October is Cybersecurity Awareness Month!

Do Your Part. #BeCyberSmart2
Cybersecurity is Everyone's Job
October means CSAM
Week 1_ Be Cyber Smart3
Week 2_ Fight the Phish3
Week 1_ Be Cyber Smart1
Do Your Part. #BeCyberSmart2
Cybersecurity is Everyone's Job
October means CSAM
Week 1_ Be Cyber Smart3
Week 2_ Fight the Phish3
Week 1_ Be Cyber Smart1
previous arrow
next arrow

Held every October, Cybersecurity Awareness Month (CSAM) is a collaborative effort between government and industry to ensure every American has the resources they need to stay safe and secure online while increasing the resilience of the Nation against cyber threats.

Now in its 18th year, Cybersecurity Awareness Month continues to build momentum and impact with the ultimate goal of providing everyone with the information they need to stay safer and more secure online. SUNY College of Optometry is proud to support this far-reaching online safety awareness and education initiative which is co-led by the National Cyber Security Alliance (NCSA) and the Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Department of Homeland Security.

Cybersecurity Awareness Month has an overarching theme that we ask you to use in your own October initiatives. This year, under the theme of “Do Your Part. #BeCyberSmart.”, the campaign will emphasize the role each individual plays in online safety and stress the importance of taking proactive steps to enhance cybersecurity at home and in the workplace.


FACTS AND FIGURES

  • The average total cost of a data breach in 2020 was $3.86 million and took an average of 280 days to identify and contain. (IBM)
  • The use of new breach techniques has boomed as a result of the COVID-19 pandemic, with 35% of breaches having leveraged new techniques in 2020. (Cynet)
  • 88% of data breaches are caused by human error. (Tessian)

More than ever before, technology plays a part in almost everything we do. Connected devices have been woven into society as an integral part of how people communicate and access services essential to their well being. Despite these great advances in technology and the conveniences this provides, recent events have shown us how quickly our lives and businesses can be disrupted when cyber criminals and adversaries use technology to do harm. Cybersecurity Awareness Month aims to shed light on these security vulnerabilities, while offering actionable guidance surrounding behaviors anyone can take to protect themselves and their organizations. Everyone has a responsibility to do their part in securing our interconnected world.

In support of Cybersecurity Awareness Month, ITS will focus and highlight on a different cybersecurity topic each week, including:

October 4-8, 2021

Week 1: Be Cyber Smart

Take simple actions to keep our digital lives secure.

October 11-15, 2021

Week 2: Fight the Phish!

Learn how to spot and report phishing attempts to prevent ransomware and other malware attacks.

October 18-22, 2021

Week 3: Explore. Experience. Share.

Commemorate the National Initiative for Cybersecurity Education’s (NICE) Cybersecurity Career Awareness Week and the global cybersecurity workforce.

October 25-29, 2021

Week 4: Cybersecurity First

Explore how cybersecurity and staying safe online is increasingly important as we continue to operate virtually in both our work and personal lives.

Cybersecurity Awareness Month 2021 Topics

Week 1: Be Cyber Smart
Read More

Week 1: Be Cyber Smart

Get Familiar with the Cyber Basics

At a time when we are more connected than ever, being “cyber smart” is of the utmost importance. This year has already seen more than a fair share of attacks and breaches, including the SolarWinds and Kaseya breaches as well as high-profile attacks on the Colonial Pipeline and other critical infrastructure. Furthermore, as has been underlined by these recent breaches, cyber attacks are becoming more sophisticated with more evolved bad actors cropping up each day.


FACTS AND FIGURES

  • 61% of data breaches used compromised credentials. (Verizon Data Breach Investigations Report)
  • 56% of IT leaders believe their employees have picked up bad cybersecurity behaviors since working from home. (Tessian)
  • More than 99.9% of Microsoft enterprise accounts that get invaded by attackers didn’t use multi-factor authentication. (ZDNet)

Luckily, there are several steps that we can take on a daily basis to mitigate risks and stay one step ahead of malefactors. Here are a few quick tips:

Enable MFA

Multi-factor authentication (MFA) adds that necessary second check to verify your identity when logging in to one of your accounts. By requiring multiple methods of authentication, your account is further protected from being compromised, even if a bad actor hijacks your password. In this way, MFAs make it more difficult for password cracking tools to enable attackers to break into accounts.

