Article, October 2010
October is National Cyber Security Awareness Month
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host
Organizations, employers, school teachers, computer clubs, senior citizen centers, and a variety of other institutions are often in search of some type of topic or event that they can use as a theme for meetings and presentations. For those looking for an October topic (but can really be done during any month), October has been declared by the president as National Cyber Security Awareness Month.
Someone may ask, "Why even have a National Cyber Security Awareness Month?" We all need to be aware of the risks involving our computers, and how those risks can impact us personally. The news is rife with stories about viruses and malware, such as the recent massive attack by the "Here You Have" trojan that wreaked havoc on millions of computers in a single day. Identity theft and other economic cyber crimes are depriving individuals and businesses of billions of dollars every year. Social networking websites are being utilized by pedophiles to lure thousands of children into dangerous, and even life threatening, liaisons with miscreants. Hackers and crackers will frequently try to break into our home and office computers for malicious purposes, trying to steal our private information, or otherwise hijack our computers to send out spam email or launch coordinated cyber attacks on other computers. Fraud of many types is rampant online, from phishing schemes designed to trick the user into giving his username and password to the crooks, to counterfeit products, get-rich-quick scams, political misinformation, and medical quackery. According to several cyber security companies, spam emails constitute over 90% of all email hitting our servers. As I type this, one security website has catalogued over 14 million different viruses, worms, trojans, and other forms of malware just waiting to infect our computers, with literally tens of thousands of new threats appearing every day. The average computer is unaware that we are currently engaged in an active cyber war, with foreign nationals hammering our government, military, and industrial computers looking for that hole that will grant them access to valuable information. Cyber espionage, the obtaining of military secrets or classified industrial projects, is rampant.
So, why have a National Cyber Security Awareness Month? While many of us are complacent, and compute with blissful ignorance, we are also all soldiers in the front lines of this battle, so we must first be aware of the threats, and then take appropriate actions to mitigate them.
National Cyber Security Awareness Month was first implemented by a Presidential Order from President Bush in 2001. The president declared that every October be National Cyber Security Awareness Month, a declaration recently ratified by President Obama. For 2010, the program is under the auspices of "The National Cyber Security Alliance (NCSA), a public-private partnership focused on educating a digital citizenry to stay safe and secure online. ... NCSA, along with the U.S. Department of Homeland Security (DHS) and the Multi-State Information Sharing and Analysis Center, sponsors National Cyber Security Awareness Month." While the Department of Homeland Security is the primary public agency promoting this activity, several private companies provide much of the funding and manpower used for this project. These private companies include AT&T, Cisco, General Dynamics, Google, Lockheed-Martin, Microsoft, Symantec, McAfee, Verizon, and Visa. Dozens of other companies, organizations, governmental agencies, and colleges have publically endorsed the project, and are actively participating in its promotion.
The NCSA has a "Get Involved!" website at http://www.staysafeonline.org/content/get-involved-1 where different groups can get information on how to promote the event. Specific resources and instructions are available for home users, educators, businesses, college students, college administrators, libraries, local law enforcement, and local government. With the resources provided, these and other groups can easily present an audience appropriate presentation. Posters, flyers, pamphlets, brochures, bookmarks, and other printed materials are available in both PDF and Word formats, such that the presenter will have little original work to prepare.
Customized examples of the content for each constituency are freely provided, and easy to use on the "Get Involved!" website. For example, the home users are instructed to use a comprehensive security suite that provides frequent automatic updates, update their operating systems and browsers as soon as patches are released, use complex passwords, be cynical about giving others your personal information online, turn off your computer when not in use, know that security applies to mobile devices (such as smart phones) just as much as it does to a computer, know the symptoms of a compromised computer, teach his children about online safety, backup his data frequently, lookup himself and family members on the major search engines to see what is posted about them, and maintain vigilance and awareness of contemporary threats.
Teachers and college faculty should encourage good cyber security practices every time their students are online, as well as integrate cyber security and safety into lesson plans and course content; arrange for a competent cyber security professional to speak to classes and parents; incorporate cyber security and safety into faculty in-service training; require all students to change their password in October to one that is long, complex and not easy to guess. It should not only be the teachers that should be involved, but administration needs to also be involved. The NCSA has resources for administrators as well, at http://www.staysafeonline.org/content/what-college-administrators-can-do.
Local law enforcement needs to be involved, as our citizens are often victimized by online criminals. There is no net difference in the pain or loss suffered by a victim who has been robbed locally, or one robbed online. Too many of our children are victimized by pedophiles who troll for naive children online. Law enforcement should get on board with the program. Local law enforcement are looked to for security guidance and protection from criminal activity; that protection should not just be the traditional protection from street crime, but should also include community education on protection from cyber crime. Local law enforcement agencies should present cyber security topics at external community events, and internal training, including at roll call. The distribution of cyber security literature should occur along with other crime prevention literature. Departments should implement a written policy on dealing with citizens who have been cyber victimized (such as Internet fraud or identity theft), and encourage them to report it to the FBI’s Internet Crime Complaint Center (http://www.ic3.gov). Appropriately trained and skilled officers should speak at local schools, businesses, religious institutions, and other organizations on cyber crime and cyber security; a police officer (or deputy sheriff) has a cache' of authority that many other speakers may lack.
Businesses, both small and large, have become the primary targets for many cyber thieves. These crooks are utilizing a variety of ingenious online tricks and tools to defraud businesses, many of which can be mitigated if only the employees (and management) are appropriately trained, and proper policies are implemented. Cyber security policies and procedures need to be reviewed frequently, and updated as appropriate, as the threats are dynamic and constantly changing. The NCSA and Symantec published a small business cyber security study which shows what businesses are doing (staysafeonline.org/content/2009-smb-security-study). Hold periodic employee meetings, such as brown-bag lunches, where cyber security practices can be openly discussed. Post security tips in break rooms, work rooms, and company newsletters, as well as distribute handouts to employees. Businesses need to create an environment where employees can freely raise security concerns. Make sure that your customers and clients, including online customers, know that you are adequately protecting their personal and private information. Make it a policy that computers should be shut down at night and at other down times. Managers need to be kept informed in a timely manner of any evolving security threats that can impact the business.
Whatever the event or group, there is an abundance of educational and training materials freely available for cyber security training. There is a large assortment of cyber security "Tip Sheets" available from staysafeonline.org/content/ncsam-tip-sheets. These Tip Sheets, available for free in both PDF and Word formats, include documents about gaming safety for kids and parents, Internet Safety and Security Tips For Parents, Mobile Safety Tips, and Social Networking Tips 2010. Under each of the groups listed at staysafeonline.org/content/get-involved-1 (home users, businesses, law enforcement, etc.) are links to additional resources. Still more resources are available online at staysafeonline.org/content/additional-awareness-resources-2010.
While October is indeed National Cyber Security Awareness Month, we need to make every day a security awareness day. We lock our cars, and we lock the doors to our homes; we need to lock our computers as well to prevent others from accessing them and doing harm to us and others.Click here to return to top