The cybersecurity training tips your company was looking for

Strictly enforce a multi-level IT security plan for ALL personnel

As new threats emerge, it is imperative to keep policies up to date to protect your business. Your employee handbook should include a multi-level IT security plan made up of policies for which all staff, including executives, management, and even the IT department, are held accountable.

• Acceptable Use Policy – Specify what is allowed and what is prohibited to protect corporate systems from unnecessary exposure to risk. Include resources such as use of internal and external email, social media, web browsing (including acceptable web sites and browsers), computer systems, and downloads (either from an online source or a flash drive). All employees must acknowledge this policy with a signature to indicate that they understand the expectations set forth in the policy.

• Confidential Data Policy – Identifies examples of data that your company considers confidential and how the information should be handled. This information is typically the type of file to be backed up on a regular basis and is the target of many cybercriminal activities.

• Email Policy: Email can be a convenient method of transmitting information, however the written record of the communication is also a source of liability should it get into the wrong hands. Having an email policy creates consistent guidelines for all emails sent and received and integrations that can be used to access the company network.

• BYOD / Telecommuting Policy: The Bring Your Own Device (BYOD) policy covers mobile devices and network access that is used to connect to company data remotely. While virtualization can be a great idea for many businesses, it is critical that staff understand the risks posed by smartphones and insecure WiFi connection.

• Wireless network and guest access policy: Any network access that is not performed directly by your IT team must follow strict guidelines to control known risks. When guests visit your company, you may want to restrict their access to outgoing Internet use only, for example, and add other security measures to anyone accessing the company network wirelessly.

• Incident Response Policy – Formalize the process the employee would follow in the event of a cyber incident. Consider scenarios like a lost or stolen laptop, a malware attack, or the employee falling in love with a phishing scheme and providing confidential details to an unauthorized recipient. The faster your IT team is notified of such events, the faster your response time can be to protect the security of your confidential assets.

• Network security policy: Protecting the integrity of the corporate network is an essential part of the IT security plan. Have a policy that specifies technical guidelines for protecting network infrastructure, including procedures for installing, repairing, maintaining, and replacing all equipment on site. Additionally, this policy may include processes related to password creation and storage, security testing, cloud backups, and network hardware.

• Staff Exit Procedures – Create rules to revoke access to all websites, contacts, email, secure building entrances, and other corporate connection points immediately upon resignation or termination of an employee, regardless of whether or not you believe that has any malicious intent towards the company.

“More than half of organizations attribute a security incident or data breach to a malicious or negligent employee.” Source: http://www.darkreading.com/vulnerabilities—threats/employee-negligence-the-cause-of-many-data-breaches-/d/d-id/1325656

Training is NOT a one-time thing; Keep the conversation going

Training employees in cybersecurity awareness dramatically reduces the risk of falling prey to a phishing email, detecting a form of malware or ransomware that blocks access to your critical files, leaking information through a data breach, and a growing number of malicious cyber threats. that are unleashed every day.

Untrained employees are the biggest threat to your data protection plan. Training once will not be enough to change the risk habits that they have acquired over the years. Regular conversations are needed to ensure cooperation in actively looking for the warning signs of suspicious links and emails, as well as how to handle newly developed situations as they occur. Constant updates on the latest threats and the application of your IT security plan create individual responsibility and confidence in how to handle incidents to limit exposure to an attack.

“All companies face a number of cybersecurity challenges, regardless of size or industry. All companies must proactively protect their employees, customers and intellectual property.” Source: https://staysafeonline.org/business-safe-online/resources/creating-a-culture-of-cybersecurity-in-your-business-infographic

Training must be both personal and professional to stay

Create regular opportunities to share current news about data breaches and explore different cyber attack methods over lunch and learn. Sometimes the best way to increase compliance is to hit close to home by making the training personal. Your employees are likely as misinformed about their personal IT security and common scams as they are about the security risks they pose to your business.

Expand on this idea by extending an invitation to educate your entire family on how to protect yourself from cybercrime during an after-hours event. Consider covering topics that may appeal to a variety of age groups, such as how to control privacy and security settings on social media, online games, etc. and how to recognize the danger signs that someone is looking for personal information or money through e-mail and phone calls. Older people and young children are especially vulnerable to such exploitation.

Don’t make a difficult situation more difficult; Remember you WANT red flags to be reported

Making ongoing security training a priority will greatly reduce repeat mistakes and prevent many avoidable attacks, yet mistakes do happen. It can be very embarrassing and a shock to pride to acknowledge your mistake and report your involvement in a possible security breach. Your first instinct may be to curse and yell, but this would be a serious mistake. Staying calm and composed is the key to the confidence necessary for employees to come to you immediately, while feeling more vulnerable.

For this reason, treat each report with immediate attention and appreciation. Whether the alert turns out to be a false alarm or an actual crisis, avoid reprimanding the employee for their mistake, no matter how red their face turns.

When the situation is under control, take the opportunity to thank them for reporting the situation so that it can be handled properly. Remember that it takes a lot of courage to step up when you know you are to blame. Help the employee understand what to look for next time if it is something that could have been prevented, such as user error.

Cyber ​​training summary

• Implement a strictly enforced multi-level IT security plan for ALL personnel

• Training is NOT a one-time thing;

• Keep the conversation going

• Training must be both personal and professional to stay

• Don’t make a difficult situation more difficult; Remember you WANT red flags to be reported