Cybersecurity Fundamentals
While some hacks truly are sophisticated, nation-state attacks , many more are the result of simpler exploits or just social engineering. After the details of such a compromise are released, people comment about how organizations should be doing at least the "basics" or "fundamentals." So what are the fundamentals? And at what point do you cross over into intermediate or expert practices? I have my opinion, but let me first share a couple official lists: NIST - Cybersecurity Basics CISA - Cyber Essentials These are great lists but allow me to expand. Multi-factor Authentication First up is multi-factor authentication (MFA). Even in 2024, lack of MFA has resulted in account or organization compromise. Take the recent SEC X / Twitter hack -- the US Securities and Exchange Commission had their X account taken over and was used to post false information. While "SIM swapping" also played a role in the hack, had MFA been enabled, the threat actor may have bee