The first Cybersecurity Awareness Month was in 2004. The first ransomware was in 2013. The Colonial Pipeline infection was in 2020. Cybersecurity awareness has never been higher. Yet cybersecurity deteriorates not due to low awareness but poor advice from the “experts”. Let’s fix this.
Delete Kaspersky. The Trump administration booted Russian-made Kaspersky, then Best Buy, Staples and Office Depot followed suit. Yet Kaspersky persists. As a nation, we must effectively remove bad software from our networks without government intervention.
Antivirus is obsolete. Ransomware’s rise is directly related to the inefficacy of antivirus. Some organizations have moved to modern detect and respond solutions. Either way, save your money and don’t rely on obsolete, foreign made, and ineffective antivirus to stop ransomware.
Backups no longer work. Backups were great against ransomware from 2013-2017 but now ransomware encrypts backups and hijacks critical data. Problem is backup promotes its products as a solution to ransomware.
Employers Issue Passwords. Employees are horrible at choosing passwords, and frequently choose the same passwords for work and home. Employers should issue passwords rather than letting employees choose them for email, network access, and other hacker entry points.
Change home router password. Research shows only 1/4th of homes change their router password. Post pandemic, work-at-home is an all time high, which poses a risk to you and your employer.
Business email compromise. Aside from ransomware, the FBI reports business email compromise as the second largest cyber threat. Beware of scams for unusual requests to transfer money. If you are a victim, the FBI can recover the money if notified quickly.
Malicious links and attachments. The most common attack vector for cyber crime is still email. The links and attachments appear remarkably authentic. Discerning good from bad links and attachments is a critical skill in this ongoing battle with cyber criminals.
Digital Signatures. If you write and deploy software, proudly sign your work. Since ransomware seeks anonymity and avoids attribution, digital signing good software makes it easier to sort out the valid stuff from the bad and malicious ones.
Buzzwords. Cybersecurity has become more about hype and buzzwords than effective cybersecurity. Caution should be exercised of products that purport artificial intelligence, machine learning, and zero trust. Likely these products are expensive with marginal efficacy.
NIST. In 2018, NIST published the groundbreaking Cybersecurity Framework 1.1. The framework, although focused on critical infrastructure, is applicable for any segment including cities, counties, K-12, higher education, police departments, small and large business, state governments, the federal government and our military. Much of the ‘expert’ advice falls outside or is obsoleted by the framework. The framework can be understood by technical and nontechnical readers alike.
Identify. The framework is composed of five functions (Identify, Protect, Detect, Respond, and Recover). The Identify Function is foundational to the effective use of the framework which means one must identify what software and hardware should be on the network first. NIST has isolated the key flaw in modern cybersecurity. Identify. Although the Identify function is foundational, it is ignored or omitted by today’s cybersecurity ‘experts’.
Omitting the Identify function is analogous to not knowing who is supposed to be in your house, and which cars should be on your driveway. Instead of identifying first, you setup 24×7 surveillance to monitor all people and vehicles and then detect and respond to suspicious activity. You identify first in your house, and that is how cybersecurity should work too.
Prevention. The ‘experts’ claim that cyber effectiveness is measured by speed of reaction. The NIST framework is clear. Prevention should precede reaction. Current cyber stacks are analogous to a car with air bags and no brakes. Whenever the car crashes and the driver dies, new cars have more air bags. NIST is saying there should be first brakes and then air bags.
Experts. There is no Home Security Month, and one day there will be no National Cybersecurity Month when the ‘experts’ read, comprehend, and make recommendations based on the NIST Cybersecurity Framework.
