Cybersecurity Awareness Month is an international initiative that focuses on simple ways to protect ourselves, our families, and our businesses from online threats. The 2025 theme “Secure Our World” highlights the pervasiveness of digital technologies that enable connections across the globe and how straightforward, yet effective measures can have a lasting impact.

In a world where our digital lives are increasingly intertwined, every attack vector secured increases the safety of other connected people. And considering how connected we all are to our devices, networks, and the internet at large, this can be a lot of us.

Key Cybersecurity Practices to Implement

1. Use Strong Passwords and a Password Manager

Sadly, less than 40% of all online users use a distinct password for each account, according to the National Cybersecurity Alliance 2023 Oh Behave! report. Reused passwords give cybercriminals bonus access to other areas of a person’s digital life when they’ve only done the work to steal (or buy, or crack) a single credential. Aside from having a different login for each site, current wisdom (a la CISA) suggests that a strong password contains:

• At least 16 characters.
• Randomization, with a mix of letters, symbols, and numbers.
• Potentially a “passphrase” of 4-7 words, although randomization is recommended.

However, even strong and unique passwords have well-documented limitations and risks. As threat actors get savvier about targeting our access credentials, the industry is gradually moving away from passwords altogether and into a passwordless future. This means switching wholesale to other forms of authentication, which may leverage biometric data, PINs, patterns, and passkeys in place of passwords. With more and more platforms supporting passkeys and passwordless authentication, moving away from passwords is becoming easier and frictionless.

In either case – passwords or passwordless passkeys – a password manager is needed (here’s why). With the average person having to keep track of roughly 100 distinct credentials, it’s no wonder that nearly one-third of the internet uses a password manager to wrangle (and “remember”) them all.

2. Recognize and Report Phishing

According to the Thales 2024 Data Threat Report, phishing is the second fastest-growing attack. Phishing tactics are getting sneakier, thanks to AI, and it is more important than ever that employees be able to recognize their telltale signs. Now, AI-based campaigns can churn out word-perfect emails in any language, typically:

• Creating a sense of urgency (creating panic and short-circuiting your critical-thinking brain)
• Encouraging some unsolicited action (like “change your password now” or “download now”)
• Asking for some form of personal information (usually financial data, like in BEC scams)

However, the most effective way to enable people to spot and report phishing emails is to strengthen the “human firewall.” Businesses should invest in security awareness training programs not only for their employees but also for their families to establish a positive culture where everyone is invited to report mistakes, like clicking on a malevolent link.

3. Turn on Multifactor Authentication

Multifactor Authentication (MFA) is a required layer of security by many cloud service providers and even more everyday organizations. CISA, ENISA, and other global security agencies advise that everyone adopts it, as it provides additional layers of defense on top of just passwords alone (a text verification code, or a fingerprint, for example). There are various MFA options available:

• Phishing-resistant MFA is known by CISA as the “gold standard” and encompasses FIDO/WebAuthn authentication and Public Key Infrastructure (PKI)-based methods.
• App-based MFA methods increase security by sending a pop-up or “push” notification to the user’s phone, generating a one-time password (OTP), or using a token-based OTP.
• SMS or Voice MFA simply relies on sending the user a verification phone call or text.

Despite the importance and the variety of MFA methods, Thales 2024 DTR report shows that only 46% of the organizations use multi-factor authentication for more than 40% of their employees. It is essential to note that while phishing-resistant MFA is most effective against AI-enabled social engineering attacks, any form of MFA is much better than no MFA at all. In addition, there’s great business value behind adopting MFA. The Thales 2024 Digital Trust Index indicates that 81% of customers expect brands to offer MFA, which serves as a means to greater loyalty and trust.

4. Update Software: A Critical Defense, But Proceed with Caution

It is crucial that all employees know to accept and apply software updates every time the reminders come up because these are how vulnerabilities stay patched. One Ponemon report noted that 60% of breaches originated from unpatched vulnerabilities, making this simple practice even more vital.

Criminals have quickly embraced AI to spot and exploit even zero-day vulnerabilities. Interestingly, these unpatched gaps open the way for spreading disruptive ransomware attacks. However, businesses, especially in critical infrastructure settings, should patch their systems with caution and not out of fear. Although timely security updates are crucial, it is equally important to test those updates in a controlled environment before rolling them out to minimize the possibility of breaking critical systems.

A Little Goes a Long Way

The overall goal of the Cybersecurity Awareness Month celebration is to enhance data security—either personal or corporate data. As these highlighted methods show, it doesn’t have to be difficult to use or implement. In fact, keeping it simple will help you meet your users where they are and give them practical tools they can implement without reaching too far outside their comfort zones, which will increase the chances of engagement and long-term adoption.

Also, if you are a business, complement the above best practices with solutions that offer robust application and data protection to reduce the potential of a data breach. These solutions can provide a proactive compliment to employee security awareness efforts, letting you know where your data resides, who is accessing it, and when it is at risk. Combined with the above user-friendly methods, Imperva’s solutions allow employees to be your first line of defense and enterprise-ready cybersecurity tools to be your last.

Now that’s defense-in-depth to secure our world!

Schema

{
“@context”: “https://schema.org”,
“@type”: “BlogPosting”,
“headline”: “Cybersecurity Awareness Month 2024: The Top Four Ways to Secure Our World”,
“description”: “Learn practical tips for enhancing cybersecurity during Cybersecurity Awareness Month 2024. Discover key strategies like strong password management, recognizing phishing attacks, enabling MFA, and updating software.”,
“datePublished”: “2024-10-01”,
“author”: {
“@type”: “Person”,
“name”: “Ashvin Kamaraju”,
“url”: “https://cpl.thalesgroup.com/blog/author/akamaraju”,
“sameAs”: “https://www.linkedin.com/in/ashvinkamaraju/”
},
“publisher”: {
“@type”: “Organization”,
“name”: “Thales Group”,
“description”: “The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.”,
“url”: “https://cpl.thalesgroup.com”,
“logo”: “https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png”,
“sameAs”: [
“https://www.facebook.com/ThalesCloudSec”,
“https://www.twitter.com/ThalesCloudSec”,
“https://www.linkedin.com/company/thalescloudsec”,
“https://www.youtube.com/ThalesCloudSec”
] },
“mainEntityOfPage”: “https://cpl.thalesgroup.com/blog/identity-data-protection/cybersecurity-awareness-month-2024”
}