Proper on/offboarding policies and procedures can protect your data and streamline your operations. JANUS’ 8 cybersecurity best practices will help you create a hardened yet more resilient enterprise.
The biggest threat to your IT network could be closer than you think. A recent study established that 88% of successful data breaches1 are the direct result of employee actions. As a result, organizations should prioritize deploying the proper practices necessary to ensure a robust cybersecurity strategy.
Organizations of all sizes and types are investing more in their cybersecurity onboarding and offboarding efforts. In this blog, we will share why you should be putting these efforts into action. More importantly, we outline eight practical steps you can do to onboard and offboard your employees more effectively.
What is Cybersecurity?
Cybersecurity is the practice of protecting electronic information from unauthorized access and/or theft. This can include measures to protect data stored on devices. It also includes measures for preventing devices or users from gaining unauthorized access to networks or systems.
There are many cybersecurity threats that all businesses should make note of, to name just a few:
- Viruses
- Malware
- Phishing scams
- Exfiltration of data
To protect your business from these threats, a cybersecurity strategy should be set into place that includes cybersecurity measures for onboarding new employees and offboarding departing ones.
What is Onboarding?
Onboarding is the process of bringing new employees into an organization. This includes orientation, training, and setting up accounts and access to systems. When onboarding new employees, it's important to equip them with the right skills and understanding to keep your IT network safe.
Cybersecurity Onboarding Best Practices
To create a cyber security-conscious staff, you need to start from the very beginning. That means going back to the hiring and onboarding processes. Here are some things you can do to make your employees better equipped to help keep your network safe:
1. Explain Your IT Security Policies to Your Recruits
A clearly defined IT security culture is essential to deterring internal cyber threats. You need to make sure that your potential in-house and remote workers are aware of your cybersecurity policies before they even start working for you.
One of these policies involves the use of passwords. Require that your employees use specific combinations of characters, numbers, and symbols in their passwords. You should also set a minimum password length to make sure that they are not using easily guessed words or phrases and enforce a password change policy every 60 days that prevent the reuse of prior passwords.
Another policy to implement is the assurance that employees do regular software updates. You should also have a policy on prompt reporting of any suspicious activity. If one of your employees sees something unusual, they should report it to their supervisor immediately.
2. HELP Your Recruits Understand the Prevalence of Cyber Attacks
Keeping your staff cyber aware is another important step in deterring internal cyber threats. Your employees need to understand that cyber-attacks are not only common, but they are also increasing in frequency and severity.
Ensure your employees understand what forms of attacks are especially prevalent. Phishing emails, social engineering, and ransomware are just some examples they need to stay on the lookout for.
3. Remind Employees of the Consequences of Data Theft
A successful cyber-attack can have catastrophic financial implications for a business. The average loss associated with a single breach amounted to $4.24 million2 in 2021, and the cost is still rising.
In addition to the financial cost, data breaches can also lead to a loss of customer trust and damage to the organization's reputation. In some cases, this can be even more costly than the immediate financial loss associated with the actual data breach.
There can also be substantial legal consequences for organizations that suffer data breaches. Depending on the type of data that is compromised, and how the organization responds to the incident an organization could be fined by the government or sued by its end users.
When your staff understands these consequences, they will hopefully stay more vigilant.
4. Educate Safe Interconnectedness
IT security in your organization is not just the responsibility of the IT department. Everyone in the organization plays a role in keeping the organization safe.
This is because cybersecurity threats can come from anywhere. An employee could accidentally click on a malicious link in an email, infecting the entire network, or they could connect their laptop to an unsecured Wi-Fi network, opening the enterprise up to an attack.
Employees need to understand that their actions can seriously impact the organization’s network. This should help them act in a more responsible manner.
5. Conduct Cyber Security Training Regularly
Conducting regular cyber security awareness training helps IT security skills stick. Incorporate well-thought-out training on a regular basis of 90 days or sooner.
During this training, you can test employees' understanding of your policies and procedures. You can also identify any gaps in your defenses and make necessary adjustments.
You can use this training to make your employees aware of any new cybersecurity threats that have emerged. By keeping them up-to-date on the latest cybersecurity threats, you can help them focus on protecting data and the network. If there's any new software or hardware that has been deployed to help mitigate these threats, you can also share this information with your employees during training.
6. Encourage Employee Feedback
Encourage feedback from employees throughout the training process. This feedback can be used to improve your cybersecurity policies and procedures. It can also help you identify any areas where employees are struggling to understand the material.
Make it easy for employees to share any concerns they have about your network and take necessary action about it. Foster an environment of cooperation and not one of punishment.
What Is Offboarding?
Offboarding refers to all the actions associated with an employee leaving your organization. This includes returning everything that is considered organization property. When an employee leaves your organization, they take all their knowledge and experience with them. This can leave your organization vulnerable to attack if they are not properly offboarded.
Cybersecurity Offboarding Best Practices
You can only experience the benefits of offboarding procedures if you go about the process correctly. Here are some things you can do to secure your operations and infrastructure when an employee departs:
7. Prepare for Employee Departures
There are 2 types of employee departures: resignation and termination. In either case, the offboarding process is similar. It should be carried out with the aid of a comprehensive checklist to protect against missing any steps.
When an employee leaves the organization, the IT team needs to be notified of what is happening, and be prepared to secure the network and data from unauthorized access by the former employee. Some of these actions include restricting remote VPN access, disabling the employee’s active directory account, revoking all passwords, local network access, telephony access, and the retrieval of all devices–including laptops, phones, and storage devices, such as USB flash drives or external hard drives.
If the employee gives notice and you plan to let them stay on, be sure to inform your IT team of the final date of employment and an access cutoff time. This way your IT team can monitor the employee's activity leading up to their departure. Monitoring can help identify any suspicious activity and allow for any necessary actions needed to safeguard the organization's data against exfiltration. Immediately notify IT if anything, such as the final date of employment changes.
Terminating an employee requires the immediate notification of your IT team as a means to protect the organization against potentially malicious or vindictive actions from the employee. In the event of termination, IT should immediately disable all access. The employee should only be allowed back into their office under the direct supervision of their manager and/or HR, and under no circumstances should they be allowed to touch their organization-owned desktop, laptop, or cellphone. Terminated employees have been known to attempt to reformat hard drives, delete files, exfiltrate data, or even load malware onto their equipment or network.
Clear policies and procedures will help protect the organization when employees leave.
8. Conduct Exit Interviews
When an employee leaves your organization, be sure to conduct an exit interview. Listen carefully to what the employee is saying to learn of anything that could help you improve your cybersecurity policies and procedures.
The exit interview is also a good time to remind the departing employee of their obligations under the organization's policies, and specifically your cybersecurity policy. This includes returning any equipment and data they may have and not sharing any information with competitors. It is also a good time to furnish them with a copy of the signed NDA they may have executed during onboarding.
Stay on Top of Your Cybersecurity at All Times
Don't wait until you’ve had a security-related incident to recognize the importance of a strong cybersecurity strategy. By taking the necessary IT security onboarding and offboarding steps, you can protect your organization from data breaches, reputational damage, and financial loss.
Are you interested in professional assistance in enhancing your IT security? Get in touch with us today and learn how JANUS Associates can help.
2https://www.csoonline.com/article/3434601/what-is-the-cost-of-a-data-breach.html
