Wikipedia

Internet security awareness

Internet security awareness or Cyber security awareness refers to how much end-users know about the cyber security threats their networks face, the risks they introduce and mitigating security best practices to guide their behavior.[1][2] End users are considered the weakest link and the primary vulnerability within a network.[1][3][4] Since end-users are a major vulnerability, technical means to improve security are not enough. Organizations could also seek to reduce the risk of the human element (end users). This could be accomplished by providing security best practice guidance for end users' awareness of cyber security. Employees could be taught about common threats and how to avoid or mitigate them.[4]

Cyber security awareness, training, education

edit

A cyber security risk mitigating end user program could consist of a combination of multiple approaches including cyber security awareness, cyber security training, and cyber security education.  According to, and adopted from,[1] see the below table that provides a comparison of the approaches.

AWARENESS TRAINING EDUCATION
Attribute “What” “How” “Why”
Level Information Knowledge Insight
Objective Recognition Skill Understanding
Delivery Method Media

Including: video, newsletters, posters

Practical Instruction Including: lecture, case study workshop, hands-on Theoretical Instruction Including: discussion seminar, background reading
Impact Timeframe Short-term Intermediate Long-term

Threats

edit

Threat agents or threat actors are the perpetrators of the threat and usually look for the easiest way to gain access into a network, which is often the human element.[5]  However, these cyber threats can be mitigated.[6] Some common threats include but are not limited to below.

Social engineering is when someone uses a compelling story, authority, or other means to convince someone to hand over sensitive information such as usernames and passwords.[7][8] An end user with cyber security awareness will have the ability to recognize these types of attacks which improves their ability to avoid them.

Scareware is another type of social engineering ploy that displays a pop-up alert that attempts to create a sense of urgency and panic by notifying the user that viruses have infected their computer or has been hacked. The alert instructs the user to click on its link to enter information or download software that will remedy the issue when, in reality, this very action is what will compromise the user’s device. The consequences can vary from having sensitive data stolen from the user’s machine, preventing access to certain files, shifting the social engineering tactic to ransomware, or coercing the user into providing credit card payment information to authorize fraudulent transactions.[9][10][11]

Phishing is a form of social engineering.[12] It is a popular attack that attempts to trick users into clicking a link within an email or on a website in hopes that they divulge sensitive information.  This attack generally relies on a bulk email approach and the low cost of sending phishing emails. Few targets are fooled, but so many are targeted that this is still a profitable vector.

Spear phishing is an email crafted and sent to a specific person to whom it may appear to be legitimate.[13] It is a form of phishing, but it is more convincing and more likely to succeed than traditional phishing emails because it tailors the email to the victim.   Its deployment can range from a bulk automated process, such as accessing the address book of a past victim and sending simple phishing attacks to their contacts (thus appearing to come from a recognized past contact), to more sophisticatedly hand-written communications to target specific recipients.

Vishing or voice phishing is a form of social engineering [12] that involves contacting individuals via traditional landlines, telephony (i.e., Voice over IP), automated text-to-speech systems, or other forms of voice communications to trick them into divulging sensitive information like credit card data.

Smishing or SMS phishing is social engineering [12] that leverages SMS or text messages as the vector to trick end users into divulging sensitive information.

Tailgating is a physical security social engineering attack in which an unauthorized individual can access a location by following an authorized user into the location without the authorized user's knowledge.[14]

Piggybacking is a physical security social engineering attack in which an unauthorized individual can access a location by following an authorized user into the location with the authorized user's knowledge.[14]

Malware is software created and used for malicious intent.  It includes a range of software to include but is not limited to viruses, trojan horses, worms, rootkits, spyware, and crypto-jacking.[15]

Ransomware is another cyber threat where attacks are carried out on the computer system but are often the result of a social engineering attack.[16][17]  This type of malware encrypts data and holds it for ransom which could paralyze the whole computer system.

Internet of Things (IoT) based attacks are a form of cyber threat in the 21st century and beyond that leverage vulnerabilities in the embedded devices found in, i.e., cars, refrigerators, and smart speakers or digital assistants.[18]

Insider threats in cybersecurity (internet security) are security risks that come from individuals within an organization, such as employees or contractors, who have access to its systems and data.[19][20][21][22] These threats can include data theft, sabotage, fraud, or espionage, posing significant risks due to the insider's knowledge and access.[19][20]

Topics

edit

There are various approaches within the cyber security risk mitigating end user program (see table above). And while this article is geared towards cyber security awareness, the following topics could also be leveraged for cybersecurity training, and cyber security education.

