Security involves training because 88% of data breaches are caused by human mistakes. Regularly train staff on how to recognize phishing and social engineering threats. Zero trust policies will reduce malicious damage.
Here are some other simple things that can be done to prevent internal staff from accidentally compromising company information systems:
1. Provide staff with Security Training
Since most compromises are caused by employees who clicked on a link or opened an attachment which accidentally installed malicious software. At a minimum, look for an online training course for your staff. Even better hire a firm to train your employees.
2. Consider a test email phishing campaign.
Hire a firm to run a series of test phishing emails with various links and attachments. They will track who clicks on the links and installs the fake malware. The firm will provide a report which can then be used to tailor training and coaching to help your staff become a part of the cybersecurity solution.
3. Control physical access to your computers and create user accounts for each employee
Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee and requires strong passwords. Administrative privileges should only be given to trusted IT staff and key personnel.
4. Limit employee access to data and information, limit authority to install software
Do not provide anyone employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission.
5. Passwords and authentication
Require employees to use unique passwords and change passwords every three months. Consider implementing multi-factor authentication that requires additional information beyond a password to gain entry. Check with your vendors that handle sensitive data, especially financial institutions, to see if they offer multi-factor authentication for your account this is key to your cybersecurity.
