Cybersecurity Awareness Month 2024: Wrapping Up with Actionable Insights to Secure Our World

As we wrap up our Cybersecurity Awareness Month series, we’d like to extend a huge thank you to everyone who contributed their insights and expertise. The response to this series has been incredible, and we’re grateful for the valuable advice shared by industry leaders throughout each article.

In this fourth and final installment, we continue to highlight simple yet powerful steps to “Secure Our World.” While the cyber landscape is ever-evolving, one thing remains clear: adopting the right cybersecurity practices can make a real difference. With the collective wisdom of our experts, we hope this series has provided useful guidance to help you protect your business, data, and loved ones in today’s digital age.

Rob Rashotte, Vice President, Global Training & Technical Field Enablement at Fortinet

“The stakes are high for organizations when it comes to cybersecurity. Breaches take a financial toll, disrupt business operations, and erode customer and partner trust. Closing risk management strategy gaps, including prioritizing skills development and proper staffing, is vital to protect any organization.”

Since 2004, the US  government and the cybersecurity industry have recognized October as Cybersecurity Awareness Month. This collaborative effort between the government and the industry generates discussion on cyber threats and enhances cybersecurity awareness with the goal to Secure Our World. Looking at the cyber landscape in 2024, the cyber skills gap continues to be a top concern.

The challenge is twofold: too few cybersecurity professionals in the field and a lack of adequate skills for those in IT and security positions. We’ve seen the real-world impact of this skills gap: 58% of respondents to Fortinet’s 2024 Cybersecurity Skills Gap Global Research Report revealed that insufficient skills and a lack of properly trained IT/security staff are the prime causes of breaches, and 70% of respondents revealed that the cybersecurity skills shortage creates additional risks for their organization.

Collaboration across the public and private sectors to address these challenges is key, including initiatives like Cybersecurity Awareness Month. Together, let’s take action this October, tackling the cyber skills gap and increasing cyber resilience. 

Paul Walker, Field Strategist at Omada

“Identity security is increasingly recognized as one of the most critical aspects of modern cybersecurity strategies. As organizations continue to embrace digital transformation and rely more heavily on cloud environments, ensuring that only the right people have the appropriate access to systems, applications, and data is vital to protecting sensitive information.”

Cybercriminals are continually refining their tactics, and a common entry point for many of their attacks is the exploitation of poor identity security hygiene. Weak identity management processes, such as inadequate authentication policies and excessive user privileges, create vulnerabilities that hackers can exploit to infiltrate IT systems and escalate their access privileges.

Despite the clear threat, many organizations, regardless of size or vertical, exhibit a low level of maturity when it comes to investments in identity security, in particular, identity governance. Research is freely available to show that a significant percentage of companies do not implement key preventative measures, such as strong multifactor authentication (MFA) and regular user access reviews, leaving their systems open to attacks. According to a report by Verizon, over 80% of hacking-related breaches leverage compromised credentials. This statistic highlights the importance of investing in identity governance solutions that can proactively detect potential vulnerabilities and enforce compliance, ensuring that access to systems is tightly controlled and monitored.

Adopting a Zero Trust and Least Privilege approach to identity security is essential for organizations seeking to minimize identity security risks. Identity Governance and Administration solutions such as Omada Identity Cloud provide the required least privilege approach while maintaining operational efficiency and alignment to user access controls mandated by regulatory frameworks such as SOX, GDPR, and HIPPA. Zero Trust assumes that no user, whether inside or outside the organization, can be trusted by default, requiring continuous verification before granting access to resources. Coupling this with the Least Privilege model, where workers are granted only the minimum necessary access to perform their roles, helps prevent toxic combinations of access and unauthorized exposure to sensitive data. These strategies not only safeguard critical systems from cyber threats but also improve compliance with regulatory standards, ensuring that organizations remain secure and resilient in an increasingly hostile cyber landscape.”

Patrick Harr, CEO of SlashNext

“The explosion of AI in recent years has made it easier for cybercriminals to execute effective phishing scams and other attacks on users.”

