The Cyber ​​Security Training Tips Your Business Has Been Looking For

Strictly enforce a multi-tiered IT security plan for ALL staff

As new threats emerge, it is imperative to keep your policies up to date to protect your business. Your employee handbook should include a multi-tiered IT security plan made up of policies for which all staff, including executives, management, and even the IT department, are accountable.

• Acceptable Use Policy – ​​State specifically what is allowed vs. what is prohibited to protect corporate systems from unnecessary exposure to risk. Include resources such as internal and external email use, social media, web browsing (including acceptable browsers and websites), computer systems, and downloads (either from an online source or from a flash drive). This policy must be acknowledged by each employee with a signature to indicate understanding of the expectations set forth in the policy.

• Sensitive Data Policy – ​​Identifies examples of data your company considers sensitive and how the information should be handled. This information is often the type of file that needs to be backed up regularly and is the target of many cybercriminal activities.

• Email Policy: Email can be a convenient method of transmitting information; however, the written record of the communication is also a source of liability in case it falls into the wrong hands. Having an email policy creates consistent guidelines for all email sent and received and the integrations that can be used to access the company network.

• BYOD/Telecommuting Policy: The Bring Your Own Device (BYOD) policy covers mobile devices as well as network access used to connect to company data remotely. While virtualization can be a great idea for many businesses, it’s crucial that staff understand the risks posed by smartphones and unsecured WiFi.

• Guest access and wireless network policy – ​​Any network access not performed directly by your IT team must follow strict guidelines to control known risks. When guests visit your business, you may want to restrict their access to outbound Internet use only, for example, and add other security measures for anyone accessing the company network wirelessly.

• Incident Response Policy: Formalize the process the employee would follow in the event of a cyber incident. Consider scenarios like a lost or stolen laptop, a malware attack, or the employee falling for a phishing scheme and providing sensitive details to an unapproved recipient. The faster your IT team is notified of such events, the quicker your response time can be to protect the security of your sensitive assets.

• Network security policy: Protecting the integrity of the corporate network is an essential part of the IT security plan. Have a policy that specifies technical guidelines for securing the network infrastructure, including procedures for installing, repairing, maintaining, and replacing all equipment on site. Additionally, this policy may include processes related to password creation and storage, security testing, cloud backup, and network hardware.

• Staff Exit Procedures – Create rules to revoke access to all websites, contacts, email, secure building entrances, and other corporate endpoints immediately upon resignation or termination of an employee, regardless of whether you create or not that he has any malicious intent towards the company.

“More than half of organizations attribute a security incident or data breach to a malicious or negligent employee.” Source: http://www.darkreading.com/vulnerabilities—threats/employee-negligence-the-cause-of-many-data-breaches-/d/d-id/1325656

Training is NOT a one time thing; Keep the conversation going

Employee cybersecurity awareness training dramatically reduces the risk of falling victim to a phishing email, detecting a form of malware or ransomware that blocks access to your critical files, exposing information through a data breach, and an increasing number of malicious cyber threats. that break out every day.

Untrained employees are the biggest threat to your data protection plan. Training once won’t be enough to change the risky clothes they’ve picked up over the years. Regular discussions are needed to ensure cooperation to actively look for the warning signs of suspicious links and emails, as well as how to handle new situations as they occur. Constant updates on the latest threats and enforcement of your IT security plan build individual accountability and confidence in how to handle incidents to limit exposure to attack.

“Every business faces a number of cybersecurity challenges, regardless of size or industry. All businesses must proactively protect their employees, customers, and intellectual property.” Source: https://staysafeonline.org/business-safe-online/resources/creating-a-culture-of-cybersecurity-in-your-business-infographic

The training should be both personal and professional useful to stay

Create regular opportunities to share breaking news about data breaches and explore different methods of cyberattack over lunch and learn. Sometimes the best way to increase compliance is to hit close to home by doing some personal training. Chances are, your employees are as uninformed about their personal IT security and common scams as they are about the security risks they pose to your business.

Expand on this idea by extending an invitation to educate the entire family on how to protect themselves from cybercrime during an after-hours event. Consider covering topics that may appeal to a variety of age groups, such as how to control privacy and security settings on social media, online gaming, etc. and how to recognize the danger signs of someone seeking personal information or money through email. mail and phone calls. Older people and young children are especially vulnerable to such exploitation.

Don’t make a difficult situation more difficult; Remember that you WANT red flags to be reported

Making security training a priority will greatly reduce repeat errors and prevent many preventable attacks, regardless of how errors occur. It can be very embarrassing and a shock to your pride to admit your mistake and report your involvement in a possible security breach. Your first instinct may be to curse and yell, but this would be a serious mistake. Remaining calm and collected is the key to the confidence necessary for employees to come to you immediately, while feeling more vulnerable.

For this reason, treat each report with appreciation and immediate attention. Whether the alert turns out to be a false alarm or a real crisis, avoid hitting the employee for his mistake no matter how red his face turns.

When the situation is under control, take the opportunity to thank them for reporting the situation so it can be handled appropriately. Remember that it takes a lot of courage to step up when you know you were at fault. Help the employee understand what to look for next time if it is something that could have been prevented, such as user error.

Cyber ​​Training Summary

• Implement a strictly enforced, multi-tiered IT security plan for ALL staff
• Training is NOT a one time thing;
• Keep the conversation going
• The training should be both personal and professional useful to stay
• Don’t make a difficult situation more difficult; Remember that you WANT red flags to be reported