Awareness

Think Before You Click

Most cyber attacks start with people, not computers. Con-artists have been around long before email and social media, and now they have faster, more scalable tools to exploit trust.

Social engineering tricks people into sharing passwords, clicking malicious links, or bypassing normal procedures. Once attackers gain access, they can move laterally into systems you use, potentially accessing sensitive information or sending messages in your name.

Cybercrime exists across two primary attack surfaces:

1. Technical: System-Level Threats; vulnerabilities in software, networks, and systems.
   This is what most people think of when they of when discussing cybersecurity.  It is the protection of computers by firewalls, routers, passwords and more; and usually left to the IT professionals. 

2. Human: Trust-Level Threats; vulnerabilities in attention, trust, urgency, and authority perception.
   This is usually the starting point. This is the area of social engineering, scams, ID theft, phishing, deception and fraud.
   This is where you come in.

Contrary to popular belief, most successful compromises begin with human interaction rather than a purely technical failure. Deception and fraud long predate computers. Email, text messaging, and social media simply give bad actors faster, more scalable tools to exploit trust.

Social engineering is the deliberate manipulation of trust to persuade someone to take an action they would not normally take; such as revealing credentials, approving a transaction, or granting access. Similar persuasion techniques are used legitimately in sales and politics, but in cybersecurity the term refers to deceptive practices such as phishing and spear phishing.

Keep these principles in mind:

• Legitimate companies and support technicians will never ask for your password.

• Passwords should only be entered on official authentication pages.
  Never submit a password through email, text message, or online forms such as Google Forms.

• Don't provide your MFA passcode to anyone via text or on the phone. 

• If a message creates urgency or pressure, pause and verify through a trusted channel.

Cybersecurity depends on both hardened systems and informed users. Technology can block many threats, but informed judgment is often the first and most effective line of defense.