Flex-Protection Information Security Policy and Services: A Tiered Data Security. Simple Steps To Avoid Attacks and Data Breaches

What The Big Security Companies Don't Tell You

Insiders agree. Recent informal surveys, working with management at large and small companies, and numerous consulting engagements all point to the same conclusions. Here are three factors that make improving data security challenging and in many ways unsuccessful. -- More --

Management Is Not Motivated. This is a blunt statement but it reflects the low priority that C-level management gives to information security at most companies. Immediately following a data breach, the level of attention and expenditures often increases.
Nobody Understands. With few exceptions, staff and management have very little idea what the job of the security team entails. Even the role of the CISO is misunderstood, as most regard data security as strictly an IT responsibility.
Fear Drives Cybersecurity. Big money is being spent on high-profile security services, while cost-effective measures are available which won't disrupt your daily operations. There really is a better way. Reduce your budget, simplify your data security, and manage everything in one place.

Where does User Training Fit In?

Training for users and for management is very important. Security professionals feel that there is no better return on investment than awareness training (often called SAT training). Recurrent training, in-person or online, has the best "bang for the buck". The exact course content will depend on your organization and its operating environment and culture. However, a good course outline might be similar to the following:

1. Phishing and social engineering: Teach employees how to recognize suspicious emails, phone calls, or messages that could trick them into revealing sensitive information.

2. Password security: Educate employees on creating and maintaining strong passwords, as well as the importance of using different passwords for different accounts.

3. Data protection: Emphasize the importance of safeguarding sensitive data, including personal identifying information (PII), financial data, and customer information.

4. Mobile device security: Discuss best practices for securing mobile devices, including setting passcodes, encrypting data, avoiding public Wi-Fi, and downloading apps from trusted sources.

5. Social media usage: Highlight the risks associated with posting sensitive personal or corporate information on social media, and teach employees how to protect their online identities.

6. Physical security: Educate employees on the importance of securing physical devices and data, including locking doors, shredding sensitive documents, and using secure file cabinets.

7. Incident response: Explain what employees should do in the event of a security breach or incident, including who to contact and what steps to take to minimize damage and prevent future incidents.

8. Web browsing: Teach employees how to stay safe when browsing the internet, including avoiding suspicious or unsecured websites, downloading antivirus software, and using browser plugins like ad blockers and password managers.

9. Remote work: With the rise of remote work, it's important to educate employees on best practices for working securely from home or other remote locations. This could include using virtual private networks (VPNs) to protect data, securing home Wi-Fi networks, and keeping work devices separate from personal devices.

10. Email safety: In addition to phishing and social engineering, there are several other email-related security risks to be aware of, such as email spoofing, attachment-based malware, and email bombing. Train employees to recognize these threats and take steps to mitigate them.

11. Cybersecurity regulations: Depending on the industry your organization operates in, there may be specific regulations or compliance requirements to be aware of. Make sure employees understand these requirements and how to comply with them.

Overall, the goal of a Security Awareness Training course should be to help employees understand how cybersecurity threats work, what they can do to protect themselves and their organization, and how to respond in the event of a security incident. By providing regular training and education on these topics, you can help create a stronger security culture and reduce the risk of data breaches and other cyber attacks.

Note the impact of each answer on your risk profile. Low Risk Moderate Risk High Risk	Your Answer
Do you have a written Information Security Policy that is endorsed by management?
How often are employees and management given Security Awareness Training (SAT)?
Do you have a documented Data Inventory - a list of key data stores, where they are located, and how they are protected?
Is there a convenient list of Security Best Practices that all users are familiar with?
Is critical data backed up automatically, onto separate computers used for backups?
Does your company have remote or traveling employees who need network access?
Have you had a network vulnerability scan or professional security assessment from a third party consultant or advisor?
Does your company or organization have a public-facing web site?
Are you covered by a Data Defender subscription to insure Security Best Practices?

Information Security: Where To Start?

You can get everything you need to get started with better data security for free. And we think a flexible template is a great place to start.

Spend two minutes on the industry's fastest security self-assessment.

To help you start with realistic expectations, grab this book from Amazon.

Is Your Critical Data Safe?

At a minimum, we recommend you take a few minutes and...

Private Sector Tools and Strategies

Public Sector Tools and Strategies

Free Security Self-Assessment

What The Big Security Companies Don't Tell You

Where does User Training Fit In?

Free Downloads and Low Cost Tools