The Essential Guide: The Top 10 Cybersecurity Controls Everyone should know

Cybersecurity Control

Explanation

Advise

Do's

Don'ts

Phishing Attack

Phishing attacks involve tricking individuals into revealing sensitive information, such as login credentials or financial details, by disguising as a trustworthy entity. Attackers often send fraudulent emails or direct users to fake websites, luring them into providing personal information unknowingly. These attacks can lead to identity theft, unauthorized access to accounts, and financial losses.

Avoid clicking on suspicious links or downloading attachments from unfamiliar sources.

Do verify the legitimacy of emails and websites before providing personal information.

Do educate yourself and your employees about common phishing tactics and warning signs

Verify the authenticity of emails and websites before sharing information.

Be cautious of unexpected or urgent requests for personal information.

Report suspected phishing attempts to the appropriate authorities.

Don't provide personal information without confirming the source's authenticity.

Media Usage

Media devices, such as USB drives or external hard drives, can introduce malware into systems if not properly scanned. These devices may contain infected files or malicious software that can compromise the security of your network or steal sensitive data. It is essential to exercise caution when using external media devices and take steps to mitigate the risks associated with their use.

Don't insert unknown or unverified media devices into your system.

Do scan all media devices for malware before using them.

Do encrypt sensitive data stored on removable media.

Scan media devices for malware using reliable antivirus software.

Encrypt sensitive data stored on removable media for an added layer of protection.

Regularly update antivirus software to detect the latest threats.

Don't insert media devices from untrusted or unknown sources.

Don't ignore the importance of scanning media devices for malware.

Don't store sensitive data on unencrypted removable media.

Password Security

Passwords are a critical component of securing digital accounts and systems. Weak or easily guessable passwords make it easier for attackers to gain unauthorized access. Strong passwords and additional security measures, such as multi-factor authentication (MFA), help protect against unauthorized access and potential data breaches.

Avoid using weak or easily guessable passwords.

Do use strong, unique passwords for each account.

Do enable multi-factor authentication (MFA) whenever possible.

Create passwords that incorporate a combination of uppercase and lowercase letters, numbers, and special characters.

Make it a habit to regularly update your passwords and refrain from reusing them across multiple accounts.

Enhance your security by enabling multi-factor authentication to add an additional layer of protection.

Avoid using easily guessable passwords such as "123456" or "password".

Avoid reusing the same password for multiple accounts.

Don't disable or ignore the option for multi-factor authentication. Use passphrases rather than passwords. Passphrases are much longer than passwords.

Internet Use

Safe and responsible internet usage is crucial to protect against cyber threats. The internet is filled with malicious websites, vulnerable software, and potential risks. It's important to adopt security measures and best practices to mitigate these risks.

Don't visit suspicious or untrustworthy websites.

Do keep your software and browsers up to date with the latest security patches.

Do use reputable antivirus or anti-malware software.

Use strong and up-to-date antivirus or anti-malware software to detect and block malicious websites and downloads.

Regularly update your software, including operating systems, browsers, and plugins, to address security vulnerabilities.

Exercise caution when visiting websites and avoid clicking on suspicious links.

Don't visit suspicious or untrustworthy websites that may contain malware or phishing attempts.

Don't ignore software updates, leaving your system vulnerable to known exploits.

Don't disable or neglect to use antivirus or anti-malware software, leaving your system unprotected.

Email

Email is a common communication method, but it is also a target for cyber attacks. Attackers may send malicious emails containing malware, phishing links, or fraudulent requests to compromise personal or organizational data.

Don't open emails or attachments from unknown or suspicious sources.

Do enable spam filters and email encryption.

Do be cautious of phishing attempts and verify the authenticity of emails before taking any action.

Enable spam filters to reduce the risk of malicious emails.

Use encryption when transmitting sensitive information via email.

Be cautious of unexpected or suspicious email requests, even if they appear to come from familiar sources.

Exercise caution when opening emails or attachments from unfamiliar sources.

Don't share sensitive information via unencrypted emails.

Always verify the authenticity of links and attachments before clicking on them or downloading them.

Social Media

Social media platforms provide a platform for sharing personal information, but they can also be exploited by attackers. Cybercriminals may create fake profiles or use social engineering tactics to gain access to personal data or spread malware.

Don't share personal or sensitive information publicly.

