Every year, individuals, businesses, and organizations recognize the importance of digital security and take stock of their efforts. October’s Cybersecurity Awareness Month aims to help companies and individuals safeguard their data from cybercrime. The National Cybersecurity Alliance and the U.S. Department of Homeland Security launched Cybersecurity Awareness Month in October 2004, and 2023 marks its 20th anniversary.

While it’s a noble effort, to be sure, focusing on cybersecurity is a 24/7/365 effort — or at least it needs to be. But too many companies take cybersecurity for granted; in doing so, they make themselves more vulnerable, effectively tempting bad actors to take advantage.

An Evolving Threat.

Initially, the month focused on providing guidance such as keeping antivirus software up to date, similar to the emphasis on changing the batteries in smoke alarms during daylight saving time. However, as the cyber threats have evolved, so too have the efforts needed to thwart those who want to cause harm. According to the Cybersecurity and Infrastructure Security Agency (CISA), an overwhelming majority (more than 90%) of cyberattacks start with a phishing attack.

For better or worse, much of the media coverage of cybersecurity focuses on large-scale data breaches and cyberattacks. Companies of all sizes should remember that even small actions can protect their data. No one is immune to the actions of those who want to cause harm. Whether it’s a mom-and-pop operation, a multinational corporation or the government, bad actors have every organization in sight.

The federal government, excluding the U.S. Department of Defense, has budgeted $10.89 billion for cybersecurity spending in 2023. The Department of Homeland Security will receive roughly $2.6 billion in 2023. Interestingly, many companies aren’t taking the threat seriously. While the number of attacks is rising, data from CNBC and SurveyMonkey shows that most small business owners are unconcerned — just 4% of small business owners said cybersecurity was the biggest risk facing their business.

Nearly two-thirds of businesses (64%) believed they could quickly settle a cyberattack. But the best way to settle a cyberattack is to work to prevent it, and that starts with focusing on what’s most important.

Focus on the Fundamentals.

Cybersecurity Awareness Month emphasizes the significance of practicing basic cybersecurity measures. To help educate the world, the Cybersecurity and Infrastructure Agency partners with the National Cybersecurity Alliance to provide organizations with resources and communications. This year’s theme is “It’s easy to stay safe online.” There are some key behaviors businesses and employees alike can adopt to ensure safer online practices:

• Keep Software Updated – Software patches are designed to fix functionality issues and security vulnerabilities within software systems. By keeping patches updated regularly, businesses can ensure their software is functioning as it should be while minimizing security risks. But it’s important to have a patch management strategy to ensure known vulnerabilities are addressed in a timely manner.
• Use Strong Passwords and a Password Manager – One of the best ways to protect against unauthorized access is to enforce the use of strong passwords. Additionally, implementing a password manager can also make it easier and more secure for users to manage their passwords across software and systems.
• Enable Multi-factor Authentication – If a password and username become compromised, having multi-factor authentication turned on can help mitigate risk. Because multi-factor authentication is a combination of something you have, something you know, and something you are, it requires an additional layer of authentication, keeping systems more secure.
• Recognize and Report Phishing – Since phishing is one of the most prevalent attack vectors, ensuring employees know how to recognize it and report phishing is critical. Implementing security training can make a big impact and keep good cyber hygiene top of mind for employees.

The four behavior focus areas are interesting because they’re table stakes. Every company should be focused on this, but too often, they’re not, opening the door for bad actors to wreak havoc. To prepare for cyberattacks, companies must ensure their weakest link: their teams. Verizon’s “2022 Data Breach Investigations Report” revealed the human element was the root cause of an overwhelming majority (82%) of data breaches.

Know What Areas Need Attention.

Turning the tide on this trend requires preparing for the worst-case scenarios. While implementing protocols like multi-factor authentication will go a long way in maintaining organizational security, companies must first understand their shortcomings and blind spots.

A Cybersecurity Gap Assessment can help companies evaluate their security posture against industry standards and best practices. The assessment evaluates online security strategies and operational security, focusing on areas with the highest likelihood of incidents and breaches for organizations of all sizes. It leads to recommendations to help organizations lower their security risks while maximizing the impact of every-sized security budget. Regular Vulnerability and Penetration Scanning can also help businesses to understand where weaknesses are and how likely a hacker will be able to exploit them.

Evaluating existing cybersecurity practices and IT infrastructure is a good first step. It helps inform what changes need to be made to your cybersecurity strategy. While new policies or technology may be needed, you shouldn’t overlook the need to incorporate security training into your strategy. Security awareness training helps to prevent employees from falling prey to malicious social engineering and to avoid spreading harmful cyber threats in your network. The need for training is clear; however, it cannot be considered a mere formality. Training should be continuous and follow the National Institute of Standards and Technology guidelines to achieve the desired results.

As the world pauses to reflect on how far security education and awareness have come over the past two decades, we must consider what steps to take to achieve our goal of a secure, interconnected world. While it might seem like a burden to launch initiatives to educate team members, weigh the cost of that effort against the cost of a security incident — both monetary and reputationally.

Need help starting your journey towards better organizational security? Contact us to discuss next steps and what we can do to help improve your security posture.