Safer Internet Day is an annual event that is being celebrated today, February 7, 2023. The day was established by the European Union in 2004 to raise awareness about online safety and encourage individuals to use the internet in a responsible and positive manner. With the rapid growth of the internet and its increasing usage in every aspect of our lives, it has become crucial to promote a safe and secure online environment for all.
The theme for Safer Internet Day 2023 is “Together for a better internet.” The theme highlights the importance of collaboration and collective responsibility in creating a better online world for all. It encourages individuals, organizations, and governments to work together to make the internet a safer place for everyone.
Another key area to consider during Safer Internet Day is privacy. The internet has changed the way we live, work, and communicate, but it has also made it easier for personal information to be collected, shared, and used without our consent. Safer Internet Day raises awareness about the importance of privacy and encourages individuals to take control of their personal information by being mindful of the information they share online and using privacy settings to control who has access to their data.
VMblog reached out to a number of industry thought leaders to receive expert commentary on creating and keeping a safe environment.
—
Danny Allan, CTO, Veeam Software
Accelerating risk of ransomware attacks in 2023 have forced organizations to revisit their ransomware response strategies. According to the Veeam Data Protection Trends Report, in 2022 alone, 85 percent of organizations were attacked by ransomware at least once. However, despite increasing ransomware attacks, few companies are truly prepared against such an attack – leaving the company and its clients’ data open to theft.
My advice on Safer Internet Day is for organizations to develop and deploy necessary precautions to protect themselves and their customers. This includes immediate lockdown upon attack, cutting off connectivity to isolate the threat; raising the alarm, so the entire company is on guard; assessing the damage; employing backup and recovery tools to restore what you can; communicating with relevant parties to control the narrative and protect company reputation ahead of any news leak; and finally, to assess your attack surface and determine where you may need greater investment in protection and recovery resources.
The first 24 hours of a ransomware attack are crucial to protecting the integrity of valuable company data. Developing a ransomware response plan is necessary if organizations intend to make it in the long run.
++
Rick McElroy, Principal Cybersecurity Strategist, VMware
Safer Internet Day is a time to highlight emerging online issues in order for both businesses and consumers to form better internet practices. While its future is relatively unknown, the adoption of the metaverse will drastically change the way many aspects of the internet operate. Many enterprises and consumers are already rushing it to market faster than the security community is comfortable with. For example, we are already seeing deepfake attacks, identity theft, and other forms of cybercrime running rampant through the current version of our digital world – what’s not to say there won’t be an uptick in similar scams inside of the metaverse? As businesses and consumers look to improve their internet practices, they will need to be careful and considered in their approach to this nascent technology. If organizations are thoughtful about the controls put in place to identify users and deploy continual authentication – leveraging different factors such as biometrics and closely monitoring user behavior – it’ll help to alleviate those security concerns.
++
Tim Brown, CISO, SolarWinds
On Safer Internet Day, it’s important to remember that cybersecurity is no longer just the responsibility of the IT department. Everyone at a company has a role to play in helping ensure best practices are being followed from a security perspective. This means doing their best to limit shadow IT, using two-factor authentication, making sure you have good password hygiene and more. These are all simple best practices that every employee needs to follow.
This is critical because threat actors target both systems and human-centric failure points and often use a combination of the two in the most sophisticated attacks. For example, an attacker may use a password spraying attack — where they use common passwords to try and guess credentials for employees — to gain initial access and then find vulnerabilities within a system to exploit further. At the end of the day, it’s critical for organizations to focus on strengthening not only their systems but also focusing more on people through increased training and other initiatives.
++
Aaron Sandeen, CEO and co-founder, Cyber Security Works (CSW)
Organizations should use Safer Internet Day as a reminder to improve their cyber hygiene procedures and add cutting-edge solutions to their toolkit. Our reliance on the Internet has increasingly exposed us to risk over the past few years, so we must now implement strict security measures to protect connected people and businesses.
Threat actors are always searching for new entrance points into organizations and ways to disrupt their operations. Specifically, ransomware groups are always changing and creating new methods faster than security experts can close holes. As a result, businesses are rushing to control their attack surface and patch security vulnerabilities.
For organizations to practice safer internet use, they must implement proactive security. Before a risk is taken advantage of, a company needs to be aware of the assets it may have that could constitute a danger. Fortifying your defenses requires prioritizing vulnerabilities and applying priority patches after determining how vulnerable your company is to an attack.
++
Arti Raman, CEO and founder, Titaniam
Safer Internet Day is the perfect time for individuals to reinforce cyber hygiene and for organizations to add innovative technologies to their security toolbox that help minimize the impact of ransomware attacks.
For end users, a safer internet experience involves good cyber habits such as utilizing encrypted password managers, setting up multi-factor authorization on accounts, and cloud backups, all of which deter threat actors. Further, individuals should refrain from sharing personal data with third parties unless absolutely necessary, since this data can be sold and end up in the hands of cyber criminals who eventually use it to compromise identities and take over online accounts.