As reflected in the above table, there are several different delivery methods that can be taken to provide cyber security awareness.[4] Some of which include using posters, guides, tips [23] or even video and newsletters.[1]  Some possible Cyber security awareness topics according to [24][25][26] include but are not limited to the following.

Anti-Malware Protection: Anti-malware is sometimes referred to as anti-virus.  This type of application is used to protect systems against malicious software by preventing, detecting, and deleting the malware.  Some popular malware includes computer viruses, ransomware, rootkit, trojan horses, and worms.  Security end user awareness guidelines include device scans for malware and updating the anti-malware application definitions.[24]

Data Protection and Privacy: There are various types of data that might be mandated to be protected from unauthorized disclosure, including personally identifiable information (PII), protected health information (PHI), intellectual property (IP), and other sensitive information.  Security awareness guidelines include teaching related to data classification, encryption, data anonymization, and data masking or data obfuscation.  Permissions and who can access data, which includes file sharing via email attachments, are additional safeguards that could be discussed. Another data protection control that could be included is backing up data[24] as it could be restored if the original becomes unavailable.

Device Management: involves knowing how to protect mobile devices and computers.  Device Management is also concerned with security related to Bring Your Own Device (BYOD).  Security awareness guidelines include encryption, protecting the system with a password, PIN, or multi-factor authentication, and other forms of credential.  Additional awareness tips include end-users downloading, installing, and reviewing applications and the requested permissions from unknown sources.[25][27]  According to,[25] another awareness tip is to read reviews and comments about the application before installing it.  Additionally, the use of public WIFI is another discussion point.[25]  Device management also relates to maintaining an accurate inventory of assets from purchase to disposition. This includes knowing when to wipe a device and media sanitization.

Incident Response: An incident is any observable event of malicious intent.  Security awareness guidelines for end-users include what types of events are considered suspicious or malicious, who should be contacted if an incident occurs, and what actions should be taken in the event of an incident.[24]

Internet of Things Security: are remotely controlled capable, resource constrained devices with embedded sensor chips that interact with people and objects to collect data and provide it to remote sources on the Internet for additional analysis in an effort to personalize and customize a user's experience. These devices include but are not limited to smart speakers, wearable devices like smart watch, surveillance cameras, lights, door locks, thermostats, appliances and cars.  Guidelines include maintaining an asset inventory, patch control, and changing default credentials.[28]

Password Management: A password is a string of secret characters used to authenticate a user's account. Security awareness guidelines suggest presenting requirements for creating a strong password or Passphrase, how frequently passwords should be changed, and how to protect passwords.[24]  Additionally, guidelines suggest the need to change all default passwords and to not share passwords with others.[29]  Additional protection options could include making end-users aware of using multi-factor authentication, password managers, and awareness of various password-related threats like password cracking.

Patching: Software and system changes to update, improve, or resolve weaknesses are usually released via a patch.  Security awareness guidelines include the timely installation of security patches [24] as well as implementing vulnerability assessment and vulnerability management.

Removable Media: are storage devices that could be added or removed from a running computer, such as CDs, DVDs, removable SD cards, and USB drives (including flash drives, thumb drives, external hard drives). Security awareness guidelines include drive encryption and following the policy and guidelines presented at the organizational level regarding the use of personal removable media on organizational systems.[29]

Safe Web Browsing: Security awareness guidelines regarding securely navigating websites include looking for the padlock icon on the URL bar before entering sensitive information like credentials, credit card information, or personally identifiable information.[25]   Another visual indicator is "https" reflecting in the web address.[25]  The padlock and "https" indicate that the entered information will be secure.[25] Lastly, guidance could be shared to set privacy options on the browser or use the incognito option to limit the information shared.[30] Yet another guideline is to consider using a virtual private network (VPN).[30]

Social Engineering involves interacting with humans in hopes that they will disclose sensitive information.[12] Security awareness guidelines include not opening suspicious emails from unrecognized senders, not clicking on suspicious links in emails or on websites, not opening attachments in emails, not disclosing information, and not responding to suspicious emails or contacts provided therein.[24][29]

Cybersecurity Public Awareness Campaigns

edit

Cybersecurity education and awareness training are crucial for modern society as they enable people to defend against cyber threats and explore cybersecurity careers while being interdisciplinary and encompassing various fields to prepare for future difficulties and save resources.[31][32][33] Research on cybersecurity awareness education reveals inconsistent results, with some studies suggesting limited effectiveness and experts advocating for the customization of training programs to enhance awareness.[citation needed] There are many cybersecurity awareness campaigns in the public domain, please find some as follows:

