Educating Your Employees on Cybersecurity – Part 2

Your company’s data faces constant threats from hackers who employ various methods to steal logins, passwords, and sensitive information. Alarmingly, a Verizon report (2022) found that 82% of breaches involved human error. To address this vulnerability, employee education on cyber threats is crucial.

Here are some of the most common cyber threats employees encounter:

• Phishing Attacks: Hackers send emails disguised as legitimate sources (e.g., payroll department) to trick recipients into revealing personal or business information.  Train employees to carefully verify any request for sensitive data.
• Spoofed Websites/Emails:  These mimic legitimate sites or email addresses (e.g., accounting@abccopmany.com instead of accounting@abccompany.com).  Encourage employees to scrutinize email addresses and website URLs.
• Malware:  Hidden in email links or attachments, malware infects computers, stealing passwords, company information, and enabling criminals to send fraudulent emails (e.g., fake wire transfer requests).
• Ransomware:  Similar to malware, ransomware encrypts a victim’s data, holding it hostage for a ransom.  Like malware, ransomware attacks can be triggered by clicking a link or opening an attachment.

The Solution: A Culture of Cybersecurity

Everyone in the company plays a role in cybersecurity.  Employees’ devices can be entry points for attacks.  Through proper education and vigilance, these attacks can be prevented.

• Day One Security Training:  From the first day, instill in employees a sense of cybersecurity responsibility.
• Collective Defense:  Everyone’s awareness and caution contribute to a robust company-wide defense.

Enforcing Specific Technology Guidelines and Exercises

Cybersecurity guidelines are your first line of defense against data breaches. They go beyond simply telling employees to use strong passwords; they provide clear instructions for creating and maintaining them. The more detailed your guidelines, the better equipped your employees will be to follow them.

Essential Guidelines and Exercises:

• Never Share Login Credentials: Emphasize to employees that they should NEVER share login credentials, regardless of the email’s apparent sender, even if it seems to come from a colleague. Encourage them to verify the sender’s legitimacy by phone or in person if unsure.
• Spoofed Websites/Emails: Instruct employees on creating strong passwords with real-world examples. Recommend using a sentence structure, replacing letters with numbers and symbols, and incorporating both upper and lowercase characters. Longer passwords are harder to crack.  Enforce mandatory password changes every 90 days to minimize security risks. For easier password management, suggest password manager apps – digital vaults for storing passwords securely. If paper copies are preferred, advise storing them in a locked location. Never write passwords in plain sight, like emails or Word documents – these are prime targets for hackers.
• Regular Virus Scans: Antivirus software alone isn’t enough if employees disable scans or neglect automatic updates. Make it mandatory to have automatic updates set for antivirus software and operating systems.
• Utilize Multi-Factor Authentication (MFA): MFA adds an extra layer of security by requiring a unique code sent to a phone, email, or app upon login attempts. This code verification ensures unauthorized access is blocked, even if login credentials are compromised.