Three ways the HR department can shape a better cyber security strategy

One of the most persistent myths about cyber security is that it’s solely the domain of the IT department.

Yes, there are plenty of technical elements to cyber security – firewalls, emails filters, malware guards and the rest – but switched-on people are what form any business’ best defence against cyber criminals. 

The vast majority of breaches still result from human error. Cyber security is everybody’s concern.

This means that any security strategy has to involve people from all corners of the business. Human resources teams have a vital role to play in shaping this strategy.

Below are just three areas in which HR practitioners should be contributing.

Security starts on day one

First impressions are often lasting ones – so don’t miss the opportunity to emphasise and instil your organisation’s position on cyber security in this moment.  

Some of the first people new starters meet will be those in the HR department. New starters need to know that security is something your organisation takes seriously. 

They may have heard this before. In fact, they probably have heard it before – when they were onboarded for their last role. But don’t assume that the places new joiners have worked previously have got it right. And don’t assume that people have held on to everything they learned there.

It’s easy for cyber security to become a boring addendum to the already-quite-boring process of receiving your IT gear and logging onto the network for the first time. So separate it out, and make it clear that good cyber hygiene is a core part of your organisation’s culture.

You’re not just welcoming a new member of staff, you’re adding an extra brick to the human firewall too.

Tailor programmes to suit each team

Cyber security should be everyone’s concern. But that doesn’t mean some people aren’t more exposed than others to the dangers posed by malicious actors.

Those working in procurement, finance, IT, and HR (as well as occupants of the C-suite, of course) offer a more attractive target to hackers looking for big bucks. 

They need specific education in what internet interlopers are looking for, and how to spot the signs of an attack. Work with these teams to understand their needs and tailor programmes to suit.

Hackers often exploit weak links between teams, the grey areas where communication gets muddied, and mistakes are made. 

With a top-down view of how a company operates and how teams interact, HR professionals are ideally placed to understand where these weaknesses might occur – and how to shore up the barricades.

Cyber security training doesn’t have to be feel like a chore

Training is already the domain of the HR department. 

However, there’s often a gulf between fun, engaging personal development programmes and compulsory, dry run-throughs of how to set a strong password or spot a phishing email.

It doesn’t have to be this way.

Cyber security training that is interactive, frequent, fun, and engaging should be a core element of all development programmes.

The best training programmes are flexible, accommodating the specific needs of different teams and departments. If an employee can’t see the relevance to their day-to-day activities of what they’re being taught, then they’ll be far more likely to switch off.

Switched-off staff make mistakes. And mistakes can cost more than just the money hackers get off with.