Phishing campaigns remain the primary method for stealing user passwords, with 54% of Malaysian organisations identifying it as their top cyber threat. Another common technique is password spraying, where hackers use legitimate email addresses and commonly used passwords to breach systems.
The use of email addresses as usernames exacerbates this risk, providing attackers with half of the necessary credentials. Furthermore, information stealers—malicious software designed to covertly harvest personal data—are becoming increasingly sophisticated, with stolen credentials being sold on darknet marketplaces.
“…our finding from the Fortinet Security Operations survey indicates that phishing is the primary cyber threat, ranking as the top concern for 54% of organisations in Malaysia,” Fortinet Southeast Asia, Senior Director, Peerapong Jongvibool told BusinessToday in a recent exclusive interview.
Fortinet is a cybersecurity company with headquarters in Sunnyvale, California. The company develops and sells security solutions like firewalls, endpoint security and intrusion detection systems. Additonally, he emphasised the critical need for strong password security and comprehensive cybersecurity measures to protect enterprises from malicious actors.
The interview shed light on various tactics used by cybercriminals and the steps organisations and individuals can take to safeguard their digital assets.
Best Practices for Password Security
Peerapong highlighted the alarming prevalence of weak passwords, such as “admin” and “password,” among Malaysians. These passwords can be cracked in seconds using modern cyber tools. “It is crucial to avoid common and easily guessable elements in passwords such as personal details such as phone numbers, birthdays or even common names and company details,” he said.
To combat this, he recommended creating complex passwords that are at least ten characters long and include a mix of uppercase and lowercase letters, numbers, and symbols.
Using unique passwords for each account is essential, and password managers can help manage these securely by generating and storing complex passwords.
“It is important to use unique passwords for each account, but the challenge arises in managing numerous passwords for various accounts. To help simplify this, use password managers which generate, retrieve, and store complex passwords securely, either locally or in the cloud so that users only need to remember one master password that grants them access to their entire password vault.
By adhering to safe password habits, individuals and organisations can significantly enhance their digital security posture, effectively safeguarding their data and systems from unauthorised access and cyber threats,” he added.
Enhancing Cybersecurity Posture
With the introduction of the Cyber Security Bill 2024, Peerapong said that the company suggests several steps for enhancing cybersecurity practices. The bill requires National Critical Information Infrastructure (NCII) organisations to conduct regular cybersecurity risk assessments.
The company advocates for a holistic approach that integrates people, processes, and technology. Key measures include implementing Multi-Factor Authentication (MFA), which adds an extra layer of security, and Single Sign-On (SSO), which simplifies authentication and reduces attack surfaces.
Proactive threat hunting is also crucial. By using monitoring tools to detect unusual activities, organisations can preemptively identify and mitigate potential cyberattacks. Regular employee education on the importance of strong password creation and safe cybersecurity practices is vital in maintaining a secure environment.
Fortinet’s Cybersecurity Solutions
As a cybersecurity company that develops and sells security solutions, the company offers various solutions to help Malaysian businesses and individuals combat cyber threats. Continuous monitoring and threat intelligence sharing play pivotal roles in fortifying organisational defenses. Fortinet’s participation in the Cyber Threat Alliance (CTA) facilitates threat intelligence sharing among competing cybersecurity vendors.
“…the Cyber Threat Alliance (CTA), an organisation created to enable threat intelligence sharing among competing cybersecurity vendors, which has become vital to combating cybercrime effectively,” Peerapong said.
In the event of a breach, Fortinet’s systems implement immediate segmentation and containment strategies to isolate threats. Advanced sandboxing techniques are used for detailed analysis of threat behavior and identifying vulnerabilities.
Fostering a Cybersecurity Culture
Building a robust cybersecurity culture within organisations is essential. Fortinet promotes active employee education about common indicators of cyber scams and includes simulated phishing exercises to test knowledge. The Fortinet Network Security Expert (NSE) Training Institute offers free Information Security Awareness training to educate employees about cyber risks and threat identification.
“At Fortinet, we practice building a culture of security through active employee education about common indicators of cyber scams and include simulated phishing exercises designed to test knowledge and determine employees who might need more assistance in their cyber awareness training.
Our Fortinet’s Network Security Expert (NSE) Training Institute offers a free Information Security Awareness training service to educate employees about the increasing risks of cyber-attacks and how to identify threats,” Peerapong said.
Collaboration between security teams and other departments helps employees understand the impact of security events on the organisation and themselves. By fostering a top-down approach, the company aims to build a culture of security that permeates all job roles, ensuring a strong human firewall against cyber threats.
