Understanding Cyber Threats: How Attackers Target People, Systems, and Organizations

 Understanding Cyber Threats: How Attackers Target People, Systems, and Organizations

By Heather Lange-Wilson

Cybersecurity incidents do not always begin with sophisticated hackers breaking through complex security systems. Many attacks begin with something surprisingly ordinary: an employee receives a phishing email, someone uses a compromised password, a computer misses an important security update, or a user approves an unexpected multifactor authentication request.

These situations demonstrate an important cybersecurity principle: attackers look for opportunities.

Understanding those opportunities is a major part of CompTIA Security+ Domain 2: Threats, Vulnerabilities, and Mitigations. This domain focuses on identifying threats, recognizing vulnerabilities, understanding common attacks, and implementing protections that reduce risk.

Employees do not need to become cybersecurity experts to contribute. Understanding a few fundamental concepts can significantly improve an organization's overall security.

Threats, Vulnerabilities, and Risk

Three terms are important to understand: threat, vulnerability, and risk.

A threat is something capable of causing harm. Cybercriminals, malicious insiders, malware, ransomware, and even accidental human actions can represent threats.

A vulnerability is a weakness that could be exploited. Examples include unpatched software, weak passwords, incorrect permissions, default credentials, and poorly configured systems.

Risk exists when a threat could take advantage of a vulnerability and negatively affect the organization.

Consider an employee account protected by a weak password. The weak password is a vulnerability. A cybercriminal attempting to compromise the account represents the threat. Unauthorized access to organizational systems or information represents the potential risk.

Security controls attempt to reduce that risk.

Why Attackers Target People

Organizations use sophisticated security technologies, including firewalls, endpoint protection, encryption, email filtering, and security monitoring.

Attackers know this.

Rather than attacking technology directly, they may attempt to manipulate the person using it.

This is known as social engineering.

Social engineering relies on human emotions and behavior. Attackers frequently create:

• Urgency
• Fear
• Curiosity
• Authority
• Trust

An employee might receive an email claiming:

“Your account will be disabled today unless you verify your password immediately.”

The attacker wants the employee to react before thinking.

A useful security habit is simple:

Stop. Look. Verify.

If a request is unexpected, especially one involving passwords, money, sensitive information, or system access, verify it through an established method before taking action.

Phishing and Targeted Attacks

Phishing uses deceptive communications to convince victims to perform an action.

Attackers may want employees to:

• Click malicious links
• Open attachments
• Enter credentials
• Provide sensitive information
• Send money
• Approve authentication requests

Not all phishing attacks are generic.

Spear phishing targets specific individuals or organizations. Attackers may research employees, job titles, vendors, and organizational relationships to make their messages more convincing.

Whaling is targeted phishing directed at executives or other high-value individuals.

Phishing can also occur outside email.

Smishing uses text messages.

Vishing uses telephone or voice communication.

Regardless of the communication method, the basic defense remains similar: unexpected requests should be independently verified.

Multifactor Authentication Attacks

Multifactor authentication, or MFA, provides important protection when passwords are compromised.

However, attackers sometimes attempt to manipulate MFA users.

Suppose an attacker already has an employee's password. The attacker repeatedly attempts to log in, generating authentication notifications on the employee's phone.

Eventually, the employee may approve one simply because the notifications are annoying.

This technique is often called MFA fatigue or MFA push bombing.

If you receive an authentication request you did not initiate:

Do not approve it.

Deny the request and report it through your organization's established security process.

An unexpected MFA request may indicate that someone already possesses your password.

Password Attacks

Passwords remain attractive targets.

Attackers may use several methods to compromise them.

A brute-force attack attempts many password combinations until the correct one is discovered.

A password-spraying attack takes a different approach. Instead of trying thousands of passwords against one account, the attacker tries a commonly used password against many accounts.

Credential stuffing occurs when attackers take usernames and passwords exposed in one breach and attempt to use them on other services.

This is one reason password reuse is dangerous.

If the same password is used for several services, one compromised account could potentially expose several others.

Unique passwords and multifactor authentication significantly reduce this risk.

Malware and Ransomware

Malware is malicious software designed to perform harmful or unauthorized activities.

Common types include viruses, worms, Trojans, spyware, and ransomware.

A Trojan disguises itself as legitimate software.

A worm can spread between systems with limited user interaction.

Spyware attempts to monitor activity or collect information.

Ransomware commonly encrypts files or systems and demands payment for their recovery. Some ransomware groups also steal information before encryption and threaten to release it publicly.

Organizations defend against malware using multiple controls, including:

• Endpoint protection
• Email filtering
• Security updates
• Restricted administrative privileges
• Network segmentation
• Security monitoring
• Backups
• Employee security awareness

Employees contribute by avoiding unknown downloads, using approved software, and reporting suspicious activity.

Unpatched Systems and Misconfigurations

Not every vulnerability involves a sophisticated attack.

Sometimes systems simply have not been updated.

Software vendors regularly release security patches that correct known vulnerabilities. When systems remain unpatched, attackers may exploit weaknesses for which fixes already exist.

Employees can help by allowing approved updates to install and restarting computers when required.

Misconfiguration is another common source of vulnerability.

A system may have:

• Excessive permissions
• Default passwords
• Unnecessary services
• Open network ports
• Incorrect security settings

Organizations use security baselines and configuration-management processes to reduce these risks.

Insider Threats

Not every cybersecurity threat originates outside the organization.

An insider threat involves someone who has legitimate access to organizational systems or information.

Insider threats may be intentional or accidental.

A malicious insider may deliberately steal information.

A careless employee may accidentally send sensitive information to the wrong person.

A legitimate employee account may also be compromised by an external attacker.

This is why organizations use controls such as least privilege, logging, access reviews, and security monitoring even for internal accounts.

Physical Security Matters

Cybersecurity also includes physical security.

An attacker who gains physical access to a restricted area may be able to access unattended computers, steal equipment, photograph confidential information, or connect unauthorized devices.

One common physical social-engineering technique is tailgating.

Tailgating occurs when an unauthorized person follows an authorized employee through a secured entrance.

Employees should follow visitor and badge procedures rather than allowing unknown individuals to bypass access controls.

The same caution applies to unknown USB drives and removable media. Never connect an unknown device to an organizational computer simply to see what it contains.

Mitigation and Defense in Depth

Identifying threats is only part of cybersecurity.

