Protecting your customers’ data

1 October 2019 Training & Education, Security Services & Risk Management


Simon Murrell

While customers may be taking precautions to safeguard their personal information and verify the companies they provide personal information to, they are entrusting organisations with their details and expect them to have measures in place to ensure that their data remains secure. However, according to the World Wide Worx State of Enterprise Security in South Africa 2019 study that was conducted in association with Trend Micro and VMware, only 35% of South African IT decision-makers were prepared for cyber-attacks at any time in the next 48 hours. Companies need to take action and have processes in place that not only protect their customer’s details but also provide their customers with tools to help prevent them from falling for phishing scams or spoofing emails for example.

Email verification tools

Email spoofing occurs when recipients receive emails that resemble official organisation emails. For example, a client may receive an email that appears to be sent from his bank with the corporate logo and similar distinct graphics that have been sourced online or copied from legitimate emails sent from the organisation previously. These images are embedded into spoof emails to convince recipients that the emails are legitimate and encourage them to follow specific phishing instructions.

However, email spoofs are not only sent to customers, there are instances where emails appear to be sent from internal sources to company departments and employees with particular instructions. These include instructions that request immediate payment of funds or for funds to be released or even requesting particular customer details. Without the necessary verification tools in place, these emails are often actioned with immediate effect.

With approximately 93 percent of malware coming from emails[4] it is evident that companies lack mechanisms for email authentication. These emails often look legitimate at quick glance and as such the recipient is likely to action it as per the instructions included. To overcome this, company email signatures should aid in enhancing security. This could include providing recipients with a verification page that provides additional information about senders, qualifications, titles, and details about the company.

The details included on the verification should be approved by various departments within the organisation to ensure that the job title and qualification for example, are accurate. In addition as email correspondence can constitute a legal document, the organisation should put measures in place to ensure that all emails that leave the company authenticate the identity of the sender on behalf of the organisation.

By adopting these security measures, companies would provide added peace of mind to their customers that emails they receive from the organisation are authentic.

Securing company templates

Looking beyond email signatures, companies need to put measures in place to secure company documents and templates from third parties. This includes removing former employees from systems and limiting the access vendors and other external parties have to company documents. For example, if important documents such as company letterheads are easily accessed via an unsecure platform, anyone could use the document to spoof recipients into providing valuable personal data or releasing funds.

For added security, company documents and templates should be housed centrally on a cloud platform that restricts usage to only those departments and individuals that need access to these documents. In addition employees should not be able to save company documents to their desktops for future use as these can be easily tampered with or shared with employees that do not need access to them.

Companies should incorporate a tracking system that provides line of site of who is accessing documents and when, as well as providing executives with statistics of user template compliance at any point in time.

This is supported by Varonis which states that fewer people should be able to access to sensitive company information as some of the biggest data breaches in the past year stem from a user who had access to files they shouldn’t have been able to see in the first place [5]. In addition they found that on average, only 3% of company folders are secured leaving employees open access to the majority of company documents and customer information.

Protection from the inside out

In many instances, companies have invested significantly into improving IT security with firewalls and antivirus and antimalware software, however, internal security measures have fallen through the cracks.

In some instances companies rely on third party organisations for email branding to be applied in the form of banners and email signatures which are applied after the email has been sent from the sender. By intercepting these emails, the emails are effectively tampered with and could put customer data at risk. It also poses questions about email authenticity which is key to establishing trust with customers.

Identity theft can occur by neglecting to cancel former employee access to documents. When employees leave an organisation, their access to company documents and systems should be removed from the system immediately and any storage of documentation on the workstation should immediately be flushed. According to Varonis 34% of company user accounts are stale but enabled and 64% of user accounts are stale or inactive. This opens up additional opportunities for identity theft and gives hackers access to useful information that could go easily unnoticed for an extended period of time. As stated by Varonis, “if you’ve got outdated users with active accounts, it’s like handing over a new set of papers to your hacker.”

Giving employees’ access to locked content that cannot be tampered with, provides additional security for customers. This practice reduces the risk of employees and third parties from altering the content and minimises the possibility of intentional and unintentional sabotage from employees. It also adds a layer of authenticity to the email, giving recipients added peace of mind that the content is authentic.

