In order to create a true human firewall, however, it’s necessary to implement the right security measures, and then enforce them with regular training and reminders. Success is about creating employees who are prepared to stand as a buffer between the organization and key security threats.
Hackers are constantly working to exploit new vulnerabilities in the software that you use. The biggest threat to your firm, however, remains the same as it has always been: your employees. Seventy- Seven percent of IT professionals surveyed in a recent study sponsored by Sophos note that they receive frequent reports of phishing scams from their users. Properly educating your employees and providing them with the right tools is one of the most effective ways to manage the human element of the security risk to your business.
MANAGING THE HUMAN ELEMENT
In today’s digital society, most people know the basics of security risk management such as how to construct a strong password or to avoid responding to emails from a Nigerian prince. In order to create true human firewalls, however, it’s necessary to implement the right security measures, and then enforce them with regular training and reminders. Success is about creating employees who are prepared to stand as a buffer between the organization and key security threats. Make sure that employees know how to avoid potential problems, including:
SPOT THE BAD GUYS
- Social Engineers: Social engineers will attempt to gain access to sensitive data by impersonating individuals who are authorized. Employees need to be able to identify social engineers and prevent them from gaining that access, whether that means shutting them down or handing them off to a supervisor.
- Phishing Scams: Phishing scams attempt to gain access to sensitive data by encouraging employees to click on a malicious link. Knowing how to recognize phishing scams is a critical line of defense for employees.
- Vishing Scams: Vishing scams are when a hacker elicits information or influences action via the telephone. Like phishing, these attackers’ goal is to gather valuable information that could compromise your firm’s company data. The spoofer may forge their caller ID to pose as a legitimate business or colleague.
Verify identities. Most of the time, your employees know who is and who isn’t supposed to have access to specific information, especially if it’s sensitive information that they’re responsible for controlling. Teach employees how to verify the identity of anyone making a request for sensitive information or requesting access to data that is typically restricted. Teach employees that if something seems off, they can and should always verify that information with the individual in question. A phone call doesn’t take much time, and it can successfully determine whether or not a request is genuine and authorized.
Provide the right policies to minimize human error. Human error is inevitable. In many cases, however, it is possible to minimize human error by providing employees with the right procedures and training. This might include double-checking email addresses to make sure that they’re correct, verifying information before saving a file, or checking links before clicking.
Clean off that desk. Messy work-spaces aren’t just frustrating but can present a big security threat to your organization. In messy spaces, it’s easier to lose key cards, papers containing sensitive information, and other items that could ultimately compromise the security of the firm as a whole.
HUMAN FIREWALL SUCCESS
We all need to act as a human firewall, as an added layer of security on top of the software and hardware tools used. A good human firewall is well-trained, uses common sense, and has the situational awareness to protect the firm from security threats. Creating human firewalls throughout your organization is an ongoing process. By providing appropriate training and information, it’s possible to transform the way your employees handle potential security threats. While it may be difficult to secure your firm completely, you can create a more effective line of defense that will help heighten your overall security and make your company less vulnerable. Stephanie Kinsey
