Friday is Halloween - and the ghosts and goblins will be out in full force in search of chocolate and other tantalizing confections. But there are plenty of reasons to feel spooked without ever leaving your home, especially if you are an information security professional. Between expanding vulnerabilities, sophisticated malware attacks and devastating breaches, IT practitioners need not watch a horror movie marathon to contract chills and goose bumps.
All Saints' Eve also marks the conclusion of National Cyber Security Awareness Month in the United States, an initiative meant to raise awareness among computer users of all types to the risk of online fraud, theft and abuse.
Earlier this month, we began posting video interviews we conducted on the streets of Chicago with everyday employees we stopped at random to discuss cybersecurity. We asked them questions - and they responded candidly. Here are some of the "frightening" takeaways we determined based on their answers.
Employees pick poor passwords: We asked random passers-by to name the most common password they use. Most wouldn't give it up, but surprisingly one person did - "Student123". Others described the password complexity they use, and nobody was aware that selecting a passphrase ("thisisthebestsecretpassword") is best practice because it exponentially is more difficult to crack. Considering weak passwords are responsible for roughly a third of data breaches we investigate, organizations should realize the importance of enlisting stringent password policies and deploying two-factor authentication.
Employees aren't concerned their employers may be compromised: Many of the people we spoke with didn't seem to understand how common breaches are and how much of a role they can play in minimizing security risks. One man told us: "I don't know anything about cybersecurity other than the IT guys handle it." Their confidence in their IT department also may be misguided. Many companies - large and small - are struggling to find the essential skillsets, resources and visibility to properly defend against and respond to security threats and incidents. As a result, they are looking to managed security partners to assist them in the fight.
Employees don't know the jargon: Workers certainly don't have to be security experts - after all, their job interviews almost surely didn't inquire on their propensity to click on a strange email link or attachment - but having a working knowledge of the definitions of common terms ("malware," "HTTPS," etc.) and a grasp on how attacks tend to operate make them a stronger asset. Companies that implement creative and recurring security awareness education programs will strengthen their so-called weakest link.
Breaches don't take a month off: Finally, while this isn't necessarily connected to our videos, the bad guys didn't seem to slow down during National Cyber Security Awareness Month. Many of October's high-profile breaches that were reported employed malware and targeted point-of-sale devices. Trustwave has been studying these types of attacks for many months and has offered advice, including the need for implementing advanced anti-malware technologies.
Trick-or-treat, everyone.
Dan Kaplan is manager of online content at Trustwave and a former IT security reporter and editor.