Learn the Basics of Cybersecurity Education and Terminology

Stay ahead of the curve with cybersecurity education

There are four critical pathways to your estate: Credentials, Phishing, Exploiting vulnerabilities, and Botnets.¹ All four are pervasive in all areas of the DBIR, and no organization is safe without a plan to handle each.

It’s important you and your business understand the basic terminology around data breaches and hacks. Doing so can help you identify the warning signs of breaches, but it can also help you inform others of the risks to avoid. Moreover, businesses can use their knowledge to properly communicate with customers in a clear and timely method if a compromise ever occurs.

Understanding hacks – and how they’re talked about

Are you a consumer who’s unsure what a business is saying when notifying you of a past breach? Are you a business that wants to effectively communicate with your customers in the event of organizational data being compromised?

It’s important to realize that these terms are regularly misused – where people will refer to security incidents as hacks. As a best practice, review the details you'll communicate to others, and always get your information from a reliable publication.

Tip: look to the company or organization involved first and foremost for statements, blogs, information, and more as your source of truth.

Common types of cyberattacks

• Credential stuffing: the next step following a brute force attack, in which someone who already has access to an account’s username and password will use it for as many other sites, apps, etc. as possible. This is the risk of reusing a password – if one of your accounts gets breached, the rest are vulnerable.
• Basic web application attacks (BWAA): attacks that directly target an organization's most exposed infrastructure, such as web servers.
• Phishing: a form of fraud in which a bad actor masquerades as a reputable entity or person in email or other forms of communication – smishing (text or SMS), and vishing (voice call).
• Ransomware: a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Ransomware has continued its upward trend with an almost 13% increase – a rise as big as the last five years combined.¹
• Social engineering: The act of deceiving an individual into revealing sensitive information, obtaining unauthorized access, or committing fraud by associating with the individual to gain confidence and trust.
• Supply chain attack: Attacks that allow the adversary to utilize implants or other vulnerabilities inserted before installation to infiltrate data or manipulate information technology hardware, software, operating systems, peripherals (information technology products), or services at any point during the life cycle.

Once again, it's important to note the differences here. Always go to the source of information to see how they are communicating and with what terminology so you can better understand the potential impact and next steps.

Cyberattacks may cause panic, but you can find power in knowing the correct terminology and how to use and comprehend it.³

Create a cybersecurity strategy

The best thing your business can do is to take the cybersecurity education you’ve gained and put it into action by creating a proactive plan. Your business can get started by implementing some of the following security measures:

• Use a different, unique, and complex password for every online account created.
• Turn on multifactor authentication (MFA) for services like your email, social media, online banking, work-related apps, etc.
• Utilize data breach monitoring to keep an eye out for your credentials online, to ensure any compromised credentials are flagged and changed as soon as possible to avoid additional breaches.
• Be proactive when interacting with the common signs of an attempted cyberattack – do not click on links from people you don’t know, do not open misspelled websites, do not engage with emails that are poorly written and from unknown addresses.
• Run antivirus, endpoint protection, or antimalware protection software.
• Regularly update your apps and operating systems (OS) to keep software up to date. 
• Regularly backup of your critical data – either locally or to the cloud – to ensure you have an additional copy of your sensitive data in a safe place.

Sources used in this article

1. 2022 Verizon Data Breach Investigations Report (DBIR)
2. Secureworks Boardroom Cybersecurity Report
3. NIST Computer Security Resource Center