# data[].attributes.attachment_link.title
Information security vs cybersecurity: What is the difference?

# data[].attributes.headline
Remote Work and Cloud-based Devices and Systems

# data[].attributes.subject
Remote Work and Cloud-based Devices and Systems

# data[].attributes.body
The growth of remote based work and BYOD policies has led to increased security risks due to devices not all being companied owned with the same software. There are ways to manage this to reduce the risk, however companies must respect their employees and balance security control with employee privacy due to employees using their own personal devices. Some of the common methods that companies are using today are, multifactor authentication, mobile device management, and VPN usage. All of these methods go off of a zero-trust basis and requiring authentication through several steps to be sure that company files are not leaked to other people.

# data[].attributes.attachment_link.readable_text
Nearly everyone has a smartphone and a laptop these days. With large portions of the workforce taking on hybrid or fully remote positions, many are using these devices to complete their work and access company data. This practice can save your organization when it comes to hardware costs... but is it worth the cybersecurity risk?

Bring-your-own-device (BYOD) programs experienced significant popularity in recent years. LinkedIn's Information Security Group, and Crowd Research Partner's BYOD & Mobile Security study found that cost isn't always the biggest motivator behind BYOD adoption, with security leaders citing the following motivations:

Increased employee mobility (63 percent),

Employee satisfaction (56 percent)

Productivity (55 percent)

Despite the benefits, over one-third of security pros admit that their company's BYOD program imposes a major burden on their resources, according to the same study.

BYOD Security Risks: Trends in BYOD

In many organizations, BYOD is a decision that's made for many reasons that have nothing to do with security. If you're at the helm of a program that allows, or is considering allowing, employees to use personal devices for work, you're probably concerned about the security risks.

Employees feel strongly about their work devices. According to one study, 89% of respondents stated they would take a pay cut to use a device of their choosing.

The increase in remote work following the pandemic lockdowns of early 2020 resulted in a comparable increase in BYOD. Though employees appreciate the option of using their own devices to complete their work, workers have concerns surrounding their own privacy. Employees want to know that their personal data is safe even when they are using their devices for work.

There are pros and cons to implementing BYOD in your organization. In this blog, you'll learn the difference between hype and reality in regard to current BYOD security fears and how to protect your organization.

1. Data Leakage

Regardless of whether your employees need to access their corporate email or protected payroll information via mobile, data leakage is a possibility when personal devices come into play. Data can be lost or exposed when devices are misplaced or stolen, or if a personally-owned device has malware on it. While cloud technology has mitigated most data loss due to device damage, security barriers and backups are crucial to a healthy BYOD program.

Ways to prevent data leakage include:

Mobile device management: In case of loss or theft, an MDM program can enable IT to remotely "wipe" a device to ensure sensitive information is not exposed.

Smarter data provisioning: Minimum necessary access is the smartest way to limit exposure. Role-based provisioning is optimal for security.

The use of app segregation and/or a VPN: Segregation and VPNs prevent sensitive data from being leaked via sketchy public wireless hotspots, and can create barriers between personal and work content on a personal device.

File integrity monitoring: Agent-based file integrity monitoring software that operates at the kernel level can notify IT the moment malware gains access to a device, allowing you to take action before it impacts your network.

2. Malicious Apps

Not all personal apps are what they appear to be, or have any business being on your end users' mobile devices. Some may remember the Pokemon Go craze that took over a few years ago. A large quantity of fake and malicious apps accompanied this craze. TechCrunch reports that some of the confirmed malicious apps included titles such as "Pokémon Go Ultimate," "Guide & Cheats for Pokémon GO," and "Install Pokémongo," in order to appeal to fans of the game.

In some cases, malicious apps have the potential to take control of the user's mobile device. This can result in surveillance, unexpected data or call charges, or loss of personal or work information. Your users need training on app best practices. This knowledge-based training should include the importance of only downloading content from app stores. In many cases, malicious mirror or personal apps are downloaded through web pages.

