It's 2022 and netizens are only now getting serious about cybersecurity
US folks start to get the message about protecting themselves online
Jeff Burt
Mon 10 Oct 2022 // 12:30 UTC
End users, often viewed by infosec specialists as a corporation's weakest link, appear to be finally understanding the importance of good security and privacy practices.
Since 2019, more US consumers have taken steps such as using stronger passwords to their home Wi-Fi networks, multi-factor authentication (MFA), blocking or deleting all cookies on their web browsers, and deleting smartphone apps they suspect are collecting too much personal data or don't protect that data adequately, according to a study [PDF] by Aspen Digital Institute and Consumer Reports.
This is all good news for enterprises that are seeing more of their employees working from home and accessing more applications and data from the cloud and other places outside of their companies' central datacenters.
"Among the security habits surveyed, consumer privacy and security practices have increased over the years as consumers have made changes to update and protect themselves and their personal information or data," the report's authors wrote. "These increases vary depending on each practice. Since 2019, a large number of individuals have adapted the use of multi-factor authentication versus a stagnant change in individuals who use a password manager or virtual private network."
Consumer Reports surveyed 2,103 adults in the United States via the phone and internet.
The right time of year
The report comes out during National Cybersecurity Awareness Month, a program started in 2004 by the US Cybersecurity and Infrastructure Security Agency (CISA) and National Cybersecurity Alliance (NCA) to put a focus on what individuals can do to protect themselves against cyberthreats.
The report doesn't drill down on why attitudes are changing for the better, though Bruce Schneier, a Fellow and lecturer at Harvard Kennedy School, wrote in the report that some results – such as consumer suspicions about how companies are handling their data – shouldn't come as a surprise.
"Surveys consistently demonstrate that people are concerned about their privacy in the face of both governments and corporations," Schneier wrote. "The reason people don't often act on those concerns is that they feel powerless. There are often no easy ways people have to protect the privacy of their personal data, nor are there reasonable alternatives to the tech monopolies that make surveillance their business model."
Dominant companies like Facebook, Google, Twitter, and Amazon long have been suspect for the massive amounts of personal data they collect from their billions of users and how they use that data. As the saying goes, if a company doesn't charge you for a product, you are the product.
Getting smart about authentication
According to the survey results, US users appear to be getting the message about passwords, often the primary way for authenticating identities despite efforts by Microsoft, Apple, Google, and others to push biometrics and other options. In 2019, 74 percent used a strong password – defined as having at least eight characters and upper and lowercase letters, numbers, and symbols – for their home Wi-Fi networks. Three years later, that number is up to 88 percent.
Mastercard moves to protect 'risky and frisky' crypto transactions
That thing to help protect internet traffic from hijacking? It's broken
When are we gonna stop calling it ransomware? It's just data kidnapping now
Biden's Privacy Shield 2.0 order may not satisfy Europe
In addition, 85 percent of vendors now require a password, PIN, or methods like touch or face ID to unlock their smartphones – compared with 69 percent in 2019 – while 77 percent of users use MFA to log into online accounts. That number in 2019 was 50 percent (though at the time the question was about two-factor authentication).
In other areas – using a password manager tool, a VPN, or the "private" or "incognito" feature on their smartphone – consumer use improved slightly but were still at relatively low levels, hovering around the one-third area in some instances.
Wavering confidence about data privacy
However, even with the improvements, a slight majority – 52 percent – of respondents said they were at least somewhat confident that personal data like their Social Security Numbers and health and financial information is private and not distributed without their knowledge.
However, 75 percent said they were at least somewhat concerned about the data companies collect about them and how that data is stored.
According to the report, 33 percent said the federal government bears the most responsibility for protecting their online privacy, about the same as three years ago. However, there was a shift away from companies – 32 percent this year said they were most responsible, while 42 percent in 2019 put it on companies – and toward the consumers themselves. About 25 percent this year said users were primarily responsible, up from 17 percent in 2019.
High-profile attacks driving awareness
Darren Guccione, co-founder and CEO of zero trust software maker Keeper Security, told The Register his company has seen similar growth in security awareness among individuals, noting that the number of people buying their secure password management software last year grew 11.3 percent.
The constant flow of news about high-profile cybersecurity incidents has had the "silver lining" of raising awareness about the need for people to take proactive measures like implementing MFA and strong passwords as well as regularly updating software, according to Guccione.
"As consumer awareness about the critical importance of cybersecurity continues to grow, cutting-edge technologies, such as gesture-based controls and biometrics, and improved user interface design, are unifying security with ease of use," he said. "This, in effect, has a transformative and positive impact on enterprise-wide adoption, which in turn, improves the overall security of the organization."
Casey Ellis, founder and CTO at crowdsourced security company Bugcrowd, shared Guccione's perspective. While cybersecurity has been an issue for a long time, until seven to 10 years ago, most of the awareness efforts came from those in the security field "preaching from the street corner soapbox."
That has changed. Cybersecurity is now a "dinner-table topic, and anything that is discussed enough times at the dinner table eventually makes its way into the board room," Ellis told The Register.
"The consistent and ascending cadence of breaches, as well as the increasingly personal and uninsurable nature of the consequences of breaches, are making even the most non-technical consumer aware that cyberspace is an extension of their personal space, and thus the safety and privacy of that space is something that affects them as an individual. I believe the main shift here is that people who think this way are no longer seen as outliers, but as the norm." ®
Cybersecurity and Infrastructure Security Agency
Multifactor authentication
More like these
NCSAM
Narrower topics
RSA Conference
Broader topics
Federal government of the United States
CISA sends schools back to the classroom on security
Oy, teacher, protect those kids online
Government Tech Week25 Jan 2023 | 1
For password protection, dump LastPass for open source Bitwarden
Opinion After the security breach last summer, staying put is playing with fire
Cyber-crime16 Jan 2023 | 131
We're just shouting into the void, says US watchdog offering cybersecurity advice
Federal depts ignore almost 60% of IT defense recommendations
Government Tech Week24 Jan 2023 | 14
Finally, ransomware victims are refusing to pay up
Near 50% drop in extorted dosh ... or so it says here
Cyber-crime19 Jan 2023 | 18
NSA asks Congress to let it get on with that warrantless data harvesting, again
In brief Also: That Pokemon is actually a RAT, Uncle Sam fails a password audit
Security14 Jan 2023 | 24
Been hit by BianLian ransomware? Here's your get-out-of-jail-free card
Avast issues a free decryptor so victims can get their data back
Security18 Jan 2023 | 3
Homeland Security, CISA builds AI-based cybersecurity analytics sandbox
High-spec system is crucial to defending against the latest threats
The world is 'clearly' not prepared for cyberwarfare
6,000 netizens can't be wrong
Microsoft locks door to default guest authentication in Windows Pro
Bringing OS version into sync with Enterprise and Education editions
CSO17 Jan 2023 | 23
Microsoft closes another door to attackers by blocking Excel XLL files from the internet
More of them used by baddies since Redmond blocked VBA macros
Research25 Jan 2023 | 3
Live Nation CFO on Taylor Swift ticket chaos: Don't blame me, bots made me crazy
Attack was three times the size of anything company had seen – they couldn't shake it off
Offbeat24 Jan 2023 | 20