Cyber SafeRocheston Cybersecurity Awareness Campaign

Cybersecurity Best Practices

• Automate security monitoring and IR of cloud assets using cloud-native SOAR
• Set up and prepare your cloud digital forensics and IR environment before it is needed
• Retool analysis, containment and isolation capabilities to support cloud-native resources
• Rehearse your security response capability with cloud-focused adversary simulations
• Understand and follow all company policies regarding data security and confidentiality.
• Be an advocate for safe computing in your workplace by explaining the purpose of your organization’s cyber security practices to your coworkers and demonstrating the best practices.
• Help bridge the gap between IT security and employee productivity by informing your manager about any security-related frustrations your coworkers have.
• Do not use unapproved technology in the workplace.
• Encourage coworkers to use officially supported solutions.
• If a particular shadow technology fulfills a highly desired need in the workplace, advocate for its official adoption.
• Report suspected shadow IT usage to IT admin or manager.
• Do not install any applications on company devices without the explicit approval of your IT department.
• Take anti-phishing training that includes phishing simulations, examples of phishing emails, and procedures for reporting phishing attempts to your IT department.
• Treat every email that demands non-public information, files, or unexpected requests with suspicion – especially if it tries to force you to rush the request. If a request sounds dubious, take the time to call the requester and verify that their demands are legitimate.
• On receiving a suspected phishing email, report it to your IT department so they can investigate.
• Do not reuse passwords. If a data breach ever leaks one of your accounts the attacker could gain access to other accounts using your reused passwords.
• Use company-provided authentication measures such as a password manager or Identity Access Management (IAM) solution.
• Do not leave passwords in an insecure location such as a post-it note, journal, or unencrypted text file.
• Do not share your passwords or accounts with anyone, not even your coworkers.
• Every employee must have their own unique login credentials so that their activity can be accurately monitored and managed by the IT department.
• Think of password as more of a passphrase. Use a series of unrelated words to create long, simple passwords rather than short and complex ones. Passphrases are easier for you to remember and harder for attackers to brute force or guess.
• Leverage the most secure multi-factor authentication method.
• Follow employer’s internet use policies. They will provide you with guidance regarding the personal use of company devices.
• Wherever possible use personal devices for non-work web browsing and applications.
• Do not install or use unauthorized software on company computers.
• Understand that anything you do on the corporate network can be monitored.
• Do not visit high-risk websites such as file sharing sites on company devices.
• Do not store sensitive or confidential data on any portable storage device. These devices are easily lost or stolen, making them a valuable target for hackers.
• Follow your organization’s data security policies. They may include encryption requirements, specific procedures for USB devices, and designated devices.
• Do not insert unknown USB devices into company computers. Your organization should have policies and procedures surrounding USB devices such as requiring that they are scanned for malware using an air-gapped computer.
• Only use company-authorized USB devices. Do not bring personal USB flash drives to work and avoid using any USB devices that have been provided at conferences or trade shows unless they have been approved by your IT department.
• Do not bring company-provided USB devices home with you without prior approval and a legitimate need to do so. Instead, keep it locked in a secured cabinet in your workplace.
• Do not plug company-provided USB devices into personal computers. If your computer is infected with malware it could transmit it to your company’s network.
• Read and understand every security policy you agree to. Re-review them as necessary to ensure you do not pick up bad habits over time.
• Request clarification or further training whenever you are uncertain about how to follow a given policy or procedure.
• If you doubt the necessity of effectiveness of a given computer safety protocol, err on the side of trusting the corporate IT staff’s knowledge and background.
• If you see a coworker not following proper procedure, help educate them on the correct procedure or inform their supervisor.
• Avoid going against company security policies for the sake of convenience. For example, transferring data to a USB drive to bring data home to work on may be more convenient but you will risk losing that data or having it stolen. 37
• Follow any applicable social media policies that are provided by your company.
• Do not share nonpublic information about your workplace, coworkers, vendors, etc.
• If you use social media for work, ensure that you are clear about your intellectual property rights. Accounts that are created for work purposes may be considered your employer’s property even if they represent you as an individual.
• Limit the amount of personal information that you may publicly available on social media. This information could be used by an attacker to impersonate you in a social engineering scam.
• Do not openly complain about your workplace on social media. A potential attacker could use this information to persuade you to become a malicious insider threat. It may also cause damages to your reputation as a professional.
• Do not use public WiFi hotspots. Instead, make a password secured personal hotspot by tethering to your cell phone’s data network or by using a dedicated mobile router.
• If you do not have access to reliable mobile internet you can use an enterprise-grade VPN to reduce, but not eliminate, the security risks of public WiFi.
• Where possible you should only use public WiFi for low-risk web browsing on a personal device.
• Never leave your equipment unattended if you are working in public space. Even a short bathroom break can provide a thief plenty of time to steal a laptop or cell phone.
• Portability of sensitive data should not be permitted on portable devices such as USB storage devices, mobile phones, and laptops.
• Access permissions should be reviewed periodically to ensure that the available permissions are still relevant and necessary. Any permissions that are no longer needed should be restricted until a legitimate need arises.
• Encrypt sensitive data such as trade secrets, PII such as full names or social security numbers, and credit card data. Encrypt individual files and the devices they’ll be stored in.