Organizations must also reduce the likelihood or impact of successful attacks.

This is known as mitigation.

One of the most important cybersecurity strategies is defense in depth.

Defense in depth means using multiple security controls rather than depending on one.

Consider a phishing attack.

An email security system may block the message.

If it does not, employee awareness may prevent the user from clicking the link.

If credentials are stolen, MFA may prevent account access.

If an account is compromised, least privilege may restrict what the attacker can reach.

If malicious activity occurs, monitoring systems may detect it.

Each layer provides another opportunity to stop the attack.

Least Privilege

The principle of least privilege means users should receive only the access necessary to perform their responsibilities.

An employee who does not require administrator privileges should not have them.

A vendor that only requires access to one application should not automatically receive access to the entire network.

Least privilege reduces the potential impact of compromised accounts, malware, mistakes, and insider threats.

Employees Are Part of the Defense

Cybersecurity technology is important, but employees remain an essential security layer.

Every employee can reduce risk by following a few basic practices:

• Think before clicking links or attachments.
• Verify unusual requests.
• Protect passwords and authentication information.
• Never approve unexpected MFA requests.
• Use approved software and services.
• Keep organizational information in approved locations.
• Lock unattended computers.
• Follow physical access requirements.
• Allow approved security updates to install.
• Report suspicious activity quickly.

Employees are not expected to investigate cybersecurity incidents themselves.

When something seems unusual, report it and allow the appropriate IT or security team to investigate.

Why Reporting Matters

Imagine receiving a phishing email and recognizing it immediately.

You delete it without clicking anything.

You protected yourself, but the attack may not be over.

Hundreds of other employees may have received the same message.

Reporting the phishing attempt gives security personnel an opportunity to identify similar messages, block malicious links, warn employees, and determine whether anyone else interacted with the attack.

Reporting suspicious activity can therefore protect more than one person.

It can protect the entire organization.

Final Takeaway

Attackers look for opportunities. Sometimes those opportunities are technical vulnerabilities. Other times they involve passwords, physical access, misplaced trust, or simple human mistakes.

Strong cybersecurity therefore requires more than security software.

It requires people, processes, and technology working together.

Employees do not need to recognize every cybersecurity technique. They need to recognize when something appears unusual, stop before acting, verify unexpected requests, follow established security procedures, and report concerns quickly.

Every suspicious email reported, every unexpected MFA request denied, every computer kept updated, and every unusual situation questioned removes another opportunity an attacker might otherwise exploit.

Cybersecurity is everyone's responsibility - and awareness is one of our strongest defenses.

 -  Heather Lange-Wilson

 

Change Management and Configuration Management: Keeping Systems Secure Through Controlled Change

 Change Management and Configuration Management: Keeping Systems Secure Through Controlled Change

By Heather Lange-Wilson

Technology never stays the same.

Software gets updated. Computers are replaced. Firewall rules change. New applications are installed. User permissions are modified. Servers are upgraded. Cloud services are introduced. Security patches are deployed.

Change is necessary.

But every change can also introduce cybersecurity risk.

A seemingly minor configuration change can accidentally expose a system to the internet. An untested software update can cause an important application to stop working. An unnecessary administrator permission can give someone more access than intended.

This is why change management and configuration management are important parts of cybersecurity.

The goal is not to prevent change.

The goal is to make sure changes are authorized, documented, tested, implemented, and reviewed in a controlled manner.

What Is Change Management?

Change management is a structured process for controlling changes to systems, applications, networks, and other technology.

Instead of someone simply deciding:

“I'm going to change this setting.”

A formal change process asks several questions first.

What is changing?

Why is the change necessary?

What systems could be affected?

What could go wrong?

Has the change been tested?

Who approved it?

When should it be implemented?

How will we know whether it worked?

How can we reverse it if something goes wrong?

These questions may seem excessive for a small change, but organizations depend on interconnected technology.

A change to one system can unexpectedly affect several others.

Why Change Creates Security Risk

Imagine that an administrator changes a firewall rule to troubleshoot an application.

The change fixes the application.

But the firewall rule also unintentionally allows external access to a sensitive server.

The operational problem was solved, but a cybersecurity vulnerability was created.

Now imagine that nobody documented the firewall change.

Weeks later, another administrator reviews the firewall and has no idea why the rule exists.

This illustrates why controlled change matters.

Documentation provides history.

Testing reduces unexpected problems.

Approval establishes accountability.

Review helps verify that the change produced the intended result without introducing unacceptable risk.

Types of Changes

Organizations may classify changes differently depending on their processes.

Common categories include:

Standard Changes

A standard change is a routine, well-understood change that follows an established procedure.

Examples might include regularly approved software updates or routine account-management activities.

Because the process is already understood and documented, it may require less individual review.

Normal Changes

A normal change may require additional evaluation, testing, scheduling, and approval before implementation.

For example, upgrading an important business application could require coordination between multiple departments.

Emergency Changes

Sometimes organizations cannot wait for the normal change-management process.

A critical vulnerability may be actively exploited.

A major system may be unavailable.

An emergency security configuration may need to be deployed immediately.

Emergency change procedures allow organizations to respond quickly while still maintaining appropriate documentation and accountability.

Emergency does not mean undocumented.

The change should still be recorded and reviewed afterward.

What Is Configuration Management?

Change management focuses on controlling changes.

Configuration management focuses on maintaining systems in known and approved configurations.

Organizations may establish secure configurations for:

• Workstations
• Laptops
• Servers
• Firewalls
• Routers
• Mobile devices
• Cloud systems
• Applications

Instead of configuring every computer differently, the organization establishes an approved baseline.

Security Baselines

A security baseline defines the minimum approved security configuration for a system.

A workstation baseline might specify:

• Required security software
• Firewall settings
• Password requirements
• Screen-lock settings
• Approved operating-system versions
• Encryption requirements
• Logging settings
• Disabled services
• Patch requirements

Baselines help create consistency.

If 1,000 computers are configured 1,000 different ways, protecting and troubleshooting them becomes significantly more difficult.

Standardization reduces unnecessary variation.

Configuration Drift

Even when systems begin with identical configurations, they can gradually become different.

This is called configuration drift.

For example, someone might disable a security setting while troubleshooting and forget to turn it back on.

Another person might install unauthorized software.

Someone else might manually change a firewall rule.

Over time, the system no longer matches the approved baseline.

Organizations may use configuration-management and monitoring tools to identify these differences.

