Today’s blog is written by my partner, Louise Ann Fernandez, Chairperson of JMBM’s Labor & Employment Group. Louise Ann helps companies put hiring and employment policies in place — and develops training programs — that help to protect the business against cyber threats. — Michael A. Gold
Could We Have Seen This Coming?
The Importance of HR to Cybersecurity
Louise Ann Fernandez, Chair, JMBM’s Labor & Employment Law Group
After a cybersecurity breach, second guessing can often turn into a blood sport. The business often blames Human Resources and the HR department is quick to say that they were not given enough information or blames IT. This kind of tension is far too common and nonproductive. Communication and creativity on all sides are essential to identifying and preventing cybersecurity threats. This article discusses some simple proactive steps that you can take now to help you recognize potential issues before it’s too late.
Your IT department is both your first line of defense and greatest vulnerability. Do you really know who is working there? We will cover hiring in general and its role in preventing cybersecurity attacks in another blog, but often problems come because of bad hiring choices in the IT department. Because there is a shortage of qualified IT personnel and immediate needs must be met, warning signs are often overlooked. Both HR and IT must be trained to carefully analyze the credentials of all IT applicants. You need to look for gaps in employment history, too much job hopping and things that seem inconsistent such as career changes or abnormal job progression. Most importantly, you must do careful reference checks. Do not rely on the headhunter to provide references or do reference checks. They have a conflict and will not be as careful as you would like. References can easily be faked. For example, don’t accept just cell phone numbers. They could be giving you their brother’s number. Ask employees to provide work numbers for all references and call the human resources department of each prior employer to get dates of employment. Although there are more and more restrictions on background and criminal checks, they can still be done if you follow the rules. Make sure you do them. Also, do a careful social media check to see what their online presence looks like. Key warning signs are signs of second jobs that conflict with your business, angry posts, alternate identities such as “stage names,” peculiar political affiliations and overactive Twitter or Instagram accounts. Make sure you know all of their email addresses. Continue reading