The challenge of mitigating threats requires a nuanced combination of people and technology. In theory, modern security technologies can help lower the chances of a phishing email finding your inbox, for example. In reality, even the latest and greatest versions of software or hardware are only as effective as the people that use them.

That’s why it’s vital every member of an organization learns how to become an insider asset — the final and most valuable link in the security chain. Here’s how:

Always follow policy.
Everything starts with following an organization’s policies, which were designed to keep cybercriminals from gaining unauthorized access while also giving employees specific guidelines for protecting information. Failure to follow policy, intentionally or unintentionally, undermines security efforts and could lead to major consequences like data breaches.

Learn to identify social engineering attacks.
Social engineers use psychological manipulation to convince their victims to click on a malicious link or divulge confidential information. Learn how to spot phishing emails and other attacks carried out by these scammers. Never assume someone is who they claim to be, and treat requests for sensitive information with skepticism.

Report security incidents immediately.
A phishing attack, a secured door left open, an unfamiliar person in a secured area — anything and everything that seems suspicious must be reported immediately. The sooner you report it, the better the chances of mitigating damage and preventing future events. If you see something or hear something, please say something!

Understand the risks.
Think about data protection from a personal perspective. What would happen if your sensitive information, such as your home address, banking information, national ID number, etc., ended up in the wrong hands? No one wants that to happen to them. Consider the ramifications of intentionally, accidentally, or carelessly mishandling data.

Respect privileged access.
Privileged access refers to both the physical and digital clearance provided to members of an organization. Respecting access refers to the process of ensuring your access is not obtained by unauthorized parties for any reason. That includes never sharing login credentials, keys, or badges; utilizing strong, unique passwords for every account; and always locking systems when not in use.

Article retrieved from Understanding the Insider Threat by The Security Awareness Company – KnowBe4, Inc. (2023)