organization has provided you with a bunch of videos to look at, that you, as a let\u2019s say someone from sales or accounting, won\u2019t care much about nor will understand fully.<\/p>

Same goes for the phishing campaigns that are internal for the companies. They can actually work against you, as users can adopt the attitude of everything\u2019s suspicious, I am not going to click or reply to any emails before forwarding them to the Cybersecurity team <\/em>which is better than clicking on stuff blindly, but can easily saturate your team\u2019s capabilities to investigate, leading to much slower resolutions and other issues. This is one of the more benign examples, but its still quite real. And if your SOC team is checking every <\/em>email, they might miss some much more important event.<\/p>

Obviously, social engineering is extremely tough thing to crack and control, especially since emails are also hard to defend from appropriately (not to mention that there\u2019s almost no real solution for detecting a fraudulent email that\u2019s coming from an internal compromised mailbox) and its what\u2019s the crux of the whole issue. As with all things, you need to strike some balance here.<\/p>

Educate your users of course \u2013 I still feel this is one of the (if not the<\/em>) most important thing, but also set aside some time to understand their context, thus their \u2018answers\u2019 if you\u2019ve just did a phishing campaign. There\u2019s usually a reason behind every one of those user-based actions, and ideally you are going to understand your users and why they do such thing.<\/p>

To conclude, I still feel that education on Cyber awareness is paramount, but if you\u2019re going to do it blindly with out of context surveys, random videos, and phishing campaigns (that you grade on how they passed just to impress upper management) \u2013 I dare say better not to do it at all!<\/p>

With that out of the way, let me try and connect some dots, and talk about the most common things an organization might experience, regardless of its size or maturity.<\/p>

Common Attacks<\/h3>

For this article, I opted to talk about social engineering (phishing), malware and ransomware, as well as passwords and authentication. In the second, upcoming, part of this article I will talk more about MFA, backups, patches, and other things you can do to stay safer and endorse a better cyber hygiene.<\/p>

Social Engineering<\/h4>

Social Engineering, sometimes known as People hacking is a term that is used to describe a cyber attack that targets a human, rather than a computer\/electronic device.<\/p>

No need to brute force and waste your CPU\/GPU, when you can ask nicely, right?<\/p>

All jokes aside, these social engineering attack can be extremely complex, and quite devastating to the victim as well. These attacks are usually layered and can escalate quite a bit. Imagine an attacker taking some of your publicly available information to use and obtain more information on your phone, email, ISP.<\/p>

With these steps, they can eventually escalate to something like your bank account! Check this video<\/a> out, as it is a prime example of how attackers can obtain your information.<\/p>

Social engineering is a huge <\/em>topic! And I mean huge<\/strong>. It also doesn\u2019t necessarily entail a human interaction. Most notorious examples of this are the parking lot \u2018lost\u2019 USB an attacker would drop in hopes of an employee plugging it into a computer that belongs to the company. Another one is leaving the charging cable plugged in, in a very public place. Similarly to the lost USB, the cable most likely has some keylogging software or another tool to help the attacker gain control of your device.<\/p>

Social Engineering: Phishing<\/h4>

Phishing is as we all know one of the most common attacks out there, used by many different types of threat actors, from scammers to more advanced threat actors. This is the stage zero for an attack, usually. This attack vector is used to gain access to your org\u2019s infrastructure, before trying to move laterally, escalate privileges, drop payloads, or anything else.<\/p>

This is an attack that\u2019s a \u2018subgroup\u2019 of the social engineering class of attacks, and as the name implies, is directed against humans instead of computers.<\/p>

When we say phishing, we usually mean emails, but phishing can be done through voice\/calls \u2013 aka Vishing <\/em>or through SMS \u2013 aka Smishing<\/em>.<\/p>

These are particularly dangerous since threat actors will use these tactics on an enormous scale, usually leveraging leaked\/stolen phone numbers and\/or emails.<\/p>

I\u2019ve already talked about most common ways phishing tries to get us to act \u2013 e.g., urgency, calling you to action, basically anything to make you act quickly without much contemplation.<\/p>

There are also three main forms in which we can see phishing:<\/p>