For businesses that store and process end-user data, keeping it safe from cyberattacks can be a little more complicated. Looking to the year ahead, Titaniam’s latest survey report, the ‘Enterprise Security Priorities for 2023 report,’ shows that 41% of surveyed security experts expect large companies to be the top target in 2023 for cyberattacks.
We recommend organizations take three important steps to keep customer data safe. First, request and retain only the bare minimum of customer personal data. Unnecessary additional data creates additional cyber risk. Second, deploy a strong identity and access management program to ensure that sensitive data is available only to those who truly require it to do their jobs. Finally, utilize a modern data security platform to implement strong data security controls such as encryption at-rest, in-transit, and most importantly, encryption-in-use. Encryption-in-use technology ensures files remain undecipherable and unusable to bad actors even if they break through perimeter security infrastructure and access measures.
Organizations and users can celebrate Safer Internet Day by implementing these security measures to prevent ransomware attacks and fully utilize modern encryption technology.
++
Richard Bird, CSO, Traceable AI
To achieve a truly safer internet, we have to stop relying on 20 year old security practices that were born in data centers that clearly do not work in the highly distributed compute world we live in now. The internet depends wholly on encryption standards that were introduced more than 20 years ago, account and password constructs that were first originated in 1961 and other aged security approaches that have zero effect against ransomware and social engineering.
Something to consider about ransomware is that at its core, it is an identity security failure. Hacking is simply being someone you are not in order to get something you shouldn’t have. Ransomware hackers take that a step further to either lock down the things they shouldn’t have had access to or by just simply taking those things. Mastering the basics of identity security can and will dramatically reduce the success of ransomware.
++
Anthony DiBello – Vice President, Strategic Development, OpenText
With a global recession looming and budgetary constraints, many organisations will be tempted to reduce their cybersecurity spend and consolidate the number of cybersecurity vendors they interact with. But now is not the time to put feet on the breaks when it comes to cybersecurity. Cybercriminals will be intensifying their hunt for weak spots in organisations and those hit will fall hard. You’ve only got to look at the news to see that cybercriminals are becoming increasingly tactical and sophisticated with their methods.
As a consumer, it’s harder than ever to safeguard yourself and it’s not always easy to recognise potential threats, meaning the onus is largely with regulators and businesses to ensure they’re doing everything they can to address these issues. Businesses are adapting accordingly but even the smallest crack in a cybersecurity strategy can be detrimental to both the organisation and the individuals it affects. Cyber resilience needs to be baked into the entire organisation and should be a consideration in any and all decision making. Securing the supply chain (physical and digital), as well as critical infrastructure, will be a particular challenge for security leaders this year.
Investing in the right tools and services is key – but it isn’t enough in isolation. Nowadays cybersecurity is not just the responsibility of the CSO or security teams. Everyone is responsible for making the internet a safer place. All staff – from front-line to the C-suite – need to be educated on the latest cyber risks as they evolve so they can act as a first line of defence. Safer Internet Day serves as another reminder that to be safe, you need to be secure.
++
Rodman Ramezanian, Global Cloud Threat Security Lead at Skyhigh Security
The thing to keep in mind for Safe Internet Day is that although public-cloud data security offerings will indeed strengthen and presumably offer greater autonomy to users to control their data, there are number of fundamental, non-negotiables that users and organizations must not neglect. Here are just a few:
- Identifying and classifying their data
- Knowing where and how their data is stored/shared/used
- Determining how it needs to be protected across all vectors at all times
Safe Internet Day should absolutely be recognized and praised for the awareness it promotes. It endeavours to bring the ever-important topic of internet safety front-of-mind to the masses.
++
Corey Nachreiner, chief security officer at WatchGuard Technologies
In support for a safer internet for all – in 2023 and for years to come – here are some insights on today’s most prevalent threats and what you can do to stay cyber secure.
Stick to legitimate software, and keep it up to date
Malicious actors are constantly on the hunt for vulnerabilities in software that will allow them to infiltrate your devices and networks, which is why it’s so important to regularly update your software with the latest patches and security updates. And remember, this applies not just to business software but to games as well. Popular online games have been compromised in recent years, allowing attackers to take over gamers’ PCs or otherwise break into gaming accounts and systems.
While the price tag on some games might tempt certain users to opt for pirated versions they can download free of charge, the risks are high and can end up being extremely costly. Attackers often try to lure victims with pirated software that contains embedded malware or a backdoor into their computers. Key crackers, which can be used to get around software license keys, could also contain dangerous trojans. Beyond the fact that pirating software is unethical, you’re better off sticking to software purchased from legitimate sources for security reasons, too!
