Practical data security tips for employers: Could employees be your best defense?

Within the rapidly evolving digital landscape, human judgment often is the weakest link in any organization’s cybersecurity posture. Whether it be falling for a phishing email or using a weak password, human error is often the leading cause of security breaches. For instance, Verizon’s 2023 Data Breach Investigations Report concludes that 74% of breaches involve the human element, including social engineering attacks and employee errors. In 2022, a joint study found that approximately 85% of all data breaches are caused by an employee mistake.

Given these findings, it comes as no surprise that human error should be a primary point of focus for organizations seeking to enhance their network safeguards. Oftentimes, organizations spend all of their time and money keeping systems and software up to date and instituting strict internal controls. While state-of-the-art firewalls and well-intentioned policies are important tools for every organization to have in their toolbox – what organizations fail to recognize is that one of their best defenses is a well-trained workforce. Your workforce holds so many of the cards when it comes to a breach occurring in the first place. Employee training and awareness is the best investment an organization can make to insulate itself from the far-reaching impacts of a cyberattack. What does that look like?

• Annual employee training - Routine training on data handling and retention best practices along with cybersecurity best practices (training employees how to spot a phishing email, a spoofed domain and to report all malicious links to IT).
• Developing an Incident Response Team and implementing an Incident Response Plan – The best way to respond to a breach is to be prepared for one. An Incident Response Plan serves as a roadmap for organizations to use in the event of a suspected or actual data breach. Organizations should take the time to train and designate key employees as Incident Response Team leaders and put their Incident Response Plan to the test in annual tabletop exercises.
• Partner with platforms such a KnowBe4 – There are a variety of great platforms that organizations can rely on that put employee training to the test. KnowBe4 is a simulated phishing platform that will challenge your employees to spot and report phishing emails.

With cybersecurity threats at an all-time high, employees should appreciate the vital role they play in keeping data breaches off an organization’s doorstep. If you want to learn more about proactive cybersecurity defense such as employee training, Incident Response Plans, or tabletop exercise, contact a member of McDonald Hopkins’ national data privacy and cybersecurity team.