The American Federal Government, through the President of the United States, announced in 2004 that October would become the official Cybersecurity Awareness Month. The goal of such a month is to increase awareness of the most common cybersecurity threats and adopt basic practices conducive to their prevention. This initiative was built upon the collaboration of the private and public sectors in an exchange of expertise, with the intent of creating a safer digital world.[34]

Microsoft's Cybersecurity Awareness Month: Celebrating its 20th anniversary in 2023, Microsoft partnered with the National Cybersecurity Alliance and CISA to amplify cybersecurity best practices globally. Their focus includes educating organizations on multifactor authentication, updating software, recognizing phishing, and checking privacy settings. Microsoft also provides resources for small and medium businesses, which are often vulnerable to ransomware attacks.[35]

NIST's Cybersecurity Awareness Month: In 2023, NIST emphasized four key behaviors: (1) enabling multi-factor authentication, (2) using strong passwords and password managers, (3) updating software, and (4) recognizing and reporting phishing.[36] This annual event, celebrated every October since 2004, is part of a collaborative effort to provide resources and raise awareness about cybersecurity, thereby increasing national resilience against cyber incidents.[36]

The nature of cybersecurity awareness training suggests it's an ongoing process,[37] primarily because threat vectors— or methods and paths by which hackers attack systems— constantly evolve.[citation needed] As cyber threats become more sophisticated,[38] the strategies and knowledge required to defend against them must also advance. Continuous education and adaptation are essential to keep pace with new security challenges. This perspective aligns with the understanding that as long as technology advances and integrates more deeply into everyday life, the need for up-to-date cybersecurity awareness and training will remain critical.[citation needed] Ansari et al. (2022) utilized the AI-based cybersecurity awareness training to the cyberspace.[39]