As a result, we’ve seen a dramatic increase in attacks across various communication channels such as email, SMS, social media platforms, collaboration tools like Slack and Microsoft Teams, messaging apps like Signal and WhatsApp, as well as voice and video calls. There has also been growth in the use of 3D phishing—a sophisticated approach where cybercriminals target victims through multiple channels to establish credibility, instill urgency, and enhance their chances of successfully deceiving the target. By combining multiple modes of deception across different channels—such as starting with an email request and then following up with a phone call or a message—the attackers can launch very believable scams that are hard for the average person to detect, allowing them to bypass traditional security measures.

Cybersecurity Awareness Month is a reminder that the methods used by cybercriminals continue to evolve, making it imperative for organizations to have the resources and plans in place to prevent these attacks before they result in data compromise and other security concerns. To stay one step ahead of these sophisticated tactics, organizations must adopt a multi-faceted defense approach, which includes utilizing AI to combat AI-based scams. Even with continuous training to help employees recognize the hallmarks of email and message-based scams, many are still unable to evade complex schemes like 3D phishing. However, while humans may struggle to recognize these threats on their own, AI-based security platforms can detect unusual activities associated with 3D phishing attempts.

Ratan Tipirneni, President and CEO of Tigera

“This Cybersecurity Awareness Month, organizations should work to deploy tactics that help evaluate risks holistically and implement controls such as default-deny network policies, workload isolation, IDS/IPS, and WAFs. These tactics will reduce their risk of exploitation, limit lateral movement in the event of a breach, and block known threats before they can manifest.”

Cybersecurity Awareness Month highlights the importance of implementing stronger defense mechanisms that protect organizations and citizens from increasing cybercrime. Kubernetes and containerized environments underpin digital innovation and are at the core of modern application development. While these environments boast significant advantages, offering scalability, efficiency, and flexibility, they are also subject to various security risks. This includes vulnerabilities, misconfigurations, network exposures, and both known and zero-day malware threats. The distributed nature of microservices, the dynamic scaling of workloads, and the ephemeral nature of containers introduce unique security challenges. 

Traditional approaches to risk assessment whereby vulnerabilities, misconfigurations, and threats are identified and prioritized in isolation – and each generates its own set of alerts and priorities – are insufficient for the unique nature of Kubernetes. To effectively protect your Kubernetes environment, it is essential to adopt an interconnected security approach that accounts for how these risks interact. Many security risks are associated with specific services. By understanding the relationships between services, security teams can better assess the potential blast radius of risks if left unmitigated. This will enable more accurate and timely risk assessment, prioritization, and mitigation. 

Organizations should work to deploy tactics that help evaluate risks holistically and implement controls such as default-deny network policies, workload isolation, IDS/IPS, and WAFs. These tactics will reduce their risk of exploitation, limit lateral movement in the event of a breach, and block known threats before they can manifest. 

Venky Raju, Field CTO of ColorTokens

“When a cybersecurity breach makes headlines, the finger often points straight at humans. High-profile incidents like the SolarWinds attack, where human error was cited as a key factor, the recent 23andMe breach blamed on users’ weak passwords, or Uber’s MFA fatigue incident—all reinforce the narrative that humans are the weakest link in security.”

While there’s some truth to it, I believe it’s not the whole story. The real issue isn’t human incompetence. It’s the complexity of the systems we expect people to navigate. Alert fatigue, overly complicated user interfaces, and an endless stream of warnings all contribute to burnout. Combine that with limited budgets and staffing, and it’s no wonder mistakes happen.

Instead of piling more responsibilities onto users, we need to rethink our approach to cybersecurity.

