6 Ways To Protect Your Business From Data Breaches in 2017

Size: px

Start display at page:

Download "6 Ways To Protect Your Business From Data Breaches in 2017"

Brook Kennedy
6 years ago
Views:

1 6 Ways To Protect Your Business From Data Breaches in 2017 Alaskan-owned company providing Paper Shredding & Hard Drive Destruction Services. We serve all of Southcentral Alaska with professional, secure, dependable document destruction services. We offer onsite and offsite services.

2 It may not be incredibly surprising, but identity fraud is the number one fraud in Alaska! It seems like every week we re hearing about another security breach at one of those big companies. Well those breaches are certainly big issues, but breaches can happen to companies of all shapes and sizes. And it can happen right here in Alaska too! This ebook is designed to provide you with tips you can use to protect your business from a potential data breach. Here are the chapters. Chapters 1. How To Implement A Clean Desk Policy Are papers left all over your office? Improper removal of documents in the office can lead to potential identity thefts and breaches. Here is how to implement a policy to fix the issue. 2. How To Train Your Employees About Phishing Scams Your employees are your most valuable assets and hackers know it. Train your employees on ways to protect themselves and your company when it comes to one of the biggest issues in identity theft: phishing scams. 3. How Legal Compliance Can Affect Business Security Legal compliance helps you figure out where you may need to make improvements to the way you handle your business data. Here is what you need to know. 4. New Ways Companies Are At Risk For Security Breaches The security industry is always changing. Here are some of the recent ways that hackers have attacked businesses. By learning how it happens you can better prepare your business. 5. How To Setup A Paper Shredding System For Your Business In this chapter you ll get a process for setting up a secure paper shredding system for your business. Once this system is in place and becomes habit, your business will be more well protected from a potential breach. 6. Data Security Checklist In the final chapter you ll get an opportunity to evaluate your organization and see where you can improve you data breach exposures. Use this checklist to implement a secure Paper Shredding System for your Business.

3 Chapter 1. How To Implement A Clean Desk Policy A Clean Desk Policy is a great way to ensure sensitive information is secured, or destroyed, at the end of each day. Information left in the hands of your employees can be sensitive and contain the personal or financial information of your patients or clients. Understanding The Clean Desk Policy (CDP) A Clean Desk Policy (CDP), put simply, is a policy put in place by management that requires all documents be stored securely or destroyed at the end of each day. When an employee leaves, their workspace must be free of papers period. This will ensure sensitive information is either stored securely in locked containers, or has been destroyed at the end of the day. Employer Requirements to effectively implement a CDP, employers must meet a few minimum requirements. Defined First, a policy must be clearly defined and agreed to by the staff. There must be clear requirements of the employees, direction on what to do with what types of files or papers, and the employees must be given the policy in an understandable format. Document Storage Policy Secondly, the employer must provide ample storage for documents that are to be saved and filed at the end of each day. This ensures employees know exactly where to place papers that are part of a patient file or other business file. Document Destruction Policy Thirdly, a reliable and realistic means of document destruction must be in place. Locked shredding boxes are the best way to do this. Implementing A Clean Desk Policy at your business does not have to be an arduous task. There are many resources that can help.

4 Chapter 2. How To Train Your Employees About Phishing Scams Most companies are at risk for phishing scams. You put a lot of faith in your employees. Some of them may know all of your financial information. Others may have company trade secrets. Your employees should be trained to avoid phishing scams that may target your company for identity theft. Phone Calls Cold calls from sales people can be an inconvenience or an annoyance but the wrong ones can also be dangerous. Train employees to be wary of phone calls requesting any personal or business information about other employees, customers, or the business itself. Remind your employees that scam artists are often charming and effective at getting information from a reluctant target. s It s no secret that many ing that come through are scams. Most people can see through them- they aren t going to give their bank account information to the Prince in Nigeria and they have learned not to click the link promising free diet pills. What about the s that look more legitimate and come from what seem like real people? An requesting bank details so an invoice can be paid or a request for company officer s information may look legitimate to an employee unfamiliar with scams designed to steal bank information and the identities of top ranking executives of companies. Visitors People that drop by store fronts or offices usually just want to deliver information however there are some people who use face to face contact to throw off a target and steal information. Your front desk staff should be trained to recognize potential scams right away. People who get pronunciation of names wrong or who seem overly friendly when they haven t met the desk staff before should cause suspicion. Make your staff aware of any files that need to be picked up or information allowed to be released prior to someone arriving for pick up. Always train your employees that if you re not sure, ask their supervisor before giving out any information.