Hardening Systems

System hardening involves reducing unnecessary security exposure.

Hardening can include:

• Removing unnecessary software
• Disabling unused services
• Closing unnecessary ports
• Changing default credentials
• Applying security patches
• Enabling encryption
• Restricting administrative privileges
• Enabling appropriate logging

A newly installed operating system or application may not automatically have the most secure configuration for every organization.

Hardening adjusts the system to meet organizational security requirements.

Testing Changes Before Deployment

Whenever practical, significant changes should be tested before being deployed broadly.

Testing can identify:

• Application compatibility problems
• Performance issues
• Security problems
• Unexpected dependencies
• Installation failures

Organizations may use test environments, pilot groups, or staged deployments.

For example, instead of deploying an operating-system update to 5,000 computers simultaneously, an organization might first deploy it to a smaller group.

If unexpected problems occur, fewer users are affected.

Rollback Plans

Sometimes changes fail.

That possibility should be considered before implementation.

A rollback plan explains how the organization will return the system to its previous working state.

Rollback might involve:

• Restoring a previous configuration
• Uninstalling an update
• Restoring a backup
• Reverting a virtual machine snapshot
• Restoring previous firewall rules

The question should not be:

“What do we do if this fails?”

after the failure occurs.

That question should be answered before the change begins.

Maintenance Windows

Organizations may schedule significant changes during designated maintenance windows.

A maintenance window is a planned period when systems may be updated or temporarily unavailable.

Scheduling changes during these periods can reduce operational disruption.

Employees should pay attention to maintenance notifications.

If IT announces that a system will be unavailable during a scheduled maintenance period, employees should plan accordingly rather than attempting unauthorized workarounds.

Unauthorized Changes

Not every technology change is approved.

Employees sometimes install applications, browser extensions, utilities, or cloud services because they make work easier.

However, unauthorized technology can create security risks.

The software may:

• Contain vulnerabilities
• Collect organizational information
• Introduce malware
• Conflict with security software
• Store information outside approved environments
• Create licensing issues

Employees should follow organizational procedures for requesting new software or services.

Convenience should not override security.

Documentation Matters

Documentation is one of the most important parts of change management.

A change record may include:

• Description of the change
• Business reason
• Systems affected
• Risk assessment
• Testing results
• Implementation plan
• Rollback plan
• Approvals
• Implementation date
• Final results

Months later, administrators can review the record and understand what happened and why.

Without documentation, troubleshooting often becomes guesswork.

Post-Implementation Review

Completing a change does not necessarily mean the process is finished.

Organizations may conduct a post-implementation review.

The review asks:

Did the change work?

Did anything unexpected happen?

Were security controls affected?

Should documentation be updated?

What did we learn?

Lessons learned can improve future changes.

Employees Have a Role Too

Change management may sound like something only IT employees need to understand.

Employees also contribute.

Employees should:

• Avoid installing unauthorized software
• Follow application-request procedures
• Report unexpected system changes
• Pay attention to maintenance notifications
• Avoid disabling security controls
• Report problems after updates
• Follow instructions during system upgrades

If something suddenly looks different after an update, reporting it may help identify a larger issue affecting other employees.

The Danger of “Just This Once”

Security problems frequently begin with temporary exceptions.

“I'll disable the firewall just long enough to test this.”

“I'll give this account administrator access for now.”

“I'll open this port temporarily.”

“I'll install this application and remove it later.”

Temporary changes have a tendency to become permanent when nobody remembers to reverse them.

Formal change management helps prevent this.

If an exception is necessary, it should be documented, appropriately approved, and removed when it is no longer required.

Change Is Necessary - Uncontrolled Change Is the Risk

Organizations cannot remain secure by refusing to change.

In fact, refusing to update systems can create even greater risk.

Security patches need to be installed.

Old technology needs to be replaced.

Configurations need to evolve.

New threats require new protections.

The important distinction is between controlled change and uncontrolled change.

Controlled changes are evaluated.

They are documented.

They are tested.

They are approved.

They have rollback plans.

And afterward, someone verifies that they accomplished what they were supposed to accomplish.

That structure allows organizations to improve technology without unnecessarily sacrificing security or stability.

Knowledge Check

1. What is the primary purpose of change management?

A. Prevent all technology changes
B. Control and document changes to reduce operational and security risk
C. Allow employees to install any application
D. Eliminate system updates

Answer: B

2. What is a security baseline?

A. An approved minimum security configuration
B. A list of employee passwords
C. A disaster-recovery site
D. An incident-response report

Answer: A

3. What is configuration drift?

A. Moving computers between buildings
B. Systems gradually moving away from their approved configurations
C. Installing a new computer
D. Performing a backup

Answer: B

4. Why should significant changes have a rollback plan?

A. To determine how to restore the previous state if the change fails
B. To eliminate documentation
C. To avoid testing
D. To permanently disable security controls

Answer: A

5. What is system hardening?

A. Making computer hardware physically stronger
B. Reducing unnecessary system exposure and applying secure configurations
C. Preventing all software updates
D. Giving users administrator access

Answer: B

6. What should happen to emergency changes?

A. They should never be documented.
B. They should bypass all security controls permanently.
C. They should still be documented and appropriately reviewed.
D. They should only be performed once per year.

Answer: C

7. An employee needs software that is not currently approved. What should the employee generally do?

A. Download it from any website
B. Disable endpoint protection before installing it
C. Follow the organization's software request and approval process
D. Install it using another employee's administrator account

Answer: C

Security+ Quick Review

Change Management = Structured control of technology changes

Configuration Management = Maintaining systems in known, approved configurations

Security Baseline = Minimum approved security configuration

Configuration Drift = A system moving away from its approved configuration over time

System Hardening = Reducing unnecessary attack surface and applying secure settings

Rollback Plan = Instructions for returning to the previous state if a change fails

Maintenance Window = Scheduled period for planned system maintenance or changes

Emergency Change = Urgent change handled through an expedited but still controlled process

Post-Implementation Review = Verification that a completed change worked as intended

Final Takeaway

Technology must change to remain useful and secure.

But every change should have a purpose.

Know what is changing.

Understand the risk.

Test when possible.

Document what was done.

Have a way back if it fails.

And verify the result.

Good change management is not about slowing technology down. It is about making sure that today's solution does not become tomorrow's cybersecurity incident.

 

Cybersecurity Governance: Who Is Responsible for Security?

