Cybersecurity Awareness Month: Tips on avoiding online perils

For businesses, cybersecurity is no longer a problem that can be left solely to the IT department. A single compromised password, fraudulent email or careless click can expose sensitive information, disrupt operations and potentially cost a company thousands, or even millions of dollars.

That makes Cybersecurity Awareness Month more than a reminder to update software and change passwords. It is an opportunity for businesses to examine how well they are protecting their customers, employees, finances and reputation from increasingly sophisticated cybercriminals.

I always encourage businesses and consumers to make cybersecurity a year-round priority. In fact, many of the most effective defenses are also among the simplest.

We always use a key piece of advice at the BBB, please use Strong, unique passwords are an important starting point. Employees should not use the same password for multiple accounts. If criminals obtain credentials from one compromised account, they may try those same credentials to access email, financial accounts or other business systems. Password managers can help employees create and securely store unique passwords.

Businesses should also use multifactor authentication whenever it is available. MFA requires an additional verification step beyond a password, creating another barrier for criminals who obtain login credentials.

But technology alone cannot prevent every attack. Employees remain one of a company’s most important lines of defense.

Phishing remains a significant threat because fraudulent messages can look remarkably legitimate. A message may appear to come from a company executive, customer, vendor, bank or government agency and request confidential information, a payment or an immediate response.

That sense of urgency is often intentional. Employees should be trained to stop and verify unexpected requests before clicking links, opening attachments, sharing information or transferring money. If a message appears suspicious, employees should contact the individual or organization independently using a trusted telephone number or website rather than information contained in the questionable message. These same rules also apply to all people whether it’s business or online shopping or seeing messages which cause alarm or seem urgent.

That extra step can be particularly important when criminals attempt to manipulate employees into changing payment instructions or transferring funds. In those situations, a few minutes spent verifying a request could prevent a substantial financial loss.

Keeping computers, smartphones, applications and other connected devices updated is another basic but essential security measure. Software updates frequently contain security patches designed to close vulnerabilities that criminals can exploit. Delaying those updates can leave otherwise legitimate systems exposed.

Businesses should also create a clear procedure for reporting potential security incidents. Employees need to know what to do if they click on a suspicious link, provide information to a scammer or believe an account has been compromised. Prompt reporting can give a company an opportunity to contain the problem before it becomes a larger breach.

The financial consequences of inadequate cybersecurity can extend well beyond the immediate cost of an attack. Businesses may face operational disruptions, lost revenue, legal expenses, customer notification costs and damage to their reputation. For smaller companies, the impact can be particularly difficult to absorb.

A most important cybersecurity practice is also the simplest: slow down. Cybercriminals frequently use fear, urgency and pressure to encourage people to act before thinking. Creating a workplace culture in which employees are encouraged to question unusual requests — and are not penalized for taking time to verify them can significantly strengthen a company’s defenses.

Taking security precautions is ultimately a business responsibility, not simply a technology responsibility. Protecting digital systems means protecting your money, employees, customers, reputation and the trust you've worked years to build.

Cybersecurity Awareness Month takes place each October, but the responsibility doesn't end when the month does. At BBB, we believe protecting trust should be a year-round commitment. In an environment where one careless click can have serious consequences, good cybersecurity isn't simply good technology. It's good business.

Steve J. Bernas is president and CEO of the Better Business Bureau and can be reached at sbernas@chicago.bbb.org.