Developing a cybersecurity strategy to protect end-users

“94 percent of malware was delivered via email.”

Who are the high-risk people within your business?

To understand which people are most at risk within your business, you need to think like an attacker.

When someone attempts to hack into your organization’s computer systems, they’re doing so for a reason. It could be that they want to access customer data, which they plan to sell on to a third-party. Or it could be that they’re trying to access sensitive information (e.g. in the case of corporate espionage).

Whatever the reason, they target the people within your business who can give them what they want. This means people with access to sensitive data, customer information or company secrets.

The CEO, directors and their assistants are obvious choices. These people often have access to high-level information, as well as customer data.

Engineers and IT staff are also high-risk as they tend to have access to a variety of systems, both physical and digital, that appeal to hackers. Gaining access to these systems may enable the attackers to gain access to the sensitive data we’ve already mentioned, as well as to take actions to disrupt the business (e.g. install malicious code, delete data, damage systems).

Finally, anyone who works remotely, away from the organization’s physical location, poses an additional risk.

What are the factors that contribute to end-user risk?

There are many factors that influence the risk posed to end-users and your business. These include:

• Vulnerabilities – for example, outdated software that hasn’t been kept up-to-date is likely to have weak points attackers can exploit.
• Access rights – users that have access to privileged information are at risk as this increases the likelihood the users have access to something the hackers want.
• Knowledge – if an end-user doesn’t know how to keep themselves (and your business) safe, how can you expect them to do it? While some data breaches are caused by negligent staff, many arise simply because the appropriate policies, procedures, and training aren’t in place.

Understanding these factors is key to risk mitigation.

How to mitigate risk and reduce attacks

When it comes to mitigating your risk and reducing cybersecurity attacks on your business, focusing on the end-user is an essential part of a successful cybersecurity strategy.

Here are a few ways you can do this:

Document the relevant policies and procedures

A good starting point is to ensure all relevant policies and procedures are documented, easily accessible, and introduced to new staff when they begin their employment with the business.

These should be easy to read and understand — and displayed in locations across the business to remind employees as they go about their work.

Educate your staff

The policies and procedures won’t mean much if your staff hasn’t received adequate training.

Develop sessions on cybersecurity to walk your employees through the actions you expect them to take to keep themselves and your business safe.

Make sure they know how they pose a threat to your business and the kind of threats they need to look out for.

Refresh their knowledge regularly

The cybersecurity landscape is evolving constantly. You need to ensure your employees understand this and keep up-to-date with the changes they’ll need to make as attacks get more sophisticated.

Leave all your employees with no doubt about the roles they need to play to prevent an attack.

Ensure the appropriate access restrictions

Data breaches often occur because employees have access to information they don’t need — and shouldn’t have access to.

One study by Varonis found that 17 percent of all sensitive files can be accessed by all employees and that 53 percent of all companies have over 1,000 sensitive files open to everyone inside the business. Not only is this unnecessary, but it puts your customers — and your business — at risk.

“53 percent of all companies have over 1,000 sensitive files open to everyone inside the business.”