 Cybersecurity Governance: Who Is Responsible for Security?

By: Heather Lange-Wilson

Who is responsible for cybersecurity?

The cybersecurity team?

IT?

Management?

Employees?

The answer is all of them - but they have different responsibilities.

Cybersecurity governance establishes how an organization directs, manages, and oversees its cybersecurity program.

It helps answer questions such as:

Who makes security decisions?

Who owns cybersecurity risks?

Who approves policies?

Who ensures requirements are followed?

Who is accountable when corrective action is required?

Without governance, security decisions can become inconsistent and responsibilities unclear.

What Is Cybersecurity Governance?

Governance provides organizational direction and oversight.

It connects cybersecurity with:

• Business objectives
• Risk management
• Policies
• Legal requirements
• Regulatory requirements
• Leadership responsibilities
• Accountability

Cybersecurity governance ensures security is treated as an organizational issue rather than simply a technical problem.

Leadership Responsibilities

Leadership establishes priorities and determines acceptable levels of organizational risk.

Senior management may be responsible for:

• Approving policies
• Allocating resources
• Reviewing significant risks
• Establishing accountability
• Supporting security initiatives

Technical staff can explain vulnerabilities and recommend controls, but some risk decisions ultimately require business leadership.

Security and IT Responsibilities

Cybersecurity and IT teams may implement and operate controls such as:

• Firewalls
• Endpoint protection
• Identity management
• Logging
• Vulnerability management
• Incident response
• Security monitoring

They may also provide technical guidance to leadership.

However, IT should not be expected to make every organizational risk decision alone.

Risk Owners

Organizations may assign risk owners.

A risk owner is responsible for overseeing a particular risk and ensuring it is appropriately managed.

Ownership creates accountability.

Instead of saying:

“Someone should fix this,”

the organization can identify who is responsible for tracking the issue and making sure appropriate action occurs.

Policies Create Direction

Security policies translate governance decisions into organizational expectations.

Policies may address:

• Acceptable use
• Access control
• Information security
• Remote access
• Data handling
• Incident response
• Vendor management

Policies help employees understand what is expected.

Governance ensures those policies have appropriate authority and oversight.

Separation of Duties

One important governance principle is separation of duties.

Critical activities may be divided among multiple people so one individual does not control the entire process.

For example, the person requesting a significant financial transaction might not be the same person approving it.

In technology, administrative responsibilities may also be divided.

Separation of duties can reduce fraud, mistakes, and misuse.

Job Rotation and Mandatory Vacations

Organizations may use job rotation to periodically move employees between responsibilities.

This can improve cross-training and sometimes help reveal inappropriate activities that might otherwise remain hidden.

Mandatory vacations can serve a similar control purpose in certain sensitive positions because another employee must perform the person's responsibilities during the absence.

These concepts are important within Security+ governance and security-control discussions.

Policies Need Enforcement

A policy that nobody follows provides limited protection.

Organizations should support policies through:

• Training
• Technical controls
• Monitoring
• Management support
• Consistent enforcement
• Periodic review

Policies should also remain realistic.

If employees routinely need to bypass a policy to perform legitimate work, the organization should investigate why.

The solution may involve better technology, a revised process, additional training, or an updated policy.

Employees Have Governance Responsibilities Too

Employees may not approve cybersecurity budgets or organizational risk strategies, but they still participate in governance.

Employees are responsible for:

• Following policies
• Protecting organizational information
• Completing required training
• Using approved systems
• Reporting security concerns
• Following access requirements
• Asking questions when requirements are unclear

Governance works only when organizational expectations translate into everyday behavior.

Accountability Does Not Mean Blame

Accountability means understanding who is responsible for particular decisions and actions.

It should not automatically mean finding someone to blame whenever something goes wrong.

Effective organizations examine incidents to understand:

What happened?

Why did it happen?

Which controls failed?

What should change?

Lessons learned can strengthen governance and prevent repeated problems.

Metrics and Oversight

Leadership needs information to understand whether the cybersecurity program is working.

Organizations may monitor metrics such as:

• Security incidents
• Vulnerability remediation
• Training completion
• Phishing simulation results
• Patch compliance
• Vendor assessments
• Audit findings
• Risk remediation

Metrics should help leaders make informed decisions rather than simply generate reports.

Cybersecurity Is an Organizational Responsibility

The cybersecurity department cannot protect an organization alone.

IT cannot protect an organization alone.

Leadership cannot protect an organization alone.

Employees cannot protect an organization alone.

Effective cybersecurity requires each group to understand its responsibilities.

Leadership provides direction.

Security teams provide expertise and oversight.

IT implements and operates technology.

Managers enforce expectations.

Employees follow requirements and report concerns.

Governance connects those responsibilities.

Knowledge Check

1. What is cybersecurity governance primarily concerned with?

A. Organizational direction, oversight, responsibility, and accountability
B. Installing printers
C. Increasing internet speed
D. Replacing all policies

Answer: A

2. What is a risk owner?

A. Someone responsible for overseeing and managing an assigned risk
B. Every external attacker
C. A software vendor
D. A backup administrator only

Answer: A

3. What is separation of duties?

A. Giving one person complete control
B. Dividing critical responsibilities among multiple people
C. Eliminating management
D. Sharing administrator passwords

Answer: B

4. Why might organizations use mandatory vacations in certain sensitive positions?

A. They can require someone else to perform the employee's responsibilities, potentially revealing irregularities.
B. They eliminate cybersecurity risk.
C. They replace audits.
D. They prevent employees from receiving training.

Answer: A

5. Who is responsible for organizational cybersecurity?

A. Only IT
B. Only executives
C. Only the security department
D. Multiple groups throughout the organization, with different responsibilities

Answer: D

Security+ Quick Review

Governance = Organizational direction and oversight

Risk Owner = Person responsible for overseeing an assigned risk

Separation of Duties = Dividing sensitive responsibilities

Job Rotation = Periodically changing responsibilities

Mandatory Vacation = Requiring time away so another person performs sensitive duties

Security Metrics = Measurements used to evaluate and oversee security performance

Accountability = Clearly establishing responsibility for decisions and actions

Final Takeaway

Cybersecurity is not simply an IT responsibility.

Technology teams may operate the systems, but leadership establishes direction, managers support enforcement, risk owners manage identified risks, and employees make security-related decisions every day.

Good governance makes those responsibilities clear.