• Rethinking Authentication: Passwords are a prime example. We tell people to use complex, unique passwords, change them frequently, and never reuse them. Password managers are supposed to help, but even they aren’t foolproof. The LastPass breach raised concerns about relying solely on these tools since they can become single points of failure. 
• Embracing Passwordless Technologies: By adopting passwordless technologies like passkeys or biometric authentication, we can enhance security and simplify the user experience. Passkeys use public-private key cryptography, allowing users to authenticate using their devices’ built-in capabilities. 
• Reducing Alert Fatigue: Cybersecurity professionals face an overwhelming number of alerts daily, many of which are false positives. This constant barrage leads to alert fatigue, where genuine threats might be missed. Our reliance on detection and response technologies like Endpoint Detection and Response (EDR) contributes to this overload. While valuable, they shouldn’t be our only defense.
• Proactive Security Measures: By adopting proactive security measures, we can reduce alerts and ease the burden on professionals. Techniques like micro segmentation compartmentalize the network, limiting threat spread and reducing the attack surface. By fortifying networks from the start, we prevent threats from reaching users in the first place. This approach lessens the reliance on human vigilance and reduces the chances of error due to fatigue or complexity.

This Cybersecurity Awareness Month, let’s shift the narrative. Too often, we find the easy victim—users—when the real issue lies in the systems they’re forced to work with. As responsible technologists, it’s our duty to simplify their lives, not complicate them.

It’s time to stop expecting users to be perfect and start designing systems that support them better. After all, security is a collective responsibility, and technology should be an enabler, not an obstacle.

Jon Fielding, Managing Director, EMEA at Apricorn

“Though cybersecurity should be an ongoing process, for some, it is often considered a tick box exercise, or in cases where budgets are restricted, it can be overlooked altogether. Cybersecurity Awareness Month presents an opportunity to raise awareness around the need to remain vigilant and consider the processes organizations can, and should, put in place.”

While many focus on external threats, it’s important not to underestimate the potential risks posed by insider threats. Employees, whether malicious or simply negligent, can inadvertently compromise sensitive data. To combat this, organizations should foster a culture of transparency and accountability, encouraging employees to report suspicious activities without fear of retribution. This approach not only mitigates risks but also empowers staff to take an active role in cybersecurity.

Moreover, organizations must prepare for the inevitable breaches that will happen. Instead of solely investing in prevention, businesses should prioritize building robust incident response plans that include the need for strong data backups. The ransom attack on UnitedHealth earlier this year was a prime example of how poor backup processes can have devastating consequences. 

In fact, many organizations dismiss the value of a comprehensive backup strategy, and a recent Apricorn survey found that 25% were only able to partially recover their data/documents following a breach. Regularly backing up data is not just a best practice; it’s a necessity. A backup and recovery strategy that follows the ‘3-2-1 rule’, having at least three copies of data stored on at least two different media, one of which should be offsite, can be the difference between a minor setback and a catastrophic failure.

Victor Monga, Global Cybersecurity Technologist at Menlo Security

“The internet has become such a big part of our everyday lives, and most of us don’t even realize how much we rely on it. Whether we’re shopping online, paying bills, or even closing million-dollar deals for work, most of these activities now happen in our web browser. It’s like the front door to everything we do online.”

But with that convenience comes risk. The same browser that lets you order groceries or work from home can also be a target for cybercriminals trying to steal your money, your identity, or even your work. It’s no longer just about protecting your bank account—it’s about protecting everything that matters to you.

Here are a few things that can happen if your digital security is compromised:

• Identity theft: Hackers can use your personal information to open credit cards or take out loans in your name.
• Loss of privacy: Cybercriminals can access your emails, personal messages, and sensitive files.
• Job security risks: If you work from home or on the go, your job might be at risk if your company’s data is stolen through your browser.
• Family safety: Your kids’ information can also be at risk, leading to identity theft or unwanted exposure to harmful content.

To protect yourself online, there are some simple but powerful steps you can take to keep your information safe. One of the most important things you can do is always use multi-factor authentication (MFA) whenever possible. This adds an extra layer of security by requiring a second form of identification, like a text message code or an app confirmation, before accessing your accounts. It’s also smart to validate any requests for money or signatures—if you’re about to transfer funds or sign an important document, double-check with the person or organization first, especially if it seems urgent or unexpected. Keeping an eye on your financial well-being is just as important, so make sure you review your credit card statements regularly for any suspicious activity.

