Ashvin Kamaraju | Vice President of Engineering, Strategy & Innovation
More About This Author >
Ashvin Kamaraju | Vice President of Engineering, Strategy & Innovation
More About This Author >
Cybersecurity Awareness Month is an international initiative that focuses on simple ways to protect ourselves, our families, and our businesses from online threats. The 2025 theme “Secure Our World” highlights the pervasiveness of digital technologies that enable connections across the globe and how straightforward, yet effective measures can have a lasting impact.
In a world where our digital lives are increasingly intertwined, every attack vector secured increases the safety of other connected people. And considering how connected we all are to our devices, networks, and the internet at large, this can be a lot of us.
Key Cybersecurity Practices to Implement
1. Protect your credentials – Go Passwordless!
As threat actors get savvier about targeting our access credentials, the industry is gradually moving away from passwords altogether and into a Passwordless future. This means switching wholesale to other forms of authentication, which may leverage biometric data, PINs, patterns, and passkeys in place of passwords. With a growing number of platforms supporting Passkeys and Passwordless authentication, moving away from passwords is becoming easier and frictionless.
If Passwordless options are not feasible, use strong passwords with a password manager. Sadly, less than 40% of all online users use a distinct password for each account, according to the National Cybersecurity Alliance 2023 Oh Behave! report. Reused passwords give cybercriminals bonus access to other areas of a person’s digital life when they’ve only done the work to steal (or buy, or crack) a single credential. Aside from having a different login for each site, current wisdom (a la CISA) suggests that a strong password contains:
- At least 16 characters.
- Randomization, with a mix of letters, symbols, and numbers.
- Potentially a “passphrase” of 4-7 words, although randomization is recommended.
In either case – passwords or passwordless passkeys – a password manager is needed (here’s why). With the average person having to keep track of roughly 100 distinct credentials, it’s no wonder that nearly one-third of the internet uses a password manager to wrangle (and “remember”) them all.
2. Recognize and Report Phishing
According to the Thales 2024 Data Threat Report, phishing is the second fastest-growing attack. Phishing tactics are getting sneakier, thanks to AI, and it is more important than ever that employees be able to recognize their telltale signs. Now, AI-based campaigns can churn out word-perfect emails in any language, typically:
- Creating a sense of urgency (creating panic and short-circuiting your critical-thinking brain)
- Encouraging some unsolicited action (like “change your password now” or “download now”)
- Asking for some form of personal information (usually financial data, like in BEC scams)
However, the most effective way to enable people to spot and report phishing emails is to strengthen the “human firewall.” Businesses should invest in security awareness training programs not only for their employees but also for their families to establish a positive culture where everyone is invited to report mistakes, like clicking on a malevolent link.
3. Turn on Multifactor Authentication
Multifactor Authentication (MFA) is a required layer of security by many cloud service providers and even more everyday organizations. CISA, ENISA, and other global security agencies advise that everyone adopts it, as it provides additional layers of defense on top of just passwords alone (a text verification code, or a fingerprint, for example). There are various MFA options available:
- Phishing-resistant MFA is known by CISA as the “gold standard” and encompasses FIDO/WebAuthn authentication and Public Key Infrastructure (PKI)-based methods.
- App-based MFA methods increase security by sending a pop-up or “push” notification to the user’s phone, generating a one-time password (OTP), or using a token-based OTP.
- SMS or Voice MFA simply relies on sending the user a verification phone call or text.
Despite the importance and the variety of MFA methods, Thales 2024 DTR report shows that only 46% of the organizations use multi-factor authentication for more than 40% of their employees. It is essential to note that while phishing-resistant MFA is most effective against AI-enabled social engineering attacks, any form of MFA is much better than no MFA at all. In addition, there’s great business value behind adopting MFA. The Thales 2024 Digital Trust Index indicates that 81% of customers expect brands to offer MFA, which serves as a means to greater loyalty and trust.
4. Update Software: A Critical Defense, But Proceed with Caution
It is crucial that all employees know to accept and apply software updates every time the reminders come up because these are how vulnerabilities stay patched. One Ponemon report noted that 60% of breaches originated from unpatched vulnerabilities, making this simple practice even more vital.
Criminals have quickly embraced AI to spot and exploit even zero-day vulnerabilities. Interestingly, these unpatched gaps open the way for spreading disruptive ransomware attacks. However, businesses, especially in critical infrastructure settings, should patch their systems with caution and not out of fear. Although timely security updates are crucial, it is equally important to test those updates in a controlled environment before rolling them out to minimize the possibility of breaking critical systems.
A Little Goes a Long Way
The overall goal of the Cybersecurity Awareness Month is to enhance the security posture of identities, applications, data and software —either personal or corporate data. As the above highlighted methods illustrate, good defensive measure doesn’t have to be difficult to use or implement. In fact, keeping it simple and using practical, easy to use tools and procedures will get wider adoption.
Also, if you are a business, complement the above best practices with solutions that offer robust application and data protection to reduce the potential of a data breach. These solutions protect applications and APIs, discover and classify sensitive data, provide risk intelligence and complement the employee security awareness efforts. The above user-friendly methods enable your employees to be the first line of defense and the deployment of Imperva solutions the next level of defense.
Now that’s defense-in-depth to secure our world!