Cyber Security Guidelines for Organizational Users

Assess the full range of hack damages, from data and financial loss to physical security risks, life-safety concerns, and productivity impacts, highlighted by a Florida water-treatment breach.

Explore supply-chain attacks, such as the SolarWinds Orion IT compromise delivering Sunburst malware, and see how zero-day exploits in Microsoft Exchange servers enable lateral movement.

Explore how scams exploit current affairs to lure users with malicious emails and fake domains, including covid-19 themed schemes targeting professionals and engineers.

Identify phone call frauds targeting non-digital users with offers like maturity payouts or free holidays, and learn how scammers seek pins, cvvs, and otps.

Explore insider threats, including how current or former employees and contractors abuse privileged access to steal data or intellectual property, and learn monitoring strategies to detect access, changes, or copies.

Explore bitcoin mining hacks or crypto jacking, where attackers use victims' cpu cycles, ram, and storage to mine cryptocurrency via malicious links or emails.

Explore the compilation of breaches (comb) in early 2021, showing how 3.8 billion username and password combinations enable credential stuffing across Gmail and LinkedIn. Change passwords and enable multifactor authentication.

Explore the dark web as a hackers marketplace and the onion router (tor) access. Restrict access within organizations; avoid using tor and beware of sold credentials and credit cards.

Examine a real-world Uber breach where a single compromised user enabled a full company attack through social engineering, MFA abuse, and stolen VPN credentials, revealing crown jewels and AWS data.

Discover how loan apps can turn quick online loans into extortion by data access and threats, and learn to avoid it by using banks and verifying apps.

Learn how to check if your email is hacked or pwned using haveibeenpwned.com, review breach details and dark web exposure alongside sources like LinkedIn to understand your email exposure.

Explore how a compromised email exposes credentials on the dark web, triggers ransomware and remote access tools, and leads to phishing, sim swapping, and fake banking sites.

Explore how phishing emails unfold by simulating a finance controller scam, showing attacker research, spoofed boss accounts, malware via attachments, and key tips to spot suspicious messages.

Explore ISO/IEC 27001 ISMS—the international information security management standard with 114 controls across 14 groups; learn how physical security, external audits, and certification strengthen organizational security and trust.

Apply ISO 27001 security controls and cybersecurity awareness to safe web browsing. Use HTTPS with the padlock, avoid insecure networks, and avoid storing passwords or cookies.

Learn safe email usage guidelines for company accounts, including avoiding suspicious messages, not opening unknown sources or unusual subjects, and scanning attachments before opening to prevent spam.

Learn password management guidelines to create strong, unique passwords with mixed case, numbers, and symbols; avoid easily guessed terms, don't share or reuse passwords, and enable multi-factor authentication.

Practice clean desk and clear screen guidelines to protect sensitive information. Lock your computer, securely dispose of documents, remove personal items, and avoid sharing client data or leaving whiteboards exposed.

Explore physical access guidelines for organizational users: wear ID badges and RFID cards, avoid sharing credentials, use access only in authorized areas, and report lost badges for revocation.

Learn visitor management guidelines to prevent tailgating and piggybacking. Escort visitors to the reception, collect their details, stay with them, report tailgating to security, and ensure returned badges.

Explore the CIA triad—confidentiality, integrity, and availability—and how ISO 27001 and ISMS apply data protection, role-based access, monitoring, and accountable access to data.

Protect company and personal data by enforcing encryption, secure backups, and restricted sharing; comply with PCI, HIPAA, GDPR, and KYC, and avoid personal cloud storage or public sharing.

Protect company assets by following asset management guidelines, use devices for office work only, avoid sharing or free wifi zones, and return assets at tenure end to prevent data breaches.