How Security Savvy are Your Staff?

Modern business enterprises deal with large stacks of crucial data that need to be processed at high speeds. As a result, security is often a blind spot for them. Basic enterprise security tips are overlooked for the sake of convenience and this eventually leads to security breaches or data loss.

While CIOs implement precautions like firewalls and IDPS’s to monitor and maintain network security, one area they fail to divert resources towards is human error. Management of data by employees often leads to carelessness and this leads to security threats against enterprises.

Negligence is often found to be the major culprit and factors like BYOD policies, multiple cloud services and inadequate training lead to compliance issues. Training staff is crucial, but security awareness training also needs to be interactive, dynamic and evolving to deal with the ever changing threats of enterprise security. Moreover, staff members need to be tested from time to time to gauge the effectiveness of training.

Effective approaches to security testing of staff

Carry out white hat social engineering
Many times, users fall victim to social engineering tricks that derive confidential information from them. In order to check how resistant staff members are to such tricks, they can be subjected to white hat social engineering. This can be carried out by company reps or even by an externally hired agency to rate their responses and vulnerability. Remember, the purpose of such exercises is not to find faults in staff members, but to educate them about potential threats.

Simulate white hat phishing attacks
White hat phishing attacks can also be simulated so that reaction time and type can be judged. By exposing employees to phishing pages to see how they respond, CIOs can facilitate learning about existing security threats. Common red flags that indicate the presence of phishers can be clearly made visible on the simulated pages.

Administer quizzes on a regular basis
The best method to check if security training has been absorbed properly is to conduct quizzes for employees. These can be conducted immediately after training sessions or randomly. Quizzes should be based on real-life case studies and their patterns should be altered from time to time. They should be fun and interactive and should give relevant learning to employees.

Timely work area checks
Random workstation checks can help CIOs find out if employees are following basic security precautions. Many staff members leave vital passwords lying around on sticky notes and many don’t even have password protection enabled on their workstations when they leave their desks.
CIOs should also check if all workstations are running updated programs. Out of date versions of Flash, Java etc. open up security holes which are highly vulnerable. Updated programs and antivirus software are the first line of defence and they should be looked into at all times as one of the best practices for enterprise IT security.

Explain the repercussions of security breaches
Staff members who are aware about security breaches and compliance issues will deal with cyber threats better. Educating employees about enterprise targeting methods, checking their value absorption with regards to such training and constantly evolving the training as per industry standards is the key to dealing with these issues.

A well trained and aware staff can help maintain enterprise security. Since human error can often be the cause of security breaches, it is wise for CIOs to invest considerable resources into the training, testing and retraining of staff members to ensure policy compliance.

Rahul Thadani