Training employees in online business security
Running an efficient and secure business involves many tasks, but it’s important to remember that when it comes to online security, your employees are an incredibly important asset. In this little article, we’ll cover:
examples of training topics, including password security and phishing
the importance of providing employees access to training resources
how nurturing a strong security culture can benefit your business
The people in your business are the heart of your company’s security.
In this lesson, we’ll look at how you can help your employees protect your business, through training, resources, and a strong security culture.
When it comes to security training, make sure it’s regular, targeted and comprehensive.
Keep employees up to date on the latest company policies and guidance, as well as their own individual responsibilities. Tailor training for each role so employees learn about situations they’ll encounter in their specific jobs. Finally, make sure you cover how to spot a security problem, how to report it, and what to do if something goes wrong.
Let’s take a look at a couple of examples of training you could provide.
Setting strong passwords should be standard company practice. Remind your employees that it’s their responsibility to set a strong password for their corporate accounts.
Apart from making passwords difficult to guess, make sure everyone in your business uses a different password for each account or service, and NEVER uses the same passwords for personal and work accounts. Using different passwords means that even if someone figures out a password for one account, they can’t use it to access other accounts.
You should also make sure employees know they must never share passwords or accounts with each other.
A common security problem to be aware of is phishing.
Phishing is when someone tries to trick you into sharing personal information online. It’s typically done using email, ads, or sites designed to look like they come from legitimate businesses you already deal with.
For example, an employee might get an email that looks like it’s from his bank asking him to confirm his bank account number.
Remind your employees to be careful when clicking on email attachments, downloading files or visiting new URLs. Advise them not to click on links in unsolicited emails, and to look out for suspicious sender email addresses and email signatures.
There are other steps you can take to minimise the risk of successful phishing attacks, such as implementing 2-step verification.
In addition to training, ensure your employees have access to security-related policies, practices and guidance whenever they need it. For example, you could establish an internal website where security information and training course material is published so your employees can refresh their knowledge. It’s also worth publishing the contact details of a designated mailbox or security specialist who can answer questions or concerns.
Training and resources are a great start, but it’s just as important to make sure your company has a strong security culture. People working in a company with a strong security culture understand that everyone plays a role in the security of their business.
When you have a strong security culture, employees feel able to report concerns or mistakes without fear of blame. Instead of pointing fingers, you’ll focus on identifying and resolving problems quickly and efficiently, and then look at how to prevent similar problems happening again.
Talk with employees regularly about security, encourage them to share any concerns honestly and directly, and ensure your company leadership are modeling good security behaviors.
When it comes to the security of your business, your employees are your first line of defence. Training them and providing them with the resources they need to help protect your business online will help to develop an overall culture that is more security focused.
Think about the security culture in your business. How can you improve your business’s security culture, training and resources so that you and your employees are better prepared?
Considerable Actions To Take
- Tell employees to delete unsolicited emails, and look out for suspicious emails from senders they don’t recognise or trust.
- Set up regular training programs to ensure employees stay up-to-date with security policies.
- Don’t encourage all employees to share their passwords to make life easier for the IT team.
Securing Employees Devices
Just as you identify keeping your personal devices secure as important, so should your business prioritise the security of employee devices.
the benefits of developing a device policy
how 2-step verification can be used to increase device security
tips for maintaining security when using other hardware
Many businesses today issue smartphones or laptops to their employees. But what happens if these objects are lost or stolen? What happens if someone outside the company gains access?
In this lesson, we’ll look at security for the devices and hardware used in your business.
One thing you can do is establish policies limiting what data is stored on company equipment. If a device only contains the information needed for someone to do their job, there’s less risk to the company if it falls into the wrong hands.
The same applies to mobile devices. If your employees can access company information via smartphones or tablets, think about setting a mobile device management policy. The policy could, for example, require employees to encrypt their devices, require a pin to unlock them, allow remote wiping of data if necessary, or perhaps all of these points.
An extra security measure you can take is to enable 2-step verification for account login on company hardware.
2-step verification works by requiring a user to input a password, as well as something else in order to log into the account. The secondary verification could be a code sent to a user’s phone or a physical security key which they need to plug into their computer. This means the account is protected by something they know, like their password, as well as something they physically own, like a phone or security key. This combination makes it harder for an unauthorised person to log into systems.
2-step verification is also considered an effective way to prevent successful phishing attempts, since you need more than just someone’s password to access a device or account.
In addition, employees should make sure hardware comes from a trusted source before using it. For example, if you receive a USB stick in the post, and you’re not sure where it came from, don’t plug it into your computer.
In this lesson we’ve covered what you can do to reduce the risk of someone accessing sensitive information if your employees’ devices are lost or stolen, as well as being careful only to use hardware you know you can trust.
Think about the devices you use in your business. What could someone do with the information stored on them? What steps could you take now to help secure them?
Sandra opened her first café in 2008 and now runs four others across Dublin. Many of her staff work remotely using laptops, phones and other devices. She’s keen to set up a mobile device management policy to ensure important business information is kept secure.
Below should be applied for a an employee successful online security devices
If employees can access company information on their devices, you’ll need a mobile device management policy in place.
- employees must encrypt their devices
- employees must set up a PIN to unlock their devices
- devices should only contain the information people need to do their job
Share this if you think Is helpful !!