IEEE Computer Society’s Top Tips for Cybersecurity Awareness Month 2019
31. Protect your customers’ financial data.
- Encrypt transmission of credit card data across both open and public networks.
- Restrict all access to cardholder data to only key roles within your business.
- Restrict all physical access to cardholder data.
30. Protect your customers’ personal data.
- Create and maintain a firewall configuration for the purpose of protecting customers’ data. Take steps to protect all stored customers’ data.
- Avoid using vendor-supplied defaults for passwords and security parameters throughout your system.
29. Train your employees to recognize phishing attempts.
Cyber attackers use phishing techniques such as spam emails and phone calls to find out information about employees, obtain their credentials, or infect systems with malware.
Your basic defense involves getting a properly configured spam filter and ensuring that the most obvious spam is blocked. Educate your employees about handling popular phishing techniques.
28. Be aware of phishing scams
- Clicking a malicious link, or opening an attachment can infect your system with malware, a trojan, or zero-day vulnerability exploit. This often leads to a ransomware attack. In fact, 90% of ransomware attacks originate from phishing attempts.
- Don’t open email from people you don’t know.
- Know which links are safe and which are not. Hover over a link to discover where it directs to.
- Be suspicious of the emails sent to you in general. Look to see where it came from and if there are grammatical errors.
- Malicious links can come from friends who have been infected too. So, be extra careful.
27. Bonus tip: Our popular SE Radio podcast also offers free episodes this month about security:
Zero-Trust Networks: Evan Gilman and Doug Barth, authors of “Zero Trust Networks: Building Secure Systems in Untrusted Networks” discuss zero-trust networks. The discussion covers the perimeter network architecture; the threat model in modern networks; the meaning of “trust in the network”; why we should not trust our networks (it’s probably already owned); the concept of zero trust in the network; design of the zero-truest network; the control plane and the data plane; trust scoring – behavioral, policy-driven, and uses of ML/AI. encryption; running your own internal CA; trusting apps; the secure build pipeline; DevOps and the zero-trust model; tools and frameworks; and where are we in the adoption curve?
26. Learn how the IEEE Security & Privacy magazine contributes to cybersecurity and security advancements.
People are the weakest link in cyber systems. The first line of defense against cyber malfeasance is human awareness of what is happening, what can happen, how it happens, how it can be kept from happening. IEEE Security and Privacy is a magazine devoted to increasing the awareness of its readership to issues like these.
25. Know who your friends are.
Be careful accepting friend requests from people you don’t know. People can create fake accounts or impersonate someone you know in order to friend you and gain access to the private social media information you share only with friends. Don’t accept requests from strangers, and don’t automatically accept a request from someone on your friend list. If it’s a fake account, report the account and block the user.
24. Protect your sensitive information.
Watch what you’re sharing on social networks. Criminals can befriend you and easily gain access to a shocking amount of information—where you go to school, where you work, when you’re on vacation—that could help them gain access to more valuable data.
23. Practice physical cyber safety.
Be conscientious of what you plug in to your computer. Malware can be spread through infected flash drives, external hard drives, and even smartphones.
22. Practice safe clicking.
Always be careful when clicking on attachments or links in email. If it’s unexpected or suspicious for any reason, don’t click on it. Double check the URL of the website the link takes you to: bad actors will often take advantage of spelling mistakes to direct you to a harmful domain.
21. Protect your personal information.
Limit availability of personal information. Limiting the number of people who have access to contact information or details about interests, habits, or employment reduces exposure to bullies that you or your child do not know. This may limit the risk of becoming a victim and may make it easier to identify the bully if you or your child are victimized.
20. What really is cybersecurity? It’s time for a new term.
The bottom line here is that “umbrella” terms like “cybersecurity” do not lead researchers, practitioners, and the general public into any real understanding of the fundamental issues related to malicious behavior and malicious intent. Refreshing terms from time to time is usually futile and frustrating, but I think for this one it might be timely and beneficial.
19. Bonus Tip: Cyberphysical Systems and Security: Testing Must Reflect the Real World
Today, cyberphysical systems interact with the real world, with vastly more variables, most of which the system has no control over. Such systems may be networked into “internet of things” configurations, with an enormous number of possible interactions with potentially less control over what is coming into the system; possibly unknown sources, or unpredictable numbers of connections.
Can we ever get a handle on assurance for today’s autonomous systems with vast interconnections and non-determinism? Yes, one way forward is to provide measures for the degree to which the environments in which these systems are tested reflect the range of conditions that will be encountered in the real world.
18. Use multi-factor authentication.
MFA helps you protect sensitive data by adding an extra layer of security, leaving malicious actors with almost no chance to log in as if they were you. Even if a malicious actor had your password, they would still need your second and maybe third “factor” of authentication, such as a security token, your mobile phone, your fingerprint, or your voice.
17. Update your software regularly.
This is especially important with your operating systems and internet security software. Cybercriminals frequently use known exploits, or flaws, in your software to gain access to your system. Patching those exploits and flaws can make it less likely that you’ll become a cybercrime target.
