What Is Cyber Security Awareness Training And Why Is It So Important?

What Is Cyber Security Awareness Training And Why Is It So Important?

Did you know that more than 90% of cybersecurity incidents can be traced back to human error?

That’s why Cybersecurity Awareness Training is an essential part of an effective cybersecurity defense.

Are your staff members supporting your cybersecurity? Or putting it at risk?

Find out more in our latest webinar:

The Cost Of A Cyberattack

According to Security Magazine, the average cost of a data breach for a small business is $36,000 to $50,000. Not to mention the lost productivity and reputational damage to your company.

Of course, this number is much greater when we look at large successful businesses.

Here are the stats:

• 90% of cybersecurity incidents can be traced back to human error
• The average cost of a data breach is $3.86M
• 60% of breached companies go out of business within half a year of a cyber incident

The fact is that you can’t afford to cut corners on your cybersecurity. It’s easy to assume that just because you haven’t been hit by a cyberattack yet, you won’t be anytime soon.

You may think you can put off investing in an effective business continuity plan, but without warning, you may get hit. Don’t assume you’re safe.

Cybercrime Attacks That Target Unaware Users

Phishing

Phishing is a method in which cybercriminals send fraudulent emails that appear to be from reputable sources in order to get recipients to reveal sensitive information and execute significant financial transfers.

Phishing attacks are mass emails that request confidential information or credentials under pretenses, link to malicious websites, or include malware as an attachment.

With only a surprisingly small amount of information, cybercriminals can convincingly pose as business members and superiors in order to persuade employees to give them money, data, or crucial information.

The average phishing attack costs businesses $1.6 million. The problem with the rising tide of cybercrime incidents is that you get desensitized to the whole thing.

The fact is that businesses aren’t learning to protect themselves, which is why the number of reported phishing attacks has gone up by 65% in the past few years.

Ransomware

In a ransomware attack, an unsuspecting user clicks on a seemingly safe link, or emailed attachment that appears to be a bill or other official document. Instead, the attachment installs a malicious software program (malware) onto the computer system that encrypts the data and holds it at ransom.

The user is then stuck without access to their data, and faced with paying the attacker a huge sum.

According to Coveware’s Q4 Ransomware Marketplace report:

• The average ransomware payout is $84,116
• The highest ransom paid by a target organization was $780,000
• The average ransomware attack results in 16.2 days of downtime

Malicious Websites

Hackers can create fake websites that are set up to look like a real site, but the spelling of the URL or site name contains an error that is easily made by users. For example, an attacker may set up a site with the name “www.gooogle.com” instead of www.google.com.

Users who are not careful may type in an extra ‘o’ in the name and will land on the fake site. From here, the site will record all of the information that you enter into any text or password boxes, which the cybercriminal will then use against you.

6 Ways To Spot A Fraudulent Email

• Check The Right Fields: If you’re unsure about an email, check the details on the email itself—specifically the “mailed-by” and “signed-by”, both of which should match the domain of the sender’s address.
• Suspicious Links: Always be sure to hover your mouse over a link in an email before clicking it. That allows you to see where it actually leads. While it may look harmless, the actual URL may show otherwise, so always look, and rarely click.
• Spelling and Grammar: Modern cybersecurity awareness comes down to paying attention to the details. When reading a suspicious email, keep an eye out for any typos or glaring errors. Whereas legitimate messages from your bank or vendors would be properly edited, phishing emails are notorious for basic spelling and grammatical mistakes.
• Specificity: Another point to consider is how vague the email is. Whereas legitimate senders will likely have your information already (such as your first name) and will use it in the salutation, scammers will often employ vaguer terminology, such as “Valued Customer”—this allows them to use the same email for multiple targets in a mass attack.
• Urgent and Threatening: If the subject line makes it sound like an emergency—”Your account has been suspended”, or “You’re being hacked”—that’s another red flag. It’s in the scammer’s interest to make you panic and move quickly, which might lead to you overlooking other indicators that it’s a phishing email.
• Attachments: Phishers will often try to get you to open an attachment, so, if you see an attachment in combination with any of the above indicators, it’s only more proof that the email is likely part of a phishing attempt.

How To Spot A Malicious Website

A malicious website is a site that attempts to install malware.

Malware is a blanket term for viruses, worms, trojans, and other harmful computer programs hackers use to cause destruction and gain access to sensitive information.

Malicious websites often look like legitimate websites.

Some may even ask you to install software that your computer appears to need. Sometimes the website may ask for permission to install one program, but installs a completely different one, one you definitely do not want on your computer.

Similarly, a phishing website, sometimes called a “spoof” or a “lookalike” website, steals your data. They look like legitimate websites but steal your login info and personal data.

7 Indicators That A Website May Be Dangerous

1. Grammar or punctuation errors
2. A misspelled website domain or URL
3. A generic.com domain
4. Unsecured sites
5. Pop-up windows
6. No Security Trust Seal
7. No SSL/TLS Certificate

Top Tips To Enhance Your Cybersecurity

• Be suspicious. It’s a wild world out there and we all need to be on alert more than ever.
• Never send money or pay for something without confirming it by phone. Only call a phone number you know is correct, not a number given to you in an email.
• Don’t click on a website address link. Enter the web addresses directly into your web browser, to make sure it’s a secure and legit website, and log in to websites that way.
• Always be on the lookout for grammar, spelling, phrasing, or punctuation errors.
• Make sure your passwords are complex and unique.
• Implement Multi-factor Authentication for all business accounts.
• Keep your systems and solutions up to date with the latest security patches released by developers.
• Back up your data on a regular basis to multiple redundant systems.

Don’t Let Your Users Put You At Risk

The key to truly comprehensive cybersecurity is simple, yet often overlooked: the user.

The best cybersecurity technology and practices in the world can be undone by one staff member who doesn’t understand how to use them, or how to protect the data they work with.

The good news is that you don’t have to handle cybersecurity training for your team by yourself — Discovery IT is here to help.

We offer a comprehensive employee Cyber Awareness Training program that combines regular online training, simulated phishing attacks, and dark web monitoring. This solution is available to our managed services clients and non-managed clients as well!

With our help, your staff will contribute to your cybersecurity, not compromise it.