When it comes to overseeing data loss prevention (DLP) for your SaaS apps, your employee’s bad habits could be letting you down. 

According to Infosecurity, data breaches rose by 70% globally in Q3 of 2022, showing just how serious the problem is. 

Here’s what you can do to minimise the risk to your business. 

What bad habits can cause data loss or cybersecurity attacks?

There are a number of bad habits that can cause data loss and in most cases, they can be improved with some careful planning and a robust DLP strategy: 

1. Lack of a human firewall 

Your employees are one of your most important defences against cybersecurity threats and building your human firewall with well-informed staff can help you enormously when it comes to detecting anything unusual. 

Security is often seen as the complete domain of the security or IT team, but within any organisation, everybody should be taking steps to protect important data like customer information. By implementing a tool like Metomic that makes security everyone’s responsibility, you can start to build a security-aware culture and reduce the threat of cyber attacks such as phishing. 

2. Leaving screens open and unattended 

With more people working remotely, it’s not unusual for your employees to be working from coffee shops or co-working spaces where data left on unattended computers could easily be accessed. 

Whether you have an office space or not, encouraging your team to always lock their screens before they leave their desk can help reduce the chances of someone stealing company secrets. 

3. Connecting to public wifi 

And with all those coffee shop trips, or visits to co-working spaces, comes the potential of employees connecting to public wifi or unsecured networks. 

Easily intercepted by hackers, public wifi can be a huge risk, particularly for those working with sensitive data. Understanding the chances they’re taking by connecting to it can be the difference between losing sensitive data or protecting it. 

4. Employees falling victim to social engineering tactics 

Social engineering attacks have become increasingly more sophisticated, making them more difficult to spot. Of the UK businesses that were impacted by breaches in 2022, the most common form of cyber attack was phishing at 83%.

If employees aren’t properly trained to notice possible phishing tactics, they could be easily manipulated into handing over sensitive information that could compromise the company. 

5. Easy-to-guess passwords 

Weak passwords typically contain employees’ names, hometowns, or dates of birth - all of which are easily accessible via social media accounts. Not only that but passwords are often reused across multiple platforms, making it easier for hackers to gain access to company secrets and/or sensitive customer data. 

6. Employees emailing themselves documents 

When employees move from one job to another, they may email documents to their personal accounts, so they can retain them for future use. 

However, this can lead to difficulties in tracking sensitive data and where it’s being shared. This bad habit could potentially involve company secrets being taken to competitors, or customer data being held in insecure spaces.

7. Not updating software 

Although it can be tempting to put off software updates, outdated equipment can put your sensitive data at risk. Encourage your employees to update software whenever they’re prompted to, rather than leaving it too long. 

The small interruption to their day will be worth it in the long run. 

‍What is the potential damage of just one mistake? 

Just one mistake could have massive ramifications for companies that suffer a data breach. 

In 2022, some of the biggest data breaches resulted in reputational damage for huge companies such as Uber as well as eye-watering financial losses, including $600M being stolen from Ronin. 

Within the security world, it can be difficult to earn trust, and once you have it, you don’t want to lose it. Tightening your policies around data loss prevention can help you show your customers that you’re doing everything you can to protect their information. 

How can security teams prevent bad habits?

One of the best things you can do is bridge the gap between your security team and the rest of the company. Make sure everyone is taking responsibility for cybersecurity, rather than a select few. You can do this through educational tools like Metomic, as well as embedding yourself within the organisation. 

As a security professional, make yourself known to the rest of the team so they can easily report any incidents and know who they can go to for help. You may even want to carry out a practice run of a cybersecurity attack, so that the information really does stick in your employees’ minds. 

Finally, invest in security tools that can keep data protected, so you know that even if one person in your team does make a mistake, there’s a tool that can help you pick up any DLP concerns. 

‍How can you educate staff on the risks, dangers and consequences? 

Think about the best way to educate your staff - is it really with an annual training session or is it with continuous learning that feeds into their day-to-day work, so they can see it in action? Make it relatable to their job & scenarios they might find themselves in so they know what to do instantly if they notice any suspicious activity. 

You’ll also need to speak to them in a language they understand. For instance, speak in financial terms for your leadership team so they can realise the impact that a data breach would have on the business. 

Conclusion

Educating your staff could have a massive impact on your DLP strategy, and help you to identify any cybersecurity attacks, such as phishing. 

To enable your team to receive continuous training, and build your human firewall, take a look at Zappi’s case study to see how they used Metomic to educate their organisation. 

‍