Tag: cyberawareness training

  • Home
  • cyberawareness training
22 Jun 2023
cyberawareness training 2023
Blogpost, eLearning creativ technologies 0 comment

What must be cyber awareness training in 2023?

Cyberawareness training is the need of the hour for companies because their data is at stake with everything getting digitalized. Hackers are adopting new solutions to hack websites and apps, and it has become difficult to trace them. The training is not enough, and more advanced methods have to be used to teach employees how to protect their computers. Companies can’t expect people to become expert cyber security experts because they have attended one training session.

Cyberawareness training can’t be completed in one session because it comprises many topics like phishing emails, ransomware and malware.Companies must ensure that they are well-prepared to deal with cyber attacks. But how? They must prepare employees through simulations to prepare them for what can happen. They must have proper examples to teach them and not some old legacy examples.

When employees are assessed through the same, their skill gaps come out in the open. With such skill gaps, companies know how to prepare employees for future training. These are the reasons due to which cyberawareness training has become important:

  • Employees’ devices are vulnerable:

The employees must ensure that they don’t get the company devices stolen while working from home. It’s because such devices contain all the sensitive data. Moreover, even when working from the office, they should ensure that such devices are always locked by passwords so that no one can access confidential data. Employees must install antivirus software on their systems to prevent such attacks. Apart from various training sessions, the knowledge of the employees must also be checked through tests to see if they have grasped the information.

  • Use of smartphones:

Since mobile phones have replaced computers, the threat has gotten bigger. Because mobile phones are taken everywhere, they can be stolen easily.

Moreover, they are used for every purpose now, for making payments. Due to this reason, they contain our bank account details which hackers can misuse. Mobile phone hacking has increased by 50% in 2019, so the companies are at a greater risk. These smartphones also contain company email account details. Unlike computers, mobile phones are used for every purpose now due to the presence of apps.

  • Use of AI:

The threat of cybersecurity has gotten bigger because AI can be used to write malware. So, hackers now have AI at their disposal, which can’t be traced easily. With the use of the internet to sell things, digital data is also a primary concern for companies. With the advent of AI, the software has become more complex and their weaknesses have increased too.Although such data is stored in the server, any bugs and the data is available for misuse. Hence the security of servers is also an important consideration.

Hence every database needs a supervision system so it can’t be hacked.

How should a cyberawareness training program be prepared?

A company must ensure that no one misses the cyber awareness training.

Without it, the employees can commit mistakes, even at the managerial level.

The preparation of the cyber awareness training should include the IT Department head. Also, executives who enter the data into the system and are at severe risk of providing access to confidential data should also provide their inputs for such a program.

Role of the HR department

The Human Resources Department should also spread awareness about the program so everyone attends it. This department can track who attended the program and who missed it.

Apart from ensuring that the program gets implemented well, they can also ensure that the employee feedback is collected on whether they understood everything. Even the test results collection is HR’s job.

The employees are the most crucial weapon in a company’s hands because it cannot monitor everything. But when employees know about the possible attacks and how to thwart them, it can be beneficial.

As far as the cost of the cyber awareness training program is concerned, it is dependent on how large the organization is. With a large organization, there is an extensive risk of making the systems compromised. The big companies need to see that the program is more detailed so that everyone in the organization can understand it. People who understand the cyber awareness training program better can skip some of its levels.

On the other hand, smaller organisations can get a program at a low cost because they don’t have many levels. They only have a few executive staff, so the program must be designed to keep their needs in mind.

14 Mar 2022
LMS
Blogpost, eLearning creativ technologies 0 comment

Can an LMS be hacked? Make sure that does not happen!

Online learning has become a crucial part of our lives in the pandemic. Cyber awareness training takes so much of a company’s time, but it is worth the effort when the LMS does not get hacked. E-learning is happening all the time, but sometimes that can cause problems when your security details are shared with unwanted people.

Issues arise when the company’s LMS gets hacked or when a MOOC’s website is compromised.

Hence, these organizations must ensure that the users cannot log in without providing an OTP. It will prevent unauthorized users from accessing the accounts of learners. This can be the adverse consequence when an LMS gets hacked:

Hackers can take loans and steal mail

Hackers can get access to so much valuable information through login credentials. This can include the user’s bank details, which can be further used to take credit. But this can be stopped through a credit freeze, where the users can ensure that no one can apply for a credit card or a loan when such a freeze has been imposed. When you need a loan, you can unfreeze your account.

Apart from that, the unsuspecting users of such e-learning sites can also have concerns when someone gets access to their house address and pays a visit. He can check the mailbox and steal all kinds of items, such as passport numbers included in confidential mail.

