The Two Best Things You Can Do to Protect Yourself and Your Organization from Cyberattacks

Since the beginning, two types of cyberattacks (known as initial root cause exploits) have composed a majority of successful attacks: social engineering and exploiting unpatched vulnerabilities. These two root causes account for 50% to 90% of all successful attacks. You can be attacked in many other ways (e.g., password guessing, misconfiguration, eavesdropping, physical attacks, etc.). Still, all other types of attacks combined do not equal either of the other two more popular methods.

Social engineering is involved in 50% to 92% of successful attacks, and exploiting unpatched software and firmware accounts for 20% to 40%. There are a lot of crossovers because attackers often use multiple methods to accomplish their malfeasance. For example, a social engineering email will try to convince potential victims to download a trojan-enabled Microsoft Word document that launches an attack against an unpatched vulnerability.

It is the world’s inability to focus on these two top root causes of attacks appropriately that allows hackers and malware to be successful.

You need to do everything you can do to fight social engineering, including implementing good policies, which reduce the risk of social engineering, implementing your best defense-in-depth technical defenses (like content filters, endpoint detection and response software, secure configurations, etc.) to prevent social engineering from getting to end users, and training end users to recognize social engineering that gets past the first two mitigations.

You must aggressively patch software and firmware vulnerabilities used by malicious hackers and malware. What software and firmware vulnerabilities are used by hackers and malware to exploit devices and networks? The U.S. Cybersecurity & Infrastructure Security (CISA) agency has a list of those vulnerabilities, branded as the Known Exploited Vulnerability Catalog. Subscribe to this list, and CISA will send you an email any time a vulnerability gets newly exploited by an attacker for the first time (as far as they know). If you have software or firmware on this list, get it patched as soon as possible.

That is it! These two mitigations, fighting social engineering and patching exploited vulnerabilities, are the two best things most organizations can do to fight hackers and malware. If you do these two things better, the risk that you will be compromised goes way down, and if you do not, vice-versa.

Information used in this article was provided by our partners at KnowBe4.