HR’s Role in Protecting Against Cyber Attacks

There was widespread disruption again with the recent cyber-attack, dubbed “Petya”, which hit millions of users wolrdwide. This is the second widespread cyber-attack in recent weeks, after the ransomware ‘WannaCry’ held computer systems for ransom in May.

Small businesses that suffer the effects of cybercrime and hacking attacks risk losing thousands in lost revenue and lost customers. There is also the price of defending against cyber assaults which can be time consuming and expensive. We have witnessed email leaks such as the one Sony suffered in 2014, where a trove of almost 50,000 employees’ details and the quarrels of the Hollywood elite were laid out for the world to see. This can cause irrepairable reputational damage. 

Organisations can no longer rely on protecting themselves only through technology. A large part of protecting your business is by understanding that human behaviour and action plays a major role. 

As the threats become more advanced it is clear why this is necessary. While WannaCry most likely spread via a ‘worm’ that found and exploited vulnerabilities in corporate networks, and Petya likely spread by using two exploits, spreading into a system through the network without having to click on anything or have any action be taken, malware can take different, equally pressing, forms as well.

What should you look out for?

Malware can take the form of spam emails, specifically aimed at persuading finance departments to authorise payments. Other forms to look out for include ‘phishing’, where attackers researching individuals via social media to write emails or direct messages that they are more likely to respond to, as well as non-virtual threats—an example of which can be seen through a major London law firm who discovered that the TV in its boardroom was secretly relaying an audio feed to an external source in a different country.

What Can Be Done?

To be better equipped for instances like these a new mindset may be necessary. Educating on how cybercrime could affect employees in their personal lives is the trick to training. “Make them feel: ‘Gosh, this affects me just as much as it affects the organisation’ – this is more likely to create ‘buy-in’ and engagement much more strongly than just presenting this as a rather dull corporate thing. However, if the greater company culture is not focusing on cyber threats as well, even the best training programme won’t help protect an organisation. 

Building this strong cyber culture means that HR must improve not just learning outcomes, but in sourcing expertise as well. They must ensure that businesses have the expertise and knowledge to protect against cyber-attacks.

This process must include the recruitment of IT specialists to ensure systems are secure. HR directors must communicate the need for resource in this area and advise on the potential consequences if adequate skills are not in place.

For those organisations where those inside a business were the ones responsible for a cyber-attack,  there is usually warning signs. In most cases,  before they happened those signs were ignored. It’s a case of: ‘I always thought this individual was acting strangely, but I didn’t think I could tell anyone,’HR are great at being the people who can both look for the flags that indicate someone is a risk to the organisation, and help create a culture where people feel empowered to raise a suspicion.

To Protect Against Petya

  • Install the MS17-010 patch from Microsoft.

  • If an unpatched Windows system is currently being run, shut down the machine and leave it off the network.

  • Block network access to port 445 on Windows workstations, and have security professionals monitor traffic to this port.

  • Run a full Malware scan of each machine in your organisation.

  • Encourage your employees to shutdown their PC’s each evening. This will allow updated patches sent by Microsoft or your IT team to install correctly.

Keeping a vigilant eye on all workers can be difficult, as the number of workers is made up by full time employees, contractors and contingent workers. Although trying, this vigilance is needed.  Ensuring temporary workers have completed the same training, that we know who they are and have the same amount of confidence that they don’t have malicious intent is important. Because of the turnover in that kind of work, it can be a crucial back door into organisations.

In light of recent events, although not the easiest of tasks, ensuring that both IT and HR departments are taking steps to better protect their organisations, acknowledging the importance of not only their separate responsibilities, but their role as a team as well is truly essential to keep organisations safe from cyber-attacks.