When everyone understands their role, cybersecurity becomes part of how the organization operates - not simply something the security department does.

 

Incident Reporting and Security Culture: See Something, Say Something

 Incident Reporting and Security Culture: See Something, Say Something

By: Heather Lange-Wilson

A cybersecurity incident does not always begin with flashing warnings or obvious ransomware messages.

Sometimes it begins with something small.

An unexpected MFA request.

A suspicious email.

A laptop that suddenly behaves differently.

A document accidentally sent to the wrong person.

A phone call asking for information that normally would not be requested.

The speed at which these events are reported can make a significant difference.

What Should Employees Report?

Employees should follow organizational procedures for reporting situations including:

• Suspicious emails
• Unexpected MFA requests
• Lost or stolen equipment
• Malware warnings
• Accidental information disclosure
• Unusual account activity
• Unauthorized software
• Suspicious phone calls
• Unknown people in restricted areas
• Unexpected changes to files

Employees do not need to determine whether something officially qualifies as an incident before reporting it.

Report the concern and allow the appropriate team to investigate.

Why Speed Matters

Suppose an employee accidentally enters credentials into a phishing website.

If the employee reports it immediately, security personnel may be able to:

• Reset credentials
• Terminate active sessions
• Review account activity
• Block malicious infrastructure
• Search for similar phishing messages

If the employee waits several days, attackers have additional time to use the compromised account.

Reporting quickly gives responders options.

Do Not Hide Mistakes

People make mistakes.

Clicking a suspicious link and immediately reporting it is far better than hiding the mistake.

Employees sometimes hesitate because they are embarrassed or afraid of consequences.

A security culture that makes people afraid to report mistakes may unintentionally increase organizational risk.

Accountability remains important, but so does early communication.

Preserve Evidence

Employees may instinctively try to clean up a suspected incident themselves.

That can sometimes destroy useful evidence.

Unless instructed otherwise, employees should avoid actions such as:

• Deleting suspicious messages
• Wiping devices
• Removing files
• Reinstalling systems
• Conducting their own investigation

Follow established procedures and instructions from authorized responders.

Know the Reporting Process

Every employee should know how to contact the appropriate team.

Reporting mechanisms might include:

• IT service desk
• Security team
• Dedicated phishing-reporting tool
• Hotline
• Incident-reporting portal

Organizations should make these methods easy to locate and understand.

Near Misses Matter Too

Not every reported event becomes a security incident.

Suppose an employee recognizes a convincing phishing email before clicking anything.

Reporting it can still help.

Security teams may discover that hundreds of employees received the same message and can take action to remove or block it.

A near miss can provide valuable threat information.

Security Culture

Security culture describes how people throughout an organization think about and behave toward security.

A strong security culture encourages employees to:

Ask questions.

Verify unusual requests.

Report problems quickly.

Follow established procedures.

Learn from incidents.

Security becomes part of normal work rather than something handled only by IT.

Knowledge Check

1. Should employees wait until they are certain an incident occurred before reporting suspicious activity?

A. Yes
B. No

Answer: B

2. Why is early reporting important?

A. It gives responders more opportunity to contain potential damage.
B. It guarantees no incident occurred.
C. It eliminates security training.
D. It replaces backups.

Answer: A

3. Should employees delete suspicious messages before reporting them?

A. Always
B. Follow organizational procedures and preserve potential evidence when appropriate.

Answer: B

4. Why are near misses useful?

A. They can reveal threats before additional employees are affected.
B. They should always be ignored.
C. They eliminate risk.
D. They replace incident response.

Answer: A

Security+ Quick Review

Incident Reporting = Communicating suspected security events through approved channels

Evidence Preservation = Protecting information that may assist an investigation

Near Miss = An event that could have caused harm but did not

Security Culture = Shared organizational attitudes and behaviors toward security

Final Takeaway

You do not need all the answers before reporting a security concern.

If something looks wrong, report it.

A five-minute delay may not matter—but sometimes it does. Early reporting gives the security team the best opportunity to protect accounts, information, systems, and other employees.

 

Business Continuity and Disaster Recovery: Keeping the Organization Running

 Business Continuity and Disaster Recovery: Keeping the Organization Running

By: Heather Lange-Wilson

Cybersecurity is not only about preventing unauthorized access.

It is also about making sure critical services remain available when something goes wrong.

A ransomware attack, equipment failure, power outage, natural disaster, network outage, or human mistake can interrupt operations.

Organizations therefore need plans for continuing essential operations and recovering technology.

Business Continuity

Business Continuity Planning (BCP) focuses on maintaining essential business operations during a disruption.

The central question is:

How do we continue operating?

This may involve:

• Alternate work locations
• Manual procedures
• Backup communications
• Redundant systems
• Emergency staffing plans
• Prioritization of critical services

Disaster Recovery

Disaster Recovery (DR) focuses more specifically on restoring technology and systems following a disruption.

The question becomes:

How do we restore our systems and data?

Business continuity and disaster recovery work together but are not identical.

Business Impact Analysis

A Business Impact Analysis (BIA) helps identify critical business functions and the consequences of disruption.

Organizations may evaluate:

• Critical processes
• Dependencies
• Financial impact
• Operational impact
• Maximum acceptable downtime
• Required resources

The results help prioritize recovery.

Recovery Time Objective

Recovery Time Objective (RTO) describes the targeted amount of time within which a system or process should be restored after a disruption.

If a system has an RTO of four hours, the recovery strategy should be designed around restoring the service within that target.

Recovery Point Objective

Recovery Point Objective (RPO) addresses acceptable data loss measured in time.

If an organization has an RPO of one hour, its backup and recovery strategy should generally support recovering data to a point no more than approximately one hour before the disruption.

An easy way to remember:

RTO = Time to restore

RPO = How much recent data can be lost

Backups

Backups are essential, but simply having a backup is not enough.

Organizations should consider:

• Backup frequency
• Storage location
• Access controls
• Encryption
• Offline or isolated copies
• Restoration testing

A backup that cannot be successfully restored provides little protection.

Redundancy

Redundancy reduces dependence on a single component.

Organizations may implement redundant:

• Internet connections
• Power supplies
• Servers
• Storage
• Network devices
• Data centers

Redundancy improves resilience but does not replace planning.

Exercises and Testing

Plans should be tested before an emergency.

Organizations may use:

Tabletop exercises -  Participants discuss how they would respond to a scenario.