See also

edit

References

edit
  1. ^ a b c d "NIST SP 800-12:63 cpr Chapter 13: Awareness, Training and Education". csrc.nist.rip.
  2. ^ Kim, Lee (April 2017). "Cybersecurity awareness: Protecting data and patients". Nursing Management. 48 (4): 16–19. doi:10.1097/01.NUMA.0000514066.30572.f3. ISSN 0744-6314. PMID 28353477. S2CID 9518792.
  3. ^ Kemper, Grayson (2019-08-01). "Improving employees' cyber security awareness". Computer Fraud & Security. 2019 (8): 11–14. doi:10.1016/S1361-3723(19)30085-5. ISSN 1361-3723. S2CID 201901451.
  4. ^ a b c "What is Cybersecurity Awareness Training & Why is it so Important?". FraudWatch International. 2018-12-21. Archived from the original on April 29, 2019.
  5. ^ Abawajy, Jemal (2014-03-04). "User preference of cyber security awareness delivery methods". Behaviour & Information Technology. 33 (3): 237–248. doi:10.1080/0144929X.2012.708787. ISSN 0144-929X. S2CID 12289090.
  6. ^ "Top 10 Cyber Security Threats & Its Mitigation". vCloud Tech Blogs - Your IT Solutions & Servicers Provider. 2020-11-23.
  7. ^ Fruhlinger, Josh (2019-09-25). "Social engineering explained: How criminals exploit human behavior". CSO Online.
  8. ^ "What is Social Engineering? Examples and". www.webroot.com.
  9. ^ "Scareware", Wikipedia, 2024-08-29, retrieved 2024-09-17
  10. ^ "What Is Scareware? Defined and Explained". Fortinet. Retrieved 2024-09-17.
  11. ^ "What is Scareware? How to Identify, Prevent and Remove It". WhatIs. Retrieved 2024-09-17.
  12. ^ a b c d "Avoiding Social Engineering and Phishing Attacks | CISA". us-cert.cisa.gov. February 2021.
  13. ^ "What is Spear Phishing? - Definition". usa.kaspersky.com. 2021-01-13.
  14. ^ a b Security, Mitnick. "6 Types of Social Engineering Attacks". www.mitnicksecurity.com.
  15. ^ Fruhlinger, Josh (2019-05-17). "What is malware: Definition, examples, detection and recovery". CSO Online.
  16. ^ Fruhlinger, Josh (2020-06-19). "Ransomware explained: How it works and how to remove it". CSO Online.
  17. ^ "What is ransomware? | Techniques & Prevention | Terranova Security". terranovasecurity.com.
  18. ^ Mazhar, Tehseen; Talpur, Dhani Bux; Shloul, Tamara Al; Ghadi, Yazeed Yasin; Haq, Inayatul; Ullah, Inam; Ouahada, Khmaies; Hamam, Habib (2023-04-19). "Analysis of IoT Security Challenges and Its Solutions Using Artificial Intelligence". Brain Sciences. 13 (4): 683. doi:10.3390/brainsci13040683. ISSN 2076-3425. PMC 10136937. PMID 37190648.
  19. ^ a b Cybersecurity and Infrastructure Security Agency. "Defining Insider Threats | CISA". www.cisa.gov. Retrieved 2024-01-15.
  20. ^ a b Cybersecurity and Infrastructure Security Agency. "Insider Threat 101 Fact Sheet" (PDF). www.cisa.gov. Retrieved 2024-01-15.
  21. ^ National Institute of Standards and Technology. "insider threat - Glossary | CSRC". csrc.nist.gov. Retrieved 2024-01-15.
  22. ^ U.S. Department of Homeland Security. "Cybersecurity Insider Threat | Homeland Security". www.dhs.gov. Retrieved 2024-01-15.
  23. ^ Tasevski, Predrag (2016). "IT and Cyber Security Awareness – Raising Campaigns". Information & Security. 34 (1): 7–22. doi:10.11610/isij.3401.
  24. ^ a b c d e f g Wilson, M.; Hash, J. (2003). "NIST Special Publication 800-50: Computer Security" (PDF).
  25. ^ a b c d e f g Employee Security Awareness Training, June 2017
  26. ^ "Building a Security Awareness Program". www.gideonrasmussen.com.
  27. ^ "Securely Using Mobile Apps - SANS OUCH! Newsletter - June 2021". www.sans.org.
  28. ^ Forrest, Conner. "Ten best practices for securing the Internet of Things in your organization". ZDNet.
  29. ^ a b c "Common Cyber Threats: Indicators and Countermeasures" (PDF).
  30. ^ a b "Privacy - Protecting Your Digital Footprint - SANS OUCH! Newsletter - April 2021". www.sans.org.
  31. ^ Triplett, William J. (2023-01-01). "Addressing Cybersecurity Challenges in Education". International Journal of STEM Education for Sustainability. 3 (1): 47–67. doi:10.53889/ijses.v3i1.132. ISSN 2798-5091.
  32. ^ Safa, Nader Sohrabi; Sookhak, Mehdi; Von Solms, Rossouw; Furnell, Steven; Ghani, Norjihan Abdul; Herawan, Tutut (2015-09-01). "Information security conscious care behaviour formation in organizations". Computers & Security. 53: 65–78. doi:10.1016/j.cose.2015.05.012. ISSN 0167-4048.
  33. ^ Wang, Yu; Qi, Bin; Zou, Hong-Xia; Li, Ji-Xing (2018-10-01). "Framework of Raising Cyber Security Awareness". 2018 IEEE 18th International Conference on Communication Technology (ICCT). IEEE. pp. 865–869. doi:10.1109/ICCT.2018.8599967. ISBN 978-1-5386-7635-6.
  34. ^ "Cybersecurity Awareness Month | CISA". www.cisa.gov. Retrieved 2024-09-17.
  35. ^ Jakkal, Vasu (2023-10-02). "Celebrate 20 years of Cybersecurity Awareness Month with Microsoft and let's secure our world together". Microsoft Security Blog. Retrieved 2024-04-03.
  36. ^ a b National Institute of Standards and Technology (NIST) (2023-10-25). "Cybersecurity Awareness Month". NIST.
  37. ^ Zwilling, Moti; Klien, Galit; Lesjak, Dušan; Wiechetek, Łukasz; Cetin, Fatih; Basim, Hamdullah Nejat (2022-01-02). "Cyber Security Awareness, Knowledge and Behavior: A Comparative Study". Journal of Computer Information Systems. 62 (1): 82–97. doi:10.1080/08874417.2020.1712269. ISSN 0887-4417.
  38. ^ Amanowicz, Marek (2021-09-30). "A Shared Cybersecurity Awareness Platform". Journal of Telecommunications and Information Technology. 3 (2021): 32–41. doi:10.26636/jtit.2021.154421. ISSN 1899-8852.
  39. ^ Ansari, Meraj Farheen; Sharma, Pawan Kumar; Dash, Bibhu (2022-03-01). "Prevention of Phishing Attacks Using AI-Based Cybersecurity Awareness Training". International Journal of Smart Sensor and Adhoc Network.: 61–72. doi:10.47893/IJSSAN.2022.1221 (inactive 1 November 2024). ISSN 2248-9738.{{cite journal}}: CS1 maint: DOI inactive as of November 2024 (link)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Internet_security_awareness&oldid=1254916623"