Cybersecurity is everyone's responsibility

The Army has proclaimed October as Cybersecurity Awareness Month, but Soldiers, civilians and their families need to be vigilant the whole year round. The U.S. Army Special Operations Command's Information Assurance Office is working with the U.S. Army Cyber Command to stop cyber-attacks to both the service and its people by educating individuals in their responsibilities in both their personal lives but also at work.

The cyber threat facing the Army is pervasive and increasingly sophisticated. Cyber-attacks constantly threaten Army network, information and personnel. Outside threats have managed to breach several Army and Department of Defense sites and gathered personal information.

USASOC faces the challenge of cyber security each day from both internal and external threats. According to the USASOC Industrial Security Office, there is an estimated 12 cybersecurity incidents per week, most coming from employees failing to follow proper procedures or ignore command policy.

"An insider threat can come in a variety of forms ranging from a rogue employee leveraging their unique position, someone with admin privileges to deliberately steal intellectual property and/ or government secrets, to a user unknowingly plugging in an infected (unauthorized) device to the network (personal phones)," Paul Perry, information assurance manager for USASOC, said in an email interview. "Insider threats also come in the form of employees acting without consideration of the security policy."

The threats that Perry's office and USASOC's Industrial Security look for include social engineering; email phishing and spear phishing; fraudulent websites; theft, loss or negligent disclosure of information and malware.

Social engineering is when somebody manipulates somebody into divulging sensitive information such as bank or credit card data; computer passwords or classified information. To avoid being a victim of social engineering avoid unsolicited phone calls or email and when providing information online, make sure that the website is legitimate and stars with https.

Phishing is when an attacker uses emails to get you to clicking on a link or attachment. Most of the times they try to appear to be a legitimate business or someone you know. If a phishing attack is suspected, contact the person or company to verify that they actually sent it. Most of these attacks include emails from fraudulent banks or credit cards that look real.

Most users are seeing an upsurge of fraudulent websites popping up on their computers. The websites appear legitimate by copying the look of other well-known sites. Fake virus updates, cheap flights or products and links to various celebrity videos are showing up to lure people to clicking on their sites that download viruses or gain personal information such as credit card information or computer access.

To avoid fraudulent websites, avoid sites that offer prices on products that are too good to be true. Look for missing sales or contact information, or different website and email domain names. Only shop at trusted stores and monitor credit card statements.

One of the viruses that users need to be aware of is malware. Malware is software used to perform malicious actions on computer devices. It is used to steal confidential data, collecting passwords, sending spam emails, or identity theft. Avoid malware attacks by installing trusted anti-virus software and updating programs and systems.

A major concern for USASOC Soldiers and employees is the loss, or negligent disclosure, of information. The most common occurrence of this is called spillage; when classified or sensitive information is put on a non-secured system or device. Examples include emailing classified material to a personal or unclassified email account or including classified material on a PowerPoint slide.

Users need to review the classification of material used in documents including notes and images. Never store or process classified information on any system not approved for handling that material.

Cybersecurity is everyone's responsibility. The information that is provided to the attackers is costly in both time and money. Attackers only need to find one weakness -- don't be that weak point.