By Vasu Jakkal, CVP Microsoft Security, Compliance, Identity & Privacy
October is Cybersecurity Awareness Month, and I’m excited about what Microsoft and our partners in the industry have planned to help everyone stay #CyberSmart. 2022 may have offered some respite from the previous year’s rush to enable a remote/hybrid workforce, but the increased use of personal devices also left security professionals with even more endpoints to manage and secure. As shown by breaches like the March 2022 attack on Shields Health Care Group (1) (two million people affected) followed by the April ransomware attack that took down the Costa Rican government (2), we all need to be cyber defenders to protect what matters.
Technology can only do so much; it’s people who remain our greatest strength. That’s why Microsoft is taking this opportunity during Cybersecurity Awareness Month to help security professionals educate their employees on fundamentals highlighted by the National Cybersecurity Alliance, such as protecting their identities, updating their software and devices, and not falling prey to phishing schemes. Be sure to explore the resources and skilling opportunities in our Cybersecurity Awareness Month website, such as the #BeCyberSmart education kit with assets to help people to protect their data both at work and at home.
People have become the primary attack vector for cyber attackers around the world, so humans rather than technology now represent the greatest risk to organizations. —SANS 2022 Security Awareness Report
Security starts with awareness
In today’s boundaryless workplace, comprehensive security is essential. That kind of 360-degree protection requires education and awareness to safeguard identities, data, and devices. Awareness programs enable security teams to effectively manage their human risk by changing how people think about cybersecurity and helping them practice secure behaviors. The SANS 2022 Security Awareness Report analyzed data from more than a thousand security professionals from around the world to identify how organizations are managing their human risk. The report found that more than 69 percent of security awareness professionals are part-time, spending less than half their time on security awareness.
According to the SANS 2022 Security Awareness Report, cybersecurity awareness professionals should endeavor to:
- Engage leadership by focusing on terms that resonate with them and demonstrate support for their strategic priorities. “Don’t talk about what you are doing, talk about why you are doing it.”
- Consider having a 10-to-1 ratio of technical security professionals to human-focused security professionals.
- Partner with other departments in the organization—communications, HR, Business Operations—to help engage and communicate with your workforce.
- Make the training simple to understand and follow. “Just like working out—it’s the frequency that’s important” and dedicate time to collection information about the impact of their awareness programs.
It’s up to each of us to #BeCyberSmart
In 2022, the most common causes of cyber-attacks are still malware (22 percent) and phishing (20 percent) (3). Even with the rise of Ransomware as a Service (RaaS) and other sophisticated tools, human beings remain the most reliable, low-cost attack vector for cybercriminals worldwide. For that reason, it’s vital that we all stay informed about how to prevent breaches and defend ourselves, both at work and at home.
Here are some basic steps we can all take to #BeCyberSmart:
Phishing: Deceptive emails, phony websites, fake text messages… These kinds of phishing scams accounted for 30 percent (4) of attacks in 2021. During Terranova’s annual Gone Phishing Tournament last year, 19.8 percent of participants clicked on the phishing email link while 14.4 percent downloaded the fake document. So, how can we avoid taking the bait?
- Check the sender’s email address for verifiable contact information. Common phishing tip-offs include a misspelled or unrelated sender address. If in doubt, do not reply. Instead, create a new email to respond.
- Don’t click on links or open email attachments unless you have verified the sender.
- For more tips, visit the Federal Trade Commision phishing site.
Devices and software: Unpatched, out-of-date devices and software are a leading access point for cyber criminals. That’s why practicing good cyber hygiene is so important for avoiding destructive malware that can steal users’ personal information. To keep your devices safe:
- Enable the lock feature on all your mobile devices.
- Activate multifactor authentication (MFA) on your sensitive apps and accounts.
- Run antivirus software and install system updates immediately.
Scams: Criminals will often contact you seeking to “fix” a nonexistent problem. The email or text message will contain a sense of urgency, i.e., “Act now to avoid having your account locked!” If you see this type of message, do not click the link. And remember to always report any suspected scam; so the organization can take action. A few tips to remember:
- Be skeptical of unsolicited tech-support calls or error messages requesting urgent action.
- Do not follow any prompts to download software from any third-party website.
- When in doubt, open a separate browser page and go directly to the company’s web page.
Passwords: Passwords are our first line of defense against unauthorized access of accounts, devices, and files. However, the average person now has more than 150 online accounts; so, password fatigue is always a danger. Some tips on how to protect your passwords include:
- Use your browser’s password generator to create stronger passwords.
- Avoid accessing personal and financial data using public WiFi.
- Use a password manager, or consider going passwordless.
Fostering a more diverse cybersecurity workforce
As of April 2022, there are more than 700,000 vacant cybersecurity positions in the United States, with a predicted 3.5 million cybersecurity positions going unfilled worldwide by 2025 (5). That’s why Microsoft continues reaching out to students, veterans, people re-entering the workforce—anyone with an interest in becoming a cybersecurity defender. This year, for Cybersecurity Awareness Month, we are also approaching Microsoft’s initiatives to increase cybersecurity education access and help close the workforce gap. In partnership with the Last Mile Education Fund, Microsoft aims to reach at least 25,000 students by 2025 with scholarships and additional resources relate to cybersecurity pathways.
On October 7, we’re again hosting the Microsoft Student Summit, a virtual skills event designed to inspire higher education students toward a career in tech. This one-day event offers students the opportunity to engage with the Microsoft student developer community, hopefully providing inspiration and stoking a passion for innovation. We’re also continuing to help students move into real-world employment by offering learning sessions aligned to Microsoft certifications for Security, Compliance, and Identity. Eligible students can take up to eight fundamental certification exams for free this academic year.
Additionally, our partner, the National Security Alliance is running a free online mentorship program in conjunction with several HBCUs that you can get involved with right now.
Helping to create the next generation of cybersecurity defenders is important, and we want to make sure the doors are open to everyone. That’s why we’re also continuing our partnership with Girl Security, helping to empower adolescent and adult girls, women, and gender minorities, by demystifying cybersecurity and developing the in-demand skills needed for employment. Helping to empower adolescent girls, women, and gender minorities by demystifying cybersecurity and developing the in-demand skills needed for employment. Microsoft is also partnering with other organizations to leverage the message from this moment in October 2022 to bring more women to the industry, with a Community College Pathways to Cybersecurity Success webinar with Women in Cybersecurity (WiCys) and a virtual event with the Executive Women’s Forum focused on cybersecurity careers at Microsoft.
We’re always working on new educational initiatives; so stay tuned to our security blog and check for updates here.
Stay cyber smart year –round
Cybersecurity Awareness month is a special time for us as we collectively come together—industry, academia, and government—to promote the importance of a secure online environment. We know that cyber criminals are persistent and driven, working 24/7 with no days off. That’s why we need to work together on awareness and education year ‘round and build a culture of cyber defenders. Please continue to visit our cybersecurity awareness and education website to learn more about Microsoft’s Cybersecurity Education programs, download the 2022 Microsoft Digital Defense Report, and get our new cybersecurity education kit to use in your organization. Everyone has a role to play in cybersecurity, and when we learn together, we are more secure together.
Learn More
Explore our best practices and educational resources with our Cybersecurity Awareness website. To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.
1 Shields Health Care Group data breach affects 2 million patients
2 A massive cyberattack in Costa Rica leaves citizens hurting
3 Alarming Cyber Statistics For Mid-Year 2022 That You Need To Know