Simulation exercises -  Participants practice aspects of an emergency response.

Technical recovery tests -  Systems or backups are restored to verify recovery capabilities.

Testing often identifies assumptions or missing information that would otherwise remain undiscovered until a real emergency.

Employee Responsibilities

Employees should know:

• How emergency communications will occur
• Where to report during a disruption
• How to access approved alternate systems
• Which manual procedures may be required
• Who to contact for assistance

Employees should avoid creating their own unauthorized workarounds during an outage.

Security requirements still matter during emergencies.

Knowledge Check

1. What does BCP primarily focus on?

A. Maintaining essential operations
B. Password creation
C. Software licensing
D. Phishing simulation

Answer: A

2. What does RTO measure?

A. Targeted time for restoring a service
B. Password age
C. Number of backups
D. Data classification

Answer: A

3. What does RPO help define?

A. Acceptable data loss measured in time
B. Number of administrators
C. Firewall rules
D. Audit frequency

Answer: A

4. Why should backups be tested?

A. To verify they can actually be restored
B. To make files larger
C. To avoid encryption
D. To eliminate continuity planning

Answer: A

Security+ Quick Review

BCP = Keep critical operations functioning

DR = Restore technology and systems

BIA = Determines impact and identifies critical functions

RTO = Target restoration time

RPO = Acceptable data loss measured in time

Tabletop Exercise = Discussion-based practice of a scenario

Final Takeaway

Resilience is not simply having backups.

Organizations need to understand what is critical, how quickly it must return, how much data loss is acceptable, and what employees should do while recovery is underway.

 

Security Audits and Assessments: Checking Whether Our Defenses Actually Work

by: Heather Lange-Wilson 

Having cybersecurity controls is important.

Knowing whether those controls actually work is equally important.

Organizations use audits, assessments, vulnerability scans, penetration tests, and other forms of security testing to identify weaknesses and verify that security requirements are being followed.

Security Audits

A security audit examines whether an organization is meeting defined requirements.

Audits may examine:

• Policies

• Access controls

• System configurations

• Training

• Documentation

• Logs

• Security processes

Audits can be internal or external.

An internal audit is performed by or on behalf of the organization.

An external audit involves an independent outside party.

Independence can provide additional confidence in the findings.

Security Assessments

Security assessments examine controls, risks, and security practices.

An assessment may ask:

What controls exist?

Are they configured correctly?

Are they operating effectively?

What weaknesses remain?

Assessments help organizations identify areas needing improvement.

Vulnerability Scanning

A vulnerability scan uses tools to identify potential weaknesses.

It may detect:

• Missing patches

• Outdated software

• Insecure configurations

• Exposed services

• Known vulnerabilities

Finding a vulnerability does not automatically mean it has been exploited.

It means the organization has identified something that should be evaluated.

Penetration Testing

Penetration testing goes further.

Authorized security professionals attempt to exploit vulnerabilities under controlled conditions.

The objective is to understand what an attacker might actually accomplish.

Because penetration testing involves active testing, it should be properly authorized and carefully scoped.

False Positives

Security tools are not perfect.

A false positive occurs when a tool reports a problem that is not actually present.

A false negative occurs when a real problem exists but the tool fails to identify it.

Human analysis remains important when interpreting automated results.

Remediation

Finding problems is only useful if something happens afterward.

Remediation means correcting identified weaknesses.

Organizations may prioritize remediation based on factors such as:

• Severity

• Exploitability

• Business impact

• Asset importance

• Exposure

• Available compensating controls

Not every vulnerability represents the same level of risk.

Validation and Retesting

After remediation, organizations may perform additional testing to verify that the problem was actually corrected.

Closing a ticket does not necessarily prove that a vulnerability has been eliminated.

Verification matters.

Employees and Assessments

Employees may be asked to participate in security assessments.

They might be interviewed about processes, asked to provide documentation, or participate in security-awareness exercises.

Employees should cooperate honestly.

The goal should be understanding the actual security environment, not creating the appearance of perfection.

Knowledge Check

1. What is vulnerability scanning designed to identify?

A. Potential security weaknesses
B. Employee vacation schedules
C. Building maintenance
D. Payroll changes

Answer: A

2. How does penetration testing differ from basic vulnerability scanning?

A. It may attempt controlled exploitation of identified weaknesses.
B. It requires no authorization.
C. It only reviews policies.
D. There is no difference.

Answer: A

3. What is a false positive?

A. A real threat that is missed
B. A reported issue that is not actually present
C. A successful attack
D. A password reset

Answer: B

4. What is remediation?

A. Correcting identified weaknesses
B. Ignoring audit findings
C. Deleting audit reports
D. Disabling monitoring

Answer: A

Security+ Quick Review

Audit = Verification against requirements

Assessment = Evaluation of security controls and risks

Vulnerability Scan = Identifies potential weaknesses

Penetration Test = Authorized attempt to demonstrate exploitability

Remediation = Correcting identified problems

Retesting = Verifying corrective actions worked

Final Takeaway

Security testing is not about proving that an organization has no problems.

It is about discovering weaknesses before attackers do and making sure corrective actions actually improve security.

Compliance and Cybersecurity: Why Regulations Matter

 

Cybersecurity decisions are not based only on what an organization believes is a good idea.

Organizations may also be subject to legal, regulatory, industry, contractual, and privacy requirements governing how information and systems must be protected.

This is where cybersecurity and compliance intersect.

What Is Compliance?

Compliance means meeting applicable requirements.

Those requirements may originate from:

• Laws

• Regulations

• Contracts

• Industry requirements

• Organizational policies

Different organizations face different requirements depending on their industry, location, services, and the information they maintain.

Healthcare organizations, for example, may have requirements related to protected health information. Organizations handling payment cards may have contractual or industry security obligations associated with payment-card processing.

Compliance and Security Are Not Identical

An organization can technically meet a particular compliance requirement and still have cybersecurity risks.

Compliance often establishes a baseline.

Security requires continuously evaluating actual threats and risks.

Organizations should therefore avoid thinking:

“We passed an audit, so we are secure.”

Cybersecurity is an ongoing process.

Privacy

Privacy and cybersecurity frequently overlap.

Cybersecurity focuses heavily on protecting systems and information.

Privacy considers how personal information is collected, used, stored, shared, and disposed of.

Employees should understand that access to information does not automatically mean permission to use it for any purpose.