3. Device Management Challenges

With any mobile device, employee or company-owned, there are risks associated with a loss of control. When an endpoint walks out of your company's building, it can be difficult to control whether it's used on questionable free wireless connections or whether it will be misplaced and stolen.
Related Read: 5 Ways to Reduce Information Security Risk in a Mobile Workplace
Protecting mobile and laptop endpoints from exposure requires IT pros to focus on a mix of device security, layered protecting, and smarter provisioning. Your team must also train end-users in the safe use of personal devices for business purposes.

Some management and training opportunities you should pursue to keep your company data safe include:

Mobile device management: MDM allows employees to remotely control the content and security of an employee's device. When coupled with file integrity monitoring, IT pros can establish an optimal level of control.

Enterprise Apps Stores: Providing employees with easy access to the right apps approved for business use can mitigate the risks of "shadow IT," or employees using apps outside approval or your VPN.

Single Sign-On: A password-protected lock screen is likely not enough protection for endpoints. IT pros can enable smart user authentication without disrupting productivity by segregating and protecting your mobile apps via a single sign-on (SSO) requirement.

Multi-Factor Authentication: MFA requires employees to verify their identities through a password and a second measure such as a mobile application. This measure helps ensure that only verified parties access your organizational data.

4. Device Infection

The vast majority of users with an infected smartphone don't know their device is carrying malware. Even more concerning, feelings of "app fatigue," or excess exposure to mobile content, can make users careless about mobile security. They may not read the terms of service on new apps or think twice before granting excessive permissions when downloading new content.

Outdated mobile operating systems can be a major risk factor, with some of the most vicious forms of malware primarily affecting outdated OSs. With any BYOD program, IT pros should ensure that mobile OSs are kept up to date. Even new OSs have vulnerabilities, so it's also crucial to use file integrity monitoring to immediately detect and act on device infection.

5. Insufficient Policies

It may be possible to attempt a BYOD program without effective security policies in place, but it's certainly risky. If your organization is required to comply with PCI DSS, HIPAA, or any other regulatory requirements, an effective policy is necessary to avoid fines.

With a combination of written policy and policy-based administration, IT pros should address each of the following:

Passwords, lock screens, and single sign-on

Network connectivity

Required use of a VPN

Real-time updates and patching

Location tracking

Mobile device management

6. Mixing Personal and Business Use

With BYOD, mixing business and personal use is inevitable. You can't control whether your employees decide to shop online at compromised websites or whether they will misplace a device. While you can educate heavily on security best practices, you can't guarantee that your employees won't loan their devices to a friend or use public wireless connections to save data.

Security teams should plan to control for personal use, including times when employees don't follow best practices. The smartest methods of protection against employee behavior likely include:

App segregation: Creating a strong barrier between personal and private use of the device can prevent accidental access to work data.

Use of a VPN: A VPN can protect communications from interception, even if employees are trying to use a coffee shop's wireless network.

File integrity monitoring: IT pros can gain access to negative changes to critical system files or security, allowing them to act immediately.

7. Inability to Control Devices

What if an employee leaves the organization? In many BYOD programs, the majority of the security stress comes from a lack of control around devices. Employees are not always careful, and disgruntled staff can do a lot of damage with too much access.

Mobile device management and smarter access governance are important. If an employee is terminated or begins exhibiting questionable behaviors, policy should support your ability to immediately revoke access to sensitive data before it's leaked.

8. Lost or Stolen Devices

Lastly, you must consider what happens if an employee loses their mobile device. According to one survey, sixty-eight percent of healthcare data breaches happened due to the loss or theft of an employee device or file.

Train employees to protect their devices with passwords or biometric security measures. This way, even if a thief gets their hands on an employee's device, they will not be able to access the data.

Is BYOD Security Possible?

Bring-your-own-device security isn't simple.

Yes, it's much easier to exert control over company-owned mobile devices, especially if your employees are all using a uniform model and operating system. However, BYOD security is possible with the right tools to assess security and detect compromises.

In addition to best technical practices like the use of a VPN, an SSO, and an MDM, security teams need tools for assessing device integrity, especially as new employee-owned devices are brought onto your company's network. Mobile has some inherent risks, but allowing an employee to use a jailbroken device for work can mean that built-in security measures are effectively null.

