10 tips about IT Security and your IT Policy

GDPR træning

10 Tips For IT security And Your Organisation's IT Security Policy

IT security is important for every organisation, whether you work in a private company, an NGO, or a public institution. When it comes to IT security you can consider your employees your human firewall. They can help prevent unauthorized people from gaining access to the organisation’s IT systems and programs. Safety is a top priority whilst controlling a plane and IT safety must also be a top priority when running businesses and public institutions. It is too expensive not to because the corporation or organisation’s data and systems are crucial for their existence. Here you can get advice on both what IT security course to provide for your employees and for IT security in general. 

1. Get Your Entire Organisation Reliable Antivirus Software and Make Sure to Keep it Updated

You probably already know this, but antivirus software is crucial when building a safety net that protects the organisation against cyber attacks. 

2. Use a Firewall to Deny Access to the Organisation's IT systems, Programs and Data

A firewall to keep unauthorized people away from the organisation’s systems, networks and programs is also an important tool. 

3. Remember That Educating and Training Your Employees Can Strengthen Your Defences Against Cyber Attacks

When employees have access to IT systems and programs that contain data, that is valuable to the organisation, it places great demands for the safety. 

Studies show that Danish corporations and organisations do not immediately fear hacker attacks. However, there is still reason to view them as a potential threat. The Danish Business Authority says: 

“We know that some of the Danish corporations are vulnerable to IT security incidents. They can have far-reaching consequences for the respective corporation and for their employees.”

Effective IT Security Training

The way you train your employees in IT security has a crucial impact on how aware they are afterwards. Our e-learning has a proven learning effect that can create great value in your organisation. Through involving and practice-based cases the most important IT security subjects are clarified. The final test results in a certificate that is given when the participant answers enough questions correctly. Continuous training in IT security is also proven to have a good effect. Because of this, we have recertification on our e-learning course that automatically reminds the participants after a year. 

If you think training your employees sounds like a smart solution, then start the dialogue with us today! 

4. Require That Your Employees Report Any Suspicious Behaviour

Hackers and other cybercriminals with the intention of gaining access to your organisation’s IT systems gradually use more advanced methods. Some organisations experience infected USB plugs being thrown in front of their buildings. The hackers want people to pick them up and insert them in a computer thinking a colleague had lost it. 

5. Never Forget to Back-Up Business-Critical Files and Systems

Security information management is also an important field when it comes to IT security. Once business-critical information gets into the wrong hands it can have fatal consequences. 

Imagine the following scenario: You sit and resent that fact that you did not make a backup before your organisation was hacked and unauthorized people denied access to business-critical files and systems. You know this situation could have been avoided if you had a fixed backup procedure. Start today or keep up the good work – of course, you are one of those who always make sure that backups are taken. It pays off. 

6. Make Sure Your Employees Create Strong Passwords That Are Updated Regularly

As you know, strong passwords are a good basis to prevent unauthorized people from gaining access to data, IT systems, programs, and networks. Therefore, it may come as a surprise that the most common weak passwords are still used by many. Guessing a password that e.g. only consists of 6 letters can be easy. Reusing the same passwords multiple places is also very common and this is a direct danger to the IT security. Once the wrong people gain access to one of the sites your password can be misused elsewhere. 

You can share this article with your employees which, among other things, cover how to create strong passwords. 

7. Encrypt Your Wireless Network and Emails That Contain Personal Information

If unauthorized people gain access to your network, there is also a risk of them accessing your programs, systems and personal information. It can have major consequences if it is not discovered that someone has gained access to your networks and systems. It allows the cybercriminals to nose about your data for a long time. Did you know that it on average takes 229 days before a safety breach is noticed? 

This is why you should encrypt your wireless network and generally make access as difficult as possible. This also applies to the physical storage of routers and other IT equipment. 

It is also important how you encrypt the emails that leave your network. At least those containing personal information or business-critical information, e.g regarding strategy. By encrypting them, you can avoid unauthorized access to the information. 

