10 Common Security Mistakes That Can Sink Your Network

Most companies have to have a workforce, generally one of considerable size. Unfortunately, the more users you have, the more potential risks you run into. Of course, your workforce doesn’t collectively intend to be a security risk, but the digital world is a complicated place, with threats around every corner and malicious programs just waiting for your employed end-users to slip up. Here are ten such honest slip-ups to watch out for:

1. Clicking on Risky Websites - The web is pretty big, so when an employee has been searching for something and finally manages to find a link, they might not always think about the source. As a result, your network and files could be subject to any number of threats. Be sure to emphasize to your employees that there is such a thing as “too good to be true,” especially on the Internet.
2. Weak or Personal Passwords - As much as your employees might love their dogs, cars, or a particular date in time, a password is no place to express that love. Also, if they actually use “password” as their password, they are just begging for trouble. Encourage them to use private, randomized strings of numbers and letters as insistently and consistently as possible.
3. Lax Habits in Mobile Security - You may have the latest versions of spyware and virus blockers on your company desktops, but do your employees have the same on their tablets, phones, and other portable electronics? Without the same security, once they are connected to your network, these devices leave your network wide open for breaches. Be sure your employees aren’t leaving points of access to your network without safeguards by establishing mobile device policies and a BYOD (Bring Your Own Device) policy.
4. Using Insecure Connections to Access Sensitive Data - Are your employees reviewing company files on their lunch break by using the local fast food franchise’s free Wi-Fi? If they are, it is recommended that
    you put a stop to it; as public Wi-Fi hotspots are prone to have malware lurking about.
5. Lost or Stolen Unencrypted Tech - So an employee is riding the bus to work, and leaves their company phone behind when they disembark. Without encryption software, that phone is potentially an encyclopedia of company data and information for sale to competitors, as well as a free pass into company files and email. Enforcing encryption policies helps to mitigate this risk.
6. Shadow IT - An employee decides that they prefer a different program to perform their job-related task and downloads a copy of that program onto their company desktop without the knowledge of the IT department. Besides the question of compatibility with your systems, it spreads your company data into yet another system, but this time you don’t have control over it. Plus, there is always the risk that the download will come with a bonus - vulnerabilities that could allow malware to hitch a free ride into the network. Be vigilant regarding the use of unapproved, personally downloaded applications.
7. Phishing Calls/Personalized Phishing Emails - One of your HR employees checks their email and finds what looks to be a job application directed specifically to them, using their name, title, and other personal identifiers. They click on the included link, not realizing that the email was actually from a hacker who did a bit of research on Facebook and LinkedIn, and downloads a mess of viruses. Impress upon your employees the importance of private social media accounts and the careful consideration of any linked content from unknown senders. Similarly, make sure your employees can recognize and appropriately handle phishing telephone calls for both live callers and robocalls, and understand the importance of not sharing company information compulsively.
8. Personal Email Use - The news has presented enough evidence in recent years to prove that using a personal email account for work purposes is never a good idea. Beyond the implicit unprofessionalism of some usernames, personal accounts tend to be more vulnerable to malicious programs than their corporate counterparts are. Encourage your employees to keep work and personal emails separate.
9. Leaving Workstations Unattended - As unfortunate as it is, not all employees will be completely on the up-and-up. Some will attempt to view information they aren’t cleared to access, often for purposes of corporate espionage. This task becomes remarkably easy when a workstation is left unattended while still active. The fix is relatively easy to establish; just remind employees to log off of their desktop (or at least lock it) before they leave their post, and enforce it appropriately.
10. Using Random Memory Devices - It makes no sense to carefully craft your system defenses if your employees are going to find a random USB drive lying on the street and plug it into their workstation, subjecting your network and files to whatever malware might happen to be on the device’s storage.

While human error is impossible to avoid entirely, you can minimize your risk of a security breach by implementing these policies for your workforce and educating them on best practices. For more information about industry best practices when dealing with company data, give Directive a call at 607.433.2200.