National Cybersecurity Awareness Month
How to Raise Employee Vigilance
October is National Cybersecurity Awareness Month (NCSAM), and it’s the perfect time to raise employee vigilance about cybersecurity, both at work and at home. NCSAM is jointly sponsored by the federal Cybersecurity and Infrastructure Security Agency (CISA) within the Department of Homeland Security (DHS) and the National Cybersecurity Alliance, which fosters public-private partnerships.
The theme for this year is “Own IT. Secure IT. Protect IT.” Thanks to collaboration between the federal government and industry, there are a raft of materials available to help you promote cybersecurity awareness, including thirteen ready-made tip sheets and a cybersecurity trivia game, available at National Cybersecurity Awareness Month 2019.
If you’re looking for more detail, the NCSAM 2019 Toolkit provides a comprehensive discussion, with key messaging, articles, and social media guidelines. It’s worth reviewing the suggested top tips, reproduced below for your convenience. The Toolkit contains guidance on hosting NCSAM-related events and promoting participation in NCSAM through your organization’s social media, as well as a sample communications calendar. The Toolkit also discusses how you can promote cybersecurity awareness and your participation in NCSAM to customers as well as employees.
For organizations looking for a more streamlined approach, one easy way to get started would be to send employees a new training tip sheet every week during NCSAM. Here’s a suggested schedule, with links to a selection of tip sheets that should apply for a broad range of employees:
- Week 1: Online privacy
- Week 2: Creating a password
- Week 3: A how-to guide for multi-factor authentication
- Week 4: Phishing
- Week 5: 5 ways to be cyber secure at work
The NCSAM 2019 site contains graphics you can use in in the email notice or on a website to highlight the message.
Finally, an interactive training event can be a fun, light-hearted, but substantive way to drive home the messages of NCSAM. If you’re interested in hosting one for employees, the site includes a clever PowerPoint-based trivia game with a Jeopardy-style scoreboard.
Top Tips from the 2019 NCSAM Toolkit
- Double your login protection. Enable multi-factor authentication (MFA) to ensure that the only person who has access to your account is you. Use it for email, banking, social media, and any other service that requires logging in. If MFA is an option, enable it by using a trusted mobile device, such as your smartphone, an authenticator app, or a secure token—a small physical device that can hook onto your key ring.
- Shake up your password protocol. According to National Institute for Standards and Technology (NIST) guidance, you should consider using the longest password or passphrase permissible. Get creative and customize your standard password for different sites, which can prevent cybercriminals from gaining access to these accounts and protect you in the event of a breach. Use password managers to generate and remember different, complex passwords for each of your accounts.
- If you connect, you must protect. Whether it’s your computer, smartphone, game device, or other network devices, the best defense against viruses and malware is to update to the latest security software, web browser, and operating systems. Sign up for automatic updates, if you can, and protect your devices with antivirus software.
- Play hard to get with strangers. Cybercriminals use phishing tactics, hoping to fool their victims. If you’re unsure who an email is from—even if the details appear accurate— or if the email looks “phishy,” do not respond and do not click on any links or attachments found in that email. When available use the “junk” or “block” option to no longer receive messages from a particular sender.
- Never click and tell. Limit what information you post on social media—from personal addresses to where you like to grab coffee. What many people don’t realize is that these seemingly random details are all criminals need to know to target you, your loved ones, and your physical belongings—online and in the physical world. Keep Social Security numbers, account numbers, and passwords private, as well as specific information about yourself, such as your full name, address, birthday, and even vacation plans. Disable location services that allow anyone to see where you are – and where you aren’t – at any given time.
- Keep tabs on your apps. Most connected appliances, toys, and devices are supported by a mobile application. Your mobile device could be filled with suspicious apps running in the background or using default permissions you never realized you approved—gathering your personal information without your knowledge while also putting your identity and privacy at risk. Check your app permissions and use the “rule of least privilege” to delete what you don’t need or no longer use. Learn to just say “no” to privilege requests that don’t make sense. Only download apps from trusted vendors and sources.
- Stay protected while connected. Before you connect to any public wireless hotspot – like at an airport, hotel, or café – be sure to confirm the name of the network and exact login procedures with appropriate staff to ensure that the network is legitimate. If you do use an unsecured public access point, practice good Internet hygiene by avoiding sensitive activities (e.g., banking) that require passwords or credit cards. Your personal hotspot is often a safer alternative to free Wi-Fi. Only use sites that begin with “https://” when online shopping or banking.
DHS, STOP. THINK. CONNECT. Toolkit (contains additional resources for different audiences, including students and older people)