Involving top management and boards in this communication is necessary and help show the importance an organisation gives to information security. Every collaborator should be part of the communication, no matter their role in the organisation.
3. Communicate how to report an incident
Once collaborators know what to do when facing a cyber threat or incident, they also need to know how they can report any undesirable event they might witness. Raising collaborators’ awareness on security should also include communications on the necessity to notify something unusual they find or see in the offices, on their workstations, on their mobile devices, or on the network. Collaborators need to know when, how, and to whom they can reach out to notify a potential incident.
Our incident management policy template can help organisations define an effective incident management process, including the reporting part.
Cybersecurity threats and advice to share with collaborator
1. Cyber threats
The threat landscape is constantly expanding. There are many common cybersecurity threats organisations are facing nowadays that collaborators need to be aware of and to know how they can react to them:
Phishing
Through the use of fake emails or phone calls, cybercriminals try to collect personal or professional information they can use to make profit. Stay vigilant to potential scam or malicious messages and report any suspected phishing attempt to suspect@safeonweb.be.
For more recommendations on phishing, visit our dedicated article.
Ransomware
By installing a malware on one or multiple organisation’s resources, cybercriminals block the access and information they are willing to give back in
exchange of a payment. Stay vigilant to potential malicious message and ensure thay your systems are updated, backed up and protected by an antivirus.
For more recommendations on ransomware, visit our dedicated article.
Website hacking
Cybercriminals gain unauthorised access to a website configuration and data and use it for malicious purposes (e.g., launch other attacks, access sensitive information, etc.) that will make them earn profit. Some steps you can take to prevent your website from getting hacked are to protect all the accesses to your content management system and to keep all your components updated.
For more recommendations on website hacking, visit our dedicated article.
Website defacement
Cybercriminals modify and/or replace the initial content displayed on a website to share a message or disrupt operations. Pay attention to any change made to your organisation’s website and report it as soon as possible.
For more recommendations on website defacement, visit our dedicated article.
DDoS attack
A Distributed Denial of Service attack aims at disrupting the usual operations of an organisation’s web host or server by overloading an internet server and launching an enormous amount of page requests. You can mitigate DDoS attacks by implementing, amongst others, a firewall and Multi-Factor Authentication for the access. Multi-Factor Authentication requires a user to provide at least two different methods (e.g., passwords and PIN code, PIN code and a code received via text) to verify their identity and grant them access to the resource they are trying to reach.
For more recommendations on DDoS, visit our dedicated article.
Computer virus
A virus represents malicious code that can harm a device and the data it contains either to steal data, encrypt it and request a payment or make the device unavailable. One of the main controls to protect against computer virus
is to have an antivirus solution installed on all devices and make sure to keep it up-to-date.
For more recommendations on virus, visit our dedicated article.
Account hacking
An authorised individual gets access to an account and all the information it contains to use them for malicious purposes, such as stealing data. To make sure an account doesn’t get hacked, set up strong passwords by combining upper and lower cases, symbols and numbers. In addition, Multi-Factor Authentication should be implemented wherever possible.
For more recommendations on account hacking, visit our dedicated article.
CEO Fraud
Through the impersonation of a CEO, cybercriminals reach out to collaborators and try to convince them to execute a payment or provide confidential information. Establish clear procedures on wire transfers and clear guidelines on information sharing to make sure collaborators don’t respond to cybercriminals’ requests when executing a CEO Fraud attack.
For more recommendations on CEO fraud, visit our dedicated article.
Fake wire transfer
Through persuasion, threat or any other form of putting pressure, cybercriminals try to convince collaborators that they either need to execute an unplanned and urgent transfer or give away confidential information and/or internal procedures about how to execute a payment. As for CEO fraud, establish clear procedures on wire transfers and clear guidelines on information sharing to make sure collaborators don’t respond to cybercriminals’ requests.
For more recommendations on fake wire transfer, visit our dedicated article on LINK.
Fake technical support
Through impersonation of technical support, cybercriminals try to convince collaborators that their device need technical assistance for which they should pay or provide confidential information. Make sure to inform collaborators about this type of scam and to share some tips and tricks to stay protected, e.g.,
watching where they surf, downloading updates from official websites and keeping all devices up-to-date.
For more recommendations on fake technical support, visit our dedicated article.
Spam
By sending unsolicited messages to a large number of collaborators, cybercriminals try to execute a phishing, spread malware or steal confidential information. Stay vigilant to potential scam and report all scams you receive to suspect@safeonweb.be.
For more recommendations on spam, visit our dedicated article.
2. Cybersecurity best practices and advice
In addition to educating collaborators on the threats they are facing, organisations can also give them best practices and advice to adopt to prevent them from falling for a cyber-attack:
Passwords
Strong passwords are built by combining upper and lower cases, numbers and symbols. They should be completed when possible with Multi Factor Authentication, which requires a user to provide at least two different methods (e.g., passwords and PIN code, PIN code and a code received via text) to verify their identity and grant them access to the resource they are trying to reach. Finally, Password Managers help manage several passwords by storing them safely.
For more recommendations on passwords, visit our dedicated article.
Social Media
Several cyber threats can be encountered on social media, such as phishing, account hacking or malware. Collaborators can protect their information by using Multi Factor Authentication and strong passwords.
For more recommendations on social media security, visit our dedicated article.
Professional and personal usage
It is important to separate professional and personal usage by differentiating chat services, passwords and backup services.
For more recommendations on differentiating professional and personal usage, visit our dedicated article.
Public Wi-Fi
Anyone can access a public Wi-Fi. Its use should be restricted to when it is necessary and the use of a Virtual Private Network, a solution that helps encrypt and hide internet traffic to whomever might be trying to “listen” to the data that is being transmitted, should be implemented.
Online websites
The legitimacy of a website can be determined by checking if the address is the real one, checking the reputation and assessing the payment method to see if it seems odd (e.g., through a parcel or transport organisation).
Homeworking
To ensure working from home is done in a safe way, the devices and data should be secured by restricting and protecting their access.
For more recommendations on securing homeworking, visit our dedicated article.
Mobile devices
Mobile devices also contain personal and/or professional information and should be secured accordingly by establishing a strong password or PIN code to access them, keeping them up-to-date and backing up all the important data.
For more recommendations on mobile device security, visit our dedicated article.
Backups
The most valuable information should be identified and backed up accordingly to ensure its availability in case of an incident.
For more recommendations on backups, visit our dedicated article.
Updates
Keeping all the resources updated ensure that they have all the security enhancements needed. Those updates should be downloaded only via official websites.
For more recommendations on updates, visit our dedicated article.
Antivirus
The right type of antivirus is picked based on what needs to be protected, the features it offers and how much expertise is needed to manage it. An antivirus needs to be updated whenever possible to ensure its efficiency.
For more recommendations on antivirus, visit our dedicated article.