Cyber Security Starts with Your Employees

Action items to help protect your business

When identity thieves trick employees, businesses pay a steep price. Consider the case of the Oregon Department of Human Resources. In January 2019, the personal information of over 645,000 applicants was exposed to hackers. Why? Nine employees were conned into clicking on phishing emails.

The results can be catastrophic. Workers spend months cleaning up the mess. Companies face penalties, fines, and lawsuits. Customers and business partners lose confidence in your company’s ability to manage data. A company’s brand and reputation take a hit, creating a perfect storm for competitors to take full advantage of your problem.

Don’t become a statistic. Train your employees to be vigilant about the following identity theft schemes.

Phishing Emails

Here’s the scenario. An employee receives an email or text message purporting to come from company management or a trusted vendor. He or she is duped into opening the message and clicking on a malicious link. When the victim lands on a bogus page requesting both new and existing passwords, the attacker hijacks the original password to gain access to the network.

Action items. Beat this problem by training employees to recognize phishing schemes. Look for subtle mistakes such as spelling errors and domain name anomalies. Teach employees to hover their mouse over links to ensure they are legitimate. Above all, staff should routinely ask, “Why am I receiving this email?” A simple verification may be all that’s needed to stop a phishing attempt.

Ransomware

Ransomware is malicious software that infects a computer, locks it and then demands a ransom. In effect, the system’s critical data is held hostage until fees are paid. Like phishing, ransomware relies on victims to download pernicious software.

Action items. Train employees to confirm that senders are, in fact, trusted contacts. Teach them to avoid clicking on links from questionable sources. They should be particularly skeptical if an attachment asks them to enable macros, which is a common way ransomware is spread. Your best defense to ransomware is active, secure backups of all systems.

Social Media

Cyber-crooks use social media to gather enough information to appear legitimate to company employees. After all, if a worker receives an email from a well-known vendor who asks about his recent trip to Florida, the message must be legitimate. Right? Not necessarily.

Action items. Train employees to protect both themselves (and your business) when sharing on social media. Create a policy that limits the sharing of sensitive information on social media.

Internet Access

With the increase of telecommuting, data security risks continue to grow. Workers who access company networks from coffee shops, airports, or other unsecured access points may allow identity thieves to exploit vulnerabilities. In addition, with the expense of cellphone data, employees will be tempted to use your company wi-fi for personal use.

Action items. Limit personal access to your company wi-fi. Explore creating separate access for employee use during the day. Develop VPN protocols for remote workers, this limits access to your network. Require strong password, encryption, time-out locking and theft protocols within written policies. Prohibit access to your network using public wi-fi. Hire or create an accountable person to constantly monitor company security.

Company security is now a complex but critical success factor for all small businesses. Take it seriously by hiring experts and constantly training your employees to be vigilant.

As always, we hope you find our tips and news for businesses valuable, and look forward to receiving your feedback. Companies focused on growth have sought the help of Insero & Co. for more than 40 years. During that time they have consistently experienced the peace of mind that comes from knowing their CPA firm takes the concept of integrity seriously. Should you have any questions, please contact us directly.