Archive Monthly Archives: September 2017

Cyber Security Compliance is Nothing Without Measurement

These days, companies need to do whatever they can to make sure their business is cyber security compliant. Being compliant means your company is following certain practices to protect your customers, your network, and most importantly, yourself.

A CIO’s main responsibility is to implement the right cyber security measures for your company. But, another part of their job is guiding you to make the right decisions for your company thereafter. So, here’s how we can all do a better job of taking cyber security just another step further:

Compliance is Important, But It’s Not the Only Factor

One of the main reasons businesses invest in the services of a CIO to begin with is because it’s imperative that they are cyber security compliant. However, many CIOs are only keeping this in mind when setting up the right security infrastructure, and unfortunately, that’s not going to help a business in the long run. All security decisions need to be made with the business mindset, because if the actual risk can’t be understood or evaluated from a business point of view, why would any company leader take interest?

Businesses Should Be Involved in Making Cyber Security Decisions from the Start

Although your CIO is the primary decision maker when it comes to cyber security, it’s likely that they are working with many businesses at once. The needs of your business may be very different from the needs of another, and you want to be absolutely sure that your needs are constantly being kept in mind. Therefore, the best way to go about this is by being involved in cyber security decisions from the start. Be proactive in keeping the conversation open and make sure you’re present when those big decisions are being made. Your CIO is allowed to guide you in making these decisions and they should. After all, one of the reasons you’re hiring them in the first place is because you’re not quite equipped to do these things on your own.

There Should Always Be Consistent Measurement and Evaluation by Businesses

Once a decision has been made, it’s important to recognize that it won’t be the last. Cyber security is an ongoing process, and it’s both your job and the CIO’s job to stay involved at all times. And, once a decision is implemented, the impact of that decision should be consistently monitored, measured, and evaluated for future purpose. This is really to say, can you be certain that your cyber security system has worked, or is it time for a new solution?

Make Sure Your CISO Has a Good Reporting Record

It goes without saying that the Chief Information Securiry Officer (CISO) that your company is working with should have a great track record. The IFS, or Information Security Forum, has reported that many of these CIOs aren’t doing their job when it comes to reporting their findings of KPIs (Key Peformance Indicators) and KRIs (Key Risk Indicators) to their clients. This goes back to a previous point: that decisions need to be made from a business — your business’ — point of view. Of all the things to consider when hiring a CIO, this is a question you don’t want to leave out.

There are many steps to making sure your business is paying the utmost attention to its security situation. Is your CIO helping you be part of the process?

Are Your Employees Hiding the Truth About Your Recent Security Breach?

Though company leaders would like to believe that their own employees wouldn’t do anything to put the company’s security at risk, sometimes, these employees are actually the most likely suspects. Though we tend to think data breaches are only caused by malicious hackers, usually, those aren’t the people you need to worry about. That’s because most of the potential problems are being caused by the people sitting right in front of you every day.

So, are your employees ignoring security measures deliberately? Probably not. But, they could be avoiding telling you about a cyber-security incident, that could ultimately result in a major loss for your company.

So, if it’s just a little mistake, why are these employees not saying anything? And, as a leader of your company, how can you get them to speak up so you can stop the problem in its tracks?

 5 Reasons Employees are Causing Data Breaches and Not Saying Anything

Typically, one of the biggest reasons an employee won’t tell you about a data breach is the same reason no human likes to admit he or she is wrong. After all, why bring attention to something when it might not be a big deal after all? This mentality, along with other things, is putting companies at major risk, resulting in huge losses that could have otherwise been avoided.

Besides that, there are other reasons why employees don’t say anything.

1) They’re scared of losing their job.

These days, companies have strict rules in place when it comes to their employees correctly managing the equipment. If employees are held accountable for a data breach, it’s certainly not the kind of news an employer wants to hear. Therefore, employees are under a lot of pressure and thus afraid of losing their job if they put the blame on themselves.

2) Policies are too loose and employees are taking advantage.

If your company has a BYOD policy or you have a lot of remote workers accessing the system from all over the world, you’re already at risk. If that device is not solely for work and thus lacks the proper security on it, you’re at risk of a data breach whenever that person uses their device at home, at a cafe, or while traveling. Don’t let your employees take advantage of your leniency, because once a BYOD policy is implemented, it’s very difficult to supervise.

3) They were uninformed or unaware that they even did something.

Perhaps an employee made a security error, but they didn’t even know they did. With technology being so advanced, even the best and most skilled employees may not be too read up in the IT department. In many cases when there’s a data breach, it’s very likely the person who is at fault isn’t even aware that they are. All employees need to have basic knowledge when it comes to protecting your company’s security.

4) They were actually careless.

While in most instances we want to believe that a potential cyber breach was really just an accident, we know that’s not always the case. There are employees who don’t follow guidelines and are quite careless. And, if that is what happened, that’s not something an employee is going to be so willing to admit.

5) They were doing it intentionally.

It’s hard to trust any one 100%, and when that one untrustworthy person has access to your company’s most sensitive data, there’s always a chance that you’ll receive an unfortunate surprise; that someone you hired has been intentionally stealing your company’s data or hacking your systems to their own benefit. As scary and unlikely as this may seem, it has happened before, and will continue to happen if employers aren’t more diligent.

How to Prevent Employees from Causing Serious Breaches

The first step in making sure your employees don’t cause a data breach is by screening employees before they start working for your company. It may seem obvious, but you don’t want any suspected hackers slipping through the cracks.

If your employees are all deemed trustworthy but you still want to prevent them from accidentally causing a breach, start by implementing strict security standards in the office. Make sure new employees are aware of how to use the systems securely and update current staff regularly. Secondly, make sure your employees feel comfortable letting you know that they may have made some kind of error. If they feel worried about losing their job, they aren’t going to be willing to talk. But, encouraging them to speak up and assuring them that it’s the right thing to do, will save your company from any serious breaches and leave your employees feeling secure in their job.

Additionally, it’s your job as a company leader to make sure you implement specific instructions given to you from your outsourced CIO. For example, if your CIO strongly advises you against using a BYOD policy, then listen. Most of all, make sure your CIO is doing their job of keeping your company’s security safe above everything else, and it will be much easier to prevent problems from happening altogether.

Don’t have time to worry about your employees making an expensive mistake? Your CIO will take care of that.

>