Access should have a legitimate business reason.

Minimum Necessary Access

A useful principle is providing people access only to the information required to perform their responsibilities.

This supports both privacy and security.

An employee who does not need particular confidential information generally should not access it simply because the system technically allows them to.

Curiosity is not a business requirement.

Consequences of Noncompliance

Failure to meet requirements can result in consequences including:

• Regulatory action

• Financial penalties

• Contractual penalties

• Legal costs

• Corrective action plans

• Loss of customer trust

• Operational disruption

However, compliance should not be viewed only as avoiding penalties.

Many requirements exist because improper information handling can cause real harm.

Evidence Matters

Organizations may need to demonstrate that security controls actually exist and operate.

Evidence might include:

• Policies

• Training records

• System logs

• Access reviews

• Risk assessments

• Security assessments

• Incident documentation

Simply saying that a control exists may not be sufficient.

Organizations may need to demonstrate it.

Employee Responsibilities

Employees support compliance every day.

This can include:

• Protecting passwords

• Completing required training

• Following data-handling requirements

• Using approved applications

• Reporting incidents

• Following access-control procedures

• Protecting confidential information

• Avoiding inappropriate access

A single employee action can create a compliance issue.

For example, sending confidential information to an unauthorized recipient can become both a cybersecurity and privacy incident.

Exceptions Should Be Managed

Sometimes a business process cannot meet an established requirement.

Employees should not simply bypass the requirement.

Organizations may have formal exception processes that document the reason, associated risks, approvals, and compensating controls.

An exception is different from ignoring a policy.

Knowledge Check

1. What does cybersecurity compliance involve?

A. Meeting applicable requirements
B. Eliminating all cyber risk
C. Replacing cybersecurity policies
D. Avoiding employee training

Answer: A

2. Does passing an audit guarantee that an organization is secure?

A. Yes
B. No

Answer: B

3. Why should access to confidential information be limited?

A. To increase paperwork
B. To reduce unnecessary exposure and support privacy
C. To eliminate backups
D. To prevent audits

Answer: B

4. Which is an example of compliance evidence?

A. Training records
B. An employee's personal opinion
C. An undocumented assumption
D. An advertisement

Answer: A

Security+ Quick Review

Compliance = Meeting applicable requirements

Privacy = Appropriate collection, use, access, sharing, and protection of personal information

Audit Evidence = Documentation demonstrating controls or requirements are being followed

Exception = Formally approved deviation from an established requirement

Final Takeaway

Compliance is not simply an audit activity.

Every time employees protect credentials, handle information correctly, complete training, or report an incident, they help the organization meet its security and compliance responsibilities.

Data Classification and Protection: Know What You’re Protecting

 

Organizations collect and create enormous amounts of information.

Not all of that information requires the same level of protection.

A publicly available brochure does not need to be protected in the same way as employee records, financial information, passwords, or confidential customer information.

Data classification helps organizations determine how information should be handled based on its sensitivity and importance.

What Is Data Classification?

Data classification places information into categories so appropriate security controls can be applied.

Classification models differ between organizations, but common categories include:

Public -  Information intended for public distribution.

Internal -  Information intended primarily for organizational use.

Confidential -  Sensitive information requiring additional protection.

Restricted or Highly Confidential -  Information requiring the organization's strongest protections.

The exact labels are less important than understanding and following your organization's classification system.

Why Classification Matters

Without classification, employees may not know whether information can safely be:

• Emailed
• Printed
• Stored in the cloud
• Shared externally
• Copied to removable media
• Discussed publicly
• Accessed remotely

Classification connects information with appropriate handling requirements.

Data Owners and Custodians

Security+ distinguishes between different responsibilities surrounding information.

A data owner is generally responsible for determining the classification and protection requirements for information.

A data custodian is responsible for implementing or maintaining controls protecting that information.

Users also have responsibilities.

Employees who access information must follow the rules established for its handling.

Data States

Information can exist in different states.

Data at rest is stored information, such as files on a server.

Data in transit is information moving between systems.

Data in use is information actively being processed or accessed.

Security controls may differ depending on the state of the information.

Encryption, for example, can help protect both stored information and information being transmitted.

Handling Sensitive Information

Employees should understand where sensitive information may be stored.

Uploading a confidential document to an unapproved file-sharing service can create risk.

So can sending sensitive information through an unapproved communication platform.

Approved systems have generally been evaluated to determine whether appropriate security protections are available.

Verify Before Sending

One of the simplest data-protection habits is checking recipients before sending information.

Autocomplete can make email convenient, but it can also cause mistakes.

Before sending sensitive information:

Verify the recipient.

Verify attachments.

Verify whether the recipient is authorized to receive the information.

A few seconds of verification can prevent an accidental disclosure.

Printing Creates Data Too

Digital security often receives the most attention, but printed information also requires protection.

Sensitive documents should not be left unattended on printers, desks, conference-room tables, or other public locations.

Organizations may require secure disposal methods such as shredding or locked destruction containers.

Throwing sensitive documents into ordinary trash may expose information.

Data Retention

Keeping information forever is not necessarily safer.

Organizations often establish data retention policies defining how long particular records should be maintained.

Retention requirements may be influenced by operational, legal, regulatory, contractual, or historical requirements.

When information reaches the end of its approved retention period, it should be disposed of according to organizational requirements.

Secure Destruction

Deleting a file does not always mean the underlying information has been securely destroyed.

Organizations may use different destruction methods depending on the media involved.

These can include:

• Secure erasure
• Cryptographic erasure
• Physical destruction
• Shredding
• Approved media-destruction services

Employees should follow established procedures rather than improvising disposal methods.

Clean Desk and Clear Screen Practices

Sensitive information can also be exposed simply by being visible.

A clean-desk policy can reduce exposure of documents, credentials, and removable media.

Employees should also lock computers when leaving them unattended.

Even a short absence can create an opportunity for unauthorized access.

Data Loss Prevention

Organizations may use Data Loss Prevention (DLP) technologies to identify and control sensitive information.

DLP may help detect or prevent activities such as:

• Sending sensitive information externally
• Copying protected data to removable media
• Uploading data to unauthorized services

DLP supports employees, but technology should not replace good judgment.

