Thieving employees can destroy a business that took years of blood-sweat-tears to build. Not only do the owners suffer but all the honest-hard working staff who could lose their jobs.
There are 100′s of articles on businesses nearly losing all due to employee theft – below are just a small collection.
What becomes apparent while reading the articles is the amount of trust owners and managers grant employees – sometimes ignoring the obvious signs of theft because they cannot believe the “trusted” employee could “do that to them”.
Showing that you trust an employee can provide a loyal and long lasting relationship but can also breed opportunity.
In order to reduce theft within the work place I have provided some security processes you should implement.
Separation of Duties
All critical tasks such as banking, payroll and billing should be managed by more than one employee. For example all payments to suppliers/contractors/customers must have two signatories for sign-off. A summary of the accounts should be automatically emailed to a senior manager including audit events (audit events should record all additions, modifications and deletions done by the system and users. The audit logs cannot be altered by anyone including administrators. So if an employee covers up their theft by changing or deleting records within the accounts system the audit logs will show all events).
Separation of duties provides a business with the ability to remove the chance of having one person within the business in complete control of a critical process(s). There should be no employee that has the “is the only one that knows how to do this” role.
Job rotation is the process of rotating employees among numerous jobs within the business. It maybe hard within a small business where there are limited staff and/or jobs but even having the marketing person hangout with the payroll person for a day can offer some benefits.
Job rotation provides two core benefits:
1) Provides a type of knowledge redundancy whereby if the payroll’s person gets run over by a bus another person who worked within that role for a period can take over while a suitable replacement is located.
2) Moving an employee around reduces the risk of fraud, theft, sabotage etc.. The longer an employee works within the same role, the more likely they will identify holes in the process to hide illegal activity.
Have you ever had an employee that refuses to go on holiday or allow anyone to take over their role for even a small period? That should raise alarm bells. Many cases of theft within a business identify that the staff member was in complete control of their tasks and hardly took any holidays sometimes for years on end.
By forcing all employees to take a holiday every year a business can not only audit all work done by the employee but allow another employee to learn the tasks as well – fulfilling the “Job Rotation” requirement.
Document the Tasks for a Process
By documenting in detail the steps for every process within a role the following benefits are provided:
1) A training manual for any new employees taking on the role.
2) A great resource for auditors reviewing the employee.
Principle of least privilege
The Principle of least privilege is applied within security to make sure that a person is not assigned rights and privileges they do not need to fulfil their role. For example having the employees use an admin level account on their desktop computer is a big no-no because it allows them to add, delete and modified software installed on their machines – which increases the damage malware can do on the computer and network.
An employee should only be allocated the rights and privileges they need to fufill their role – no more.
On top of that long term employees may also accumulate all kinds of rights and privileges as they change roles throughout their employment. This is called “privilege drifting” meaning the employees rights and privileges drift to each new role. This is why every employee must be audited (while they are on holiday!) so all access, rights and privileges not removed from previous roles and not needed anymore are removed.
If you reflect on an employee who uses an account on a networked business computer with full admin rights and also has accumulated over the years all kinds of rights and privileges from every role they did and none where removed – then goes “rogue” you can see where theft can be quite easy.
So in summary employee theft can be dramatically decreased by just implementing a few basic security practices.
Take These Steps And Protect Your Business From A Cybercrime
You might have read the news story surrounding the events that happened at Mal A Largo. The prestigious club favoured by the president was recently breached by a woman who claimed she was a member. She wasn’t. When she was inside, she suggested she was there for a conference.
There was no conference taking place and the woman entered the club with multiple pieces of tech. One of which contained malware data. The president was in the club at the time and it is not currently known what the woman’s intentions were. It is however clear, that she almost succeeded.
This shouldn’t come as a massive shock. After all, recent reports have suggested that by 2021 there will be a cyber attack on a business every twenty seconds. That’s crazy and it won’t just be big businesses that are exposed either.
Indeed, experts suggest that smaller companies will be targeted because criminals won’t expect them to have the latest protection measures in place.
