Cybersecurity: Sometimes the Best Defence Is Simply to Pause

October is Cybersecurity Awareness Month, so this month we invited Jaycee Roth of Kroll to join us for a conversation about today’s cyber threat landscape. Jaycee works on the front lines of cyber incidents, helping individuals and organizations respond when something has gone wrong, from compromised email accounts to ransomware, extortion and insider threats.

What I found most interesting about Jaycee’s presentation was that protecting ourselves isn’t necessarily about becoming more technologically sophisticated. In many cases, it’s about slowing down long enough to recognize when someone is trying to take advantage of our trust.

One example really stuck with me. Imagine receiving a call from someone who sounds exactly like your child, grandchild, parent or sibling. They’re in trouble, they need money and they need it immediately. Maybe the phone number even looks familiar. With advances in artificial intelligence, voices, emails, images and videos can increasingly be made to appear convincing. Rather than trying to determine whether something sounds real, Jaycee suggested focusing on what you are being asked to do.

Is there urgency? Are you being told not to tell anyone? Are you being asked for money, personal information, a password or an authentication code?

Those are the moments when it’s worth taking a step back.

One of Jaycee’s simplest suggestions was also one of my favourites: hang up and call the person back using a phone number you already know. The same principle applies if someone calls claiming to be from your bank. Rather than relying on the incoming number, end the call and contact your bank yourself using the number on your card or through its verified app.

She also recommended creating a simple family agreement before anything happens. Decide together that if someone receives an unusual or urgent request for money, you will pause, call the person back independently and verify the request. You can even establish a private family verification phrase that isn’t something easily discovered through social media.

I really liked this idea because it removes some of the pressure in the moment. You aren’t accusing anyone of anything. You’re simply following a family rule that everyone has already agreed to.

There were also a few practical reminders that are worth revisiting:

• Use different passwords for important accounts, particularly your email and financial accounts.
• Turn on multi-factor authentication wherever possible.
• Never provide an authentication code in response to an unexpected call.
• Independently verify any unexpected request to change banking or payment instructions.
• Regularly review your financial accounts and banking alerts for activity you don’t recognize.

Perhaps the point that resonated with me most, though, came toward the end of the presentation.

Smart, careful people can still be deceived when they are put under pressure. If a family member or friend tells you they think they’ve been the victim of fraud, Jaycee’s advice was to focus first on helping them. Contact the financial institution through a verified channel as quickly as possible and worry about figuring out exactly what happened afterward.

I think that’s something worth remembering. We spend a lot of time talking about protecting our accounts, passwords and information, but creating an environment where someone feels comfortable saying, “I think I made a mistake,” can be just as important.

If there was one message I took away from the conversation, it was this: you don’t need to become a cybersecurity expert. You just need to create enough space between the request and your response to verify that what you’re being told is real.

Sometimes, the most effective thing we can do is simply pause.