Global security spending will reach $219 billion this year, yet over 80% of cyber incidents are caused by employees. With the constant threat of human error and ever-evolving compliance laws, even the most advanced software can be ineffective at keeping your organization secure and compliant.
So, how can we tackle this ongoing security issue and minimize internal risk? From a CIO’s perspective, I have identified the top three risks to security and compliance in Microsoft Teams and how to overcome them.
#1 Tackle human error with regular training
Human error is one of the biggest security risks facing organizations today. Without adequate risk training, employees can leave the front door open for bad actors to attack with social engineering attacks like phishing emails and CEO Fraud or by accidentally storing sensitive data on a public server.
Compliance and certification programs like ISO27001 or SOC2 can help protect your business against the threat of human error and data leaks. However, employee training must be comprehensive and consistently applied to the entire organization, with specialized training given to high-risk teams in development and operations. Business owners should also ensure that training is given regularly instead of a single session during onboarding since attack vectors and methodologies are constantly evolving.
I recommend that any training solutions be interactive to help with comprehension on a subconscious level. Monthly training should be under ten or even five minutes to retain focus and avoid burdening your employees.
#2 Choose your Multi-factor authentication method wisely
Another security issue for organizations is multi-factor authentication. Most businesses use SMS for MFA, which nowadays is so ridiculously easy to intercept that it should never be used.
A more secure approach to MFA is using the Microsoft Authenticator app, Google Authenticator app, or even email. You should also have a good policy and mechanism for tagging documents with the correct classifications to protect classified resources against unauthorized access.
#3 Take advantage of Microsoft’s inbuilt security and compliance tools
Keeping up with new regulatory laws can challenge businesses trying to remain compliant. As more countries and US states adopt the ‘right to forget’ and ‘right to privacy’ laws, knowing which ones apply to your organization can be confusing.
To help protect sensitive data, I recommend using Microsoft tools built into the Microsoft 365 E5 licenses that provide a full suite of data protection and compliance applications across the business.
