Firstly, you need to establish a baseline of your risk. There are a few platforms that can help with this. What this entails is running simulated cyber attacks on your business network.

The first type of simulated attack is a physical attack called a USB drop. This is where USB drives are left somewhere in or around your workplace. The drives themselves have a special piece of software that reports back to a central system if they’re plugged into a computer. The report will log the user who picked the drive up and attached it to a computer on your corporate network.

Moving on, the second type of simulated attack is email phishing. Many simulation platforms allow you to send out dummy email phishing tests to your staff. The purpose of this is to see who opens, clicks the link and ultimately falls victim to this test. As a result, this allows you to identify users that need training on spotting email phishing. As well as raise the awareness of what not to click on.

Whilst these simulation platforms are great at profiling risks within the organisation they need to be combined with correct user training. Ultimately there should be a two-pronged approach here. First, many of the simulation platforms will have a training module built in where training on cybersecurity can be automated via a web portal. They also include content libraries to choose from on what type of training you want to deliver through the platform. The other training is in-person training which works really well if scheduled on a quarterly basis. Lunch and learns work best as you can get a level of interaction with your colleagues and find out what types of questions they may have in their mind in regards to the threats of cybersecurity.

The third and final measure you should be taking in the workplace is having the correct policies and procedures in place. This can be as basic as making sure everyone reads, understands and has read your cybersecurity policy. Of course, not all small businesses have the time to implement a cybersecurity policy. That’s where we can help as one of the most security aware IT companies in our operational areas.