Cybersecurity threats

Cybersecurity awareness among your employees could save your business. Security breaches could lead to leaks of sensitive data, loss of business and financial ruin. You cannot bear the burden of protecting your company alone or with only one or two techs. Every one of your employees must know their roles in protecting the company from cyber threats. Through training and awareness, you can help protect your company from cybersecurity threats.

You don’t need to personally be a cybersecurity expert to know that keeping your company’s data safe is vital to your operations. In fact, the team member at your company who will bear much of the responsibility for data security is your human resources (HR) director.
The HR department focuses on hiring and training, and you need to make cybersecurity an integral part of job training. By taking advantage of HR’s ability to engage workers in the training material and keep them updated with new policies, you can more effectively educate your workers about cyber threats. Unlike the IT department, HR can implement training methods that will help employees to retain more information and see why education is useful.

1. Having More Employees Creates More Openings
Security threats to your company increase the more employees you have. Those extra workers add to the number of emails sent and received in addition to the number of computers and vulnerable devices you have. Onboarding training and continual updates help to create a human firewall between your company’s information and security threats.


2. Your Employees Are Targets
The criminal people who send out fake emails to attempt to steal information target your employees specifically. Often, those targeted have control over finances or tax information, such as payroll personnel, although anyone can receive phishing emails. You need to train your workers to recognize fake emails and websites to avoid sending information to those who will misuse it.


3. It Decreases Successful Phishing Attacks
Training your workers helps prevent attackers from having success with their phishing emails. In fact, training reduces the chances of phishing attack success by 20% with each session. Making your workers aware reduces the chances your company will become a victim of a scam.

Cybersecurity awareness training helps workers understand the threat the company’s data faces and their roles in protecting it. At the end of each course, each worker must know what they need to do to keep your business’s information safe and why protection is essential. When workers have this information, they can feel empowered in protecting the company instead of powerless to prevent a data breach.

1. Add a Mandatory Cybersecurity Training in Onboarding
As soon as you hire a worker, they need to recognize their role in the company’s cybersecurity. As part of the onboard training, include measures of what you expect the employee to do to protect the company’s data. By working with HR, you can ensure that every worker at your company has security in mind from their date of hire.


2. Avoid FUD Training and Enforcement
Older training policies that created fear, uncertainty and doubt (FUD) are not as powerful as training that uses positive reinforcements. Punishments for failing to adhere to the security policy can cut into workers’ productivity levels, especially when those penalties involve taking away internet or email access.
Instead, encourage workers to embrace security measures. Positive reinforcements are more effective than FUD measures. Use rewards for finding phishing emails or spotting potential security openings in access to information. Having everyone working together will make finding problems easier while giving the employees a role in the company that feels good to fulfill.


3. Create a Culture Focused on Cybersecurity
Every aspect of employee education on information security needs to build a culture that takes cyber threats seriously. The more deeply involved your employees are in the culture, the more likely they will be to remember the rules they learned in training.
To ensure everyone stays on top of your company’s cultural expectations, assign someone in each department to act as a cybersecurity cultural liaison. This person will guide employees in their department in upholding strong security to protect your company’s information.

Threats to your company’s data can take many forms. Hackers use a variety of methods to try to steal login information, passwords and sensitive company data. To get this information, they specifically target your employees. Social engineering, such as phishing schemes, caused 93% of the data breaches in 2018. To avoid having your company become another statistic, you must keep your workers updated on the latest threats your company’s information faces.

1. Phishing Scams
Phishing is a common ploy in which a disreputable person sends an email out that looks like it comes from a well-known company or a person the recipient knows. For instance, workers may get phishing emails that look like delivery companies asking for the person to click a link to verify login information.
Toward the end of the year, when companies’ payroll departments finalize W2s to send out to workers at the end of January, IRS scams reign. In these phishing emails, the payroll employee may get an email that looks like it comes from the company’s CEO or CFO or the IRS asking the employee to send W2 information back. The sender then has social security numbers, names and home addresses for anyone the recipient replied about.
If a worker doubts whether someone in the company sent an email, they should phone that person directly to verify the legitimacy of the message.


2. Spoofing Websites or Email Accounts
Spoofing uses a slight variation on a website or an email address. These fake addresses may look close to their correct counterparts. For example, the sender may be a spoof if it reads from jane@copmanyxyz.info instead of the correct jane@companyxyz.com.


3. Malware
As its name suggests, malware is harmful software that a cybercriminal installs on a victim’s computer. Often, it happens when an unsuspecting person clicks on an email link or downloads an attachment. This software can then access the victim’s computer, including their email program, passwords and company information. From the victim’s email, the criminal can send out emails that appear to come from the victim. Some cybercriminals use this email to receive verification notices when sending illegal wire transfers. Because no one in the company saw the emails about the transfers, no one notices until the money disappears.