Here are a few other things you can do to protect yourself:

• Keep your PC and all software up to date: Regular updates help patch security vulnerabilities that hackers could exploit.
• Only install software from trusted sources: Avoid downloading anything unless you’re certain it’s safe and from a reputable company.
• Be mindful of what you post or click on online: Remember, once you post something or click a suspicious link, it’s often a one-way street. Visiting websites with fake coupons or offers could lead to malicious actors tracking your activity or, worse—hacking into your system and ruining your day.

By following these steps, you can significantly reduce your risk of becoming a victim of cybercrime and protect not just your finances but your personal life and privacy as well.  Another essential way to protect yourself is by freezing your credit, which makes it harder for identity thieves to open new accounts in your name. You can call the three major credit bureaus—Equifax (1-800-685-1111), Experian (1-888-397-3742), and TransUnion (1-888-909-8872)—to request a credit freeze. It’s free, and it helps stop any new credit accounts from being opened without your permission. It’s a simple but effective way to secure your personal information. Stay vigilant and cautious—it’s better to prevent an issue than to fix it later! 

Innes Muir, Regional Manager, MSSPs, UK, EIRE and RoW, at Logpoint

“Cyber Awareness Month is now 20 years old, yet we still see the same security issues leading to attacks. Most attacks are opportunistic in nature – they exploit a lack of basic cyber hygiene – and it’s putting these controls in place that the National Cybersecurity Alliance, which established the initiative, is promoting this month. Effective password management, multi-factor authentication (MFA), spotting and reporting phishing attacks, and updating software are all on the list, but these require the organization to keep up to speed with their defenses and the evolving threat spectrum.”

Most organizations continue to find implementing these controls challenging. The Cyber Security Breaches Survey 2024 found that while 72% had a password policy, just over half (54%) had an agreed process for staff to follow with respect to fraudulent emails/websites, and only 39% had 2FA (let alone MFA), and 34% a policy to apply security updates within 14 days. It’s a picture that only worsens when it comes to SMBs. Armed with limited resources, rising costs, dwindling budgets, and faced with a shortage of cybersecurity professionals, these businesses struggle even more to cope with the day-to-day machinations of maintaining a secure network. 

There are ways in which this sector can embrace cybersecurity more effectively, however. Automating threat hunting, detection, and incident response can dramatically improve the ability of the enterprise to spot and stop attacks using a Security Incident and Event Management (SIEM) platform. Previously the preserve of big business, technological innovation has now placed this technology within reach of the SMBs, allowing them to detect issues in real-time. It’s also possible to combine the technology with other offerings such as Security Orchestration Automation and Response, automating response and remediation of issues.

But for businesses that do not want to manage their cybersecurity, Managed Detection and Response (MDR) may be a better solution. It sees a third-party provider, ie, an MSSP, provide a service that combines the capabilities of the SIEM with a response team, providing the business with a 24×7 solution. In either scenario, implementing a SIEM enables the SMB to dramatically improve its security posture and cyber hygiene without taking the focus away from its core line of business.”

Dena Bauckman, Senior Vice President of Product at Sectigo

“In the 21^st year of the Annual Cybersecurity Month, I can’t help but think that the themes for this year seem the same ones we have been talking about for years: use strong passwords and a password manager, turn on multifactor authentication, recognize and report phishing, and update software. So why do we still have to remind everyone to do these after all these years?”

I am convinced that in our personal and professional lives, we are all trying to move so fast that we don’t do the simple things we know we should. These four themes are basic security measures but take time to implement. I was once told that “sometimes you need to slow down to speed up,” and I think that is the case here.

Taking the time to set up a password manager, creating strong and unique passwords across all accounts, and combining that with multifactor authentication (MFA) on all systems would greatly reduce the compromised accounts that are part of so many attacks. With AI improving the effectiveness of phishing emails, we all need to slow down and think about who is sending us an email and why. And with the constant release of new software updates, we need to take the time to implement the updates and, wherever possible, automate the updates. If we can slow down long enough to implement these basic themes, we can go faster by spending less time recovering from cybersecurity attacks that should never have happened.