CYBR10

Importance of Cybersecurity Training

Today, every company is vulnerable to cyber security. The risk of vulnerability increases with the level of cybersecurity awareness of the employees or users. It is important to determine various user groups in an organization so as to tailor a training program that is suitable for each of them. Generally, the two main categories of users are privileged users and regular users. A privileged usually has a broad access of an organization’s information system (Crouse, 2014). Since companies are relying heavily on technology to carry out activities, every other employee in an organization qualifies as a regular user.

The requirement for each group is slightly different. A lot of emphasis regarding how to prevent, identify and mitigate cyber threats should be given to the privileged users since he/she is more prone to cyber threats. Similarly, regular users should be taught how to identify, prevent and address cyber threats.

A training program is meant to empower employees to protect themselves and the company against cybercrime. Therefore, these programs should address key elements of cyber security. First, employees should be made aware of types of cyber security threats such as social engineering and malware among others. Second, users should be educated about various protective mechanisms against cyber threats such as installing and updating anti-virus software’s on regular basis and creating strong passwords. Third, users should be taught how to recognize and handle cyber threats such as phishing. Lastly, employees should be informed and cautioned against reckless behavior that can compromise cybersecurity such as use of unsecured personal devices, unsecured wife’s and failure to adhere to company’s cyber security policies or guidelines (Feather, 2019).

Even after employees have undergone cyber security training programs, it is important to incorporate other methods of raising awareness and encouraging adoption of acceptable behaviors. One key method of reinforcing training programs is the use of drills. Drills involve actual attempts to breach the company’s cyber security to test the employees’ ability to recognize and address the threat. This strategy is useful to test the employees’ preparedness by assessing their strengths and weaknesses. In addition, cyber security is a field that is changing rapidly. Therefore, it is important that the organization encourages its employees to attend external conferences, forums and training programs about cyber security. This approach will ensure that employers are up-to-date with recent developments and bring valuable skills and information to the company.

It is dangerous for a company to fail to train its employees on organizational cybersecurity. According to Ramarchandran (2019), employees are the biggest risk to a company’s information systems. They are usually the target of cyber criminals and often become victims of social engineering and phishing among others. However, employees who are trained on organizational cybersecurity are able to handle cyber threats effectively. Therefore, failure to train employees on cyber security increases a company’s vulnerability to cyber threats in various ways. First, employees lack the self-driven motivation and accountability to protect themselves and the company since this aspect is usually inculcated during training. Second, employees lack the ability to identify and address cyber threats. As a result, they are easily tricked by cybercriminals and also lack the ability to handle cyber-attacks.

In conclusion, cyber threats are rampant in the digital era. They pose a huge threat to organizations. People or users are the primary targets of most cybercriminals. Therefore, it is important that organizations train their employees on cybersecurity as a way of empowering them to handle cybersecurity threats more effectively.

Reducing Risk: Organizational Data

Data classification offers a rigid basis for information security plan because it enables organizations to identify vulnerable areas in the IT network, both externally and internally. In this sense, for several reasons, it is of the essence for organizations to develop a data classification scheme. First, data classification helps in securing critical data. For organizations to secure their data, they need to understand their data (Real Security, 2018). For instance, the firms should be able to know what sensitive data they possess, where the crucial data resides, the parties that can find, alter, and erase it, and how it may affect business if leaked. Understanding all these aspects helps firms in prioritizing data to protect.

Secondly, data classification assists firms to act in accordance with regulatory mandates. Usually, compliance standards require firms to secure clearly defined information, such as health records (HIPAA), cardholder information (PCI DSS), and financial data. Data classification can help an organization identify the location of such data and ensure that necessary protection is in place. Another benefit of data classification is that it demonstrates a high level of organizational commitment. Organizations that develop data classification schemes display concern and commitment towards protecting their data which is a very important characteristic of any organization.