The learners must make sure that they do a follow-up whenever they have not received any mail from an organization. They know if their mail has been stolen by someone else in such a situation. When they are not in the house, they must ensure that their mail is received by someone else so that it does not go into the hands of fraudsters. If someone is not available to collect your mail while on vacation, it’s better to ask the sending organization to delay it until you arrive. Apart from passport numbers, thieves can get access to all kinds of information through your mail, such as school records, utility bills, etc.

Solution 1: Limited number of login attempts

The e-learning companies USA must ensure that the users are given an extra layer of protection when they log on to the LMS through their business’s website. Any user must be unable to access the LMS after three attempts to log in. His access must be blocked because, generally, a user can’t enter an incorrect password three times. It could be hackers trying to get into an account using brute force algorithms.

Solution 2: Anti-spam feature in the LMS

The users must also be given a reCAPTCHA option so that no bot can access the LMS. Also, the user data must be protected on the server’s end. Only specific LMS administrators must have access to this server so that no one can steal this confidential data. The company getting an LMS from the e-learning vendors must ensure that it has features such as anti-spam. It makes sure that no one can access the LMS through spam email accounts. Once any spammer creates an account on an LMS, he can install ransomware on the server and access all user details. They can then ask for a hefty ransom to get back access to all its LMS files. Even if such spammers don’t install ransomware on the server, they can still send learners phishing emails and access sensitive information like banking details.

Solution 3: LMS access allowed through specific IP addresses

It’s the job of the e-learning vendor to check that anyone cannot register on the LMS. The permitted users should only be from certain specific domains, like the corporate website or an e-learning portal created for this purpose. Anyone else logging from his email ID should not create an account. Furthermore, the company should ensure that no one has access to the e-learning portal except the employees. But even if the URL gets known to others, its access must be allowed from specific IP addresses. Hence, the businesses must ensure that the LMS security is taken care of properly by the e-learning vendor.

Solution 4: Automatic Backup

An LMS vendor must also have backup support if the servers get hacked. In the absence of a backup, the e-learning content is also lost apart from user details. Hence, its LMS software must have the capability to create a backup every night on the dedicated server of the LMS vendor. When a backup option is there, companies are saved from the hassle of recreating all the e-learning content from scratch.

The LMS vendor must ensure that the users’ systems don’t get hacked by fraudsters. Hence, the LMS must come bundled with antivirus software to scan the users’ computers and alert them about any virus installation.

Solution 5: Access through OTP only

The LMS vendors must also ensure that the software is compatible with the mobile phone. It’s because any app can be hacked quite easily; hence it’s the job of the LMS vendor to check that the users can only log into the app through the OTP protocol so that anyone who has downloaded the app can’t log on to it. Also, all the data transferred through the app must be encrypted to protect it from hacking.

This is how an e-learning vendor can prevent an LMS from getting hacked.

Learn more…

 

24 Jan 2022
cyberawareness training
Blogpost, eLearning creativ technologies 0 comment

Can companies prevent ransomware attacks through RDP with cyber awareness training? 

Ransomware attacks have become commonplace, and their danger is increasing.

It’s because companies can only fight them once employees get the crucial cyber awareness training.

After all, once such software is installed on the systems the companies have to experience downtime affecting their reputation.
CAN Financials paid the largest amount of 40 million USD as ransom in March 2021 to hackers. But most importantly, hackers got access to confidential data of its clients, i.e. the insured.
Hence, employees must have due training to detect such attacks in time. Insider attacks are also common when they upload ransomware on the system. RDP(Remote Desktop Protocol) is now the most common way to upload ransomware on systems.

What is RDP?

Over time, RDP has become an increasingly common way for employees to access their systems once they are not present near them. This happens because employees are working from home on their laptops but need to work on some files stored on the office computer. So, when the employee works in a hybrid model and uses the office PC sometimes but does not have time to transfer them to a USB for use when he is working from home, he can use RDP. In RDP, the user gets access to the desktop of his office PC and all the files stored on the PC can be edited by him.

Through the internet, the keystrokes of the user on his home PC’s keyboard are transferred to his desktop PC.

The RDP method of connecting the home PC to the office desktop pc allows companies to keep a tab on their operations because they can monitor when an employee logged into the remote desktop client software to access the desktop PC. The user can locally get printouts of documents available on his office PC. In RDP, the keystrokes of the user are encrypted through 128-bit RC4 encryption. The user can also store his files on the office PC through the copy-paste functionality through a shared clipboard. Through the remote desktop functionality, since the users get control of the office PC, they can run any software installed on it.

