CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

CVE-2024-3400: PAN-OS Command Injection Vulnerability in GlobalProtect Gateway. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

4 Scary Truths We Observed During National Cyber Security Awareness Month

Friday is Halloween - and the ghosts and goblins will be out in full force in search of chocolate and other tantalizing confections. But there are plenty of reasons to feel spooked without ever leaving your home, especially if you are an information security professional. Between expanding vulnerabilities, sophisticated malware attacks and devastating breaches, IT practitioners need not watch a horror movie marathon to contract chills and goose bumps.

All Saints' Eve also marks the conclusion of National Cyber Security Awareness Month in the United States, an initiative meant to raise awareness among computer users of all types to the risk of online fraud, theft and abuse.

Earlier this month, we began posting video interviews we conducted on the streets of Chicago with everyday employees we stopped at random to discuss cybersecurity. We asked them questions - and they responded candidly. Here are some of the "frightening" takeaways we determined based on their answers.

Employees pick poor passwords: We asked random passers-by to name the most common password they use. Most wouldn't give it up, but surprisingly one person did - "Student123". Others described the password complexity they use, and nobody was aware that selecting a passphrase ("thisisthebestsecretpassword") is best practice because it exponentially is more difficult to crack. Considering weak passwords are responsible for roughly a third of data breaches we investigate, organizations should realize the importance of enlisting stringent password policies and deploying two-factor authentication.

Employees aren't concerned their employers may be compromised: Many of the people we spoke with didn't seem to understand how common breaches are and how much of a role they can play in minimizing security risks. One man told us: "I don't know anything about cybersecurity other than the IT guys handle it." Their confidence in their IT department also may be misguided. Many companies - large and small - are struggling to find the essential skillsets, resources and visibility to properly defend against and respond to security threats and incidents. As a result, they are looking to managed security partners to assist them in the fight.

Employees don't know the jargon: Workers certainly don't have to be security experts - after all, their job interviews almost surely didn't inquire on their propensity to click on a strange email link or attachment - but having a working knowledge of the definitions of common terms ("malware," "HTTPS," etc.) and a grasp on how attacks tend to operate make them a stronger asset. Companies that implement creative and recurring security awareness education programs will strengthen their so-called weakest link.

Breaches don't take a month off: Finally, while this isn't necessarily connected to our videos, the bad guys didn't seem to slow down during National Cyber Security Awareness Month. Many of October's high-profile breaches that were reported employed malware and targeted point-of-sale devices. Trustwave has been studying these types of attacks for many months and has offered advice, including the need for implementing advanced anti-malware technologies.

Trick-or-treat, everyone.

Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.

Latest Trustwave Blogs

The Power of Red and Purple Team Drills in Enhancing Offensive Security Programs

Despite investing in costly security solutions, keeping up with patches, and educating employees about suspicious emails, breaches still occur, leaving many organizations to wonder why they are...

Read More

Balancing Innovation and Security: How Offensive Security Can Help Navigate the Tech Industry’s Dual Challenges

Two of the greatest threats facing technology-focused organizations are their often-quick adoption of new technologies, such as artificial intelligence (AI), without taking security measures into...

Read More

Trustwave Government Solutions (TGS) Salutes New Mexico’s New Cybersecurity Executive Order

New Mexico Governor Michelle Lujan Grisham issued an Executive Order to shore up the state’s cybersecurity readiness and better safeguard sensitive data by conducting a state-wide security assessment...

Read More