Human Resources is often the target of malicious attacks via hackers and fraudulent email, simply because of the wealth of information available in your HR department. Employee names, birth dates, Social Security numbers, W2 forms and addresses will snag a high price tag on the dark net. The most common means for obtaining this information is phishing emails that appear to be from a trusted employee or head executive asking for sensitive company data, financial records, or access to employee information. In most cases the employee on the receiving end of the email cannot recognize that the email is fraudulent, and will pass on the information without hesitation. HR departments from numerous organizations have reported W-2 tax form whaling scams. After receiving a spoof letter from a company executive requesting employee information, Seagate Technology said employees handed over thousands of current and past employee W-2 forms. Snapchat has reported a similar story, stating that a scammer posed as CEO Evan Speigel and asked for payroll data and an employee in the payroll department complied thinking the request was legitimate.
The hackers are not going to stop asking for your information so you might as well protect your company from vulnerabilities. This means educating employees, storing data in the cloud, encrypting such data in the cloud storage, and bringing in Identity Management Software. As always I recommend a highly capable IT department as well.
Train your employees about the elements and characteristics of company emails. Teach them to pay attention to the person requesting the information as well as the information in question. Let them get used to asking “Why?” before pressing send. For example, the head of the financial department has access to all financial data and probably does not need to email employees in the financial department for additional access. This may sound like pure common sense, but it never hurt to reiterate the importance. Let employees see what a fraudulent phishing email lots like. Cybersecurity training company KnowBe4, has taken a hands on approach to teaching employees to recognize phishing emails. Sending over 300,000 fraudulent emails to employees at 300 client companies over the course of the year, using the example emails to educate staff on key elements to spot an attack email. According to KnowBe4 founder and CEo Stu Sjouwerman, before the training 16 percent of employees clicked on links in the simualted phishing emails, after a year of education only 1 percent of employees clicked on the links.
Regardless of how much training you provide for your employees, all it takes to create chaos is one simple mistake.
A viable way to double the protection in this case would be to encrypt data and store it in the cloud, rather than in document folders on the desktop or laptop. If an employee were to accidentally release information to a non-credible source, the hacker would be lead to a link they could not open because additional information needed to open the link would not be in the hands of the hacker.
San Francisco identity management company, OneLogin, has banned the use of files in their office entirely. CEO Thomas Pedersen gives us his reasoning, “It’s for security reasons as well as productivity,” said David Meyer, OneLogin’s cofounder and Vice President of Product Development. “If an employee’s laptop is stolen, it doesn’t matter because nothing’s on it.” Not a bad idea.
Identity Management Software that controls log-ins and passwords is a great tool to protect your HR department. Rather than trusting that HR staff are protecting usernames and passwords for each platform they use for payroll, benefits, recruiting, scheduling and such, the single log-in allows access to everything. This helps the employees, as only one password needs to be remembered, eliminating the need to write down passwords or save them elsewhere. The identity management software you choose should use a multi-factor authentication, which ensures even if the password got into the wrong hands, additional approval from another device will be needed to access the log-in. Companies can also employ geofencing to restrict log-ins so admins can only sign in from specified areas, such as the office.
HR tech platforms and cybersecurity firms are working together to improve the security of HR departments, fingerprint log-in is one of the safer means of logging in, but that technology is not available across all platforms. Until these needs can be met, the best protection is prevention.
If you would like to educate yourself in more detail about the information presented in this blog post please visit : www.pcmag.com
