Five Ways HR Can Improve Cyber Security

Security breaches are becoming more targeted and costly. The UK government’s Cyber Security Breaches Survey 2019 shows that one in three businesses (32%) suffered an attack or breach in the previous 12 months. 

These attacks had an average cost of £4,180 to each smaller business and nearly £10k for charities that were attacked, but medium and larger businesses some paid a lot more.

Around a third (32%) of businesses and two in ten charities (22%) report having cyber security breaches or attacks in the last 12 months. As in previous years, this is much higher specifically among medium businesses (60%), large businesses (61%) and high-income charities (52%). 

As companies ramp up their cyber defences with more sophisticated technology, attackers are choosing softer targets. Attacks that rely on human error, such as phishing (identified by 80% of respondents) and impersonating an organisation (28%) now outnumber viruses, spyware or malware attacks (27%).

Incidents can result in loss of data or even large sums of money. Last year holiday company Butlin’s admitted that up to 34,000 guests may have had their personal details compromised as a result of a phishing attack. 

Meanwhile, the financial director of film company Pathe’s Dutch arm was sacked after paying over €19m into a bank account in Dubai, along with the CEO Edwin Slutter who had authorised him to do so. The two men believed they were acting on instructions emailed from the Paris headquarters and that the funds related to a company acquisition. Both later filed for unfair dismissal.

Cyber security has traditionally been seen as a job for IT departments, but as threats change they are unable to hold the line alone. It has become a company-wide challenge and HR professionals have a key role to play in minimising it. 
Malware protection and anti-virus software are vital, but technology will not deter intruders if poor staff awareness or access policies effectively leave the door wide open.

HR professionals need to ensure employees’ skills are updated to encompass cyber security. Most have already taken the first steps by increasing data protection measures in light of the General Data Protection Regulation, and the Cyber Security Breaches Survey found the regulation had raised awareness of security, but the focus has largely been on data. 

There is still more that organisations can do to protect themselves from cyber risks. This includes taking important actions that are still relatively uncommon, around board-level involvement in cyber security, monitoring suppliers and planning incident response. 

Organisations now need to consider cyber security as a whole.

Here are five step HR teams can take to minimise threats:

1. Collaborate with IT
HR and other departments need to work closely with IT departments to manage cyber security. Ideally there should be a company-wide framework that brings different elements together, including technology and policies and procedures, and ensures that everyone understands their roles and responsibilities.

2. Understand the basics
While HR professionals do not need to know all the technical details, it will be useful to learn the basics of cyber security. The government’s Cyber Essentials guide outlines the key principles. The most relevant for HR is the need to control user access, the key principle being that “staff should have just enough access to software, settings, online services and device connectivity functions for them to perform their role. Extra permissions should only be given to those who need them”.

3. Put the right policies and procedures in place
Access rights should be outlined in a user access control policy, granted as part of the onboarding process, reviewed regularly, then revoked when an employee leaves the organisation. There should also be appropriate password controls in place and a process to allocate secret authentication information to users.

The use of mobile devices and remote working must also be considered. Companies should have a policy detailing the acceptable use of mobile devices, along with a policy on security measures to protect the information accessed, processed or stored outside the office. Social media is another risk.

Policies and procedures will be determined by the organisation’s circumstances and whether it simply wants to meet its legal obligations or achieve a recognised standard such as Cyber Essentials or ISO/IEC 27001:2013.

Employers should also complete background checks as part of staff-vetting procedures and have a disciplinary process for those who breach security rules. 

In 2014 a disgruntled Morrisons employee deliberately leaked staff salaries, bank details and national insurance numbers of 100,000 staff numbers to newspapers and data-sharing websites. Although he was sentenced to eight years in prison, Morrisons was also found vicariously liable for his actions. The retailer has been given permission to appeal the decision in the British Supreme Court.

4. Carry out staff training
All staff should have some type of cyber security training to make them aware of security and data protection rules, policies and procedures, plus any particular threats they may encounter. Cyber security training should be part of the onboarding process, but in any case employees need to receive updates regularly.
While staff at all levels have a responsibility to protect their employer’s data, directors have a particular duty of care. Regulators have made clear that it is a board-level issue and are willing to hold directors liable for any breaches. The National Cyber Security Centre says cyber security should be part of a manager’s skill set and its guidance states that “executive staff should be as aware of the major vulnerabilities in their IT estate as they are of their financial status”.

 5. Put monitoring in place
Companies need to be able to detect threats at an early stage. While breach detection might normally be outside the HR remit, HR teams do need to know if procedures have not been carried out by staff. An emergency plan also needs to be in place in case a data breach or other incident occurs.

Employers should keep records for compliance purposes too. Not every incident can be prevented, but they should be able to demonstrate that steps have been taken to minimise security risk.

While much of the responsibility for cyber security lies with IT departments, an organisation’s systems will not be watertight unless human error or malpractice is tackled with HR’s input. 

Personel Today:         DCMS Cyber Breach Survey

You Might Also Read: 

Five Reasons To Learn Cyber Security:

 
« Cyber Essentials For Board Directors
India & Japan In Cyber Security Pact »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ACIS Professional Center

ACIS Professional Center

ACIS provides training and consulting services in the area of information technology, cybersecurity, IT Governance, IT Service management, information security and business continuity management.

Infiltrate

Infiltrate

INFILTRATE is a deep technical conference that focuses entirely on offensive security issues.

Device Authority

Device Authority

Device Authority specialises in security automation for the Internet of Things (IoT).

TeleTrusT

TeleTrusT

TeleTrust is an IT Security association and network for IT security comprising members from industry, administration, consultancy and research.

Hitachi Systems Security

Hitachi Systems Security

Hitachi Systems Security provides customized services for monitoring and protecting the most critical and sensitive IT assets in our clients’ infrastructures 24/7.

Bechtel

Bechtel

Bechtel’s Industrial Control Systems Cyber Security Laboratory focuses on protecting large-scale industrial and infrastructure systems that support critical infrastructure.

R2S Technologies

R2S Technologies

R2S can help you implement a cyber security framework to ensure your business is more resilient towards the growing threat of cyber crime. We provide Web and Mobile Application Security Assessment..

InnoValor

InnoValor

InnoValor realises value from digital innovation for organisations and government. We provide advisory services and develop innovative software solutions, based on our background in research.

Euro-Recycling

Euro-Recycling

Euro-Recycling is a leading UK provider of Secure On-Site Data Media Destruction Services.

Nova Leah

Nova Leah

Nova Leah helps connected medical device manufacturers meet cybersecurity compliance requirements throughout the entire product lifecycle.

OpSec Security

OpSec Security

OpSec Online is the only brand protection solution that spans all channels so your brands are protected no matter what digital venue the criminals target.

Enet 1 Group1

Enet 1 Group1

Enet 1 Group audits, assesses, recommends, and delivers tested solutions for the ever-increasing threats to your critical systems and digital assets

Octiga

Octiga

Octiga is an office 365 cloud security provider. It offers Office 365 monitoring, incident response and recovery tools.

SignalFire

SignalFire

SignalFire invest across both enterprise and consumer sectors at the seed and early growth stages.

Technivorus Technology

Technivorus Technology

Technivorus is a deep-tech firm delivering customized Cybersecurity, Digital Marketing, Web & App Development, and multifarious IT services for businesses across the globe.

Sentar

Sentar

Sentar is a cyber intelligence company, applying advanced analytics and systems engineering expertise to protect our national security by securing mission-critical assets.