In 2020, 49% of French companies have reportedly suffered a cyberattack According to this Hiscox Cyber Readiness study conducted among a thousand IT decision-makers and professionals in France. However, the Lack of vigilance on the part of users It ranks high among the causes of cyberattacks.
After ours 3 tips against phishing in the workplace, So here is the second installment of our cybersecurity special series with 6 good practices that all employees can apply to protect your personal and professional data well to give the pirates something to talk about! ☠️
Cybersecurity: how to protect your data?
1. Do not let your data «hang around» on paper
Writing your credentials, passwords, and credit card number on a post-it note or notebook, especially near your computer, obviously presents a risk of theft of these sensitive data. Despite everything, still many people continue to do so.
Prefer instead, to store your passwords, a secure platform specialized among recognized actors (KeePass certified by the ANSSI, Keeper, Dashlane, 1Password, For example, you can also use the «safe» feature that is usually offered free of charge in your computer tools to authenticate yourself on your devices, such as Windows Vault on PCs or the iCloud vault on Macs.
On the side of the Payment data, You can entrust your credit card number and its expiration date to major e-commerce sites, third-party solutions like PayPal, or even Google… provided that the chosen service ensures the encryption of the data, whether it is stored locally or in the cloud. cloud. In all cases, the visual code (the 3 digits on the back of your card) must always be entered by you.
2. Choose a different password for each account
A quality password must contain at least 12 characters, including lowercase, uppercase, numbers and special characters (for example @). Why? To prevent hackers, who have software that tests all the combinations of the dictionary, from finding it too easily… Naturally, your password can be even longer!
Change your password regularly, For example, every 3 months, it constitutes a second line of defense against cyberattacks: in the event of a computer hack of a company that results in a leak of your user data (which can happen even without your knowledge), hackers will not be able to access your account even if they have your login ID or email address.
Finally, define a different password for each of your web accounts constitutes the best protection in this regard. Indeed, if a cybercriminal recovers one of your passwords, even if it has been recently modified, their attempts to access your other accounts using it will be futile.
To make it easier to remember your passwords, tap on one personal algorithm – First name+date+Location in the model below – with special characters and a part that adapts to the site you are connecting to, like «LR» for La Redoute. Example of a password (fictitious) applying these principles: Thibaut2014@Nantes%LR
Naturally, using a password manager as mentioned at the beginning of the article allows you to create even more complex passwords, ideally without any personal information, or even completely random ones.
3. Implement double online authentication
Double authentication, also known as two-factor authentication (A2F), allows the secure online access to sensitive data (bank details, health data, etc.) by requiring: two separate pieces of proof of identity. In practice, this method often relies on capturing the password on the web, then entering a security code transmitted by email, SMS, or a voice server.
This mechanism is increasingly used by banking players to validate an online purchase or carry out a sensitive transaction. Although double authentication may sometimes seem a bit cumbersome for the user, who is forced to show their face twice, it is now indispensable, in the event of a password hack, to prevent the theft of your password. prevent a hacker from performing fraudulent transactions.
4. Transmitting sensitive data via multiple channels
When you need to share data such as your login and password, Do not transmit them through a single channel to avoid making it easier for hackers in the event of a hack (especially of your email account). Here are some examples of how information might be distributed:
- sending the identifier by email and the password by SMS
- Sending data via SMS in two steps to two numbers
- transmission of the password verbally (by phone or in person)
- sending data by registered letter in two stages
5. Regularly back up all your data
In the event of a hack that prevents access to your data, or even to your devices, it is essential to Have a copy (without viruses…) of your data on a separate medium from your everyday tools, In order to restore the data and resume your activity on another computer.
Today, the online backup in the cloud comes immediately to mind. This service on which Dropbox Having built its reputation since 2008, it is now included in the native features of Windows (Microsoft OneDrive) and MacOS (Apple iCloud), and many large players such as Google now offer a backup tool with features – most of which are paid – adapted to businesses.
However, even the biggest players in the cloud They are not infallible (as evidenced by the fire at the French company OVH in March 2021) and the multinational companies of the cloud Companies like Amazon – whose AWS service accounted for nearly two-thirds of its net profit in 2020 – are a prime target for hackers.
Knowing that the lack of «physical» access to the servers can also be a deterrent in the case of very sensitive data, it is always useful to perform local backups (after verification by your antivirus) on a USB stick, an external hard drive, or – even better – a NAS server, or even the company’s file server if you have one.
Think about backing up The most critical data on an external computer device outside the company’s premises (or at home in the case of teleworking) and in a secure location itself, for example by renting a safe at a bank… a solution that is certainly «old-fashioned» but still very effective against the risks of theft and fire.
6. Do not mix personal and professional data
In a context of hybrid work, where some tasks are carried out in the office and others remotely, it can be tempting to copy professional documents onto a USB stick or onto their smartphone in order to access them more easily on the go or to edit them on the home computer… thus multiplying the risk of data hacking.
Unless there is a special case, Professional data must be kept on the corporate network as much as possible, Without physical copies, only computer tools validated by your organization (and therefore secured by your IT department) should be able to edit the documents, with possible read-only access from the outside.
Naturally, connecting an external device, such as a USB flash drive, to your professional computer is also prohibited if that device comes from outside the company and already contains data. This prevents the introduction of a virus… a subject we will discuss in our next article!
Password management, double authentication, data backup… Applying the 6 tips above already ensures a high level of security for your personal and professional information. Come back in a few days to discover how to keep control of your IT tools!
Attention! Be also vigilant regarding the data protection measures taken by your partners and service providers… Indeed, Your network of subcontractors forms an entry point, sometimes direct, to your data. Cybercriminals are increasingly exploiting the vulnerability of small businesses to target large organizations (in 2019, already 4 out of 10 French SMEs declared that they had suffered a cyberattack). CPME investigation).
