Protecting business data Te pare i ngā raraunga pakihi

Video transcript: Keeping your employees safe online

[Visual: Blue introduction screen with white business.govt.nz logo on the right-hand side of the screen. The sentence “Keeping your employees safe online” in smaller, thinner text is on the left-hand side of the logo.]

[Visual: The screen changes to a shot of the presenter standing in a board room, in front of a panel of four speakers. One presenter sitting in a desk chair to the left of the table, three other presenters sitting down at a table and an audience of two visible people. I-Film Science Logo is in the top right-hand corner for the entire video. The presenter standing up is speaking.]

What things can small businesses put in place to help their staff stay safe online and keep their businesses safe?

[Visual: The screen changes to a close-up mid shot with the third speaker on the left-hand side and the fourth speaker sitting on the right-hand side. The presenter on the left-hand side is speaking.]

I’d say one of the first things is around education and awareness.

Making sure your staff are aware of the scams and what goes on and where the resources are they can find to keep up their awareness. One thing I’d say is that, if you receive something by email that looks suspicious, a lot of organisations now do run pages on their website where they[BT1]  keep track of those latest scams that are exploiting their brands.

Xero’s got its se[BT2] curity noticeboard, if you look at New Zealand Post, Westpac Bank, and probably every other major player in New Zealand (I think Vodafone runs a very good scams and online safety site). So, [BT3] there’s a lot of information to be had out there, so [BT4] if you get something you think is[BT5]  dodgy, it’s fairly easy to check.

There’s also the MBIE (Ministry of Business and Innovation) scam watch site ,which gives you a rundown of everything going. So, there’s a lot of resources to be had out there.

I think the other thing I’d say is[BT6]  that, possibly not a day or maybe a week goes by where you don’t see an [BT7] article around somebody defrauding their employer.

One thing I’d say there, I know it’s not possible in very small business perhaps, to[BT8]  enforce a segregation of duties where no one person has the keys to the kingdom when it comes to being able to get access to the business’s[BT9]  money. But if you can do that,[BT10]  it’s a good idea.

And always operate on a principle of least privilege — you have just the access you need to do just your job and nothing more.

And that also [BT11] is a good thing for preventing external hackers from exploiting you, because if they compromise an account and they’re[BT12]  not able to do a great deal, then that’s the best thing that can happen.

[Visual: The screen changes and zooms out to show the whole room again. The presenter on the right-hand side is speaking.]

I think it’s also good to have an acceptable use policy as well. The word policy is always quite frightening for a small business.

[Visual: The screen changes to a close-up mid shot of the third and fourth speakers.]

So, we always say just put ten things about how you can use the internet as an employee. Just define some very simple things about what you expect employees to do when using the internet, and that will give you a little bit more of that awareness.

The other thing about that is that, often in post-incident reviews I often hear from staff saying, “I didn’t realise I couldn’t do that. I didn’t realise I couldn’t do that on the internet. I didn’t realise that was the rules in place”.

So, regular reviews of that with staff, just to make sure they are following the acceptable use practice you’ve got[BT13]  in place.

[Visual: The screen changes to a white outro screen with blue bolded business.govt.nz logo on the right-hand side of the screen. The words “Make business easier” appear on the left-hand side of the screen in thinner text, separated by a blue vertical line from the logo on the right.]

[Video ends.]