The internet has revolutionized our lives greatly in many positive ways but it is like a double-edged sword. Transmission of data via the internet even when using solutions such as back office outsourcing and data entry services should be carefully done ensuring foolproof security. Personal privacy and business data can be compromised easily, leaving your company and clients in the hands of hackers and mischief makers. Personal files, bank details, client information and payment information can be hard to replace and cause potential danger such as payment of damages, loss of reputation, fines etc if such data falls into the wrong hands.
It takes many years for a business to build a good reputation and data security is important to maintain that reputation. With the emergence of highly sophisticated technologies such as cloud computing and platforms for online trading, hacking threats have also increased. The most common threats today include skimming, data interception and unauthorized access to data flowing through networks.
Proper employee training and data security awareness are important to avoid data breaches. According to industry and government research studies, more than 90% of all cyber attacks are successfully executed with information stolen from employees who inadvertently give away their system ID and access credentials to hackers.
So here are a few ways in which employees can be trained on effective cyber security practices.
- Secure way of managing password: Sensitive documents like confidential information and trade secrets are often protected using a password, hence proper password management is important. Employees should use a password of considerable length with upper and lower cases, and special characters like symbols or numbers. Highly sensitive information should be protected by two factor authentication which includes entering a password and also providing additional verification through physical access such as phone numbers or email notification.
- Track portable devices used by company employees: Employees can now work from their mobile phones, tablets and laptops and this improves productivity but also requires extra diligence on the part of both the employee and employer. Portable devices must be protected from threats outside the office premises. It is easier for someone to steal a laptop or hack into a wireless network than to break into an internal database. In 2014, a company was charged a fine of over $1.7 million under the Health Insurance Portability and Accountability Act (HIPAA) in a case involving a stolen laptop that contained unencrypted health information. Human resource and IT departments should train employees on best practices regarding remotely connecting company devices to Internet wireless spots. One should be very cautious when connecting to free Wi-Fi spots. Employers should develop and implement policies that require employees to report to the IT department the loss of any portable device so that damages can be minimized. Companies should track the location of devices and have policies for the collection of devices and data stored on personal devices when employment terminates. It is also important to have data management policies to retrieve company information stored on a personal device from a terminated employee.
Cyber security is everyone’s responsibility: Employees should be well trained on phishing and spear- phishing emails, which are often designed to attract the recipient to click on a link that contains malware. A phishing email may be obvious as it is likely to contain broad information that is aimed at millions of people while a spear phishing email uses information specific to the recipient. Employees should be trained to handle any request for transfer of electronic information. Employees should be able to check with an authorized employee before transferring money or sending any other personal or company information that has been solicited electronically. This prevents loss of valuable information that could expose a company’s liability, customers and vendors.- Train employees on the significance of data categorization: Employees should understand that social security number and credit card information are sensitive pieces of information that must be protected. A company’s disclosure of personally identifiable information could invite heavy penalties. Companies and their employees need to be cognizant of state privacy breach notification law requirements.
- Train employees to recognize phishing emails or scams: Companies should stress the importance of data governance to every employee. If the employees fail to follow best practices regarding data management, it could cause even the best IT department to fail. Revealing electronic information could prompt data breach notification procedure under state and federal law, and cause severe financial loss as previously discussed and considerable reputation damage.
Cyber security is everyone’s responsibility: Employees should be well trained on phishing and spear- phishing emails, which are often designed to attract the recipient to click on a link that contains malware. A phishing email may be obvious as it is likely to contain broad information that is aimed at millions of people while a spear phishing email uses information specific to the recipient. Employees should be trained to handle any request for transfer of electronic information. Employees should be able to check with an authorized employee before transferring money or sending any other personal or company information that has been solicited electronically. This prevents loss of valuable information that could expose a company’s liability, customers and vendors.With many organizations across diverse industry verticals engaging in data entry outsourcing and other partnerships with external providers, cyber security must be very efficient. Just as it is vital to ensure compliance on the part of employees, it is equally important to make sure that business partners have the best security measures in place to protect sensitive business data.
