The Cyber ​​Security Training Tips Your Business Has Been Looking For

Strictly enforce a multi-tiered IT security plan for ALL staff

As new threats emerge, it’s imperative to keep your policies up to date to protect your business. Your employee handbook should include a multi-tiered IT security plan made up of policies that all staff, including executives, management, and even the IT department, are accountable for.

• Acceptable Use Policy – ​​Specifically state what is allowed vs. prohibited to protect corporate systems from unnecessary exposure to risk. Include resources such as internal and external email usage, social media, web browsing (including acceptable browsers and websites), computer systems, and downloads (either from an online source or from a flash drive). This policy must be acknowledged by each employee with a signature to indicate that they understand the expectations set forth in the policy.

• Sensitive Data Policy – ​​Identifies examples of data that your company considers sensitive and how the information should be handled. This information is often the type of files that should be backed up regularly and are the target of many cyber criminal activities.

• Email Policy: Email can be a convenient method of transmitting information; however, the written record of the communication is also a source of liability should it fall into the wrong hands. Having an email policy creates consistent guidelines for all email sent and received and the integrations that can be used to access the company network.

• BYOD/Telecommuting Policy: The Bring Your Own Device (BYOD) policy covers mobile devices as well as network access used to connect to company data remotely. While virtualization may be a great idea for many businesses, it’s crucial that staff understand the risks that smartphones and unsecured WiFi present.

• Wireless Network Policy and Guest Access – Any network access not performed directly by your IT team must follow strict guidelines to control known risks. When guests visit your business, you may want to restrict their access to outgoing Internet use only, for example, and add other security measures for anyone accessing the company network wirelessly.

• Incident Response Policy – ​​Formalize the process the employee would follow in the event of a cyber incident. Consider scenarios such as a lost or stolen laptop, a malware attack, or the employee falling for a phishing scheme and providing sensitive details to an unapproved recipient. The faster your IT team is notified of such events, the faster your response time can be to protect the security of your sensitive assets.

• Network Security Policy – ​​Protecting the integrity of the corporate network is an essential part of the IT security plan. Have a policy that specifies the technical guidelines for securing the network infrastructure, including procedures for installing, repairing, maintaining, and replacing all on-site equipment. Additionally, this policy may include processes related to password creation and storage, security testing, cloud backup, and network hardware.

• Staff Exit Procedures: Create rules to revoke access to all websites, contacts, email, secure building entrances, and other corporate connection points immediately upon an employee’s resignation or termination, regardless of whether you create or not that he has any malicious intent towards the company.

“More than half of organizations attribute a security incident or data breach to a malicious or negligent employee.” Source: http://www.darkreading.com/vulnerabilities—threats/employee-negligence-the-cause-of-many-data-breaches-/d/d-id/1325656

Training is NOT a one time thing; Keep the conversation going

Employee cybersecurity awareness training dramatically reduces the risk of falling victim to a phishing email, detecting a form of malware or ransomware that blocks access to your critical files, leaking information through a data breach, and a growing number of malicious cyber threats. that are unleashed every day.

Untrained employees are the biggest threat to your data protection plan. Training once will not be enough to change the risky clothes they have collected over the years. Regular conversations are necessary to ensure cooperation in actively looking for the warning signs of suspicious links and emails, as well as how to handle new situations as they occur. Constant updates on the latest threats and enforcement of your IT security plan builds individual responsibility and confidence in how to handle incidents to limit exposure to attack.

“Every company faces a number of cybersecurity challenges, regardless of size or industry. All companies must proactively protect their employees, customers and intellectual property.” Source: https://staysafeonline.org/business-safe-online/resources/creating-a-culture-of-cybersecurity-in-your-business-infographic

Training should be both personal and professional useful to stay

Create regular opportunities to share breaking news about data breaches and explore different cyberattack methods over lunch and learn. Sometimes the best way to increase compliance is to hit close to home by doing personal training. Chances are, your employees are just as uninformed about their personal IT security and common scams as they are about the security risks they pose to your business.

Expand on this idea by extending an invitation to educate the entire family on how to protect themselves from cybercrime during an after-hours event. Consider covering topics that may appeal to a variety of age groups, such as how to control privacy and security settings on social networks, online games, etc. and how to recognize the danger signs of someone seeking personal information or money through email. mail and phone calls. Older people and young children are especially vulnerable to such exploitation.

Don’t make a difficult situation more difficult; Remember you WANT red flags to be reported

Making security training a priority will greatly reduce repeat errors and prevent many avoidable attacks, regardless of how the errors occur. It can be very embarrassing and a shock to your pride to own up to your mistake and report your involvement in a potential security breach. Your first instinct may be to curse and yell, but this would be a serious mistake. Remaining calm and collected is the key to the trust necessary for employees to come to you immediately, while they feel most vulnerable.

For this reason, treat each report with appreciation and immediate attention. Whether the alert turns out to be a false alarm or a real crisis, avoid hitting the employee for his mistake no matter how red his face turns.

When the situation is under control, take the opportunity to thank them for reporting the situation so it can be handled appropriately. Remember that it takes a lot of courage to step forward when you know you were at fault. Help the employee understand what to look for next time if it is something that could have been avoided, such as user error.

Cyber ​​Training Summary

• Implement a strictly enforced, multi-tiered IT security plan for ALL staff
• Training is NOT a one time thing;
• Keep the conversation going
• Training should be both personal and professional useful to stay
• Don’t make a difficult situation more difficult; Remember you WANT red flags to be reported