Your organization needs the ability to monitor employee-owned devices at the device level from the moment they're provided with access to your company data and every minute of the time they're used for work or personal activities off-site.

Overcoming BYOD Security Risks

CimTrak is a solution for total compliance and security, even within complex situations that BYOD policies can create. Your employees need mobile access 24/7. With agent-based file integrity monitoring, CimTrak enables security administrators to access real-time alerts about negative changes at the device level in real-time. With one easy-to-use tool, you can enable integrity monitoring, the full ability to remediate negative changes, and auditing capabilities.

To learn more, download our FIM guide today.

# data[].attributes.attachment_link.title
The 8 Top BYOD Security Risks (and How to Mitigate Them)

# data[].attributes.attachment_link.description
How can you maintain information security concerning your BYOD policies? Consider-and counter-these 8 top BYOD security risks.

# data[].attributes.body
Cybersecurity is limited to only online information and falls under the overarching topic of information security, which can pertain to real life security breaches of any information. They are both similar because they deal with protection of information, just taken from different formats. The biggest threats to information security can include human error, third-party exposure, supply chain weaknesses. The best way to balance information security and employee productivity is to inform. By being transparent about different privacy applications through practices like training sessions.

# data[].attributes.body
The 5 most common social engineering attacks are Baiting, Scareware, Pretexting, Phishing, and Spear phishing. Baiting is when an attacker uses a false promise to pique a victims interest. Scareware is when attackers bombard victims with tons of false alarms, hoping to trick the victim into believing they are real. Pretexting is when an attacker attempts to get sensitive information from victims. Phishing is when an attacker attempts to to get a victim to share sensitive information with a sense of urgency. Spear Phishing is a more targeted form of phishing.

There have been a lot more attacks over social media in recent times. With the evolvement of AI, there have been new ways of scamming people.

# data[].attributes.attachment_link.readable_text
What is social engineering

Social engineering is the term used for a broad range of malicious activities accomplished through human interactions. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.

Social engineering attacks happen in one or more steps. A perpetrator first investigates the intended victim to gather necessary background information, such as potential points of entry and weak security protocols, needed to proceed with the attack. Then, the attacker moves to gain the victim's trust and provide stimuli for subsequent actions that break security practices, such as revealing sensitive information or granting access to critical resources.

What makes social engineering especially dangerous is that it relies on human error, rather than vulnerabilities in software and operating systems. Mistakes made by legitimate users are much less predictable, making them harder to identify and thwart than a malware-based intrusion.

Social engineering attack techniques

Social engineering attacks come in many different forms and can be performed anywhere where human interaction is involved. The following are the five most common forms of digital social engineering assaults.

Baiting

As its name implies, baiting attacks use a false promise to pique a victim's greed or curiosity. They lure users into a trap that steals their personal information or inflicts their systems with malware.

The most reviled form of baiting uses physical media to disperse malware. For example, attackers leave the bait-typically malware-infected flash drives-in conspicuous areas where potential victims are certain to see them (e.g., bathrooms, elevators, the parking lot of a targeted company). The bait has an authentic look to it, such as a label presenting it as the company's payroll list.

Victims pick up the bait out of curiosity and insert it into a work or home computer, resulting in automatic malware installation on the system.

Baiting scams don't necessarily have to be carried out in the physical world. Online forms of baiting consist of enticing ads that lead to malicious sites or that encourage users to download a malware-infected application.

Scareware

Scareware involves victims being bombarded with false alarms and fictitious threats. Users are deceived to think their system is infected with malware, prompting them to install software that has no real benefit (other than for the perpetrator) or is malware itself. Scareware is also referred to as deception software, rogue scanner software and fraudware.

A common scareware example is the legitimate-looking popup banners appearing in your browser while surfing the web, displaying such text such as, "Your computer may be infected with harmful spyware programs." It either offers to install the tool (often malware-infected) for you, or will direct you to a malicious site where your computer becomes infected.

