By: Martin Straub Principal, SimplePowerIT
About 77% of all cloud data breaches originate from compromised passwords. Compromised credentials are also now the number one cause of data breaches globally. A password security policy will lay out for your team how to handle their login passwords. It should include things like:
- How long passwords should be
- How to construct passwords (e.g., using at least one number and symbol)
- Where and how to store passwords
- The use of multi-factor authentication (if it’s required)
- How often to change passwords
Here are some IT policies that can add real protection to your organization:
Acceptable Use Policy
The Acceptable Use Policy is an overarching policy that includes how to properly use technology and data in your organization. This policy will govern things like device security. For example, you may need employees to keep devices updated. If this is the case, you should include that in this policy.
Another thing to include in your AUP would be where it is acceptable to use company devices. You may also restrict remote employees from sharing work devices with family members. Data is another area of the AUP. It should dictate how to store and handle data. The policy might require an encrypted environment for security.
Cloud & App Use Policy
The use of unauthorized cloud applications by employees has become a big problem and is now estimated that the use of this “shadow IT” ranges from 30% to 60% of a company’s cloud use. Often, employees use cloud apps on their own because they don’t know any better. They don’t realize that using unapproved cloud tools for company data is a major security risk. A Cloud and App Use Policy will tell employees what cloud and mobile apps are okay to use for business data. It should restrict the use of unapproved applications and provide a way to suggest apps that would enhance productivity.
Bring Your Own Device (BYOD) Policy
Approximately 83% of companies use a BYOD approach for employee mobile use. Allowing employees to use their own smartphones for work can save your company money. It can also be more convenient for employees because they don’t need to carry around a second device. But if you don’t have a policy that dictates the use of BYOD, there can be security and other issues. Employee devices may be vulnerable to attack if the operating system isn’t updated. There can also be confusion about compensation for the use of personal devices at work. The BYOD policy clarifies the use of employee devices for business, including the required security of those devices. It may also note the required installation of an endpoint management app. It should also cover compensation for business use of personal devices.
Wi-Fi Use Policy
Public Wi-Fi is an issue when it comes to cybersecurity. Sixty one percent of surveyed companies say employees connect to public Wi-Fi from company-owned devices. Many employees won’t think twice about logging in to a company app or email account, even when on a public internet connection. This could expose those credentials and lead to a breach of your company network. Your Wi-Fi Use Policy will explain how employees are to ensure they have safe connections and may dictate the use of a company VPN. Your policy may also restrict the employee use and behavior when on public Wi-Fi, such as not entering passwords or payment card details into a form.
Social Media Use Policy
With social media use at work so common, it’s important to address it. Otherwise, endless scrolling and posting could steal hours of productivity every week. Items to include in your social media policy should include:
- Restricting when employees can access personal social media
- Restricting what employees can post about the company
- A process for posting to company social media platforms
- Noting “safe selfie zones” or facility areas that are not okay for public images
Get Help Improving Your IT Policy Documentation and Security
If your organization could use some support in reviewing existing policies or creating new ones, we can help. Our team of experts can help identify deficiencies and security issues and is committed to using best practices to ensure the cyber safety of your company. Contact SimplePowerIT at (509) 433-7606 for a free initial consultation.