Cybersecurity awareness is important throughout the year and should not be limited to just one month. While security threats continue to evolve and tools become more advanced, the best practices and advice we offer in the field often remain consistent from year to year. In part, that’s because the meat and potatoes of cybersecurity are pretty evergreen (back up your files, use strong passwords, encrypt data, train end users, etc.), but also because so many companies still haven’t implemented many of those best practices.
Everyone knows the importance of deploying software updates and patches and strong password management. But they still manage not to follow that advice. There are some pretty common areas where people consistently fail to follow cybersecurity advice:
Use strong passwords and password management. The road to cybersecurity breaches is paved with weak passwords. Despite many years of security experts pushing users to adopt strong passwords, most people are still relying on simple, easy-to-remember passwords, or worse, they are defaulting to things like simple number strings or even, still, “password.” It’s easy to understand why — as more of our work and home lives move online, we must remember dozens or hundreds of passwords. As a result, many users reuse simple passwords and don’t have a password recovery plan in place.
A Forbes report found that 78% of people use the same password for more than one account, 52% use it for three accounts, and 4% use it on at least 11 accounts. Further, 22% of Americans do not use any safety measures to secure passwords.
Read the instructions. Most people do not read instruction manuals for new software or technology, whether those are printed or online. People want to get started with their new tech and don’t want to be bogged down in details if they think they (mostly) know how something works.
Keep it simple. In business, you want technology that offers valuable features, not just an abundance of features. The more unnecessary widgets you have, the more points of failure you introduce into a given network. Ensure everyone has the features/functions they need to do their job, and eliminate useless ones that impact security and productivity.
Don’t ignore cybersecurity alerts. Like MFA fatigue, users (including IT professionals and security professionals) can let their guard down because they receive numerous alerts about updates, passwords, and threats. Once alert exhaustion sets in, users stop responding and taking the steps necessary to protect themselves.
Install software updates and patches. Because they can be disruptive and time-consuming, users may delay or avoid security patches and other software updates. Automatic updates timed for off-work hours have helped (and remote monitoring and management (RMM) and other tools have made this easier), but not all applications are provisioned that way.
Regularly backup data and applications. As with updates/patches, backup can be configured to happen in the background or at night. However, users (and companies) may not be scheduling backups frequently enough to protect against data theft or a ransomware attack thoroughly.
Building a cybersecurity culture
Users want seamless, frictionless technology experiences so they can do their actual jobs. They have rightly identified that juggling several dozen complicated passwords is not what they are getting paid for, so they skirt those rules as much as they can. Unfortunately, a lot of them don’t trust password managers, either.
This is bad news when it comes to cybersecurity. Compromised passwords are responsible for 77% of hacking-related breaches, according to the Verizon Data Breach Investigations Report 2024. In addition, multifactor authentication (MFA), which was designed to strengthen access controls, is also being targeted by criminals using techniques such as MFA fatigue.
Awareness and training help with these issues, but that only goes so far. Culture is critical to getting employees to change their behavior in the long term. IT solution providers can help their clients establish a strong culture of cybersecurity by embracing these best practices from the top down, providing a variety of different types of training and reminders to keep employees engaged, making security awareness relevant to current threats, and providing as much automation as possible to help remove the security friction mentioned above.
Leveraging advanced, proactive security tools, a 24/7 security operations center (SOC), and RMM platforms can also help you monitor compliance, direct training and reminders, and identify where cybersecurity policies might be misaligned. Remember, employees don’t ignore these best practices out of malice; they are just trying to do their jobs efficiently. Providing the right tools and information to help them improve their cybersecurity hygiene is critical.
