Paris Call Principle: Cyber Hygiene

“Support efforts to strengthen an advanced cyber hygiene for all actors”

Cyber-attacks have been growing in both frequency and impact in recent years. These types of attacks can seem highly complex, however the truth is most successful cyber-attacks leverage security problems that are simple enough to understand and address. As noted in the 2019 Verizon Data Breach Incident Report, the leading cause of confirmed breaches continues to be the exploitation of weak, default or otherwise stolen passwords, and another 13% of total breaches are due to individuals falling victim to phishing attacks. These predominant attack methods, along with others, can be largely addressed via good cyber hygiene.

With this in mind, organizations of all types can significantly improve their security posture by taking steps to educate their user base on best practices for digital engagement and cyber hygiene. Evidence suggests that a regime of foundational measures, reflecting prioritized, essential tasks to defend against avoidable dangers in cyberspace, does in fact work to reduce overall risk. This is why it was important to have cyber hygiene specifically recognized in a principle of the Paris Call for Trust and Security in Cyberspace. However, we need more than a principle. To be effective, cyber hygiene measures need to be operationalized and made available and accessible at scale, especially to vulnerable communities with limited financial and technical resources available.

Cyber hygiene standards already exist in various forms and so our new working group of experts has strived to highlight a few of the ones we find most impactful below. These include technical standards, such as Domain-based Message Authentication, Reporting and Conformance (DMARC), as well as good practices like ensuring that your software is patched in a timely fashion. In addition, numerous recommendations on cyber hygiene have been highlighted by several of the supporters of the Paris Call. These include the UK government’s 10 steps towards cybersecurity, the Center for Internet Security’s 20 CIS Controls and Resources, and ANSSI’s 40 essential measures for a healthy network. All of these efforts have been gaining wider international recognition as governments and enterprises increasingly understand the importance of taking steps which demonstrably help prevent and rapidly mitigate the dangers of known threats.

The following organizations are part of our group and committed to promoting the implementation of the Paris Call principle on cyber hygiene: “Support efforts to strengthen an advanced cyber hygiene for all actors”.  We hope that others will join us in this effort in the coming weeks and months, to contributed to a curated list of good practices to increase the safety and security of our shared online environment. This budding coalition will come together during the Internet Governance Forum on 28th November to discuss next steps. Should you wish to participate and lend your expertise to this initiative, please email [email protected]

Supporters

 

Good practices

Cybersecurity should be understood as continuous process that is always responding to a changing threat environment. In that same vein, the list of good practices that improve cyber hygiene must evolve over time as well. The list below reflects an initial set of recommendations our group has identified based on our experience of working in different capacities around the globe; however, we are looking forward to a robust discussion in this space in the coming months.  These recommendations combine groundbreaking individual initiatives along with established practices that have served to make our online lives more secure.

  • Adopt a vulnerability disclosure policy

A vulnerability disclosure policy describes how a company or other organization will process vulnerability reports submitted by ethical hackers. A vulnerability disclosure policy is the digital equivalent of “if you see something, say something.” It’s intended to give anyone willing to highlight something is wrong clear guidelines to report it and an understanding of how the vulnerability will get fixed.  https://cybertechaccord.org/the-importance-of-vulnerability-disclosure-policies/

  • Endorse Mutually Agreed Norms for Routing Security (MANRS)

MANRS comprises simple but concrete steps for network operators that will dramatically improve Internet security and reliability. The first two operational improvements eliminate common routing issues and attacks, while the second two procedural steps provide a bridge to universal adoption and decrease the likelihood of future incidents. https://www.internetsociety.org/issues/manrs/

  • Ensure your patches are up to date

Vulnerabilities in technology are always being discovered and in response, vendors regularly issue security updates to plug the gaps. Applying these updates – a process commonly known as “patching” – closes vulnerabilities before attackers can exploit them. Failing to implement a security update in a timely fashion can leave systems vulnerable to preventable attacks. Patching can also fix bugs, add new features, increase stability, and improve look and feel (or other aspects of the user experience). https://www.microsoft.com/security/blog/2019/10/09/patching-social-responsibility/

  • Implement Domain-based Message Authentication, Reporting and Conformance (DMARC):

Phishing is a social engineering attack in which a fraudulent communication – often an email – appears to come from a legitimate organization or user in order to trick a recipient. The goal of this attack is to either steal personal identifiable information to orchestrate fraud or to infect systems with malware, such as ransomware or a keylogger. It affects everyone as the most common type of cyber-attack, and relies on users not being unable to recognize whether or not a message came from a legitimate organization.  Spammers often spoof the “From” address in an email, resulting in the recipients trusting source of the message.  DMARC prevents unauthorized usage of the organization’s email domain.  In other words, protecting against domain spoofing.  https://www.globalcyberalliance.org/dmarc/

  • Utilize CyberGreen to measure the health of your network

The first steps to improving cyber ecosystem health include accurately measuring Internet vulnerabilities, understanding the causes of conditions that pose risks to the Internet, and providing metrics in order to focus cleanup and mitigation efforts.  Using quantitative data collection and statistical analyses, CyberGreen evaluates the health and cleanliness of the Internet ecosystems within countries and recommend specific policies and measures.

https://www.cybergreen.net/what-we-do/