It's funny to see someone post on social media, "Let's make this go viral." That concept was cool before it became a mainstream phrase, and using it today only shows how out of touch someone really is.
Most phrases on social media carry no more dangerous payload than identifying an individual as out-of-touch. There are other phrases, though, that can significantly impact a personal or business level. When people do not understand a new phrase or concept around it, most ignore the subject. In terms of securing your business on a digital front, ignoring it comes at your peril.
Multifactor Authentication (MFA)
This beautiful technology can protect you from over 90% of digital threats. MFA (and its earlier cousin, 2FA – two-factor authentication) is simple in concept and extremely powerful in practice. Passwords are porous and blatantly insecure. MFA simply requires a user to provide the password AND a code, either texted to them or generated by an authenticator app, to complete the login.
At first, it will feel inconvenient. It will grow on you to the point you will be suspect of any environment that doesn't require it. (Tip – if you want cybersecurity insurance coverage, chances are this will be required)
Zero Day
Zero-day is not a concept most users are familiar with, but it impacts nearly everyone. You will often hear threats described as a "zero-day vulnerability." Simply put, a zero-day problem is one that the manufacturer did not know about before it was exploited (the vulnerability has been known for zero days). Groups of cyber criminals are hunting for zero-day exploits in nearly everything you use, such as Windows 10, Windows 11, macOS, your connected thermostat, etc.
Once an exploit is found, it is typically used….quietly. The goal is to keep the manufacturer from knowing about it for as long as possible because once it is found, the "day" ticker starts, and patches are issued to close the vulnerability. How do you address this? You can only react by keeping your systems updated and patched.
Social Engineering
This concept is starting to have a broad range of meanings. Social engineering aims to get others to think or do as they wish. We see a lot of social engineering posts (originally called "fake news" years ago) coming out of Eastern Europe. These often aim to stir up unrest or anger across large groups. Social engineering is not just about changing attitudes – it can also be used to attack your security. There seems to be a trending uptick in social engineering attacks on helpdesks. These involve a person calling the company helpdesk in a tirade and acting as the CEO of that business. They state they are locked out of their account, "and I want my password reset RIGHT NOW." If YOU are a younger person sitting in that chair at the helpdesk and YOU have the company CEO on the line wanting their password reset
RIGHT NOW, what is your first inclination? You guessed it. These attacks succeed; before you know it, the bad actor has full access to the CEO's inbox. More importantly, they have control of their outbox and the ability to send instructions to subordinates – such as "wire this payment here." Social engineering attacks are accurate and are coming more frequently. How do you prepare your workforce? In the example above, simply having everyone trained to address any such situation with "I'll call you back on your number we have on file to finish resetting your password" is a verbal form of multi-factor authentication that would avoid a mess.
Ransomware
Ransomware is malicious software designed to encrypt files on a victim's computer or network, rendering them inaccessible until a ransom is paid. This cyberattack can devastate organizations, causing downtime, financial losses, and reputational damage. Preventative measures include regular data backups, robust cybersecurity training for employees, and implementing strong endpoint protection and network security measures.
SQL Injection
SQL injection is a technique used by attackers to manipulate SQL queries through input data fields, potentially gaining unauthorized access to databases. Organizations can prevent SQL injection attacks by implementing secure coding practices, such as parameterized queries and input validation. Web application firewalls (WAFs) can filter and block malicious SQL injection attempts. At the same time, regular security assessments and code reviews help identify and remediate vulnerabilities in application code before they can be exploited.
Man in the Middle (MITM) Attack
A man-in-the-middle attack occurs when a malicious actor intercepts and possibly alters communication between two parties without their knowledge. Organizations can defend against MITM attacks using encryption technologies such as SSL/TLS protocols for secure data transmission. Implementing VPNs (Virtual Private Networks) can also create secure tunnels for communication, making it difficult for attackers to eavesdrop or manipulate sensitive information.
Ascend Can Help
Stay vigilant, implement comprehensive security measures, and prioritize ongoing education and awareness to safeguard against evolving cyber threats in today's interconnected landscape. If you need guidance through your cybersecurity journey, reach out to talk to an expert!
