Cybersecurity Awareness Month – It’s About People

Every October, the National Cybersecurity Alliance (NCA) and the Cybersecurity and Infrastructure Agency (CISA) collaborate with private industry to educate the public on how to stay safe online in an initiative known as Cybersecurity Awareness Month. As we continue through the month, Bitdefender’s team of cybersecurity experts are sharing best practices and insights to help individuals and businesses avoid online threats and better protect their sensitive data in a digital world. This is the second in a four-part blog series. Read the first blog post in the series here.  

The theme for Cybersecurity Awareness Month this year is “See Yourself in Cyber.” While cybersecurity can seem like a complex, highly technical subject, it ultimately is about people and their behaviors. Everyone plays an important role by making smart decisions and following cybersecurity best practices in their personal lives and workplaces. To learn more about what people can do to protect themselves online, we spoke with Nicole Salas, Cyber Intelligence Fusion Analyst at Bitdefender Managed Detection and Response (MDR).   

Q: Tell us about your role at Bitdefender – What is a Cyber Intelligence Fusion Analyst?

I work in the security operations center (SOC) that powers Bitdefender’s MDR service. As a recognized industry leader in threat intelligence, Bitdefender gathers data from a global network of hundreds of millions of monitored and protected endpoints and systems. It’s one of the largest security delivery infrastructures in the world, capable of processing billions of threat queries daily. That intelligence is fed into our SOC and my role as a Cyber Fusion Analyst is to help collect and monitor all these vital data points, apply threat and risk models that we’ve established for our customers, and turn this data into actionable insights. I look for trends, suspicious behavior, and emerging threats that our customers should know about.   

Most organizations don’t have the resources, staff or expertise to be constantly monitoring the ever-evolving threat landscape and the increasing number of cyber attacks that are constantly occurring. That’s why they turn to an MDR service like Bitdefender. We provide 24/7 “eyes on the glass” monitoring of not only our customers’ devices but also their external presence. We combine that with the Advanced Threat Intelligence gathered from our global network, sources on the Dark Web, open-source feeds and more. With this holistic view, we’re able to identify attacks in their very earliest stages and even notify customers of emerging threats that have not yet targeted them but could in the future. We help identify and triage incidents, notify our customers of suspicious activity or risky behaviors, and help them respond appropriately.  

Q. What are the trends you’re seeing in cybersecurity threats today?

The three biggest threats that we see across organizations of all sizes and in every industry around the world are ransomware, phishing, and social engineering. I expect those will remain the most common threats for a long time because they remain effective and relatively easy for cybercriminals to execute. That’s because they ultimately come down to human behavior. Cybercriminals seeking valuable company data know that the easiest way to breach an organizations’ network is to target internal users and trick them into clicking a malicious link or downloading a corrupted file. They use tactics such as making a phishing email appear to come from a colleague in the organization so the recipient is more likely to click the link or open the file.  

That’s why the four key behaviors that Cybersecurity Awareness Month is focused on this year are so important. For example, one of the behaviors is “Think Before You Click: Recognize and Report Phishing.” I always tell family and friends that strong cybersecurity takes people and tools working together in a layered approach to be effective. Take the time to look closely at an email before clicking on anything. Even if it appears to come from someone you know, take note if it came during an odd time (such as the middle of the night) or if there are misspellings. If anything seems a little off, don’t click on it. Verify the request through another channel, such as by picking up the phone and calling the person directly to see if the email really came from them.  

 

Another thing people need to be aware of is how much information about them is readily available on the internet. From personal information that we post on social media, to public records that anyone can access online, there is a lot of data about each of us available online. Cyber criminals use that information to customize their campaigns and make them more targeted – and therefore, more effective. They leverage this information in phishing attacks and social engineering campaigns to make their requests seem more believable and trick people into doing something they shouldn’t.  

Unfortunately, many organizations still take a very reactive approach to cybersecurity – waiting until they’ve had an incident before trying to improve their security posture. Security awareness training is not readily available to many organizations and their employees, and that creates a big hole for threat actors to exploit. Cybersecurity awareness month is an excellent time for organizations to become more proactive by introducing training for employees, engaging with a trusted security partner like Bitdefender, and implementing best practices and policies to strengthen their cyber resilience. Make sure software is up to date, conduct vulnerability scans to identify any gaps, enable multi-factor authentication, and require everyone to use strong, unique passwords for all online accounts and identities.  

Q: How can an MDR service help organizations that may be lacking strong cybersecurity?

In addition to what I described above about providing 24/7 monitoring, Bitdefender MDR is also a step above other cybersecurity services because we incorporate cloud-native, extended detection and response (XDR) technology within our MDR service. For clients, that means that we’re monitoring more than just endpoints and devices – we’re also monitoring and protecting their cloud environments, productivity applications, and all the digital identities within their organization.  

With XDR providing greater visibility across the entire organizational infrastructure, we can spot suspicious behavior and threats earlier, and respond to an attack wherever it has been identified, to stop attacks earlier in the kill chain. It also means that Bitdefender has more data points and more visibility into critical assets at customer sites throughout our global network. Our investigations are more thorough, and we can take the intelligence gathered from an attack at one location and use that information to proactively help our other clients by alerting them to emerging threats that could affect them in the future.

Q: You mentioned that cybersecurity is ultimately about people. How did you personally become interested in cybersecurity and get involved in this industry?

I didn’t come to cybersecurity through the usual career path. Many cybersecurity analysts have a degree in computer science or were trained in the field of threat intelligence through experience in the military. I don’t have either of those backgrounds, but I discovered that I’ve always been an analyst at heart. I earned my bachelor’s degree in English with an emphasis in professional writing. I started working at an IT service company and started playing around with data analytics in various ways at that company simply because I found it interesting and fun. Leaders and mentors of mine along the way took notice and encouraged me to explore various roles in business and database analytics.

From there, I eventually moved to working with threat data in an organization’s managed security service. I discovered that I love working with threat intelligence and using analytics to identify trends and risks. It’s a fascinating field and it goes to show that cybersecurity is for everybody -- everyone must play a role in ensuring strong cybersecurity, and people from a wide variety of backgrounds and experiences can find careers in this industry.   

Learn more about Bitdefender’s MDR solution.