Protecting your company’s data is an ongoing battle, where enemies are both inside and outside your walls. Your own troops are often the weakest link in your security chain because human nature doesn’t change. We all have a natural inclination to share information, in an environment where technology and hackers are always improving ways to obtain this information.
Even in the 21st century, most people have inadequate password management skills and typically use passwords that are easy to guess. Hackers are getting really good at phishing that it accounts for 90% of breaches and that 30% of phishing messages actually get opened by unsuspecting, uninformed users.
Here are the reasons why
It reduces the risks of a breach
The reason for this striking increase was the passage of the Notifiable Data Breaches (NDB) scheme. It requires agencies to inform account holders when a data breach is likely to cause them serious harm. The NDB scheme applies not only to the possibility of financial damage but also psychological and even physical injury. An IT induction program helps ensure that your staff members follow best practices in information security, helping to minimise the risk of a breach that could compromise your data. This training should include your organisation’s password policy, which describes the criteria that passwords must meet and how often they need to be changed. The methods that users must employ to protect their passwords is also an essential part of IT induction.
It protects your reputation
Today’s global news cycle and increasingly finicky customers make protecting your company’s reputation a difficult task under normal circumstances. A security breach damage goes beyond the cost of the initial clean-up since data loss has the potential for a much greater cost: your relationship with your customers. Nearly two-thirds of surveyed companies have experienced a data breach that damaged their reputation. A single data breach that compromises customer data can make it very difficult for even a large company to fully recover its reputation.
Staff members need proper IT induction to begin repairing these relationships as quickly as possible. Customers want complete transparency after a breach, even if data privacy laws don’t require it. And with trained employees, your company would do better than leaving your customers with a very company-centric tweet: “Here at Company X, we’re all about data safety, but…”
It saves you from getting in trouble with legal
Governments throughout the world are passing stricter regulations regarding the protection of data, especially personal information. Compliance failures increase the average cost of data breaches by $11.90 per capita, according to the IBM-Ponemon Institute. So IT induction should include compliance training for new staff members, especially in tightly regulated industries such as finance and healthcare. Financial services are under particularly strict scrutiny with the passage of the latest prudential standard issued by the Australian Prudential Regulatory Authority (APRA) on July 1, 2019.
This standard increases security requirements for entities with sensitive information, primarily with respect to reporting requirements. Among other obligations, they need to notify APRA about unauthorised disclosure of such information within 72 hours. The routine use of email in business correspondence also creates the possibility of legal complications. Email messages tend to be less formal, but they’re still subject to many of the same obligations as written documents. For example, businesses can make and break contracts via email and cite those messages in litigation. Your IT induction program should provide staff with appropriate guidance on email use, including the awareness that they generally qualify as official correspondence.
Manage your people’s working practices
Your IT induction program should ensure that staff members understand that it’s their personal responsibility to adopt best practices. This approach will help minimise an organisation’s risk of financial, legal, and reputational loss.
Recent trends in commercial IT practices require scrutiny during IT induction. For example, most organisations now have some type of Bring Your Own Device to work policy (BYOD).
This trend blurs the boundaries between home and business uses, especially for employees who work from home. Your IT induction should include specific training for protecting the firm’s data on personal devices.
Conclusion: Raise Your IT Defences
Attacks on your organisation will rarely be as obvious as a group of iron-clad soldiers on a street parade. They may be so subtle that you won’t even know it’s happening until your customers’ data shows up for sale on the dark web. Employee education in the form of IT inductions is essential for explaining your organisation’s policies and practices regarding IT. And this training won’t be efficient without reinforcing it with a company culture that emphasises the value of information security. Are you ready to implement an IT induction program for your organisation? Contact Blackbird IT today to learn more about how we can help you protect your company information.
Subscribe