Issue link: https://www.e-digitaleditions.com/i/727467
12 FEDA News & Views email work-related information all the time. They surf articles, log into vari- ous sites and accounts. There's a natural transition from the personal to the pro- fessional. So the fi rst responsibility any business has is to engage their employ- ees, and you do that by helping them see why they need to protect their own information, not by feeding them policy." Next comes the training. Are you pro- viding your staff with the tools to detect a phishing email? Do they have a clear understanding of how third-party ven- dors, suppliers and customers prefer to interact with you online? For example, banks usually want you to access your account through their website—not an email link. Phishing emails stand out because they don't follow the rules. Are there clearly-communicated pro- cedures in place on how to handle requests for login credentials, passwords, and employee and customer data? These are the kind of conversations that you have to have over and over again, says Sileo, which is why he suggests busi- ness owners make it a point to put training on the calendar. "It's not a once and done," he says. "It's every quarter or however often you need to do it to ensure new people are aware of what's expected, and keep the rest of the staff up to date. That's why a lot of companies have gone to some form of automated training and incorporated it into their orientation process. The fi rst time an employee sits down, they are trained on how to detect phishing and other forms of social engineering." Other action steps he recommends include budgeting for security and des- ignating a person to take ownership. "Even if it's not their day job, you need to have one person that is the voice for security," says Sileo. "Have you identi- fi ed and located your highest value data targets? Do you know what the crown jewels are? Is it social security numbers for your employees, fi nancial data? Have you encrypted and segmented your net- works and your critical data? What are you doing in terms of an external secu- rity audit? Have you invited an outside fi rm to come in to help you pinpoint your vulnerabilities?" On the Horizon First there was phishing and now there's DDOS or Distributed Denial of Service. That's the latest threat knocking on the door, according to the Verizon Data Breach Investigation Report and business owners should be aware of it, Cybersecurity continued Three Steps to Eliminate Data Breaches By John Sileo Aggressive Education. One of the costliest data security mistakes I see companies make is attempting to train employ- ees from the perspective of the company. This ignores a crucial reality: All privacy is personal. In other words, no one in your organization will care about data security until they understand what it has to do with them. Strategy: Give your people the tools to protect themselves personally from identity theft. In addition to showing them that you care (a good employee retention strategy), you are developing a privacy language that can be applied to business. Once they understand opting out, encryption and identity monitoring from a personal standpoint, it's a short leap to apply that to your customer databases and intellectual property. Start with the Humans. The root cause of most data loss is not technology; it's a human being who makes a costly miscalculation out of fear, obligation, confusion, greed or sense of urgency. Social engineering is the craft of extract- ing information out of you or your staff by pushing buttons that elicit automatic responses. Strategy: Immunize your workforce against social engineering and poor decision-making. Fraud training teaches your people how to handle requests for login credentials, passwords, employee and customer data, unauthorized building access and an offi ce full of information whose disappearance will land you on the front page of the newspaper. The latest frontiers that thieves are exploiting are your employee's social networks, especially Facebook and LinkedIn. It is imperative that you have a well-thought-out, clearly-communicated social networking policy that minimizes the risks of data leakage, reputation damage and trust manipulation. Security Audit. Once you have accounted for human weakness and error (above), focus on the technological sources of data theft: the weakly encrypted wireless router in your home or offi ce, the unprotected wireless connection you use to access the Internet in an airport, hotel or café, poor passwords, lack of user-level access, failure to properly implement a fi rewall, security software or encryption, stolen laptops, smartphones and thumb drives. Strategy: Hire an outside fi rm to audit your security. Your internal staff will NEVER tell you what they are failing to protect out of ignorance or lack of budget. I don't do security audits myself, as I am on the road speaking most of the time, but I'm happy to suggest some providers if you are interested. For more information or to contact John Sileo, visit his website sileo.com. continued on page 22