How policy acknowledgement reduces cyber risks

Cybercrime is a continuing threat to every business, both large and small. It’s not going away any time soon, and arguably we’re on the cusp of a new wave of issues as generative AI presents new opportunities for cybercriminals.

The damage from cybercrime can be devastating for a business. Recovering from a ransomware attack can lead to everything from lost revenue from disrupted operations to a significant damage to reputation, which can be very serious if you handle customer data. Similarly, data breaches caused by hackers not only lead to reputational damage but also huge GDPR-related fines: for example, both British Airways and Marriott have both received GDPR-related fines of over 20 million Euros each.

Taking active measures to reduce the associated risks of cybercrime has never been more important. While there are some technical approaches that can help, much of the approach that businesses need to take to rests in driving awareness of cyber risks among employees and ensuring employees take the right actions. This is because so many cybercrimes happen due to employee actions with cybercriminals seeking to exploit vulnerabilities and trick them into giving up sensitive data, frequently using approaches such as phishing.

One tactic that makes a significant difference is ensuring that employees understand your cyber policies and procedures, detailing the do’s and don’ts that can help reduce risk. The only way to ensure that your employees are reading and digesting a policy is to get them to acknowledge they have read and understood a policy. Testing them with additional questions can also check that understanding is embedded.

In this post we’re going to explore the role that employee policy acknowledgement plays in reducing cybercrime and how automated policy management software can help.

The importance of having cybercrime policies

Policies and related procedures and guidelines are an important part of organisational life that help reduce risk, increase efficiency, ensure consistency, guide decision-making, set expectations around behaviour and more. Policies represent the “official” line around processes to follow, how to act in certain circumstances and also define what shouldn’t be done.

Policies around cybercrime are particularly important – not only because of the severity of the risk – but also because employee actions are often a reason that cybercriminals succeed.

Policies relating to cybercrime could cover topics such as:

• Use of specific applications at work.
• Use of unauthorised software for work purposes (shadow IT).
• Use of laptops and mobile devices (device management).
• Spotting phishing emails and similar scams
• Sensible password management.
• Using workplace technology at home.
• Handling customer and employee data.
• Reporting a suspected cybercrime.
• What to do when there has been a cybercrime.
• New and emerging threats.
• And more!

Policies around cybercrime must reflected emerging threats

Another issue is that cybercrime is a fast-moving area. New threats are continually emerging. With generative AI, deep fakes are starting to become a threat, making it even easier for criminals to spoof communications, for example from a CEO.

Emerging threats require additional vigilance, meaning policies will need to be updated accordingly. Employees will also then need be made aware of any policy updates, and it is imperative that this has been fully understood.

Challenges around achieving employee policy acknowledgement

Unfortunately getting employees to acknowledge they have read and understand a cyber-related policy or update to a policy is difficult, making it significantly harder to reduce the chance of a cyber attack.

Common challenges include:

• Employees are already overloaded with information, and even though they are important, policies aren’t always the most interesting documents to read, so it can be hard to get their attention.
• Sometimes version control isn’t consistently applied so there can be multiple versions of cyber-policies in circulation, causing confusion and a lack of engagement.
• There is no way to actually see if an employee has actually read a policy, with teams sometimes relying on email to send reminders, for example, and tracking everything on a spreadsheet, which is highly inefficient and prone to errors.
• Updates in policies are very easy for employees o miss.

The role of automated policy management software in reducing cybercrime

Automated policy management software can help overcome many of the challenges around employee policy acknowledgement by facilitating the process, using automation to drive efficiency, and doing much of the heavy lifting. In this way it can help with efforts to reduce the risk and impact of cybercrime.

Let’s explore some of the features of a robust policy management solution like Xoralia.