Five Ways HR Can Improve Cyber Security

Security breaches are becoming more targeted and costly. The UK government’s Cyber Security Breaches Survey 2019 shows that one in three businesses (32%) suffered an attack or breach in the previous 12 months. 

These attacks had an average cost of £4,180 to each smaller business and nearly £10k for charities that were attacked, but medium and larger businesses some paid a lot more.

Around a third (32%) of businesses and two in ten charities (22%) report having cyber security breaches or attacks in the last 12 months. As in previous years, this is much higher specifically among medium businesses (60%), large businesses (61%) and high-income charities (52%). 

As companies ramp up their cyber defences with more sophisticated technology, attackers are choosing softer targets. Attacks that rely on human error, such as phishing (identified by 80% of respondents) and impersonating an organisation (28%) now outnumber viruses, spyware or malware attacks (27%).

Incidents can result in loss of data or even large sums of money. Last year holiday company Butlin’s admitted that up to 34,000 guests may have had their personal details compromised as a result of a phishing attack. 

Meanwhile, the financial director of film company Pathe’s Dutch arm was sacked after paying over €19m into a bank account in Dubai, along with the CEO Edwin Slutter who had authorised him to do so. The two men believed they were acting on instructions emailed from the Paris headquarters and that the funds related to a company acquisition. Both later filed for unfair dismissal.

Cyber security has traditionally been seen as a job for IT departments, but as threats change they are unable to hold the line alone. It has become a company-wide challenge and HR professionals have a key role to play in minimising it. 
Malware protection and anti-virus software are vital, but technology will not deter intruders if poor staff awareness or access policies effectively leave the door wide open.

HR professionals need to ensure employees’ skills are updated to encompass cyber security. Most have already taken the first steps by increasing data protection measures in light of the General Data Protection Regulation, and the Cyber Security Breaches Survey found the regulation had raised awareness of security, but the focus has largely been on data. 

There is still more that organisations can do to protect themselves from cyber risks. This includes taking important actions that are still relatively uncommon, around board-level involvement in cyber security, monitoring suppliers and planning incident response. 

Organisations now need to consider cyber security as a whole.

Here are five step HR teams can take to minimise threats:

1. Collaborate with IT
HR and other departments need to work closely with IT departments to manage cyber security. Ideally there should be a company-wide framework that brings different elements together, including technology and policies and procedures, and ensures that everyone understands their roles and responsibilities.

2. Understand the basics
While HR professionals do not need to know all the technical details, it will be useful to learn the basics of cyber security. The government’s Cyber Essentials guide outlines the key principles. The most relevant for HR is the need to control user access, the key principle being that “staff should have just enough access to software, settings, online services and device connectivity functions for them to perform their role. Extra permissions should only be given to those who need them”.

3. Put the right policies and procedures in place
Access rights should be outlined in a user access control policy, granted as part of the onboarding process, reviewed regularly, then revoked when an employee leaves the organisation. There should also be appropriate password controls in place and a process to allocate secret authentication information to users.

The use of mobile devices and remote working must also be considered. Companies should have a policy detailing the acceptable use of mobile devices, along with a policy on security measures to protect the information accessed, processed or stored outside the office. Social media is another risk.

Policies and procedures will be determined by the organisation’s circumstances and whether it simply wants to meet its legal obligations or achieve a recognised standard such as Cyber Essentials or ISO/IEC 27001:2013.

Employers should also complete background checks as part of staff-vetting procedures and have a disciplinary process for those who breach security rules. 

In 2014 a disgruntled Morrisons employee deliberately leaked staff salaries, bank details and national insurance numbers of 100,000 staff numbers to newspapers and data-sharing websites. Although he was sentenced to eight years in prison, Morrisons was also found vicariously liable for his actions. The retailer has been given permission to appeal the decision in the British Supreme Court.

4. Carry out staff training
All staff should have some type of cyber security training to make them aware of security and data protection rules, policies and procedures, plus any particular threats they may encounter. Cyber security training should be part of the onboarding process, but in any case employees need to receive updates regularly.
While staff at all levels have a responsibility to protect their employer’s data, directors have a particular duty of care. Regulators have made clear that it is a board-level issue and are willing to hold directors liable for any breaches. The National Cyber Security Centre says cyber security should be part of a manager’s skill set and its guidance states that “executive staff should be as aware of the major vulnerabilities in their IT estate as they are of their financial status”.

 5. Put monitoring in place
Companies need to be able to detect threats at an early stage. While breach detection might normally be outside the HR remit, HR teams do need to know if procedures have not been carried out by staff. An emergency plan also needs to be in place in case a data breach or other incident occurs.

Employers should keep records for compliance purposes too. Not every incident can be prevented, but they should be able to demonstrate that steps have been taken to minimise security risk.

While much of the responsibility for cyber security lies with IT departments, an organisation’s systems will not be watertight unless human error or malpractice is tackled with HR’s input. 

Personel Today:         DCMS Cyber Breach Survey

You Might Also Read: 

Five Reasons To Learn Cyber Security:

 
« Cyber Essentials For Board Directors
India & Japan In Cyber Security Pact »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

Datto

Datto

Datto delivers a single toolbox of easy to use products and services designed specifically for managed service providers and the businesses they serve.

SBS CyberSecurity

SBS CyberSecurity

SBS CyberSecurity is a premier cybersecurity consulting and audit firm.

BCS Financial

BCS Financial

BCS Financial delivers financial and insurance solutions. Specialty risk products include Cyber and Privacy Liability insurance.

Jscrambler

Jscrambler

Jscrambler addresses all your JavaScript and Web application protection needs.

Inspirria Cloudtech

Inspirria Cloudtech

Inspirria Cloudtech is a specialized Cloud Technologies Services provider and Cloud Aggregator focused on executing cloud models for clients.

National Cyber Security Agency (NACSA) - Malaysia

National Cyber Security Agency (NACSA) - Malaysia

NACSA is the leading government agency in Malaysia responsible for the development and implementation of national cyber security management policie and strategies.

Cloudentity

Cloudentity

Cloudentity combines Identity for all things with API and Application security in a unique deployment model, combining cloud-transformation and legacy systems.

Secure-IC

Secure-IC

Secure-IC provide end-to-end, best-of-breed security expertise, solutions, and hardware & software technologies, for embedded systems and connected objects.

BAI Security

BAI Security

BAI Security is a Nationally Recognized Leader in IT Security. Keeping your data safe and your business compliant is our singular focus.

Ermetic

Ermetic

Ermetic’s identity-first cloud infrastructure security platform provides holistic, multi-cloud protection in an easy-to-deploy SaaS solution.

Ascent Solutions

Ascent Solutions

Ascent is built to help firms evolve their cybersecurity posture, modernize their Microsoft solutions, and accelerate their journey to the cloud.

LayerX Security

LayerX Security

LayerX's user-first browser security platform turns any browser into the most protected & manageable workspace, by providing real-time monitoring and governance over users’ activities on the web.

Nuance Communications

Nuance Communications

From revolutionizing the doctor-patient relationship to reinventing the way brands connect with their customers, Nuance technology helps organizations push the boundaries of what’s possible.

FastPassCorp

FastPassCorp

In the world of IT, identity theft is a growing concern. FastPass offers an innovative solution as a cloud or on-premises offering.

Aim Security

Aim Security

Aim empowers enterprises to unlock the full potential of GenAI technology without compromising security. GenAI makes business better - Aim makes GenAI secure.

MergeBase

MergeBase

Reduce software supply chain risk with MergeBase proven Software Composition Analysis (SCA).