Use strong passphrases/password manager

This may seem obvious, but all too often securing strong passphrases/password managers is overlooked. People spending more time online during the pandemic has certainly contributed to more bad actors prowling for accounts to attack. Using long, complex, and unique passwords is a good way to stop your account from being hacked, and an easy way of keeping track and remembering your passwords is by using a password manager.

Perform software updates

When a device prompts that it’s time to update the software, it may be tempting to simply click postpone, and ignore the message. However, having the latest security software, web browser, and operating system on devices is one of the best defenses against online threats. So, don’t wait – update.

Do your research

Common sense is a crucial part of maintaining good online hygiene, and an intuitive step to stay safe online is to do some research before downloading anything new you are downloading to your device, such as apps. Before downloading any new learning app on your device, make sure that it’s a by checking who created the app, what the user reviews say, and if there are any articles published online about the app’s privacy and security features.

Check your settings

Be diligent to double check your privacy and security settings, and be aware who can access your documents. This extends from Google docs, to Zoom calls, and beyond. For meetings on Zoom, for example, create passwords so only those invited to the session can attend, and restrict who can share their screen or files with the rest of the attendees.


Being cyber smart and maintaining stellar online hygiene is the best way to protect yourself and others from cyber attacks. No single tip is foolproof, but taken together they can make a real difference for taking control of your online presence. Following these tips is also easy, and free. By taking preventive measures and making a habit of practicing online safety, you can decrease your odds of being hacked exponentially – and prevent lost time and money, as well as annoyance.


ADDITIONAL RESOURCES

Own Your Role in Cybersecurity: Start With the Basics
Cyber Secure at Work Tip Sheet
Multi-Factor Authentication (MFA) Tip Sheet
Online Privacy Tip Sheet
Protecting Your Digital Home Tip Sheet
Social Media Cybersecurity Tip Sheet

 

Week 2: Fight the Phish!
Read More

Week 2: Fight the Phish!

Fundamentals for Shoring Up Phishing Defenses

From ransomware to SolarWinds, the cybersecurity space has been as hectic as it has ever been over the last 12-24 months. However, for all of the emerging threats and news that are cropping up on the horizon, phishing — one of the oldest pain points in cybersecurity — is continuing to quietly wreak havoc, and is as big of a threat as it has ever been.

Despite often being overlooked in terms of hype, phishing has been a mainstay in the cybersecurity threat landscape for decades. In fact, 43 percent of cyberattacks in 2020 featured phishing or pre-texting, while 74 percent of US organizations experienced a successful phishing attack last year alone. That means that phishing is one of the most dangerous “action varieties” to an organization’s cybersecurity health. As a result, the need for proper anti-phishing hygiene and best practices is an absolute must.


FACTS AND FIGURES

  • Malware increased by 358% in 2020. (Help Net Security)
  • According to the FBI, phishing was the most common type of cybercrime in 2020, with the bureau receiving 241,342 complaints in 2020. (FBI)
  • Phishing attacks account for more than 80 percent of reported security incidents. (Verizon Data Breach Investigations Report)

With that in mind, here are a few quick best practices and tips for dealing with phishing threats:

Know the Red Flags

Phishes are masters of making their content and interactions appealing. From content design to language, it can be difficult to discern whether content is genuine or a potential threat, which is why it is so important to know the red flags. Awkward and unusual formatting, overly explicit call outs to click a hyperlink or open an attachment, and subject lines that create a sense of urgency are all hallmarks that the content you received could be potentially from phish and indicate that it should be handled with caution.

Verify the Source

Phishing content comes in a variety of ways, however, many phishes will try to impersonate someone you may already know — such as a colleague, service provider or friend — as a way to trick you into believing their malicious content is actually trustworthy. Don’t fall for it. If you sense any red flags that something may be out of place or unusual, reach out directly to the individual to confirm whether the content is authentic and safe. If not, break-off communication immediately and flag the incident through the proper channels.

