NexLINKEDIN ARCHIVE / Security
Cybersecurity awareness beyond suspicious links
October is Cybersecurity Awareness Month, and I think one of the biggest changes in recent years is that awareness can’t just mean teaching people not to click suspicious links.
By Phil Kinsley
Adapted and republished on Nexlinks. The publication date is the original article date; the text is preserved as historical author commentary.
Date derived from the original LinkedIn post identifier, shown in America/New_York time; the export supplied only a relative age.
Historical author commentary. Statements and links reflect the original period; this import is not a new factual verification of every historical claim.
October is Cybersecurity Awareness Month, and I think one of the biggest changes in recent years is that awareness can’t just mean teaching people not to click suspicious links.
Phishing is still part of the problem, but attackers have become much better at working around the controls we’ve traditionally relied on. We’re seeing more helpdesk impersonation, MFA fatigue, token theft, session hijacking and social engineering that uses real information about employees and organizations to make the approach more convincing.
That changes what good security awareness looks like. Users still need to understand how to recognize suspicious activity, but organizations also need to make sure their technical controls and operational processes assume that someone will eventually make a mistake.
A few practical areas I’d focus on:
- Move toward phishing-resistant MFA where possible
- Tighten Conditional Access and session controls
- Review helpdesk identity verification for password and MFA resets
- Make sure privileged accounts have stronger protections than standard users
- Test what happens when credentials or a session token are compromised, rather than assuming MFA solved the problem
The aim isn’t to make every employee a security expert. It’s to reduce the number of opportunities an attacker gets and make sure one mistake doesn’t become a breach.
Cybersecurity awareness still starts with people, but it has to be backed up by identity, process and technology that work together.
Ps. Which Halloween costume works best for Cybersecurity Awareness Month?
Original publication
Original LinkedIn post ↗Original writing supplied by the author. Feed cards, repeated article announcements, and provider promotion have been removed. Consult current primary documentation before acting on historical technical guidance.