Security savvy employees are your first line of cyber defense
If you follow business technology news, you’ve likely heard the alarming statistics demonstrating how your employees are the biggest threat to your data security. According to a recent study by security firm, Shred-it, 84% of C-level executives and 51% of small business owners report that employee carelessness or negligence is one the biggest information security risks.
We’ve seen it ourselves with local small businesses. An unsuspecting employee receives a compromised email. They don’t recognize the warning signs and click on a link that contains malware that subsequently infects their device, and possibly the entire business network. Whether it’s contained or widespread, the consequences are real. Even a small data breach, if there is such a thing, results in remediation costs, lost productivity, and potential reputation damage.
Now, it’s easy to focus on the carelessness of the employee. The person likely feels shame for being duped and worries about their employment. But, here’s the thing…. your employee is not a cybersecurity expert. They may be a financial whiz or a marketing master, a sales guru or an administrator extraordinaire; but they are not naturally equipped to deal with the sophistication of today’s cyber threats.
By not equipping your staff with the proper security training and tools, you leave them vulnerable to various security risks, which ultimately leaves your business vulnerable too.
The best way to mitigate this risk is by creating a cyber aware employee culture. The goal is to make security concerns a daily part of business operations, closely integrated within all other business processes and procedures.
To successfully implement a cultural change, your team must be willing and on board. It’s important for them to understand how they impact data security, what the risk is, and their responsibility for it. They need to understand the WHY so they adhere to the WHAT, or the rules and controls you put in place.
Here are 6 ways you can create a cyber aware employee culture. When implementing any of these, I challenge you to think about how to make it engaging and fun for your team. Remember, you want to create a culture that stays!
1. Training
Implement an ongoing cyber security training program. It can be online training, video, or live... just make sure it’s sustainable and trackable. Teach your team how to protect your business and themselves!
2. Testing
Be sure you’re training is working by using simulated phishing tests attempting to trick your team in a “safe zone.” This helps you know where more training is needed.
3. Promote
This sounds a little old-school, but put up posters and flyers promoting safe cyber practices in common areas like breakrooms, kitchens, or lunch areas. This keeps security top of mind.
4. Celebrate!
Periodically give kudos when someone identifies a phishing email. Acknowledge milestones with no cyber incidents, e.g. 6 months Cyber Safe!
5. Talk it Up
Include a cyber security update in relevant employee communications, such as on your company Intranet, in the employee newsletter, or even at company meetings.
6. Buy-in
Get ALL senior leadership on board with cyber awareness. If they demonstrate its value, your team will also. Be sure they communicate the importance of security and follow company procedures.
Creating a cyber aware employee culture is not easy. It takes time and persistence, but it’s worth the effort. Although your employees are indeed your biggest threat; when educated, they can also be your first line of defense.
