Cybersecurity is no longer something for ‘other’ companies to worry about. Nowadays, it doesn’t matter how big you are or how much capital you have to spend: if you’re any kind of business, you need to have it in place.
But pre-installed firewalls and anti-malware aren’t enough, you also need to consider the role your employees have in the event of a breach. The reality is that common sense and the assumption that people will do the right thing will only go so far.
Breaches occur more frequently than most would like to admit, but what’s even more worrying is that the majority are caused inadvertently by negligent staff. This could happen by way of accidentally emailing sensitive data to the wrong recipients or even misconfiguring assets for unwanted access.
So whether you already have some of the following things in place or are completely new to the concept of cybersecurity, let’s take a look at the role your employees have and how you can have them working with you rather than against you in the cybersecurity war. As shown below, the statistics are showing an exponential rise in data breaches, so let’s not waste any time here!
Image Sourced from whamtech.com
Use password management
One of the biggest causes of cybersecurity breaches is bad password management. Whether it’s because your employees are choosing weak passwords, storing them in an insecure way, or even mishandling them, the policies you adopt around this practice can make all the difference when protecting your computer systems.
Weak passwords make life easy for hackers, and often it doesn’t take them long to figure out what certain employees are using specific word and number configurations to create their passwords.
People will often use extremely obvious words or numerical phrases such as ‘123456’, making life ridiculously easy for someone trying to break in.
Another issue with passwords is linked to how they’re stored. Often employees will do this openly or even publicly, such as on a Google doc or on a post-it note. And even some methods of supposedly secure storage can be unsafe, such as online password management systems that offer no encryption whatsoever.
There is also the problem of incorrectly handling passwords. For example, when an employee never changes a password or when one is shared over an unencrypted messaging network. Bad management across a variety of platforms can be an issue too, such as using the exact same password over and over again.
Solutions to some of these bad practices include using two-factor authentication for access, utilizing an encrypted password management system, and improving awareness around using passwords through regular, ongoing training within your organization.
Free to use image sourced from Pixabay
Handling sensitive data
Another important factor to consider in your company’s cybersecurity is how your employees handle sensitive data. Nightmare scenarios can involve someone accidentally emailing highly confidential information to the wrong recipients, inadvertently deleting very important files, or even leaking valuable information to an imposter with their voice over IP phone systems.
Not backing up data can be a common problem too. Often employees say they haven’t got time to complete a backup or that they weren’t even aware it was necessary. These kinds of issues can be averted by increasing awareness in your company via posters and ongoing training. It can also help to have some automation in place so that you’re not relying completely on your workers for this to happen.
Human errors, such as accidentally sending sensitive info to the wrong people or deleting valuable data by mistake, can be tragic occurrences, and they can often come down to a lack of training and awareness. But what of the times when an employee says they were too tired or stressed?
Sometimes it’s worth looking at your company culture as a whole to see if it’s playing a part in your cybersecurity. There’s nothing wrong with hard work, but if it’s being championed above all else – even the protection of your computer systems – then it might be worth re-examining. Your employees shouldn’t be feeling tired most of the time, and if they are, then it shouldn’t be surprising that they’re making errors.
Look at work hours and the ethos around getting things done. If it’s too hardcore, then your problems might be helped by tweaking these things and spending more time promoting good cyber hygiene, and protecting your business from phishing and ransomware attacks.
Free to use image sourced from Unsplash
Increase cyber awareness
This echoes much of what has already been said about employee training. Incredibly, so much of the human error that occurs in cybersecurity breaches can be directly linked to ignorance. Even simple and straightforward tasks like completing a much-needed software update or backing-up important files from your contact center cloud solution can be left undone because a staff member didn’t know they were necessary in the first place.
Just because they might seem obvious to you, doesn’t mean they will be to someone else. If you want to adopt certain policies, then it’s crucial that you inform your employees of them via ongoing training. If they are regularly reminded of what to do when a pop-up prompt appears on their screen or to back up after saving an important file, then errors will occur less often.
It’s also worth considering how to deliver this kind of cyber awareness training. Lectures that are passively received are less likely to be remembered than interactive training programs that get your staff involved, be it online or in person. You can also consider strategically putting posters up in the work area as prompts and reminders to do the right thing by way of protecting passwords and backing-up files. There are also specific courses out there on things such as phishing awareness training that you could invest in for your employees.
Consider access rights and privilege control
When files are accidentally deleted, or sensitive documents are used inappropriately, it is often done by those who have no business with said files and documents in the first place. Incredibly, it can be normal for new starters to have free reign over a company’s entire digital filing system, when in fact, they only need to use a small percentage of it.
A way around this is to ensure that all employees have limited access and adopt a privilege control policy. This reduces the amount of information that someone is exposed to and thus significantly decreases the chance of a mistake being made.
To begin with, you could even deny all access by default and only grant it on a case-by-case basis. It might cost more time with requests being made, but it can seriously decrease any opportunities for error.
This ‘principle of least privilege’ is low cost and, once set up and made an official policy, is easy to enforce. It gives you peace of mind and, in turn, will make your employees more mindful about what they can and can’t access, along with what’s deemed sensitive/important versus what isn’t. Along with more advanced technology, such as malware and ransomware protection, it’s a basic policy that can be easily implemented.
Free to use image sourced from Pixabay
Use current and authorized software
Another schoolboy error is using out-of-date and unauthorized software. When you’re running old systems or software that is deemed ‘blocked’ by your company, you can open yourself up to all kinds of trouble. Similarly, when you allow employees to use their own devices in the workplace, such as in this BYOD policy example.
Software updates exist for a reason, and one of the main ones is for security purposes. Attacks by hackers are noted in the coding community, and stronger walls are put in place when they occur. These new defenses are rolled out as updates, and if they’re not downloaded promptly, you can leave yourself exposed to known threats.
Often employees don’t see or aren’t even aware that these need to be actioned, so educate them about this in your training. Remind them that if they see the valid pop-up, then they need to click on it. And if they claim that they don’t have the time for them, ensure they have.
If possible, set your computers up to download any new updates automatically, for example, overnight, so that you don’t have to rely on your workers to trigger them or worry that they might interfere with productivity by restarting workstations at random times of the day.
Free to use image sourced from Unsplash
Empower your employees and take your cybersecurity to the next level
So as you can see, the role your employees can have in your company’s cybersecurity breach is huge. From personal password management to regular software updates, it’s easy to see that employees make more of a difference than you might have originally thought and that cybersecurity practices are important.
Yes, an IT department is important too, and they can help when all hell breaks loose, but they cannot do everything. And besides, wouldn’t it be best not to have to rely on them for preventable mishaps like the ones listed above?
You need a workforce who are well educated and receive ongoing training in all things cybersecurity. It’s also important to adopt access and privilege control so that you’re not inadvertently turning your systems into a free-for-all, wild west situation.
If you haven’t already, put some – if not all – of these cybersecurity strategies in place and learn all you can about what’s important with regard to your employees and cybersecurity. With more information and business going digital, it’s most likely one of your key assets, so do the right thing and protect yourself ahead of time.
Bio:
Jenna Bunnell – Senior Manager, Content Marketing, Dialpad
Jenna Bunnell is the Senior Manager for Content Marketing at Dialpad, an AI-incorporated cloud-hosted unified communications system that provides valuable call details for business owners and sales representatives using Dialpad’s virtual business phone system. She is driven and passionate about communicating a brand’s design sensibility and visualizing how content can be presented in creative and comprehensive ways. Jenna has also written for other domains such as FreshySites and BlockSurvey. Check out her LinkedIn profile.