5 Chapter 3. How Legal Compliance Can Affect Business Security If you need more reason to be legally compliant when it comes to your business security, look no further. There are guidelines and laws everywhere you look on how to handle sensitive business information and the reason is simple it s very easy for criminals to steal identities and financial information from documents. Business Security If you are like most businesses, you and your employees handle a lot of information, both digital and hard copy that could contain sensitive information. The security of your confidential business information things like financial account numbers, routing information, proprietary price list, and other legal paperwork as well as the personal information for your employees could be at risk if your company doesn t comply with state and federal laws regarding information handling and disposal. Becoming aware of the laws and guidelines that apply to your type of business will help you take the right steps to ensure you are compliant and enhance your business security. Minimize Risk Laws regarding proper disposal of sensitive information have been implemented as technology has evolved and help lay out best practices to keep company and personal information secure. More technology means more convenience, flexibility, and more mobile capability and also more risk. Your company s information security is incredibly important, not only to protect your company s business and financial information but also the personal information entrusted to you by customers and employees. Identity Theft One of the most common ways information is used illegally is for identity theft. Ensuring your company is legally compliant in regards to customer, employee, and patient information will not only protect people who have given you their information but will also help to protect you from the liability of misuse of that information. By developing and following protocols and training your employees on a program that is legally compliant, you are greatly increasing your business security. At Shred Alaska, we comply with NAID AAA Certification standards for our customer s security.

6 Chapter 4. New Ways Companies Are At Risk For Security Breaches New technologies mean new conveniences and new risks. People give up more information to companies who ask for it without a second thought, but those companies that people give information to may be at risk to have it stolen through a security breach. Being aware of these risks can help you keep your information safe. Cloud-Based Storage Information is no longer held securely on physical servers managed solely by internal IT departments. With many types of information, and photos, stored on cloud-based servers that aren t necessarily completely secure, your information could fall into the wrong hands easier than you think. The recent celebrity photo leaks prove that cloud based technology may need a bit more vetting before it can be truly called secure. Hard Copies Not all companies outside the healthcare profession have consistent hard copy document control. Hard copies of receipts, forms, and bank statements could easily fall into the wrong hands and be used to steal security details of any company. Shredding these documents will help to ensure the security measures taken are followed through on in regards to hard copy documents. Electronic Information Most data is transmitted electronically to conduct business. This opens up many different types of opportunities for security to be compromised both inside and outside your company. Files saved on your secure servers are still accessible to your employees and they can easily steal personal, financial, or intellectual property information that would be damaging to your company. An internal breach of security is most dangerous- you may never know about all of the information that was stolen or passed on outside the company. Regardless of your concerns about security breach risks, there are measures your company can take to keep information safe.

Chapter 5. How To Setup A Paper Shredding System For Your Business Automate your business paper shredding to protect your business, customers and employees. Every business has sensitive information.