Knowledge Check

1. What is data classification used for?

A. Determining how information should be protected
B. Increasing internet speed
C. Installing applications
D. Replacing backups

Answer: A

2. What is data in transit?

A. Archived information
B. Information moving between systems
C. Printed information
D. Deleted information

Answer: B

3. What should employees do before sending sensitive information?

A. Verify recipients and attachments
B. Disable encryption
C. Upload it publicly
D. Remove its classification

Answer: A

4. What does DLP stand for?

A. Digital Login Protection
B. Data Loss Prevention
C. Device Location Protocol
D. Distributed Login Policy

Answer: B

Security+ Quick Review

Data at Rest = Stored information

Data in Transit = Information being transmitted

Data in Use = Information actively being processed

Data Owner = Determines appropriate classification/protection requirements

Data Custodian = Maintains or implements protections

DLP = Technology used to help prevent unauthorized data disclosure

Final Takeaway

Before sharing, storing, printing, or disposing of information, understand what type of information you are handling.

You cannot protect information appropriately if you do not first understand its value and sensitivity.

 

Security Awareness and Training: Building a Human Firewall

Organizations invest heavily in cybersecurity technology. Firewalls monitor network traffic. Endpoint protection detects malicious software. Email security systems filter suspicious messages. Multifactor authentication makes stolen passwords less useful.

But attackers understand something important:

Sometimes it is easier to convince a person to provide access than it is to defeat a security system.

That is why security awareness and training are essential parts of cybersecurity.

Employees do not need to become cybersecurity experts. They do need to recognize common threats, understand organizational security expectations, and know what to do when something seems suspicious.

What Is Security Awareness?

Security awareness teaches employees how their everyday actions affect cybersecurity.

Effective awareness programs commonly address:

• Phishing

• Social engineering

• Password security

• Multifactor authentication

• Physical security

• Data handling

• Removable media

• Remote work

• Incident reporting

• Insider threats

Security awareness should not be something employees hear about once during orientation and never encounter again.

Threats change, technology changes, and attackers change their techniques.

Training should evolve as well.

Phishing

Phishing remains one of the most recognizable forms of social engineering.

An attacker sends a message designed to convince someone to click a link, open an attachment, provide information, send money, or approve access.

Warning signs can include:

Urgency: “You must respond immediately.”

Fear: “Your account will be disabled.”

Unexpected attachments: Particularly files the employee was not expecting.

Credential requests: Messages asking users to verify passwords or sign-in information.

Financial changes: Requests to change banking or payment information.

Unexpected MFA prompts: Authentication requests the employee did not initiate.

Modern phishing messages may be polished and convincing. Poor grammar is no longer a reliable way to identify an attack.

Social Engineering Goes Beyond Email

Attackers can use telephone calls, text messages, social media, video calls, and in-person interactions.

Vishing uses voice communications.

Smishing uses text messages.

Pretexting involves creating a believable story to obtain information or access.

An attacker might claim to be:

• IT support

• A manager

• A vendor

• Human Resources

• A financial institution

• An executive

Authority and urgency are frequently used to pressure people into acting before thinking.

Tailgating

Cybersecurity also involves physical security.

Tailgating occurs when an unauthorized person follows an authorized individual into a restricted area.

Someone may approach an employee carrying boxes and ask them to hold the door.

Helping may seem polite, but bypassing access controls creates security risk.

Employees should follow organizational procedures for visitors and restricted areas rather than allowing someone to bypass established access controls.

Removable Media

USB drives and other removable devices can introduce malware or expose information.

Finding a USB drive in a parking lot does not mean it should be plugged into a company computer to determine who owns it.

Unknown devices should be handled according to organizational security procedures.

Employees should also avoid copying organizational information to personal removable media unless specifically authorized.

Insider Threats

Not every security threat comes from outside the organization.

An insider threat involves someone with legitimate access who intentionally or unintentionally creates risk.

A malicious insider might deliberately steal information.

An accidental insider might email confidential information to the wrong recipient.

A compromised insider may have an account taken over by an attacker.

Security controls must therefore protect information regardless of where the threat originates.

Unexpected MFA Requests

Multifactor authentication provides important protection, but attackers sometimes attempt to overwhelm users with authentication prompts.

If you receive an MFA request you did not initiate:

Do not approve it.

Deny the request and follow your organization's reporting procedure.

Repeated unexpected MFA notifications may indicate that someone already knows your password and is attempting to gain access.

Reporting Is Part of Security Awareness

Employees should know how to report suspicious activity.

Examples include:

• Suspicious emails

• Unexpected MFA requests

• Lost devices

• Unusual system behavior

• Accidental information disclosure

• Suspicious phone calls

• Unauthorized people in restricted areas

Employees do not need to prove that an incident occurred before reporting something.

The security team can investigate.

Creating a Security-Aware Culture

Security awareness is most effective when employees feel comfortable reporting concerns.

If someone accidentally clicks a suspicious link, early reporting may allow the security team to respond before significant damage occurs.

Fear of punishment can discourage reporting.

A healthy security culture encourages employees to speak up quickly while still maintaining appropriate accountability.

Security Is a Team Effort

Technology can stop many attacks.

It cannot stop every attack.

Employees provide an additional layer of defense by recognizing situations that technology may miss.

Pause when something seems unusual.

Verify unexpected requests.

Protect credentials.

Follow physical security requirements.

Report suspicious activity.

Those actions turn security awareness into everyday cybersecurity.

Knowledge Check

1. What is phishing?

A. Physical theft of a computer
B. A social-engineering technique using deceptive messages
C. A backup procedure
D. An encryption method

Answer: B

2. What is smishing?

A. Social engineering using text messages
B. Malware scanning
C. Physical tailgating
D. Password cracking

Answer: A

3. What should you do with an unexpected MFA request?

A. Approve it
B. Ignore it indefinitely
C. Deny it and follow reporting procedures
D. Send the code to IT

Answer: C

4. What is tailgating?

A. Following another vehicle
B. Following an authorized person into a restricted area without proper authorization
C. Sending repeated emails
D. Monitoring network traffic

Answer: B

Security+ Quick Review

Phishing = Deceptive electronic communication

Smishing = SMS/text-based social engineering

Vishing = Voice-based social engineering

Pretexting = Creating a believable scenario to obtain information or access

Tailgating = Bypassing physical access controls by following an authorized person

Insider Threat = Risk involving someone with legitimate organizational access

Final Takeaway

Employees are not expected to recognize every attack.

They should recognize when something is unusual enough to stop, verify, and report.

Security awareness turns employees from potential targets into active participants in protecting the organization.