This leaves an important question: Is your business secure and prepared for the threat of a cyber attack?
Truthfully, the answer is probably no. But you can take steps and make changes to ensure that your business is protected.
Let’s look at some of the ways you can do this, plus here’s a quick recap on what you need to know about cyber crime and malware.
What is Malware?
You don’t need to know the history of malware but it’s kind of interesting so here’s a short summary. Its beginnings are thought to be in 1949, with computer scientist John von Neumann, however the first documented viruses were in the 1970s.
Not all viruses are bad, though malware is and it’s thought that a third of all computers world-wide have been infected at some time.
There have been some very hard hitting computer viruses over the years including:
- 2013 – Cyptolocker. This is one of the early ramsonware programs. Ramsonware in itself is interesting insofar as it denies the user access to their computer with threats to publish the users’ data unless a ransom is paid.
- 2014 – Backoff. Known for hitting the Point of Sale (POS) machines to steal credit card data.
- 2016 – Cerber. One of the most infective viruses according to Microsoft.
- 2017 – WannaCry Ransomware. Appropriately named as many companies attacked by it did ‘want to cry’.
What is Cybercrime?
Simply put, cybercrime is the term given to describe any criminal activity online, i.e. uses the Internet. It’s far-reaching, insofar as it includes everything from ramsonware and other viruses, to hacking, phishing and spamming.
So, what can you do to make sure your business is protected?
Installed And Up To Date
It’s important to make sure that you are installing anti-virus software. Once it is installed, make sure that you are updating it regularly. Many people think that once you have installed anti-virus software on your tech, your issues are over. This just isn’t the case. Indeed, it’s instead possible and even likely that you fall behind on updates and suddenly there’s basically no protection for your business.
This is usually because people are relying on free antivirus software. Free software is better than nothing, but it’s definitely not the ideal solution. If you want the highest level of protection, then you need to invest in the best software on the market. This isn’t free but it does provide fantastic value for your company.
Choose Strong Passwords
Passwords are incredibly dangerous if they are easy to guess or if they include information that people could quickly access. As such, there should be no personal information used to create your passwords. It should be a random string of numbers and letters. These are almost impossible to guess or hack and as such will keep your sensitive data secure.
The Latest Tech
Do make sure that you are investing in the latest technology and equipment. The latest tech will usually have preventive measures in place to ensure that software is protected. Particularly if they are running the latest programs and systems.
You should be careful of methods for saving money as well such as BYOD initiatives. While this can cut costs down, you can’t guarantee that the devices that employees are as secure as they need to be. Investing in the latest technology yourself will always be the best option.
We hope this helps you understand how to secure your business from a potential cybercrime.
How Compliant is your Small Business?
Operating a small business doesn’t mean you can be complacent with how you’re protecting customer data and the prevention of the real threat of credit card theft.
Hacking gangs are alive and well hence the tightening of data protection rules in the western world including the European Union’s GDPR.
So there’s two major compliances to work on immediately if you’ve not done so already. Doing the basics to ensure your business is in compliance with data protection laws including the GDPR even if you’re not in Europe is a must-do and here’s how you can get started if you’ve not done it already.
Every website collecting email addresses and more, need to comply with the requirements for protecting customer data. There’s more that’s needed too see (Website policies) further on in this article.
There is also a pressing concern for all businesses, eCommerce and particularly those in the retail sector to commit to PCI compliance. You might be wondering what it is and is your operation too small to be bothered with it right now.
A really good explanation of what PCI DSS is and why any business transactions using credit cards needs to comply can be found in this article on BusinessBlogs.
Smaller businesses can do a self assessment and why you might sigh with relief, don’t get too comfortable, you’ll still need to know exactly how to do a PCI self assessment and how to get set up so when your business grows it’s got everything in place for external assessments.
