Today, there are teams of individuals, both state and privately sponsored, whose sole purpose is to break into corporate or government networks to either steal sensitive data, or deploy malware that will bring those networks to their knees.
Maintaining even the most rudimentary security practices (securing laptops, etc.) can go a long way to preventing security breaches. There are nine common cybersecurity risks that can easily be avoided if you adopt this motto when you are online: Stop. Think. Connect.
Make sure to stop for a moment. Think about how you will take care of your information and personal data before acting. Then, connect responsibly.
Here’s a look at nine potential online risks, including different types of malware, errors and poor password management:
- Advanced Persistent Threat (APT): These attacks are generally after the intellectual property of technology companies. It’s a concentrated attack by allied hackers focused on a single target. It infects a system and lays dormant and leaves few traces when done.
- Distributed Denial of Service (DDoS): Typically an attack on an Internet domain. Huge amounts of data flood a system until it is brought to its knees. Legitimate site requests are lost, or the site becomes too slow to function properly. This may not necessarily involve a loss of data, but the cost to its victims is substantial.
- Cross Platform Malware (CPM): Malware used to be the concern of those running Windows operating systems. That has changed with the emergence of malware targeting Java, Linux, and OSX.
- Metamorphic and Polymorphic Malware: Malware that has the ability to change code as it works its way through a system. Each version of the code makes permanent changes to its code, but each succeeding version functions the same way as the original. The longer it resides on a system, the more difficult it becomes to detect and remediate.
- Phishing: It is what it sounds like—a perpetrator is out there looking to catch a fish. You’ll receive an email that looks like it’s from your bank, or some other trusted party, asking you to visit the party’s website to update your personal information. The email will include a link to what you think is its website. It will look exactly like the merchant’s website. But if you take the time to look at the URL, it will have nothing to do with the website you thought you were visiting. Once you’ve entered your personal information, the hook is set and the perpetrator reels you in.
- Insider and Privilege Misuses / Miscellaneous Errors: The Misuse of privileges can be by an employee or business partner who is granted privileges and uses those privileges for malicious intent. Errors are can be the posting of private information on a public website, or sending information to the wrong recipients.
- Spyware: The two important things to know about spyware programs are 1) they can download themselves onto your computer without your permission when you visit an unsafe website and 2) they can take control of your computer. Keep your computer up to date—especially your operating system, web browsers, and antivirus/antispyware protection.
- Poor Password Management: Choose strong passwords that are not easy to guess. Avoid your address, pet’s name, or a child’s name. Think of creating a password by using the first letter of each word of a favorite saying. Substituting capital letters and/or numbers for some of those letters will strengthen the passwords even further. Make sure to change your passwords regularly.
- Social Media: Although social media can be a fun experience and helps keep you connected, it can also create an opportunity for information leakage or even compromise personal identity and safety. Be smart with your identity on social media sites. Make sure to review and user privacy settings. Keep all tagged photos private. Do not share information that can help people steal your personal data.
Remember to stop, think, and then connect to save yourself a lot of money, time and grief.
There are also some basic security practices you can implement to avoid these nine common cybersecurity threats:
- Secure Locations: Be sure to locate your routers and switches in a secure location—a locked room where limited access is permitted. Physical security is often overlooked, even though it is the most basic of security techniques. Biometrics and card access should be required for hardware managing the most sensitive data.
- Disable Ports: In high-security environments, unused ports should be disabled so that unauthorized systems cannot connect to the network.
- Configure Port Security: To better manage enabled ports, port security should be configured to limit which MAC addresses have access to those ports.
- Set Passwords: Be sure to configure passwords on the console port, auxiliary port, and the vty ports. Also configure the enable secret for access to privileged exec mode.
- Login Command: Do not forget the login command after setting the password on the port. The login command tells the device that anyone connecting must log in and forces the prompt for a password.
- Login Local Command: If you are looking to create usernames and passwords for login, then use the login local command to tell the device you wish to authenticate persons by the usernames and passwords configured on the device.
- Encrypt Passwords: Be sure to encrypt all passwords in the configuration with the service password-encryption command!
- Configure Banners Properly: Be sure to configure banners that do not have the word welcome in the message or any other inviting phrases. You want to make sure that the banners indicate that unauthorized access is prohibited.
- Secure Communication: If you are looking to remotely manage the device, look to using Secure Shell (SSH) instead of Telnet, as the communication is encrypted.
Related Training
Cybersecurity
This is an excerpt from the Global Knowledge white paper, Understanding Cisco Security Solutions: Are You Ready for a New Era of Risk?
Please support our Sponsors here :