Click or Treat? One Click Can Change Everything

It looks like an email from your CEO.

The name is right. The signature is right. The message references something happening at work. And there’s nothing particularly unusual about the request:

“Can you review this document for me?”

Your employee clicks. That’s when the trick begins.

October is Cybersecurity Awareness Month, and while ghosts, monsters and haunted houses might be fun to be afraid of, the cybersecurity threats facing small and midsize businesses are real.

And they’re becoming harder to recognize.

The Scary Part? It May Look Completely Normal.

Phishing attacks aren’t always filled with misspelled words and obvious warnings anymore.

Attackers can use information available online—and increasingly sophisticated technology—to create convincing messages that appear to come from executives, coworkers, vendors and customers.

The employee receiving the message doesn’t need to be careless.

They just need to believe it’s real.

That’s why employees are an important part of a company’s cybersecurity defenses.

Training should help employees recognize suspicious links, attachments, unexpected requests and other warning signs.

But there’s another part businesses sometimes overlook:

What happens after someone clicks?

Employees need to know exactly who to contact if they believe they’ve made a mistake.

If someone clicks a suspicious link and stays quiet because they’re embarrassed or afraid of getting in trouble, valuable time can be lost.

Creating a culture where employees quickly report potential incidents can be just as important as teaching them how to recognize one.

Ask Four Questions

You don’t need every employee to become a cybersecurity expert. Ask:

• Do employees receive cybersecurity awareness training?
• Can they recognize suspicious messages and requests?
• Do they know how to handle sensitive information?
• Do they know exactly who to contact when something goes wrong?

If the answer to any of these is “I don’t know,” you’ve found somewhere to start.

Most SMBs don’t have a Chief Information Security Officer or large cybersecurity department.

They have people running businesses.

That’s one reason uRISQ was designed to help SMBs bring cybersecurity, privacy, training and risk-management responsibilities into a more structured process.

This October, think before you click.

Because sometimes the scariest email is the one that doesn’t look scary at all.