Cyber security awareness empowers your employees to defend against data breaches. This presentation discusses topics including secure passwords, cloud computing and mobile device policies. Learn how to educate your employees to identify risks and protect company data.

1. 27th Annual Parsons Behle & Latimer EMPLOYMENT LAW SEMINAR
CYBER SECURITY UPDATE: HOW
TO TRAIN YOUR EMPLOYEES TO
PREVENT DATA BREACHES
Tammy B. Georgelas
Salt Lake City, Utah
TUESDAY, APRIL 28, 2015 | THE LITTLE AMERICA HOTEL
parsonsbehle.com

2. 2

3. 3
0 % 5 % 10 % 15 % 20 % 25 %
Public Sector
Retail
Health
Technology
Industrial
Data Breach by Industry
Probability of a Data Breach

4. 4
www.databreachcalculator.com
Estimates:
 The likelihood that your company will
experience a data breach in the next 12
months.
 The cost per record in the event of a data
breach at your company.
 The cost of a data breach at your company.
Data Breach Calculator

5. 5
Unauthorized access of:
Personally Identifiable Information (PII)
Protected Health Information (PHI)
Sensitive Company Information
What is a Data Breach?

6. 6
Personally Identifiable Information is:
 Information that can be used on its own
or in conjunction with other information
to identify, contact, or locate an
individual
 Examples: name, SSN, drivers license
number, financial information
What is PII?

7. 7
Protected Health Information is:
 Individually identifiable health
information that is transmitted or
maintained in any form or medium
(electronic, oral, or paper) by a covered
entity or its business associates,
excluding certain educational and
employment records
What is PHI?

8. 8
 Intellectual Property
 Research and Development
 Customer Lists
 Clients’ Sensitive Information
Sensitive Company Information

9. 9
External
 Hacking
 Theft
 Phishing
 Malware/Ransomware
Types of Data Breaches

10. 10
Internal (Employees)
 Lost assets (cell phones, thumb drives)
 Improper disposal
 Mistakes
 Criminal acts
Types of Data Breaches

11. 11
59%
Employees and
Negligence
Employee Security Incidents

12. 12
 When fraudsters impersonate a business
or other person to trick you into giving out
personal information.
 Types:
 Email
 Text
 Phone
What is Phishing?

13. 13
 "We suspect an unauthorized transaction
on your account. To ensure that your
account is not compromised, please click
the link below and confirm your identity.”
 “Our records indicate that your account
was overcharged. You must call us within
7 days to receive your refund.”
Examples of Phishing Messages

14. 14
Short for malicious software, malware is
software designed specifically to damage or
disrupt a system, such as a virus or a Trojan
horse.
What is Malware?

15. 15
 Software that attaches itself to a program
or file
 Requires human action to spread, like
sharing an infected file or sending an
email with viruses as attachments
What is a Virus?

16. 16
 Capable of spreading by itself
 Can replicate itself
 Example: the worm sends a copy of itself
to everyone in your address book. Then
everyone in the next address…
 Some worms can tunnel into your system
and allow malicious users to control your
computer remotely
What is a Worm?

17. 17
 Looks like useful software at first
 Once downloaded, wreaks havoc
 Examples:
– Adds silly active desktop icons
– Deletes files
– Destroys information
– Can allow access to external threats
 Do not reproduce or self-replicate
What is a Trojan Horse?

18. 18
?
Why should you care?

20. 20
Small Businesses < 250 employees
 2011: 18%
 2013: 36%
 2014: 34%
Medium Businesses < 2,500 employees
 2014: 26%
Cyber Attacks Against Small and
Medium Sized Businesses

21. 21
 Criminals look for the weakest link
 Target breach started with HVAC vendor
 Phishing email to Fazio Mechanical
 Stole network credentials for Target
 Had access rights to Target's internal
network for carrying out tasks like remotely
monitoring energy consumption and
temperatures at various stores
Why are they Targets?

22. 22
 Average cost of a breach of 1,000 records:
$52,000 - $87,000
 Average cost of a breach of 10,000
records:
$143,000 - $223,000
What Does a Breach Cost?

23. 23
 Median number of identities exposed per
breach:
7,000
~
$115,000 to $182,000
What does a breach cost?

24. 24
 Investigation
 Remediation
 Notification
 Regulatory fines
Types of Data Breach Costs

25. 25
 Disruption in normal business
operations
 Lost business
 Identity-theft repair and credit
monitoring
 Lawsuits
Types of Data Breach Costs

26. 26

27. 27
$25
$18
$15
$3
$0
$5
$10
$15
$20
$25
$30
Increase the Cost of a Breach

28. 28
-$10
-$13
-$17
-$21
-$25
-$20
-$15
-$10
-$5
$0
Lower the Cost of a Breach

29. 29
Strong security posture includes:
Training Employees
Decrease costs by 18-100%
Lower the Cost of a Breach

30. 30

31. 31
If you know neither the enemy nor yourself,
you will succumb in every battle.
--Sun Tzu, The Art of War
Top Ten Cyber Security Training
Topics for Employees

32. 32
Every employee is a steward.
 Team mentality
 What assets do you have?
 Where are they?
 Who has authorized access to them?
Responsibility for Company Data

33. 33
Hiding mistakes only makes it worse.
 Who needs to know?
 What should that person do with the
information?
 Incident Response Plan gives direction
and peace of mind
Notification Procedures

34. 34
Yes, it’s possible to remember them!
 Cloud storage and social media platforms
are predicted to be hit hard in 2015
 Access to many from learning one
Strong Passwords

36. 36
1. 123456
2. password
3. 12345
4. 12345678
5. qwerty
6. 123456789
7. 1234
8. baseball
9. dragon
10. football
Top 10 Worst Passwords of 2014

38. 38
Keep a clean machine.
 Dangerous to allow every employee to
download software
 Trojan Horses look useful
 Consider a white list or black list of
programs
 Penalty for breaching protocol
Unauthorized Software

39. 39
A great place to catch worms, viruses, and
Trojan horses.
 Even reputable websites have dangers
 Balance the needs of your employees with
the needs of your business
The Internet

40. 40
When in doubt, throw it out.
156 Million phishing emails sent
globally every day
 16 million pass spam filters
 8 million are opened
 800,000 links are clicked
 80,000 fall for the fake website
Email Responsibly

41. 41
Stranger danger.
 Quickly identify problems
 Wrong person accessing the system?
 Phishy email?
 Phishy phone call?
 Time is money
Recognizing Security Risks

42. 42
Twitter leaks and Facebook follies.
 Reputation
 Securing PII, PHI, and Company
Information
Social Media Policy

43. 43
Easy to lose and misuse.
 Easy to lose
 Poor password security
 Unsecure websites, Wi-Fi
 Policy should mirror office use
 Consider restricting access to just email
Mobile Devices

44. 44
Secure it like any other valuable.
 Computer = Goldmine
 Fort Knox = Ctrl-Alt-Delete
 Open with your new and improved, easy-
ish to remember password.
Protect Your Computer

45. 45

46. 46
 Tammy B. Georgelas
801.536.6873
tgeorgelas@parsonsbehle.com
Thank You