Is Cybersecurity Awareness Month Anything More Than PR?

Cybersecurity Awareness Month has been going on since 2004. This
year, Cybersecurity Awareness Month^[1] urged the public,
professionals, and industry partners to “see themselves in cyber”
in the following ways:

1. The public, by taking action to stay safe online.
2. Professionals, by joining the cyber workforce.
3. Cyber industry partners, as part of the cybersecurity
   solution.

CISA outlined four “things you can do” to stay safe online for
individuals and families, including updating their software,
thinking before they click, using strong passwords, and enabling
multifactor authentication on sensitive accounts.

The industry has been teaching security tips to employees and
the public for a long time. With so much repetitive media and
education on cyber awareness in the rearview mirror, the returning
October focus weighs on many. Here’s a roundup of reactions to
cyber month and traction from this year’s themes and messaging
which should tell us if there’s more to the campaign than a public
relations angle.

Top news from Cybersecurity Awareness Month this year

Sentiments about Cybersecurity Awareness Month 2022 range from
mindfulness to meme-fulness, with sage advice and wisecracking
commingled across sharp, clever news and interest pieces.

At the top of the pile sits a review of “The dread, sincerity and comedy of
Cybersecurity Awareness Month^[2]” from The Washington
Post.

The dread and comedy were mostly sarcastic tweets without
acknowledging this year’s theme. Cybereason’s Ken Westin tweeted
that awareness month was created by Hallmark to sell more greeting
cards.

There was some backbiting, too. Cybersecurity reporter Sean Lyngass tweeted that Cybersecurity
Awareness Month is full of PR pitches^[3]
capitalizing on security breaches. Anne Cutler, PR executive at Keeper
Security, replied^[4], “You are mistaken. It’s
actually called Cybersecurity PR teams will hold no prisoners and
raise awareness whether you like it or not month. You may now
consider yourself aware.”

The Register took a sobering look at awareness month and its
inherent challenges in the “National Cybersecurity Awareness program 18
years on: Don’t click that^[5].”

It echoed the frustration in keeping cybersecurity awareness
technical enough to be useful yet simple enough to understand.
Industry participants need to move beyond “think before you click”
without losing their audiences and any effort the public is already
making to avoid phishing.

The Register expressed the need to make employees with little
cybersecurity knowledge more like full-fledged security
professionals. That will not happen soon. However, when the story
encapsulated the thrust of See Yourself in Cybersecurity—though
security is complex, it’s up to individuals to make it work—that
made sense.

The Register points up people are the solution because people
are the problem, with over 80% of breaches involving the human
element, including people falling for phishing attacks.

According to the Register, Seeing Yourself in the Cyber
Workforce reminds organizations hiring cyber staff that training
funding is increasing. They should use it for new hires and
professionals who have gained experience since last year’s
training.

Forbes revealed a trove of unfortunate cyberattack trends in
“For Cybersecurity Awareness Month (and
Halloween)–Some Scary Cyber Threat Stats.^[6]“

Cybersecurity Awareness Month hasn’t had a measurable
effect on breach trends. Breaches are increasingly common
and severe. Phishing was the worst in Q2 2022, with over 1 million
attacks.

Forbes notes that nation-state attacks aren’t just for critical
national infrastructure, with 64% of businesses saying
nation-states have hacked them. Still, industrial control systems
and OT are in more danger than regular IT assets.

Advice implementation from Cyber Security Awareness Month
2022

The CISA “four things you can do” initiative for the 2022
Cybersecurity Awareness Month, including updating software,
thinking before they click to prevent phishing, using strong
passwords, and enabling multifactor authentication was publicized
aiming to influence end-user behavior toward better security
practices. But does directive advice like this actually work?

The Register^[7]
clarifies that the success or failure of Cybersecurity Awareness
Month rests with how you measure it. The cyber month hasn’t worked
if you expect cybersecurity to be solved. If you hoped that people
and organizations would take cyber more seriously, then awareness
month is a success.

Cybersecurity Awareness Month and “the things you can do” worked
well enough. The most resonant thing to do was to find a more
effective people-based solution to phishing beyond “think before you click^[8].”

Under the surface of the Post article, voices on Twitter^[9]
clarified that phishing education, such as finger-pointing lectures
and surprise phishing tests, is unwelcome.

CISA wants industry partners to see themselves as part of the
solution, working together to build a secure and resilient
technology ecosystem. By engineering products to be secure by
design, they can collectively reduce risk and protect the critical
infrastructure Americans count on.

In his Forbes article^[10], Chuck Brooks points
out that, despite awareness month, the energy sector and the
electric grid are at significant risk of attack. Securing critical
national infrastructure against nation-state hackers, such as those
who attacked Colonial Pipeline, is challenging. It must be a public
and private sector priority, as CISA has endorsed.

How can we improve Cybersecurity in 2023 beyond a PR
effort?

Going beyond Cybersecurity Awareness Month means organizations
are responsible for their end-users cybersecurity education, but
there are also technical solutions that can solve for
bad end-user behavior^[11] and still safeguard
your organizations’ IT security. A few quick wins to do asap:

1 — Patch your software

Organizations can see software updates as costly, and many avoid
updates, so they don’t break applications that run on the software.
But to meet cybersecurity objectives in 2023, organizations must
patch their software as soon as updates are available.

2 — Block the use of known breached passwords

By scanning Active Directory for
password-related vulnerabilities with Specops Password
Auditor^[12], organizations can
identify the use of over 900 million weak and breached within their
Active Directory. Hackers use stolen credentials in attacks on
critical national infrastructure. Password audits ensure those
breached passwords aren’t in use in your organization.

3 — Audit the security level of the 3rd party apps you’re
using

A recent report found that popular work-related apps have some
major security gaps^[13] when it comes to
passwords and MFA. Take inventory of what web applications your
organization is trusting and make sure MFA, or at least 2FA, is
enabled for your end users.