Putting the basics in place

While protecting customer and company data is a huge task, most companies have already started putting measures in place to minimise the risk of data breaches and identity theft. However, in order to provide holistic protection, they need to pay attention to basic requirements that can go a long way to adding a layer of protection to both the company and its customers.

Companies would benefit from building compliance standards into company documentation and emails, adding additional verification measures into emails and limiting access to specific documentation can all go a long way to helping to minimise threats and taking security to a higher level.

BrandQuantum develops software solutions to help companies deliver compliant customer communications and documents. The tamperproof email signatures that are sent out with every single email via Microsoft Outlook have built in verification tools to give customers added peace of mind that your company emails are authentic. The BrandOffice solution offers permission control to company documents so that only those employees that need access to your documents have it. In addition access to company documentation and templates is tracked and audited to give companies line of site of document usage and overall documentation compliance.

For more information, contact BrandQuantum at www.brandquantum.com

[1] www.securitymagazine.com/articles/90394-identity-theft-and-cyber-fraud-in-the-uk-hit-all-time-igh

[2] www.transunion.co.za/archives-article/your-identity-can-be-stolen

[3] www.banking.org.za/consumer-information/bank-crime/identity-personal-information-fraud

[4] www.varonis.com/blog/data-breach-statistics/

[5] www.varonis.com/2018-data-risk-report/

www.brandquantum.com/




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Convergence of cyber and physical security
Integrated Solutions Security Services & Risk Management
The overlap between cybersecurity and physical security will necessitate the integration of cyber and physical security in order to enable the sharing of events to the same security operations centre.

Read more...
The latest security trends at Securex South Africa 2023
Securex South Africa News Conferences & Events Training & Education
Security technology evolves at a blistering pace, so it’s important to keep up to date with changing trends in order to ensure maximised safety of human and personal assets. The Securex Seminar Theatre, powered by UNISA, is the place to be.

Read more...
Sustainability School opens for enrolment
Education (Industry) News Security Services & Risk Management
Three-part programme, first developed for Schneider Electric employees, is now available for free for companies worldwide. Attendees learn how to future-proof their businesses and accelerate their decarbonisation journeys.

Read more...
Success in business process best practices
Technews Publishing Kleyn Change Management Editor's Choice Integrated Solutions Security Services & Risk Management
This month we commandeer time with the woman who is spearheading our national conversation on Women in Security, Lesley-Anne Kleyn, to get to know the lady herself a little better.

Read more...
Security awareness training
Training & Education Security Services & Risk Management
It is critically important to have a security awareness solution that uses the limited time available to train effectively, and one that provides targeted education that is relevant to users.

Read more...
Technology to thwart solar panel thieves
Asset Management, EAS, RFID Security Services & Risk Management Products
A highly efficient industrial network is coming to the rescue of the solar industry, as solar panels, inverters and batteries are being targeted by thieves and threaten to destabilise the industry.

Read more...
Banking the unbanked comes with security risks
Financial (Industry) Security Services & Risk Management
As grim as it was, the pandemic of recent years and its resultant global economic crisis were a prime catalyst for record number of first-time bank users, the previously unbanked.

Read more...
Vulnerabilities in industrial cellular routers’ cloud management platforms
Industrial (Industry) Cyber Security Security Services & Risk Management
Research from OTORIO, a provider of operational technology cyber and digital risk management solutions, unveils cyber risks in M2M protocols and asset registration that expose hundreds of thousands of devices and OT networks to attack

Read more...
SAFPS to launch a platform to combat fraud
Editor's Choice News Security Services & Risk Management
In response to the growing need for a proactive approach to fraud prevention, the SAFPS is developing a product called Yima, which will be a one-stop-shop for South Africans to report scams, secure their identity, and scan any website for vulnerabilities.

Read more...
End the scourge of solar panel theft
Guardian Eye IT infrastructure Security Services & Risk Management
Modern solar installations are designed so they can be put together very quickly, but this means they can also be dismantled very quickly, and so there has been a massive spike in the theft of solar panels from roofs.

Read more...