Employees who create vulnerabilities are a cybercriminal’s best friend for breaking through an organization’s security defences. While technical security safeguards are important, employees continue to be the weakest link when it comes to protecting corporate information from cybercriminals of various shapes, sizes and motivations.

The persistent efforts of cybercriminals regularly convince inattentive employees, through a phishing attack, to engage in one of the following security-compromising actions:

1. Disable or ignore company security measures such as anti-virus software and software firewalls.
2. Click on malicious links in phishing emails from obviously dangerous domains.
3. Open email attachments containing macros that launch malicious code.
4. Download files from dubious sources that install malware on devices such as laptops, tablets and smartphones.
5. Hand over valuable credentials, typically usernames and passwords, to crucial systems or valuable services in response to seemingly credible requests that are fakes.
6. Make wire transfers to fraudulent bank accounts in the mistaken belief they are following direction from their superiors.

Organizations need to wake up their employees to be more aware of the risks and be more vigilant in protecting data and the computing infrastructure. If you think I’m over-stating the risks of phishing, consider this Microsoft discovery. Here’s a suggested security awareness program focused on employees.

Implement a computing use policy

Organizations should:

1. Develop an acceptable use policy for computers and the Internet.
2. Ensure the policy includes a prohibition on sharing credentials.
3. Have every employee and contractor review and sign the policy.
4. Communicate that violations of the policy will be noted in every employee’s personnel file and will be a factor in performance evaluations, calculating bonuses, promotion considerations and possible grounds for terminations.

Hold security awareness briefings

Organizations should:

1. Develop a security awareness briefing.
2. Have every employee and contractor attend the briefing annually.
3. Illustrate what security risks actually look like on email and on the web.
4. Include discussion of the learnings derived from recent internal and industry security incidents.
5. Include a review of the acceptable use policy.

Minimize system access

Organizations should:

1. Create employee and contractor access profiles that restrict access to just the functions they need.
2. Minimize the number of full-access userids.
3. Monitor system access and usage.
4. Expire network and application passwords regularly; every six months or more frequently is best.
5. Operate software that insists all passwords be created as strong.
6. Implement three-factor authentication for sensitive systems and for remote access.
7. Insist that all smartphones use the passcode feature.
8. Remove access of departing employees and contractors.

Include the supply chain

Most organizations now allow suppliers, distributors and customers limited access to some of their systems. Some of the headline-generating security breaches gained access through poor supplier security management practices.

Organizations should encourage or insist that their suppliers and distributors operate a security risk reduction program like the one described in this article.

Investigate security incidents

Organizations should:

1. Investigate security incidents thoroughly.
2. Use the findings from investigations to strengthen security management practices.
3. Be restrained in assigning blame to avoid encouraging cover-ups of security incidents.

Conduct annual audits

Organizations should conduct annual audits to provide management with assurance about how well the security awareness program is working to minimize risk of data breaches. The audit scope should include a review of:

1. Violations of the acceptable use policy.
2. Appropriateness of system accesses.
3. Frequency of entry of inaccurate passwords.
4. Comprehensiveness of security incident reports.
5. Participation in security awareness briefings.

If you want to engage a vendor to help you improving security awareness, read the Gartner report titled: Magic Quadrant for Security Awareness Computer-Based Training.

Can you share your experience improving security awareness in your organization?