Adopt a secure password manager and implement MFA
Duplicate and easy-to-guess passwords make you more vulnerable to attackers, which is why good password management is critical for a safer internet experience. Cybercriminals can easily find troves of stolen usernames and passwords on the dark web and underground forums; billions of usernames and passwords from various breaches are widely available, with millions likely more added each day. They can also scrape personal information about you from social media, including details that you might use to make a password easier for you to remember, but also easier to crack.
Creating a strong, unique password for each of your individual logins prevents attackers from accessing multiple accounts should one of those credentials get leaked in a data breach or otherwise compromised. Our pro tip? Use a password manager AND multi-factor authentication (MFA) wherever possible. Password managers can help you generate strong, unique passwords for every single one of your online accounts, and often include additional features like alerts when one of the websites you use has reported a breach. That said, you should do some research before selecting one, as certain password managers may be less secure due to recent compromises. MFA is available (and sometimes even required), for all kinds of online services these days. Combining a good password manager with MFA across all your online accounts is the most effective way to prevent unauthorized access.
++
Tony Liau, VP of Product, Object First
Safer Internet Day is a great opportunity to raise awareness about the importance of internet safety and encourage everyone to play their part in creating a safer online world. As the amount of data being stored electronically continues to increase, ransomware becomes an ever-growing threat to both individuals and businesses. To protect against ransomware, regular backups are essential, but immutable backups provide the best protection. Immutable backups are a type of backup that cannot be changed or deleted. This makes them ideal for protecting against ransomware, as it ensures recoverability of data because attackers cannot modify the backup files. This Safer Internet Day, prioritize ensuring that your organization is prepared for when the threat actors come knocking.
++
Wendy Mei, Head of Corporate Strategy at Playsee
It has been and always will be extremely important to protect teenagers online. We’re grateful that a new study has increased awareness and pushed this issue to the forefront. The social media industry is taking to heart this fresh insight on youth mental health in the digital age. In response, we will do what we do best: use technology to create safe, responsible communities for young people.
By implementing strict content guidelines and 24/7 moderation, Playsee can assure our users that their digital safety and mental health come first. Together, we will continue to build a respectful and inclusive platform where young people can learn and develop important peer networking skills to create and share in a positive, healthy way.
++
Avihay Cohen, CTO and Co-Founder at Seraphic Security
Safer Internet Day serves as a timely reminder for organizations and individuals alike to reevaluate their security posture and prioritize one of the internet’s most-used tools: the browser.
Because there is so much information kept on browsers for both personal and professional use, they are increasingly becoming the most ripe target for threat actors. Organizations must create an equally comprehensive browser security policy as the browser’s extra functions become more advanced. To eliminate the possibility of sensitive personal data being exposed, organizations must block and prevent such exploits before they happen.
On Safer Internet Day and always, it is critical to recognize the importance of protecting browsers from threat actors and exploits. From phishing scams to web application vulnerabilities, to 0-days or unpatched N-days, attacks within and on the browser are seemingly endless. Internet users and organizations can lessen these risks by utilizing thorough browser security. These attacks can be thwarted by systems based on execution flow analysis and prevent disaster before it occurs.
++
Javed Hasan, CEO and Co-founder, Lineaje
In order to build a safer Internet in 2023 and beyond, organizations will need to realize that software that is not built securely cannot run securely. With more than 70% of modern software dependent on open source and third-party components, software developers cannot deliver secure software to customers without formal software supply chain management. This realization, and the increasing tampering of popular open source and commercial software packages, will drive an intense focus on ‘what’s in the software?” and ‘how good is it?’
To work ‘together for a better Internet’ like Safer Internet Day’s theme touts, CIOs, CISOs, developers and other software producers and securers will need to take the time to educate themselves on what securing a software supply chain truly looks like. A lot of IT and security professionals today only have a high-level understanding, or simply regurgitate what they’ve heard or read publicly. Safer Internet Day should serve as a reminder for security and IT professionals to take the time to deepen the depth of knowledge on software supply chain security and enlist the help of security tools that can assess the entire software catalog to identify and mitigate any risks that could lead to an attack.
++
Dalia Hamzeh, Security Strategy and Transformation Manager, Progress
To be successful at fostering a security-first culture in any organization, you need to help your employees better understand security practices at home, too. Think about a person who regularly wears their seatbelt while driving their own car. That behavior doesn’t change when they are in the passenger’s seat of a friend’s car or if they are driving a rental. Putting their seat belt on is habitual. Well, the same goes for security awareness. For security teams to succeed at creating a Safer Internet Day every day, they need to be mindful of focusing on behaviors in relation to their personal lives.
So, how do you put this in practice? If you are looking to train your employees on how to spot a spoofed website, train them by using the example of globally popular online shopping sites. They may pay closer attention to the advice but will use it to protect their corporate data too. SANS.org and StaySafeOnline.org are both great resources organizations can leverage for awareness materials.
##
