Information Security Awareness

Information
Security
Awareness 2024
Security awareness statistics
Why is What can some recent figures reveal about the security awareness landscape? Well, strap in.
 70% of data breaches involved the human element in 2023
Security  The average cost of a data breach in 2022 was just under $4.35 million. That’s
an all-time high.
 Only 1 in 9 businesses (11%) provided a cybersecurity awareness program to
Awareness non-cyber employees in 2020.

 1 in 3 data breaches involves phishing.
Important?!
 20% of organizations faced a security breach as a result of a remote worker.
Most people just don’t have the knowledge, tools, and support they need to protect
themselves and their organizations. And the
average person’s cybersecurity knowledge is, well, patchy.
What is
Information
Information security, often What is the difference Information security
referred to as InfoSec, between cybersecurity and (InfoSec) protects all forms
refers to the processes and information security? of information, digital and
Security
tools designed and physical.
deployed to protect Cybersecurity protects all
sensitive business forms of digital
information from information, including
modification, disruption, computers, handheld
destruction, and inspection devices, cloud, and
networks, and can be
considered a subset of
InfoSec.
• Application security
Application security is a broad topic that covers software vulnerabilities in web and mobile applications and application programming interfaces
(APIs). These vulnerabilities may be found in authentication or authorization of users, integrity of code and configurations, and mature policies
and procedures. Application vulnerabilities can create entry points for significant InfoSec breaches. Application security is an important part of
perimeter defense for InfoSec.
• Cloud security
Cloud security focuses on building and hosting secure applications in cloud environments and securely consuming third-party cloud applications.
Types of
“Cloud” simply means that the application is running in a shared environment. Businesses must make sure that there is adequate isolation
between different processes in shared environments.
• Cryptography
InfoSec Encrypting data in transit and data at rest helps ensure data confidentiality and integrity. Digital signatures are commonly used in cryptography to
validate the authenticity of data. Cryptography and encryption has become increasingly important. A good example of cryptography use is the
Advanced Encryption Standard (AES). The AES is a symmetric key algorithm used to protect classified government information.
• Infrastructure security
Infrastructure security deals with the protection of internal and extranet networks, labs, data centers, servers, desktops, and mobile devices.
• Incident response
Incident response is the function that monitors for and investigates potentially malicious behavior.
In preparation for breaches, IT staff should have an incident response plan for containing the threat and restoring the network. In addition, the
plan should create a system to preserve evidence for forensic analysis and potential prosecution. This data can help prevent further breaches and
help staff discover the attacker.
• Vulnerability management
Vulnerability management is the process of scanning an environment for weak points (such as unpatched software) and prioritizing remediation
based on risk.
In many networks, businesses are constantly adding applications, users, infrastructure, and so on. For this reason, it is important to constantly
scan the network for potential vulnerabilities. Finding a vulnerability in advance can save your businesses the catastrophic costs of a breach.
What is an information security
management system (ISMS)?
• An ISMS is a set of guidelines and processes

created to help organizations in a data breach
scenario. By having a formal set of guidelines,
businesses can minimize risk and can ensure
work continuity in case of a staff change. ISO
27001 is a well-known specification for a
company ISMS.
Biggest InfoSec threats
• 1. Phishing
• Phishing attacks are fraudulent and targeted digital messages that are meant to trick a
victim into clicking or accepting a link, or into giving up sensitive information by posing
as a trustworthy source or person using electronic means.
1 in every 99 emails is a phishing attack.
• 2.Malware
• Malware, short for malicious software, refers to any intrusive software developed by
cybercriminals (often called hackers) to steal data and damage or destroy computers and
computer systems. Examples of common malware include viruses, worms, Trojan
viruses, spyware, adware, and ransomware.
• 3. Ransomware
• Ransomware is a cybercrime where a hacker encrypts a victim's data with malicious
software with the intent that the attacker must be paid before the system will be
unlocked. Once the ransom is paid, the attacker should send a decryption key to restore
access to the victim's data, but often the system is unlocked, and the stolen data is held
for as second ransom
• 4. Social engineering
• At its core, social engineering is not a cyber attack. Instead, social engineering is all
about the psychology of persuasion: It targets the mind like your old school grifter or con
man. The aim is to gain the trust of targets, so they lower their guard, and then encourage
them into taking unsafe actions such as divulging personal information or clicking on
web links or opening attachments that may be malicious.
• 5. Physical vulnerabilities
• Antivirus won’t stop a physical attack. While many businesses are starting to wake up to
the cyber risks posed by phishing and malware, it is essential that physical security is not
neglected.
We are all in
this together.
• Cybersecurity is not a topic
reserved solely for the IT
department

Information Security Awareness

Uploaded by

Copyright:

Available Formats

Information Security Awareness

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Information Security Awareness

Uploaded by

Copyright:

Available Formats

Information

Awareness non-cyber employees in 2020.

• An ISMS is a set of guidelines and processes

You might also like