Red Alert: Security is a Job for Everyone

• Crisis
• June 23, 2016
• by Merrie Spaeth

“Employees are our most important asset.” How many times have we heard that mantra? Employees are the face of the company. Employees create our culture. We’ve preached that for 30 years, and we think we were among the first to develop “Employees as Ambassador” programs.

The rise in cyber theft is a sobering warning that we need more from our employees. Preet Bharara, the U.S. Attorney for the Southern District of New York, recently wrote:

“If you relegate the issue of cyber and protecting against the threat to the IT people and think of it as only a security matter, you’re going to fail in how you prepare yourself for it.”

Bharara called cyber theft the greatest issue for business; employees at every company need to view cyber security as part of their job. He went so far as to suggest that people’s jobs depend on their attention to security and we couldn’t agree more.

We know the threat is real. We’ve done seminars for bankers and advised companies whose data had been encrypted by criminals who demanded ransom in bitcoins. But how do you convey the urgency and explain to employees what this means for them?

Other than changing passwords frequently (and not putting them on sticky notes around the computer screen), what behavior do companies need to see from their employees? This is a significant challenge for the communication and HR functions. Our recommendation is to combine best practices stories with contrasting news reports on companies successfully targeted by the criminals.

Where else to start? Perhaps with a survey of your employees to set a benchmark for what they know about cybercrime, how likely they think it is to happen to their company and what they do in their day-to-day jobs to prevent it. (Don’t be surprised if the answer is “nothing.”) For a truly sobering reminder of how far you may have to go, follow with a security audit from a trusted firm.

At least you’ll have nowhere to go but up. An added bonus, an audit gives you the next steps from where to buffer both your security and your crisis communications plan. So stay alert and enlist your employees today.