Be Aware of Vishing and Other Phishing Offshoots

As more digital natives have come online and greater awareness has been spread about phishing, bad actors have begun to diversify their phishing efforts beyond traditional email. For example, voice phishing — or vishing — has become a primary alternative for bad actors looking to gain sensitive information from unsuspecting individuals. Similar to conventional phishing, vishing is typically executed by individuals posing as a legitimate organization — such as a healthcare provider or insurer — and asking for sensitive information. Simply put, it is imperative that individuals be wary of any sort of communication that asks for personal information whether it be via email, phone or chat — especially if the communication is unexpected. If anything seems suspicious, again, break-off the interaction immediately and contact the company directly to confirm the veracity of the communications.


Phishing may be “one of the oldest tricks in the book,” but it is still incredibly effective. And although it may be hard to spot when you may be in the midst of a phishing attempt, by exercising caution and deploying these few fundamentals, individuals and organizations more broadly can drastically mitigate the chances of falling victim to a phishing attack.


Additional Resources

Spotting a Vaccine Phishing Scam: Can You Find the Red Flags? (NCSA)
How to Recognize and Avoid Phishing Scams (FTC)
To Click or Not To Click: That is the Question (NCSA)
Identity Theft and Internet Scams Tip Sheet (CISA)
Phishing Tip Sheet (CISA)
Phishing General Security Postcard – This postcard explains phishing and provides signs and tips to prevent attacks (CISA)
Attack Spotlight: Microsoft Office 365 Credential Phishing (ProofPoint)
Attack Spotlight: OneDrive Phishing Campaign (ProofPoint)
Attack Spotlight: Scammers Mimic Real Banking Emails (ProofPoint)

Week 3: Explore. Experience. Share.
Read More

Week 3: Explore. Experience. Share.

Why You Should Consider a Cyber Career

Cybersecurity is one of the hottest sectors today, with new threats and challenges emerging each day. And with that, there is a huge push being undertaken by both business and education sectors to attract individuals toward a degree and career in cyber. Interested in joining this exciting new workforce?

Week 3 of Cybersecurity Awareness Month will highlight the Cybersecurity Career Awareness Week led by National Initiative for Cybersecurity Education (NICE). This is a week-long campaign that inspires and promotes the exploration of cybersecurity careers. Whether it’s students, veterans, or those seeking a career change, the dynamic field of cybersecurity is rapidly growing and has something for everyone.


FACTS AND FIGURES

  • 80% of companies say they have a hard time finding and hiring security talent. (Gartner)
  • By 2029, the cybersecurity job market is set to grow by 31%. (U.S. Bureau of Labor Statistics)
  • Application Development Security, DevSecOps, Container Security, Microservices Security and Application Security Code Review are set to be the most in demand cybersecurity skills over the next five years. (Burning Glass)

Here are a few reasons why pursuing a degree and career in cyber might be right for you:

Hot Job Market

To say that the cybersecurity jobs market is hot would be a huge understatement. According to the U.S. Bureau of Labor Statistics, the job market for information security analysts will grow by 32 percent by 2028 — making it one of the fastest growing job sectors — while Cybersecurity Ventures has found that there will be 3.5 million unfilled cybersecurity jobs in 2021. This means that cybersecurity professionals are among the most in-demand around the world and will be for years to come.

Infinite Room for Personal and Professional Growth

Beyond just the ability to get a cybersecurity job, thanks to an ever-growing set of career tracks, cybersecurity offers a variety of different options for professionals to find a position that fits nicely with their own interests. Cybersecurity professionals work in everything from compliance to stress testing cyber defenses and software, so there are virtually limitless ways that professionals can apply their skills and look to grow them.

Investment in advanced cybersecurity pays for itself

Due to the shortage of cybersecurity talent in the workforce, businesses and educational institutions are constantly rolling out new avenues by which to make cybersecurity careers more affordable. For example, new grants and scholarships are now becoming available each day for individuals interested in cybersecurity careers, while many businesses are beginning to offer tuition reimbursement or other financial perks. This means that a degree in cybersecurity may be much more affordable than you originally thought.

