Most prominent attack vectors used locally – data provided by the TT-CSIRT of the Ministry of National Security Trinidad and Tobago
- Phishing emails
- Unpatched vulnerability
- Compromised user credentials
- System misconfiguration
Hackers have been known to use what is called Social Engineering to gain access to corporate systems. Phishing or baiting is the main route that is taken where hackers would usually offer something, such as a fake login page, in return for login credentials or other types of information. These attacks are usually deployed at times of day when persons are tired and may not be making the best decisions.
Education is one of the best ways to combat one of the most exploited vulnerabilities in your organisation, which are the people. The reason why people fall victim to attacks is simply because phishing attacks are created by imitating genuine information and some users may not be aware of how to differentiate the genuine from the imitation.
- Ensure your employees understand the significance of data privacy and protection. Ensure they are aware of the impact, as well as ways to prevent data breaches.
- Inform your employees that human error is the leading cause of data breaches. Let them know that they play a huge role in keeping the company’s data safe.
- Ensure that cybersecurity policies are always accessible to employees and vendors
- Ensure that cybersecurity training happens at least twice per year
- Re-evaluate your training program every 90 days
- Ensure that cybersecurity training is mandatory
- Create a culture of cybersecurity awareness across the organisation so that employees can protect their personal data as well
Five areas that you can focus on to quickly improve cybersecurity awareness in your employees:
- Never share passwords
- Understand what a phishing email looks like
- Ensure you are sending emails to the correct recipients
- Never connect USB drives or click on links unless they are from a trusted source
- Train users on what a breached system looks like and to immediately take action