4. Ransomware
Ransomware is a variation on malware. Like malware, it can access a victim’s information on their computer. The twist to ransomware, though, is the program can lock away that information through encryption. The cybercriminal then holds the data for ransom, refusing to release it or threatening to destroy it if the victim does not pay. Also, like malware, ransomware can happen as quickly as clicking an email link or opening an attachment. With proper training, though, your workers will be able to recognize ransomware emails and not allow the criminals to fool them.

Make Cybersecurity Everyone’s Issue

From their initial onboarding, all your workers need to know that cybersecurity is their concern as much as it is the concern of your technology experts. Everyone’s device has the potential to open the door to cyberattacks, and only through a collective effort can you prevent them.
With a consulting company taking care of your IT, you have the entire company working toward maintaining your computers instead of just two or three IT professionals. With such concentrated effort and the expertise of a larger group, you can keep your company’s data safer than if you tried to do the work yourself.

Enforce Specific Technology Guidelines

When training workers and outlining the rules, they must follow, be specific. Don’t just tell workers to use better passwords but show them how to make them better. The more details you give to your workers, the better they will understand the technology guidelines you present to them.
You also need to enforce the guidelines. Whether you choose positive reinforcement to reward proactive workers or reminders to increase their caution levels if they forget, make sure your workers know the expectations. You should also schedule security reminders for employees to change passwords and logins and to check their computers.

Never Provide Login Credentials

Stress the importance of your workers never sharing login credentials even if the email appears to come from someone in the company. The same holds for credit card information and social security numbers. If an employee thinks a coworker sent the email, they should contact the sender by phone or talk to them in person to verify. You could also establish a policy of only sharing such information when talking face to face. This rule will also prevent them from accidentally giving away information to phone scammers who may use it to steal company data.

Use Strong Passwords

Always have your workers use strong passwords and store them written on paper in a locked location. Do not allow workers to save their password in a word document or email on their computer. These places are vulnerable to hackers.
The passwords your employees use should be sentences that replace some letters with numbers of symbols and use both lower- and upper-case letters. Single words are too short and easy for hackers to guess. The longer the password, the safer it will be from those who may try to crack it.
Additionally, for every program your employees access, they must have separate, secure passwords. A password manager can make keeping track of this information easier.

Regularly Scan Your Computer for Viruses

Just having antivirus software on your company computers will not help if the workers turn off scanning or do not have automatic updates. The same holds true for operating systems. Operating systems frequently have security protocols in their regular updates that improve protection from attacks. Still, you won’t take advantage of these changes if the machines have not updated.
Require your employees to set their virus blocking software and operating system to update automatically. Doing so will ensure the software has information on the latest threats and the means of protecting the computer from them.
Additionally, require that any peripherals pass through a virus scan before the workers use them. Viruses can enter a computer or network from a download someone brought on a thumb drive from home or another office. Scanning such devices can prevent an attack on your company.

Use Multifactor Authentication

Multifactor authentication sends a code to a person’s phone, email address or app whenever they try to log in to a site or server. The user then enters the code they got to verify that someone else did not steal their information. This two-factor authentication makes it harder for a third party to take login information and use it because every login must get verification from the user.
If the user receives a code but did not attempt to log in, they know to change their login information immediately because someone has tried to use it fraudulently. This type of verification offers higher security for the system against hackers because it dramatically reduces their chances of successfully logging in with a stolen username and password.

Perform Cybersecurity Exercises

Everyone has experienced a fire drill. This activity lets building occupants practice what they would do in the event of a real fire but without the threat. You should take the same approach to test the training of your workers when it comes to cybersecurity.
Cybersecurity drills enact the events that would typically happen if your company had a data breach. These events let you see how well your employees respond. By learning what works and what doesn’t in a safe exercise, you can make improvements to your company’s cybersecurity practices and training to be ready for an actual event.

• Make a Plan
Before conducting the drill, have a plan available. You need to outline who employees should contact, what they should do and how long the process should take. During training, communicate everyone’s role in the plan.


• Make the Drills Mandatory
Make the scheduled cybersecurity drills mandatory to ensure full compliance from everyone in your company, from the CEO down to the interns.


• Learn From the Experience
Use each exercise as an educational moment. All employees need to learn what to do and not just turn to the company owner or IT professional and ask them what they will do. After each drill, host a mandatory training session to review what went right, what went wrong and how to fix problems.