So, it makes sure that they don’t have to install the software on their home PC. Although RDP, is a time-saving feature, the problem arises when a hacker gains access to an office PC because he has somehow accessed an employee’s credentials. Therefore, organizations need to follow some guidelines for the prevention of such unwanted intrusion. The organizations must ensure that all the PCs in the office are not accessible through the RDP, especially those containing confidential data.

Hence, cyber awareness training can help employees who are using the RDP to work safely. They can be taught how to change the RDP port because port 3389 is used by Microsoft to provide access to any RDP request. This port whenever it’s open due to the RDP connection can be discovered by any port scanner and hence the hackers can intercept the keystrokes.

Prevention of brute force attacks

The organizations must also be cautious regarding who is allowed access to a network. This can happen because hackers use brute force attacks to get the password to an RDP connection. Brute force algorithms try hundreds of passwords before they figure out the correct one. Hence, the organizations should block logging in through RDP client software once a certain number of login attempts fail.

Also, employees should only log in to the RDP through their email addresses, which will make it tough to access their systems even if brute force algorithms are used for cracking passwords. Employees should make sure that their email IDs are not disclosed unintentionally to anyone.

Employees can also use strong passwords to prevent any brute force algorithm from finding them. Apart from that, a company should use Remote Desktop Gateway Server, which makes sure that 2-factor authentication is there, in which case an employee can’t log in to a remote desktop without an OTP. This is the server through which all the connections to the RDP server pass through. So, the remote desktop gateway server minimizes the chances of the remote desktop server getting hacked because the latter has a private IP address and hence the connections to this server have to be routed through the gateway server.

05 Jan 2022
cyberawareness training
Blogpost, eLearning creativ technologies 0 comment

Can cyber awareness training protect employees from keylogging software? 

Cyber awareness training must include the prevention of installation of the keylogging software because they are now the most prevalent method of cyberattacks along with phishing.

The training of the C-level employees is important too because any data breach with them makes the company more vulnerable. They have access to the most sensitive data of the company, and hence their training should be a priority.

Companies are implementing cyber awareness training but still, problems get caused due to the ignorant attitude of employees. The companies hence have to make sure some checks are made mandatory for company employees. For example, a company needs to make sure that if there has been a security lapse, it is reported on time. An employee could be browsing some unanticipated sites, leading to malware getting downloaded on his PC. His fellow employees could report his behavior and then action could be taken on time and the malware could be removed from his system. But the reporting employees’ identity should be protected so that he does not face any consequences of his actions. The employees could be informed about the hotline for filing complaints through sticky notes etc.

What is keylogging software/hardware?

In a specific case, when an employee has left the company but still has access to a system through a keyboard capture/keylogging software because this software allows him to get access to an office PC as he is aware of the credentials of other employees. This is because once such software is installed on a PC; it allows the ex-employee/hacker to know the keystrokes which are entered on the computer. The victim on whose PC this software is installed does not know that this software is running in the background while he is doing his work.

Keyloggers don’t need to be only in the form of software. There are such devices, too, attached to the computer or the keyboard that can intercept the keystrokes.

Such software/hardware allows a lot of privilege to the user because he can get all the information such as the webpages visited by a victim and text which is copied and pasted. This key capture software is used when the parents want to monitor what sites children are visiting in their absence. It’s because such software can read what the children type in the browser.

How to tackle them?

Incident response plan

Employees must be made aware of how pivotal a role they play in the cybersecurity of the company. The cyber awareness training is not a one-time event, and it should be imparted continuously for best results. In a situation, when a company has detected that a key capture software is getting used, it must have an incident response plan in place.

The employees should be given all the details about the incident response plan to be implemented in case a security breach happens. All the participants should be trained about their specific roles in this plan.

Prevent installation

The employees have to be elucidated about how they can prevent the installation of a keylogging software on their system, which can happen in many ways:

Antivirus software: A user should have antivirus software installed on his system so that when he gets an email from an unauthorized source, he does not open it. Even though he might open this email, he must not download and install the email attachment including games too. A keylogger can also get access to a PC when a user visits a malicious site that has an expired security certificate. Such websites can also download a payloader software to the system, which can download and install a keylogger.

He should also not open up malicious popups and click on any mp3 files on the internet to play them and any YouTube videos.

But installing the antivirus software is not a sufficient technique to block the keylogging software. It’s because the latter software are getting invented all the time and the antivirus software can only block the installation of known software included in its database. It takes time for antivirus software to recognize any new keylogging software on the block and discover how to prevent it by creating specific signatures for its detection.

Hence, how to prevent keyloggers from finding your keystrokes?

