Information security best practices: keeping employees well-informed reduces risk

Your employees need to be knowledgeable about information security best practices, and this means providing additional training around security measures to curtail in-house mistakes that put the company at risk.

Companies face the threat of data breaches on a daily basis, and many have taken this as a cue to enable the fullest security precautions that resources allow. However, data breaches are not always provoked by malicious hackers — in fact, the majority of breaches are happening in-house, due to employee error or a lack of understanding when it comes to information security best practices.

To curtail the threat of data breaches, companies must structure internal security procedures appropriately and adequately train employees on the policies to ensure they are fully aware of all potential security threats. The following are some of the important concepts employees should be educated on:

Advanced Authentication Techniques

Passwords are the keys that open a company's information vault. As such, they should be treated as top secret. However, password managers can enhance the overall use of enterprise passwords, since they can streamline the login process for employees who have several complex passwords to remember.

When using a password manager, employees only have to memorise a single password — the password manager memorises the rest. Further, most password managers are compatible with mobile devices, which solves the problem of typing long, complex passwords on little screens.

When it comes to file sharing and emails, a technique like two-factor authentication is recommended. Two-factor authentication is a security procedure in which the user must provide two types of validation from different sets of credentials. It offers tighter security, keeping systems safe even if company passwords are compromised.

Durable Data Encryption

Most organisations preach extreme precaution when it comes to the whereabouts of company laptops and smartphones. However, even if employees are diligent, theft remains a realistic threat. This is where encryption plays a key security role. The purpose of encryption is to transfigure data so it is indecipherable to unauthorised users.

Some companies leave it up to IT personnel to become educated on the encryption process, but it's wise to train employees as well. Explain to personnel that there are three types of encryption: hashing encryption, private-key cryptology and public-key cryptology.

• Hashing encryption involves unique, fixed-length signatures for each data set. Any modification to a data set is simple to track via this method.

• Private-key cryptology, also referred to as symmetric, involves a specifically secured key that encrypts and decrypts data. For example, an authorised user encrypts and sends the information with one key, and the authorised user on the receiving end decrypts the information using the same key.

• Public-key cryptology encryption, also referred to as asymmetric, involves two separate keys for encryption and decryption.

Data Backup and Recovery

Organisations that handle a high volume of confidential records generally have a data backup and recovery system in place. While backup and recovery is typically used in a worst-case scenario, it can save companies months — possibly years — of work. For this reason, it is imperative that staff members are adequately informed about proper backup procedures and the role they play in the process.

Implementing Security Awareness

Awareness is crucial when it comes to information security best practices. To further bolster security training, some companies choose to assemble a security awareness team whose primary duties are to create, deliver and maintain the company's security awareness agenda. This agenda varies depending on the organisation and its needs, but it is a good idea to involve records management vendors in this process.

Determining roles for security awareness is important, as it gives companies a reference sheet of staff members' daily responsibilities. Education is then easy to extend according to an employee's individual roles and responsibilities. The primary objective is to structure a reference directory of different categories and associated training to ensure companies match the appropriate training to the right employees.

By teaching employees about these basic security concepts, organisations can ensure their systems are protected from both internal and external threats.