PCI and Networks
The real difficulty lies in understanding how sensitive data moves along your network which is a must for assessment. The wireless LANs and other connectivity points like USBs and bluetooth can be penetrated hence they need to be monitored and secure. This is where a PCI compliant specialist comes into their own not only for your self assessment but also when using external PCI auditors for your compliance.
Earlier on we mentioned protection of customer data and laws like GDPR.
Any business with a website that collects customer data can not avoid the basics website features that allow for transparency of how customer data is collected, utilised and shared with privacy and cookies policies.
This really is the norm now and it’s the entry level for all websites so all website developers will implement it, so it’s just the older sites and the Do-it-yourself crowd who need to be aware of the requirements.
Website visitor expectation is they’ll see the pop up that asks for acceptance of re. your website cookies policy and they’ll take the necessary action. Without it, your business is not perceived as being secure and visitors may take no further action i.e. they’ll exit your site.
All websites should also be using the SSL (HTTPS), and be mobile ready. Plus have all the bells and whistles in place to manage customer data collection and management for protection of customer data.
Ignorance is not bliss and it will be hurting your business if your website is not on top of it’s compliance requirements. Get curious, find out what you need to know and when you need to take action to keep the hackers out and the visitors in.
Why Shopping Cart Abandonment?
Shopping cart abandonment is not decreasing. Buyers add stuff to their shopping cart, however exit without finishing the purchase. The term ‘buyer’s remorse‘ needs to coined another way to describe why online shoppers abandon their shopping carts.
Relinquishment is an electronic business term used to portray a condition wherein a visitor on a page leaves that page before completing the pined for movement. Occurrences of betraying, are the place shopping cart abandonment happens the most! The reasons change from site to site and they’re explained well in the infographic created by Fullestop. We’ve added it to this post for you.
Web business destinations attempt to decrease their cart abandonment rate; however it’s a losing battle with a high level of customers still slipping past. Honestly, shopping case surrender rates if all else fails are actually rising. Business Insider reports that $4.6 trillion worth of stock was left in spurned trucks in 2016, up from $4.2 trillion out of 2013.
Reasons behind Shopping Cart Abandonment
For the retail part, these were the most widely recognized explanations behind the surrender:
• 34% were ‘quite recently looking’ i.e. not prepared to purchase.
• 23% had an issue with transportation.
• 18% needed to look at costs.
• 15% chose to purchase in-store.
• 6% relinquished because of an absence of instalment alternatives.
• 4% encountered a specialized issue.
Distinctive edifications have been offered trying to state why buyers leave shopping bushels. Most, by far, of the reasons, take after the ones in this present reality shopping process. The basic enlightenments behind shopping wicker container betraying have been seen as:
Perplexity with astound costs: in the far-fetched event that it’s not clear how to influence a purchase and you to leave your prospects with no other individual, expecting that “they’ll appreciate it”, you’re in for an epic dissatisfaction. Correspondingly, if they are out of the blue given some extra costs that they didn’t expect, you were showing the portal yourself.
Alert or secure site: An alert about the website can without much effort change over into fear. The starting point for a business is website security and assuring customers the website is safe and secure and this includes their shopping cart and when it comes to credit card data, what information is requested from purchasers.
Most electronic business purchasers are careful about revealing their own particular information, especially with respect to MasterCard inspirations driving interest. Purchasers are already nervous and it’s not long before they end up plainly suspicious especially if an overabundance of information is requested from them.
- Management2 years ago
20 Of The Worst Business Decisions Ever Made
- Finance2 years ago
What are the Advantages And Disadvantages of Business Loans?
- Marketing1 year ago
Creating Brand Identity for Small Business [Infographic]
- Marketing2 years ago
What You Can Learn From Amazon’s Marketing Strategy
- Mindset6 months ago
5 Positive Impacts of Green Businesses On Employees’ Wellbeing and Performance
- Mindset2 months ago
Entrepreneur Newcomers Join Billionaire Rich List
- Finance7 months ago
Why Entrepreneurs Often Fail
- Finance1 year ago
M&A How Industry Leaders Structure Their Deals – Fee Guide 2017