Do review and adjust privacy settings to control who can access your information.

Do be cautious of friend requests or messages from unknown individuals.

Regularly review and update privacy settings on social media platforms.

Be cautious of accepting friend requests from unknown individuals.

Think twice before sharing personal information publicly, considering potential risks.

Don't share sensitive personal information publicly.

Don't accept friend requests from unknown or suspicious individuals.

Don't click on links or download files shared by unknown sources.

Cloud Computing

Cloud computing involves storing and accessing data and applications over the internet. While convenient, it poses security risks. Breaches in cloud services can lead to unauthorized access, data leaks, or service interruptions.

Don't use insecure or untrusted cloud service providers.

Do implement strong access controls and encryption for data stored in the cloud.

Do regularly back up your data and have a contingency plan for data loss or breaches.Read their terms and conditions before signing up.If the cloud service provider is GDPR compliant ttest their data subject request procedures by sending request for your personal data they have.

Choose reputable and secure cloud service providers.

Implement strong access controls and encryption mechanisms for data stored in the cloud.

Regularly back up data and test the restoration process to ensure its effectiveness.

Don't use cloud service providers with a history of security breaches.

Don't store sensitive data in the cloud without implementing proper access controls or encryption.

Don't neglect to regularly back up data stored in the cloud.

Remote Working

Remote working allows employees to access company resources from outside the traditional office environment. However, it introduces additional security risks, such as unsecured Wi-Fi networks and vulnerable endpoints.

Don't connect to unsecured public Wi-Fi networks.

Do use secure VPN connections for remote access.

Do keep remote devices and software updated with the latest security patches.

Connect to secure Wi-Fi networks or use a VPN when accessing company resources remotely.

Regularly update remote devices and software to address security vulnerabilities.

Use strong, unique passwords and enable multi-factor authentication for remote access.

Don't connect to unsecured public Wi-Fi networks without using a VPN.

Don't neglect to update remote devices and software, leaving them vulnerable to known exploits.

Don't use weak or easily guessable passwords for remote access.

Mobile Device

Mobile devices, such as smartphones and tablets, are commonly used for communication and accessing sensitive information. However, they are susceptible to various security risks, including malware infections, data breaches, and unauthorized access.

Don't download apps or click on suspicious links from unknown sources.

Do use strong passwords or biometric authentication to secure your mobile device.

Do install reputable security apps and regularly update your device's firmware.

Download apps from trusted sources, such as official app stores.

Use strong passwords or biometric authentication methods to secure your mobile device.

Keep your device's firmware up to date and install security updates regularly.

Don't Download apps from untrusted or unofficial sources.

Don't ignore security updates and fail to install them promptly.

Don't use weak or easily guessable passwords for mobile device access.

Social Engineering

Social engineering refers to manipulating individuals to gain unauthorized access to information or systems. Attackers may use various tactics, such as impersonation, deception, or psychological manipulation, to trick individuals into disclosing sensitive data or performing actions that compromise security.

Don't provide personal or sensitive information to unknown individuals.

Do verify the identity of individuals before sharing any confidential information.

Do educate yourself and employees about common social engineering tactics and how to recognize and report them.

Be cautious of unexpected requests for personal or sensitive information.

Verify the identity of individuals before sharing confidential information.

Report any suspicious social engineering attempts to the appropriate authorities.

Don't share personal or sensitive information without verifying the recipient's identity.

Don't fall for persuasive tactics or manipulation techniques used by attackers.

Don't ignore or fail to report suspected social engineering incidents.

Security at Home

Home networks and devices connected to them are potential targets for cyber attacks. Weak or unsecured Wi-Fi networks, outdated router firmware, or vulnerable smart devices can compromise the overall security of a home environment.

Don't leave your Wi-Fi network unsecured or use weak passwords for routers.

Do use strong passwords and encryption for your home network.

Do regularly update the firmware of your routers and be cautious of smart devices' security vulnerabilities.

Secure your home Wi-Fi network with a strong, unique password.

Regularly update router firmware to address security vulnerabilities.

Ensure smart devices are from reputable manufacturers and promptly apply security patches.

Don't use default or weak passwords for home Wi-Fi networks.

Don't neglect to update router firmware, leaving them vulnerable to known exploits.

Don't install untrusted or unofficial smart devices without considering their security implications.