Cyber Security Awareness Employee Training

Password Guidance

When setting a password, make sure to do the following (Marquette University, 2021):

• DO change your password regularly.
• DO pick a password you will remember so you DON’T have to write it down.
• DO use a mix of uppercase and lowercase characters.
• DO use punctuation marks and special characters such as #, $, %.
• DO choose a line or two from a song or poem and use the first letter of each word, preceded or followed by a digit. (e.g “Do you know the way to San Jose?” becomes the password DYKtwTSJ?).

When setting a password, make sure NOT to do the following:

• DON’T include all or part of your username, first name, or last name.
• DON’T use your favorite sport as a password — “baseball” and “football” are among the top 10 worst passwords, and “hockey,” “soccer” and “golfer” are in the top 100.
• DON’T make obvious choices like your nickname, birthdate, spouse name, pet name, make/model of car, or favorite expression.
• DON’T share your password with anyone.
• DON’T use blank spaces in your password.
• DON’T use a word contained in English or foreign language dictionaries, spelling lists or commonly digitized texts such as the Bible or an encyclopedia.
• DON’T use an alphabet sequence (lmnopqrst), a number sequence (12345678) or a keyboard sequence (qwertyuop).

Phishing Attacks

Phishing is a cybercrime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords (KnowBe4, n.d.).

Types of Phishing Attacks

Phishing attacks include:

1. Vishing
2. Whaling
3. Spear-phishing

Vishing attacks rely on convincing victims that they are doing the right thing by responding to the caller. Often the caller will pretend to be calling from the government, tax department, police, or the victim’s bank.This is a social engineered fraud where a fraudster convinces the user to provide critical information over the phone.

A whaling attack is a method used by cybercriminals to masquerade as a senior player at an organization and directly target senior or other important individuals at an organization, with the aim of stealing money or sensitive information or gaining access to their computer systems for criminal purposes.

Spear-phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific individual, organization or business often for malicious reasons.

How to prevent phishing attacks

• Use spam filters to protect against spam mails.
• Change the browser setting to prevent fraudulent websites from opening.
• Change your password regularly and also use a CAPTCHA system for added security.
• If verification is required, always contact the company personally before entering any details online.

Physical Security

Physical security is an integral part of cyber security because they prevent access to the storage room where firewalls and other machines are found. Without physical security, attackers can access data centers, sneak into restricted areas of building, and even have use terminals they have no business accessing (Diehl, 2020).

Some of the physical security breaches include tailgating and piggybacking. In tailgating, someone slips in unexpectedly after an authorized person has opened the door. Similarly, piggybacking occurs when an authorized individual opens and holds the door for someone who may or may not have the proper credentials (Diehl, 2020). When these actions happen, a secure access point loses its purpose and the building, occupants, and equipment are put at risk.

How to Prevent Tailgating and piggybacking

1. Staff Education – It’s important to outline the risks that come with tailgating and why staff should not allow someone to enter behind them.
2. Install an access control system which helps to ensure that only authorized personnel have access to your building or specific areas.
3. Issue Visitor Badges.
4. Install security cameras.

Cyber Crime Cases in the Banking Sector

With the advent of technologies, banking services have become more convenient. However, the downside of these technologies is that ATM frauds, Phishing, identity theft,