7 Chapter 5. How To Setup A Paper Shredding System For Your Business Automate your business paper shredding to protect your business, customers and employees. Every business has sensitive information. Period. Client information. Vendor information. Employee information and more. There is definitely something that you don t want the wrong people to see, and likely many things. In-house shredding programs are great, but these can sometimes fall short of needs and expectations. In the present economy, many companies are understaffed and most staffs are over-worked. Furthermore, company real estate may be at a premium. There may just be no easy place to store documents until someone finds time to take care of destroying them. All that can add up to an in-house shredding system that does not work. Employees may dutifully empty their files, only to find that the boxes of paper destined for shredding is not picked up. Imagine the nightmare of boxes of files containing sensitive or confidential information sitting in piles on the floor waiting days or weeks at a time for in-house shredding, taking up valuable space while also posing a workplace hazard in the meantime! Contracting to have documents destined for shredding securely placed in locked containers, and destroyed onsite will save you money and your employees time while giving your business and your clients a valuable sense of security they otherwise would not have. Let the experts at Shred Alaska look after the details for you in a few simple steps. Step 1: Recurring Destruction Needs Assessment Perform an internal audit of the kinds of day-to-day documents and information you need to destroy. Create an itemized list. Make an estimate of how much you need to shred, and how often. That will help you create a plan for your employees to follow. In fact, a good idea is to get each employee to summarize the documents that need to be routinely destroyed form their own workstation. One example is tax documents. After 7 years, most businesses can eliminate tax information. Or, if you have paper files you could eliminate those once electronic copies are made, and after 7 years you can destroy the electronic files. Always consult at attorney prior to developing a records retention policy. Use the results of this frequency assessment to develop a routine, recurring shredding schedule for the day-today paperwork in need of proper destruction.

8 Step 2: Purge Materials Assessment Ask each of your employees to do a brief audit of the document purging needs associated with their job description (or the work they are actually doing). This would include anything not covered in the initial assessment of the daily shredding needs. Typically this is known as your purge volume. Management can then get an overall picture of the quantity and kind of information that needs to be securely destroyed on a purge basis, as well as how often, and can schedule accordingly with a trusted vendor annually ahead of time, or when the need arises. Step 3: Call in the Experts! You know your business well, but when we work every day in our own business we tend to overlook certain details. It can help to get outside input. Ask colleagues in your industry what they have done for their shredding programs. Ask customers, others in your network as well as vendors and partners. They ll help to make sure you re not overlooking anything, as well as recommending a trusted vendor that they use to handle their sensitive materials destruction. Step 4: A True Business Partner Any good business system is open for change, but only if change is required or beneficial. Make sure each employee feels responsible for the success of their department s information and the paper shredding system in place. Your employees are smart and resourceful and so is the team at Shred Alaska, Inc. Together, they will find ways to improve your document destruction process. If either side sees that something about your shredding needs has changed, they will reach out to you to make that happen. The team would then inform you of the changes needed, while at the same time assisting in keeping you fully in compliance. For example, if a new accounting regulation comes out, the accounting team will take note and request the change to the shredding process as needed which your shredding vendor can immediately implement.

9 Chapter 6. Data Security Checklist Is your Data Secure? In the past ten years, security breaches were made up of 9 basic patterns amounting for 92% of universal threats of about 100,000 incidents analyzed. [ Verizon 2014 Data Breach Investigations Report ]. It s imperative in this day and age for all organizations to have a policy in place prior to a data breach. With statistics in place like the one above, it s vitally important to the security of your companies reputation as well as your clients. Data security issues can arise with both digital and print materials. Documents that include sensitive information should be secured during printing, transmission (by or fax), storage, and disposal. Don t wait for a breach to occur. Be proactive with this check list. Develop a Data Security Policy Data Security policies should:..be communicated and known company-wide..match the size and culture of your business..be a written plan that s available to management & employees [ ] Identify Staff who are responsible for maintaining data security and minimizing risk tasks. [ ] Have employees sign that they understand the policies and know who to report any unauthorized activity to. [ ] Keep any printed materials stored in locked containers. [ ] When disposing of confidential materials, make sure paper documents are shredded and hard drives or other devices are properly and legally destroyed. If you re unsure of the proper way to dispose of such items, hire a company who has a clearly defined procedure, is NAID certified, legally accountable for this procedure and will provide a certificate of destruction. [ ] Your data security policy should be audited regularly Next Steps The path to protecting your business from data breaches doesn t end here. If you re like most business owners and managers you re incredibly busy. You know you need to protect your business, your employees and your customers from the fallout of a data breach. You don t have to go at it alone. Contact us at Shred Alaska today and we ll help figure out the best plan for protecting your business. Shred Alaska: (907)

HIPAA Compliance and Mistakes:

HIPAA Compliance and Mistakes: Let s just say what everyone is thinking: Trying to be compliant with the Health Insurance Portability and Accountability Act (HIPAA) is tough! At HIPAAgps, we get that.