Five Ways HR Can Improve Cyber Security

Security breaches are becoming more targeted and costly. The UK government’s Cyber Security Breaches Survey 2019 shows that one in three businesses (32%) suffered an attack or breach in the previous 12 months. 

These attacks had an average cost of £4,180 to each smaller business and nearly £10k for charities that were attacked, but medium and larger businesses some paid a lot more.

Around a third (32%) of businesses and two in ten charities (22%) report having cyber security breaches or attacks in the last 12 months. As in previous years, this is much higher specifically among medium businesses (60%), large businesses (61%) and high-income charities (52%). 

As companies ramp up their cyber defences with more sophisticated technology, attackers are choosing softer targets. Attacks that rely on human error, such as phishing (identified by 80% of respondents) and impersonating an organisation (28%) now outnumber viruses, spyware or malware attacks (27%).

Incidents can result in loss of data or even large sums of money. Last year holiday company Butlin’s admitted that up to 34,000 guests may have had their personal details compromised as a result of a phishing attack. 

Meanwhile, the financial director of film company Pathe’s Dutch arm was sacked after paying over €19m into a bank account in Dubai, along with the CEO Edwin Slutter who had authorised him to do so. The two men believed they were acting on instructions emailed from the Paris headquarters and that the funds related to a company acquisition. Both later filed for unfair dismissal.

Cyber security has traditionally been seen as a job for IT departments, but as threats change they are unable to hold the line alone. It has become a company-wide challenge and HR professionals have a key role to play in minimising it. 
Malware protection and anti-virus software are vital, but technology will not deter intruders if poor staff awareness or access policies effectively leave the door wide open.

HR professionals need to ensure employees’ skills are updated to encompass cyber security. Most have already taken the first steps by increasing data protection measures in light of the General Data Protection Regulation, and the Cyber Security Breaches Survey found the regulation had raised awareness of security, but the focus has largely been on data. 

There is still more that organisations can do to protect themselves from cyber risks. This includes taking important actions that are still relatively uncommon, around board-level involvement in cyber security, monitoring suppliers and planning incident response. 

Organisations now need to consider cyber security as a whole.

Here are five step HR teams can take to minimise threats:

1. Collaborate with IT
HR and other departments need to work closely with IT departments to manage cyber security. Ideally there should be a company-wide framework that brings different elements together, including technology and policies and procedures, and ensures that everyone understands their roles and responsibilities.

2. Understand the basics
While HR professionals do not need to know all the technical details, it will be useful to learn the basics of cyber security. The government’s Cyber Essentials guide outlines the key principles. The most relevant for HR is the need to control user access, the key principle being that “staff should have just enough access to software, settings, online services and device connectivity functions for them to perform their role. Extra permissions should only be given to those who need them”.

3. Put the right policies and procedures in place
Access rights should be outlined in a user access control policy, granted as part of the onboarding process, reviewed regularly, then revoked when an employee leaves the organisation. There should also be appropriate password controls in place and a process to allocate secret authentication information to users.

The use of mobile devices and remote working must also be considered. Companies should have a policy detailing the acceptable use of mobile devices, along with a policy on security measures to protect the information accessed, processed or stored outside the office. Social media is another risk.

Policies and procedures will be determined by the organisation’s circumstances and whether it simply wants to meet its legal obligations or achieve a recognised standard such as Cyber Essentials or ISO/IEC 27001:2013.

Employers should also complete background checks as part of staff-vetting procedures and have a disciplinary process for those who breach security rules. 

In 2014 a disgruntled Morrisons employee deliberately leaked staff salaries, bank details and national insurance numbers of 100,000 staff numbers to newspapers and data-sharing websites. Although he was sentenced to eight years in prison, Morrisons was also found vicariously liable for his actions. The retailer has been given permission to appeal the decision in the British Supreme Court.

4. Carry out staff training
All staff should have some type of cyber security training to make them aware of security and data protection rules, policies and procedures, plus any particular threats they may encounter. Cyber security training should be part of the onboarding process, but in any case employees need to receive updates regularly.
While staff at all levels have a responsibility to protect their employer’s data, directors have a particular duty of care. Regulators have made clear that it is a board-level issue and are willing to hold directors liable for any breaches. The National Cyber Security Centre says cyber security should be part of a manager’s skill set and its guidance states that “executive staff should be as aware of the major vulnerabilities in their IT estate as they are of their financial status”.

 5. Put monitoring in place
Companies need to be able to detect threats at an early stage. While breach detection might normally be outside the HR remit, HR teams do need to know if procedures have not been carried out by staff. An emergency plan also needs to be in place in case a data breach or other incident occurs.

Employers should keep records for compliance purposes too. Not every incident can be prevented, but they should be able to demonstrate that steps have been taken to minimise security risk.

While much of the responsibility for cyber security lies with IT departments, an organisation’s systems will not be watertight unless human error or malpractice is tackled with HR’s input. 

Personel Today:         DCMS Cyber Breach Survey

You Might Also Read: 

Five Reasons To Learn Cyber Security:

 
« Cyber Essentials For Board Directors
India & Japan In Cyber Security Pact »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Corero Network Security

Corero Network Security

Corero Network Security is dedicated to improving the security of the Internet through the deployment of its innovative DDoS & Network Security Solutions.

ObserveIT

ObserveIT

ObserveIT helps companies identify & eliminate insider threats. Visually monitor & quickly investigate with our easy-deploy user activity monitoring solution.

ATSEC Information Security

ATSEC Information Security

ATSEC is an independent, privately-owned company that focuses on providing laboratory and consulting services for information security.

Panaseer

Panaseer

Panaseer is an enterprise cybersecurity automation and data analytics company that helps organizations stop preventable breaches by ensuring security controls are working effectively.

Comiq

Comiq

Comiq provide software quality assurance, testing and project management services. Areas of expertise include cybersecurity.

Progress Flowmon

Progress Flowmon

Progress Flowmon (formerly Flowmon Networks) provide high performance network monitoring technology and behavior analytics to enhance network performance and deal with cyber threats.

Ritz

Ritz

Ritz is the largest holistic pure-play cyber security solutions provider in Myanmar.

Root9B (R9B)

Root9B (R9B)

R9B offers advanced cybersecurity products, services, and training to enhance the way organizations protect their networks.

Bechtle

Bechtle

Bechtle is one of Europe’s leading IT service providers offering a blend of direct IT product sales and extensive systems integration services.

SEIRIM

SEIRIM

SEIRIM delivers cybersecurity solutions in Shanghai China specializing in Web Application Security, Network Security for SME's, Vulnerability Management, and serving as Managed Security as a Service.

Spyderbat

Spyderbat

Spyderbat ATI closes the manual investigation gap between detection and response by instantly presenting causally connected threat activity to security analysts at the onset of an investigation.

Fortiedge

Fortiedge

Fortiedge is an IT Security solution provider specializing in Cyber Security practices and solutions for our clients.

HolistiCyber

HolistiCyber

HolistiCyber provide state-of-the art consulting, services, and solutions to help proactively and holistically defend against a new era of constantly evolving cyber threats.

ShieldIO

ShieldIO

ShieldIO Real-Time Homomorphic Encryption™ enables your organization to reach regulatory compliance without compromising data availability.

Tychon

Tychon

Tychon develops advanced enterprise endpoint management technology that enables commercial and government organizations to bridge the gap between security and IT operations.

Manifest

Manifest

Manifest is a cybersecurity company dedicated to helping enterprises secure their software supply chains.