Data Classification Policy

Purpose and Scope

The purpose of this data classification policy is to offer the foundation for securing the confidentiality of information at the Sinopec Company by setting up a data classification system. Additional standards and policies will seek to specify managing requirements for information regarding their classification. The scope of this policy states that the policy applies to all information or data that is designed, gathered, processed or stored by the Sinopec Company, in non-electronic or electronic formats.

Policy

All data such as onboarding information relevant to new hires, data on research and design for new products, press releases concerning new business units’ acquisitions, and operational, financial reports will be stored either under restricted, sensitive or open classification. Gatherings of distinct data are required to be grouped as to the safest classification category of an individual’s data component with the collected information.

Restricted Level

Under this level, the information in any type gathered, formulated, kept or controlled by or on behalf of the organization, or within the domain of company activities, that are subject to clearly defined protections under state or federal law or under executable contracts or regulations is stored here. For example, onboarding information related to recent hires such as emergency number, driver’s license, social security number, medical number, employee records, resume, and application.

Sensitive Level

The sensitive level usually comprises of information whose loss or unauthorised revelation would greatly impair the activities of the company, bring about significant reputational or financial loss or cause legal liability. Such information is very crucial to the organization and its protection is of significance. Examples of data under this category include, but are not limited to, operational, financial reports, research and design information for new product lines, security data, and strategy documents required in the process of securing the company’s data.

Open Level

The open level comprises information that does not fit into any of the other data classifications. Such information can be availed without formal or designee approval and cannot harm the organization in any way. For instance, but not limited to, press releases on new business units, publication titles, policies and regulations, university catalogues, job opening announcements, and advertisements.

Communication Strategy and the Importance of Data Classification Scheme Policy

The most suitable strategy that an organization can use in identifying and proposing an appropriate policy to support data classification and mitigate risks is through proper asset classification to protect itself from the risk of information breaches and accidental release or loss of information (Fischer, 2017). Additionally, companies must depend greatly on compliance and regulatory requirements, and try to define discrepant categories of information into their distinct networks.

References

Cockburn, T., Smith, P., & Cockburn, G. (2018). Draft 2a: Collaboration and Conflict in Three Workplace Teams' Projects. Available at SSRN 3385491. Retrieved from https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3385491

Sanders, R. (2016). Embedding Cybersecurity into Your Company's DNA. People & Strategy, 39(1), 8-10. Retrieved from https://go.galegroup.com/ps/i.do?id=GALE%7CA552253088&sid=googleScholar&v=2.1&it=r&linkaccess=abs&issn=19464606&p=AONE&sw=w

Wang, S., & Wang, H. (2019). Knowledge Management for Cybersecurity in Business Organizations: A Case Study. Journal of Computer Information Systems, 1-8. Retrieved from https://www.tandfonline.com/doi/abs/10.1080/08874417.2019.1571458

Crouse, M. (2014). How to protect yourself against privileged user abuse. Retrieved January 27, 2020, from https://www.networkworld.com/article/2369733/how-to-protect-yourself-against-privileged-user-abuse.html

Feather, N. (2019). New employees can be a cybersecurity risk. Here are five simple practices you can teach them during on boarding. Retrieved January 27, 2019, from https://www.inc.com/neill-feather/new-employees-can-be-a-cybersecurity-risk-here-are-5-simple-practices-you-can-teach-them-during-onboarding.html

Fischer, T. (2017). Why Data Classification Should be Your Security Strategy. Retrieved 3 January 2020 from http://www.dbta.com/Editorial/Think-About-It/Why-Data-Classification-Should-Drive-Your-Security-Strategy-118542.aspx

Real Security. (2018). Data Classification: Why it is important and how to do it. Retrieved 31 January 2020 from https://www.real-sec.com/2018/07/data-classification-what-it-is-important-and-how-to-do

Computing systemsMohamed ContehCecile JacksonCYBR609-2001A-01Colorado Technical UniversityJanuary 22, 2020