🔒How businesses can lead the charge in building a cyber-strong America (opinion)

Building a cyber-strong America is this year’s theme for National Cybersecurity Awareness Month. The Department of Homeland Security (DHS) over 20 years ago chartered the Cybersecurity Infrastructure Security Agency (CISA) within its organization to create and manage this yearly event.

The theme not only raises awareness but also encourages closer collaboration between government and business in our increasingly interconnected online world. Originally, most cyberattacks — such as phishing attempts in which bad actors try to trick recipients into clicking a link, downloading an attachment or sharing sensitive information — were carried out through email. These messages often appeared to come from a trusted source to elicit the desired response. Now, we are seeing the increasing use of texting that does the same. Recently, there were reports of texts purported to be originating from a toll processing service (e.g., E-ZPass). The scam text alerts you of a recent toll you incurred. The cost is moderate with a link to make your payment. Legitimate users of these services receive a detailed monthly invoice outlining each transaction’s date, time, location and cost — never a text message demanding payment. A friend recently received a text message claiming to be from the Connecticut State Police, saying the recipient had been issued a speeding ticket and needed to pay the fine immediately or risk losing driving privileges. A business colleague with a landline began receiving repeated phone calls from someone claiming to be from Amazon about a recent order totaling exactly $853.26. When my colleague replied, “I didn’t place that order,” the caller responded, “We didn’t think so — that’s why we called. It didn’t fit your profile.” The conversation then turned to a request: “Please provide your credit card number so we can issue an immediate refund.” In reality, when you place an online order with Amazon or any legitimate retailer, you receive an order confirmation shortly afterward that includes the order number, item description, total cost and shipping details. The purchase is already charged to the payment method you provided during checkout. Retailers will never contact you after the fact asking for your credit card information to process a refund. These are examples of brand phishing — scams in which criminals impersonate well-known local, national or global brands. They often create websites that closely mimic legitimate ones, complete with authentic-looking logos, addresses and URLs. In some cases, they even list phone numbers that connect directly to the scammer rather than the actual company. The National Institute of Standards and Technology (NIST) — an agency within the U.S. Department of Commerce that promotes innovation and competitiveness through advances in science, standards and technology — has published guidance on “How to Create a Good Password.” To reduce the likelihood of unauthorized access to your accounts, NIST emphasizes that length is one of the most important factors. The agency recommends using passwords that are at least 15 characters long or, alternatively, creating a passphrase — a series of unrelated words that are easy for you to remember but difficult for others to guess. CISA recommends four cybersecurity essentials for businesses:

• Train yourself and employees to avoid phishing.
• Require strong passwords.
• Require multifactor authentication (MFA)
• Update business software regularly and when prompted.

As we enter into a busy season — with significant increases in both business and personal online purchasing — it’s important to stay alert to the scams and deceptive tactics circulating online. And remember the time-honored advice: if you see something, say something. Justin Golden is co-founder of Connecticut-based cybersecurity awareness and testing corporation Golden Technology Services Inc.