Scareware is also distributed via spam email that doles out bogus warnings, or makes offers for users to buy worthless/harmful services.

Pretexting

Here an attacker obtains information through a series of cleverly crafted lies. The scam is often initiated by a perpetrator pretending to need sensitive information from a victim so as to perform a critical task.

The attacker usually starts by establishing trust with their victim by impersonating co-workers, police, bank and tax officials, or other persons who have right-to-know authority. The pretexter asks questions that are ostensibly required to confirm the victim's identity, through which they gather important personal data.

All sorts of pertinent information and records is gathered using this scam, such as social security numbers, personal addresses and phone numbers, phone records, staff vacation dates, bank records and even security information related to a physical plant.

Phishing

As one of the most popular social engineering attack types, phishing scams are email and text message campaigns aimed at creating a sense of urgency, curiosity or fear in victims. It then prods them into revealing sensitive information, clicking on links to malicious websites, or opening attachments that contain malware.

An example is an email sent to users of an online service that alerts them of a policy violation requiring immediate action on their part, such as a required password change. It includes a link to an illegitimate website-nearly identical in appearance to its legitimate version-prompting the unsuspecting user to enter their current credentials and new password. Upon form submittal the information is sent to the attacker.

Given that identical, or near-identical, messages are sent to all users in phishing campaigns, detecting and blocking them are much easier for mail servers having access to threat sharing platforms.

Spear phishing

This is a more targeted version of the phishing scam whereby an attacker chooses specific individuals or enterprises. They then tailor their messages based on characteristics, job positions, and contacts belonging to their victims to make their attack less conspicuous. Spear phishing requires much more effort on behalf of the perpetrator and may take weeks and months to pull off. They're much harder to detect and have better success rates if done skillfully.

A spear phishing scenario might involve an attacker who, in impersonating an organization's IT consultant, sends an email to one or more employees. It's worded and signed exactly as the consultant normally does, thereby deceiving recipients into thinking it's an authentic message. The message prompts recipients to change their password and provides them with a link that redirects them to a malicious page where the attacker now captures their credentials.

Social engineering prevention

Social engineers manipulate human feelings, such as curiosity or fear, to carry out schemes and draw victims into their traps. Therefore, be wary whenever you feel alarmed by an email, attracted to an offer displayed on a website, or when you come across stray digital media lying about. Being alert can help you protect yourself against most social engineering attacks taking place in the digital realm.

Moreover, the following tips can help improve your vigilance in relation to social engineering hacks.

Don't open emails and attachments from suspicious sources - If you don't know the sender in question, you don't need to answer an email. Even if you do know them and are suspicious about their message, cross-check and confirm the news from other sources, such as via telephone or directly from a service provider's site. Remember that email addresses are spoofed all of the time; even an email purportedly coming from a trusted source may have actually been initiated by an attacker.

Use multifactor authentication - One of the most valuable pieces of information attackers seek are user credentials. Using multifactor authentication helps ensure your account's protection in the event of system compromise. Imperva Login Protect is an easy-to-deploy 2FA solution that can increase account security for your applications.

Be wary of tempting offers - If an offer sounds too enticing, think twice before accepting it as fact. Googling the topic can help you quickly determine whether you're dealing with a legitimate offer or a trap.

Keep your antivirus/antimalware software updated - Make sure automatic updates are engaged, or make it a habit to download the latest signatures first thing each day. Periodically check to make sure that the updates have been applied, and scan your system for possible infections.

# data[].attributes.attachment_link.title
What is Social Engineering | Attack Techniques & Prevention Methods | Imperva

# data[].attributes.attachment_link.description
Social engineering uses psychological manipulation to trick users into making security mistakes or giving away sensitive information

# data[].attributes.headline
Remote Work and Cloud-based Devices and Systems

# data[].attributes.subject
Remote Work and Cloud-based Devices and Systems

# data[].attributes.headline
Remote Work and Cloud-based Devices and Systems Video

# data[].attributes.subject
Remote Work and Cloud-based Devices and Systems Video