A Wake-Up Call on Cybersecurity: Protecting Your Digital Identity

Improving Your Security Posture + Cybersecurity Myths + Tips to stay secure.

ICYMI

Click here to catch up on yesterday’s read.

As a follow-up from yesterday’s read; I’ll be debunking a few myths surrounding cybersecurity that you’ve probably heard.

I have a friend who casually mentioned, "I have nothing that a hacker would want." This common misconception presented an opportunity for me to educate him on the real risks lurking in the digital world.

I began by explaining how his identity could be stolen and sold on the dark web. Cybercriminals could purchase his personal information to commit crimes, leaving him to deal with the aftermath. I painted a vivid picture of how his credit and debit cards could be used to rack up debt and make online purchases, with him being none the wiser until the transaction notifications started pouring in.

But the risks didn't stop there. I went on to illustrate a more insidious threat—how he could be unwittingly used as a gateway to his organization. Hackers often target individuals to gain access to larger networks, using the initial victim as an attack vector. By compromising his personal security, they could potentially breach his workplace or exploit his connections, causing significant damage to his organization and the people close to him.

As I laid out these scenarios, the gravity of the situation began to sink in. My friend realized that cybersecurity wasn't just about protecting his personal information; it was about safeguarding the broader network of people and systems he was connected to.

Safe to say, his approach to security changed since then. He began taking proactive steps to secure his digital presence, from using stronger passwords and enabling multi-factor authentication to being more cautious about the links he clicked and the information he shared online.

This experience underscored the importance of cybersecurity awareness. It's a reminder that everyone, regardless of their perceived value to hackers, needs to take cybersecurity seriously. Protecting oneself is not just a personal responsibility but a collective one, ensuring the safety and integrity of the interconnected digital world we live in.

Common Myths in Cybersecurity

Myth 1: "My organization is too small to be targeted by hackers."

Truth: Cybercriminals often target small and medium-sized businesses because they typically have fewer security measures in place compared to larger organizations. Every organization, regardless of size, holds valuable data that can be exploited.

Myth 2: "Antivirus software is enough to keep me safe."

Truth: While antivirus software is a crucial component of a comprehensive cybersecurity strategy, it is not sufficient on its own. Effective cybersecurity involves a multi-layered approach, including firewalls, intrusion detection systems, regular software updates, and strong access controls.

As a regular user, you most likely have no idea how to set up a firewall or IDS, your device (Laptop or Mobile Phone) Operating System has a default configuration for its firewalls and IDS, so ensure you don’t tamper with them, and also make sure you use Original Software, using pirated or illegally cracked software is you inviting hackers and threat actors to harvest your data.

Here’s a curated list of top antiviruses;

• Kaspersy

• Malwarebytes

• Norton

• CloudStrike

If you can’t get these ensure your Windows Defender is active and regularly updated.

Myth 3: "Cybersecurity is only the IT department's responsibility."

Truth: Cybersecurity is a shared responsibility. Employees at all levels should be aware of security best practices, such as recognizing phishing emails and using strong passwords. A culture of security awareness is essential for protecting an organisation.

Myth 4: "Strong passwords are enough to secure my accounts."

Truth: While strong passwords are important, they are not infallible. Multi-factor authentication (MFA) adds an additional layer of security by requiring a second form of verification, such as a code sent to your phone or a biometric scan. I recommend using Authy as your Authentication application.

Myth 5: "Cyber threats only come from external sources."

Truth: Insider threats, whether intentional or accidental, can be just as damaging as external attacks. Employees, contractors, and third-party vendors with access to your systems can pose significant risks. Implementing access controls and monitoring for suspicious activity are critical measures.

Myth 6: "I don't need to worry about cybersecurity on my mobile devices."

Truth: Mobile devices are increasingly targeted by cybercriminals due to their widespread use and often lax security measures. It's essential to use security features such as encryption, remote wipe capabilities, and regular updates for mobile operating systems and apps. Hear me out there are no external antiviruses for mobile devices!! Most of what you see on the App or Play Store are in fact viruses themselves, DO NOT install them, and if you have quickly uninstall them to be safe!

Myth 7: "Cloud services are inherently secure."

Truth: While many cloud service providers implement robust security measures, the security of your data in the cloud also depends on how you configure and use these services. It's important to understand shared responsibility models and ensure proper security settings, access controls, and data encryption.

Myth 8: "Cybersecurity is only about preventing attacks."

Truth: Cybersecurity also involves detecting and responding to incidents. No system is entirely immune to breaches, so having a robust incident response and continuity plan in place is crucial for minimizing damage and recovering quickly.

Myth 9: "Older systems and software are secure if they haven't had issues."

Truth: Old or Legacy systems and outdated software are often more vulnerable because they may not receive security patches or updates. Keeping systems and software up-to-date is essential for protecting against known vulnerabilities.

Myth 10: "Cybersecurity is too expensive and complex for individuals."

Truth: There are many affordable and straightforward steps individuals can take to enhance their cybersecurity, such as using password managers, enabling MFA, regularly updating software, and being cautious about sharing personal information online.

Here are five easy steps to enhance your security posture:

1. Use Strong, Unique Passwords

Why: Weak passwords are one of the easiest ways for cybercriminals to gain access to your accounts.

How:

• Create complex passwords that are at least 12 characters long, using a mix of letters (A - Z), numbers (0 - 9), and special characters (! @ # $ % ^ & * ( ) { } [ ] ” : ’ ; ' , . / < > | \ ~ `).

• Avoid using the same password for multiple accounts.

• Use a password manager to generate and store strong, unique passwords for all your accounts. ProtonPass and Dashlane are good, secure password managers that come with extra features such as Darkweb monitoring which informs you if your email is leaked on the dark web.

2. Enable Multi-Factor Authentication (MFA)

Why: MFA provides an extra layer of security by requiring a second form of verification in addition to your password.

How:

• Enable MFA on all accounts that support it, especially email, banking, and social media accounts.

• Common methods include SMS codes, authenticator apps, or biometric verification like fingerprints. (I recommend Authy as your authenticator App.)

3. Keep Software and Devices Updated

Why: Software updates often include security patches that fix vulnerabilities.

How:

• Enable automatic updates for your operating system, applications, and antivirus software.

• Regularly check for and install updates for your browser, plugins, and firmware.

4. Be Cautious with Emails and Links

Why: Phishing attacks are a common way for cybercriminals to steal information or spread malware.

How:

• Avoid clicking on links or downloading attachments from unknown or suspicious emails.

• Verify the sender’s email address and look for signs of phishing, such as generic greetings, spelling errors, and urgent requests for personal information.

• If the email looks poorly written and composed that’s enough of a red flag.

• If the sender poses as someone in your network and you had no prior communication with the sender, verify from the person directly either with a call or an SMS confirming if he/she sent you a mail to that effect before clicking any links or sending any documents.

5. Use Secure Wi-Fi Connections

Why: Public Wi-Fi networks (can be) are insecure and easily exploited by cybercriminals.

How:

• Avoid accessing sensitive information, such as banking accounts, over public Wi-Fi.

• Use a Virtual Private Network (VPN) when connecting to public Wi-Fi to encrypt your internet traffic. Use good VPNs that don’t log your data. (I recommend ProtonVPN)

• Ensure your home Wi-Fi network is secured with a strong password and WPA3 encryption if available.