8. Have an Emergency Plan Ready For Your IT Security and IT Infrastructure For Unexpected Situations

In a survey, just over half of the IT departments in Danish corporations answered that they did not have a crisis plan when the Covid-19 crisis hit. 

A Pandemic Being A Threat to the IT Security

With the change in working conditions and more people working from home, new risks also follow. The global pandemic has caused a new problem; e-mail fraud where hackers pretend to send information about Covid-19. This demands good IT security and cyber awareness amongst your employees. A study shows that around 86% of the IT departments in Danish Corporations were exposed to an increased number of cyberattacks during the first part of the pandemic. 

9. Make Your Employees Read and Follow The IT Security Policy and Create IT Governance

It is important that your employees know and follow the guidelines of the IT security policy. This is often not prioritized in a busy everyday life where convenience sometimes prevails over safety. For instance, when an employee responds to a confidential email from their private email address after working hours because the work email is not installed on the employee’s own smartphone. 

The Neglected IT Security Policy

Most organisations have an IT security policy that informs you on how you as an employee protect the organisation’s programs, data, and IT systems. However, the IT security policy often ends up being forgotten in a drawer under the desk to collect dust. It is a challenge to get your employees to read the organisation’s IT security policy and act accordingly. Therefore, we have created a solution where employees build knowledge about IT security. They will understand the most important things regarding their activities on the internet whilst being responsible for protecting the organisation’s data. MOCH offers a solution where the IT policy is placed at the beginning of the e-learning so all employees must download and read it. Afterwards, they must confirm that they have read and will follow it. This creates a larger focus on the IT security policy and emphasizes the importance of following it. 

Just by having access to the internet, there is a risk of potential attacks on the organisation. This can be through networks, programs, and IT systems. Examples of attacks have been seen via phishing emails, breaches of the organisation’s firewall and inadequate use of antivirus. The lack of backup of data, which is critical for the organisation to run its business and fulfil its purpose, can be a sore spot for some organisations. In some places, there is an insufficient focus on ongoing updating procedures for the organisation’s IT systems and programs. In addition, lack of advice on usage of the organisation’s information in critical situations is seen as an important thing to improve.

10. Ensure That the Good IT Security is Also Maintained When Your Employees Work from Home

IT security when working from home is just as important as when your employees are at work. The things you and your employees should be aware of whilst working from home are: 

  • Use a VPN-connection.  
  • Lock your computer when leaving it. 
  • Update your systems and programs (set it to happen automatically so you do not have to remember to) 
  • If you are asked to transfer money or install a program via email, then you should do a check call to ensure the information is correct. 

You can read more good advice on IT security when working from home on our blog.

In our IT Security awareness training, we have a module on IT security when working from home. If you want an overview of the other modules in our e-learning you can order our fact sheet and book a demo of the course.

FAQ About IT Security

A “man in the middle attack” is when a hacker pretends to be two different people. Both parties believe that they are communicating with the other party. The hacker gains access to both systems belonging to the respective parties and controls the communication between them. With tools that make it possible to change identity, e.g voice imitation or deep fake video, it can be harder to figure out who you are communicating with via video or phone call.

A firewall is a software that protects against unauthorized access to a network, e.g. in an organisation or privately.

IT security is about having procedures for how you behave safely on the internet and how to protect data and IT systems. Read more in our article Worth knowing about IT security”.

An antivirus is a software designed to register and remove threats such as virus, malware, ransomware and spyware.

IT security is important because your knowledge and your actions are what makes a difference. By having this knowledge you can protect data, systems, and people from being exposed to cybercrime and fraud.

An IT security policy is a set of guidelines that everyone in a company, organization or NGO must follow to protect the company’s information, systems and employees.

An IT security policy is made by writing a document that addresses the guidelines.

You can download a template for an IT security policy on sikkerdigital.dk

The IT manager, also known as the CISO (Chief Information Security Officer), is responsible for a corporation’s IT security. We believe that safety is everyone’s responsibility. That is why our awareness training encourages everyone to do what they can to maintain good IT security. We also encourage everyone to act if they experience anything suspicious.

Comments are closed.