  1. Virtual keyboards

A user can also ensure that the keylogging software is not able to detect his keystrokes when he is using a virtual keyboard. This is because through this software the user does not press the keys on the keyboard hardware to type, but instead uses the mouse to touch the keys on the virtual keyboard, which can’t be traced. The windows operating system already has this feature enabled in its “accessories”.

The virtual keyboards were not invented for stopping keylogging software from detecting keystrokes, and such software can capture the keystrokes of such keyboards too. The reason behind the generation of such keyboards was to help the physically challenged computer users who could not type to enter the keystrokes by touching the mouse. Hence, they have to be invented exclusively for blocking such software.

  1. Using an encryption software

Encryption can only help you in protecting against data theft through keylogging software. Through cyber awareness training, employees can be taught about how to use anti-keylogging keystroke encryption software. The keystrokes are encrypted through this software and can’t be detected by any keyloggers installed on the PC.

 

 

20 Aug 2021
LMS
Blogpost, eLearning creativ technologies 0 comment

Make employees learn about the safety of home PCs through an LMS

In our age, implementing an LMS is an absolute necessity to deliver knowledge to employees. Employees indeed need to be trained consistently to ensure that an organization reaches its peak level of success. Cybersecurity is quite important for organizations to make sure that the employees are safe in their workspace.

It is crucial because employees are working from home and use company servers to access data. Although VPNs are getting used to protect the company networks, they are still prone to attacks through user errors.

As per security reports, there has been a huge increase in mobile phishing attacks. There has been a huge rise in such attacks between the times since October 2019-March 2020. This has happened due to user mistakes.

Training software is required to make sure that employees protect company systems while working from home. Since it’s so necessary, such kind of training can’t be for a short duration.

The LMS needs to be updated with cybersecurity materials to ensure that the employees look for warning signs to protect themselves from phishing.

When a child is using your system

Cyber-attacks have increased because employees use social media also. But with proper cybersecurity training, employees can inform their companies on time about any potential threats. Employees need to know that their home devices can be hacked also. It can happen when someone hacks their home Wi-Fi.

For example, someone can introduce viruses into the home PC when it is used by a child to access a gaming site. That means compromising the system and giving access to VPN credentials. Even mobile phones used to access office emails can be hacked when a nefarious site is opened.

Make sure employees use the LMS to learn about cybersecurity

Through an LMS, employees can be taught about the rules of cybersecurity. An LMS can make sure that employees partake in games, where they are asked for their response to a phishing situation. An employee with the correct answer is rewarded with tokens. So, an employee with the maximum tokens can be given the awards such as “the best employee of the year”. This way, employees can be encouraged to receive training about the latest phishing trends.

Businesses need to understand the importance of cybersecurity because if the LMS does not contain information on it, the whole system can be compromised. The employees must comprehend how important it is for them to protect the data of the company.

What to do when hackers have accessed the router?

The hackers can get access to the router’s password. Once this password, is compromised, he can attack all the systems in your home. There are many signs of what happens after a router has been hacked:

Low bandwidth: The hacker will take advantage of your bandwidth, which implies you won’t have much left to use. You will suffer from the problem of slow-loading sites, which can affect your work.

Compromise of firewall: Once the hacker can install some malware on your system, the firewall becomes disabled, leading malicious websites to open up on the system. Viruses can be unleashed on your computer, stealing all the critical data. They can also start operating the computer by themselves. They can also check all your internet activity to know which sites are getting accessed.

The employees of a company can be sent videos through the LMS to detect if any hacker has been accessing their home systems.

The employee has to follow certain basic steps:

  • Log into the computer: He has to log in to the computer using his own username and password. Once he has logged in, he then has to type the router’s IP address in the browser’s URL bar.
  • Find the connected devices: After that, you can check how many devices are logged into your network. There is a list of attached devices you can check. You might know some devices, but some of them are recognizable through their IP addresses. If you don’t recognize the IP address of any device, this implies it is the device of a hacker. What to do, once you discover such an IP address. The best way is to reboot the router to disconnect such a device from your network.
  1. The first thing you can do is reboot the router. This reset button is located on the back of this device. It’s a hole with the words RESET mentioned on top of it. You have to stick something pointed in this hole to press the button. You have to make sure that this button stays pressed for 30 seconds.
  2. After that release, the button and the router are restarted.
  3. But after that, you have to call the ISP(Internet Service Provider) person at home, to configure the network and start the internet on your PC.

All these steps can be shown to employees in a Zoom call so that their home networks are safe.

 

 

©2022 Creativ Technologies. All rights reserved.

He was a German psychologist who is known for discovering the forgetting curve. According to this curve, the biggest decline in memory happens within 20 minutes, and then 1 hour.