Tag Archive for: business cybersecurity

Click With Caution: Why Self-Control Is Your Best Cybersecurity Tool This Holiday Season

Are you sure that link, attachment, or “special holiday offer” is safe to click?

The holidays bring festive emails, online deals, shipping updates, travel confirmations, and a flood of cybercriminals hoping you’ll click before you think.

While businesses invest in firewalls, EDR, MFA, and vulnerability management, one weakness remains hard to patch: human impulse.

Every year, attackers rely less on technical exploits and more on behavioral ones – curiosity, urgency, trust, distraction.

This is why developing a little “click self-control” is one of the simplest and strongest defenses your business can adopt this season.

As Bruce Schneier famously said:

“Amateurs hack systems. Professionals hack people.”

And the holidays are the busiest season for hacking people.

Why Self-Control Matters More During the Holiday Season

Cybercriminals know the season brings:

  • More online purchases
  • More email receipts & shipping notices
  • More travel confirmations
  • More gift cards & donation requests
  • More distracted employees
  • More urgency (“Limited Time Offer!”)

According to the FBI’s Internet Crime Complaint Center (IC3)1, non-payment and non-delivery scams cost victims more than $309 million in 2023, with credit card fraud adding another $173 million in losses, a surge the IC3 says typically spikes around the holiday shopping season.

Gift-card scams surge during the holiday season, and according to ScamWatchHQ2, gift cards have now become America’s #1 payment method for scammers, with victims losing thousands per incident and Target gift cards leading to a median loss of $2,500 per victim.

This isn’t new but their tactics get sharper every year.

That’s why proactive awareness is just as important as proactive patching.

Before You Click, Ask Yourself These 7 Questions

Think of this as your personal “holiday phishing checklist.”

A few seconds of self-control can save hours (or days) of cleanup.

1. Was I expecting this email?

Unexpected package updates, invoices, or warnings are the most common lures.
If you didn’t request it, be suspicious.

2. Is the sender’s email address correct?

Attackers change one letter, add a hyphen, or mimic a known domain.

3. Is the message trying to create urgency?

“Act now!” “Your account is closing!” “Final notice!”
Urgency is a manipulation tactic – pause.

4. Does the link URL match the company website?

Hover, don’t click to preview the real destination.

5. Does the attachment make sense?

Invoices you weren’t expecting, PDFs from unknown senders, or ZIP files are red flags.

6. Is there poor grammar, odd phrasing, or formatting issues?

These inconsistencies often indicate automated or international phishing campaigns.

7. Should I verify another way?

Call the vendor, log in directly, or ask your IT team.
A 10-second check prevents a 10-hour incident response.

Self-Control Isn’t Just Personal. It’s Part of Cyber Hygiene

Just like vulnerability patching reduces system risk (see: Why Vulnerability Management Is a Must, Not a Maybe), click-control reduces human risk. The single largest cause of breaches worldwide.

And frameworks like CIS emphasize user behavior and training as a core control area (see: Cyber Frameworks for Small Business Risk Management).

Technology creates guardrails but your decisions seal the gaps.

The Human Layer of Security: Why Cybersecurity Training Still Matters

Even with strong technical controls in place – MFA, EDR, patching, and vulnerability management cyberattacks still overwhelmingly begin with a single user action. A rushed click. A convincing phishing lure. A fraudulent invoice that looks legitimate.

This is why cybersecurity training remains one of the most critical layers in any security program.

Cybercriminals know that exploiting software takes work, but exploiting a distracted or stressed person is fast, scalable, and incredibly effective. And during the holiday season, when inboxes are fuller and workloads are heavier, attackers see their best opportunities.

Training helps employees slow down, recognize red flags, and apply self-control in moments where urgency, distraction, or emotion could override judgment. That’s why modern cybersecurity frameworks, including CIS and NIST explicitly highlight user awareness and behavior as core controls.

You can have best-in-class tools, but if your people aren’t trained, your environment isn’t protected.

Cybersecurity training isn’t a once-a-year presentation. It’s an ongoing program of phishing simulations, seasonal reminders, and practical examples that help employees build good habits  even during high-risk periods like the holidays.

FAQ

1. What is the most common holiday cyber threat?
Phishing disguised as shipping notifications, invoices, gift card requests, or order confirmations.

2. Does MFA protect me even if I click a bad link?
It helps but it doesn’t prevent credential theft scams. Always verify before entering passwords anywhere.

3. Are businesses more at risk during the holidays?
Yes. Staff is distracted, understaffed, and busier – perfect conditions for attackers.

4. What should I do if I clicked something suspicious?
Disconnect from the network and notify your IT provider immediately.

5. How can I reduce accidental clicking across my organization?
Awareness training, phishing simulations, clear policies, and strong reporting practices.

Ready to Strengthen Your Human Layer of Defense?

Go West IT can help you build a cybersecurity training and awareness program tailored to your business.

Contact us today to learn how we can reduce human-layer risk and keep your team protected year-round.


Citations

  1. FBI – Holiday Scam Advisory
https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/holiday-scams

New NIST Password Rules for Businesses

The Shift in Password Policy Thinking

Historically, password guidance encouraged frequent password changes, strict complexity rules, and user responsibility for remembering strong combinations. However, this approach often led to weaker security. People reused passwords, wrote them down, or made only minor changes—actions that left systems vulnerable.

NIST’s updated Digital Identity Guidelines (SP 800-63) flip the script. The focus is now on longer passphrases, limiting password reuse, and eliminating frequent reset policies unless a breach is suspected. This change is rooted in real-world data on how users behave and how attackers exploit predictable password habits.

Why This Guidance Matters Now

As cyberattacks grow more sophisticated and identity-based breaches become more common, password hygiene is no longer a “set it and forget it” exercise. Poor password practices can expose your organization to serious risk—especially if users recycle passwords or fall victim to phishing.

This real-world example shows how a single compromised account during tax season led to a serious breach—and how Go West IT helped the firm recover through improved email security, identity management, and employee training.

Key Takeaways from the NIST Guidelines

  1. Eliminate routine password expiration

Forced resets often lead to simple, guessable variations (like Fall2024! → Winter2024!). Instead, passwords should only change when there’s a known compromise.

  • Use longer passwords or passphrases

A string of memorable words is more secure and easier to remember than a short, complex mix of characters. Think “CoffeeTableSunset” instead of “P@ssw0rd1!”

  • Block known breached passwords

Systems should check new passwords against a list of previously exposed ones. This is especially important for enterprise accounts.

  • Support password managers and MFA

Encourage tools that help users manage unique passwords and add multi-factor authentication (MFA) for added protection.

How Go West IT Helps You Stay Aligned

As part of our identity and access management services, Go West IT aligns your password and user policies with current best practices—whether you’re operating on Microsoft 365, managing remote employees, or scaling your systems.

We’ll help you:

• Configure strong authentication requirements

• Integrate password screening tools

• Implement MFA across key systems

• Reduce risk exposure due to weak or compromised credentials

Looking Ahead: A Simpler, Stronger Approach to Security

Password fatigue is real, and so is the risk of ignoring modern password hygiene. NIST’s guidance is a smart reset, giving businesses a clear path to user-friendly, effective security. Want to evaluate your current password policy? Let’s talk and see how we can help strengthen your identity management and close critical gaps.