As cybersecurity professionals, we work each day to protect against a wide variety of threats. Attackers probe our firewalls with port scans, search out application security flaws and wage other exotic attacks against our systems. While those threats are real, the controls we use to address them don’t touch the No. 1 threat that affects organizations on a daily basis: phishing.

Phishing attacks are nothing new. They’ve certainly increased in sophistication over the past 20 years, but attackers have consistently used them to gain access to systems and information over the years for one good reason: They too often work. Let’s look at three security controls that organizations can put in place today to reduce their risk of falling victim to a phishing attack.

When it comes to IT standards, the ITIL (formerly an acronym for Information Technology Infrastructure Library) framework is different from regulatory standards such as the Payment Card Industry Data Security Standard and HIPAA. While those standards require organizations to demonstrate compliance or risk harsh consequences such as fines, the ITIL framework is a voluntary set of best practices for organizations to follow to ensure that they’re aligning their IT services with the needs of the business. It’s both nonprescriptive and nonproprietary.

ITIL 4, the first major update of the framework since 2007, largely emphasizes the same values and priorities as previous versions. However, ITIL 4 was designed to keep up with recent trends in software development and IT operations. Here are four of the most significant changes to the ITIL framework.

While regulatory compliance is nothing new to cybersecurity professionals, many organizations still have concerns about their compliance with the European Union’s General Data Protection Regulation and the rollout of the California Consumer Privacy Act.

Many of the same security controls that organizations measure to demonstrate compliance with regulations such as the Payment Card Industry Data Security Standard and HIPAA, or even security due diligence, will serve those organizations well as they seek to establish programs that are GDPR and CCPA compliant.

Let’s take a look at some simple things that you can do to either shore up your existing privacy program or establish a new one.

Organizations have long understood the importance of securing their supervisory control and data acquisition (SCADA) networks and industrial control systems (ICS) from outside threats.

In recent years, these systems have become increasingly interconnected with IT systems and IoT networks, enabling organizations to take advantage of greater automation and better data analytics. But these improvements make connected systems a bigger target for cybercriminals. Here are three measures organizations should take to assess — and improve — the security measures surrounding their SCADA systems.

Government agencies, retailers, manufacturers, banks, enterprises — organizations across industries can benefit from IP-based camera systems. That’s because the technology enables them to keep an eye on their premises in real time and review recorded images to better understand security incidents and other past events.

But many organizations find that their camera systems provide new capabilities that go far beyond simple security. By treating cameras as data sources and applying analytics capabilities to this data, organizations open a wide variety of use cases that can improve safety, efficiency and productivity as well as security.

Last year, I consulted with a pastor whose church had suffered a ransomware attack. This particular church had an extensive fundraising operation designed to support a local homeless program, and the ransomware infection impacted all of the data used to solicit donations — and ground those important efforts to a halt.

Like many nonprofits, the church fallen into a common trap: the fallacy of thinking that they don’t have any important data that would attract attackers. But, in this world, every organization is a potentially lucrative target.