Graduate Growth

In addition to interesting “on the ground work” that cybersecurity professionals get to take-on everyday, there is also a growing selection of highly tailored cybersecurity graduate programs that can further academic knowledge in cybersecurity as well. For example, graduate degrees ranging from Applied Cryptography to Network Vulnerability and Detection are now being offered through colleges and universities nationwide. Additionally, as part of this deep-dive, cybersecurity professionals will also get the opportunity to network with other students from various backgrounds allowing them to open up further opportunities for future positions or businesses.


Additional Resources

Cybersecurity Career Awareness – CYBER.ORG (CISA)
Week 4: Cybersecurity First
Read More

Week 4: Cybersecurity First

Prioritizing Cybersecurity in a Hybrid Workplace 

Week 4 is all about making security a priority. For businesses, this means building security into products and processes. Make cybersecurity training a part of employee onboarding and equip staff with the tools they need to keep the organization safe. For individuals, keep cybersecurity at the forefront of your mind as you connect daily. Before purchasing a device or online product, do your research. When you set up a new device or app, consider your security and privacy settings and update default passwords. Cybersecurity should not be an afterthought.


FACTS AND FIGURES

  • Nearly two-thirds of companies have 1,000+ sensitive files open to every employee (Varonis)
  • Global spend on cybersecurity is set to cross $60 billion in 2021. (Canalys)
  • The IoT devices market is anticipated to reach $1.1 trillion by 2026. (Fortune Business Insights)

In this new normal where smart devices and consequently online safety are a must, here are some tips for securing those devices:

Remember smart devices need smart security

Make cybersecurity a priority when purchasing a connected device. When setting up a new device, be sure to set up the privacy and security settings on web services and devices bearing in mind that you can limit who you are sharing information with. Once your device is set up, remember to keep tabs on how secure the information is that you store on it, and to actively manage location services so as not to unwittingly expose your location.

Put cybersecurity first in your job

Make cybersecurity a priority when you are brought into a new role. Good online hygiene should be part of any organization’s onboarding process, but if it is not, then take it upon yourself to exercise best practices to keep your company safe. Some precautions include performing regular software updates, and enabling MFAs.

Make passwords and passphrases long and strong

Whether or not the website you are on requires it, be sure to combine capital and lowercase letters with numbers and symbols to create the most secure password. Generic passwords are easy to hack. If you need help remembering and storing your passwords, don’t hesitate to turn to a password manager for assistance.

Never use public computers to log in to any accounts

While working from home, you may be tempted to change scenery and work from a coffee shop or another type of public space. While this is a great way to keep the day from becoming monotonous, caution must be exercised to protect yourself and your company from harm’s way. Make sure that security is top of mind always, and especially while working in a public setting, by keeping activities as generic and anonymous as possible.

Turn off WiFi and Bluetooth when idle

The uncomfortable truth is, when WiFi and Bluetooth are on, they can connect and track your whereabouts. To stay as safe as possible, if you do not need them, switch them off. It’s a simple step that can help alleviate tracking concerns and incidents.


These are just a few simple steps towards achieving the best online safety possible. Staying safe online is an active process that requires constant overseeing at every stage – from purchasing and setting up a device, to making sure that your day-to-day activities are not putting anyone at risk. By following these steps, you are doing your part to keep yourself and your company safe from malicious online activity.


ADDITIONAL RESOURCES

Cybersecurity 101 Tip Sheet (CISA)
Why is Cybersecurity Important? (CISA)
Cybersecurity Starts with You (CISA)
Approaching Cybersecurity Tip Sheet (CISA)

 


SUNY College of Optometry is

recognized as a CSAM Champion!  

The Cybersecurity Awareness Month Champions represent those dedicated to promoting a safer, more secure and more trusted internet.

Champions include companies and organizations of all sizes, schools and school districts, colleges and universities, nonprofits, government organizations and individuals.


 

Cybersecurity Awareness Month Champion

Additional information and resources on cyber issues and implementing sound cyber security practices are also available at the following websites: