These include C-level executives, HR, Accounting and IT staff. Impose more controls and safeguards in these areas including: 

• Review social/public profiles for job duties/descriptions, hierarchical information, out of office detail, or any other sensitive corporate data
• Identify any publicly available email addresses and lists of connections

Every organisation should set security policy, review it regularly for gaps, publish it, review it again and make sure employees follow it. It should include such things as:

• Not opening attachments or clicking on links from an unknown source
• Not using USB drives on office computers
• Password management policy (no reusing passwords, no Post-it notes on screens as password reminders, no sharing of passwords, etc.)
• Required security training for all employees
• Review policy on WiFi access. Include contractors and partners as part of this if they need wireless access when on site.
• Ensure security levels are maintained when outside of the corporate environment.

Have a solid bank transfer policy: It should never be possible for a cyber criminal to hijack a corporate email account and convince someone to transfer a large sum immediately. Policy should limit such transactions to relatively small amounts. Anything beyond that threshold must require further authorisations. It is best practice to have multi-tier approval on approval of Purchase Invoices and Bank Payments.

Confidential information: When it comes to Intellectual Property or employee records, policy should determine a chain of approval before such information is released.

• Email secure gateway
• Two-factor authentication
• Automated password and user ID policy enforcement
• Comprehensive access and password management
• Allow or deny external traffic
• Patch/update of all IT and security systems
• Manage access and permission levels for all employees, use the Least Privilege best practice
• Review, regularly, existing technical controls and take action to plug any gaps
• And more!

IT should have measures in place to:

• Block sites known to spread ransomware
• Keep software patches and virus signature files up-to-date
• Carry out vulnerability scanning and self-assessment using best practice frameworks such as US-CERT or SANS Institute guidelines
• Conduct regular penetration tests on WiFi and other networks to see just how easy it is to gain entry
• Domain Spoof Protection
• Create intrusion detection system rules that flag emails with extensions that are similar to company emails

Recommended company procedures include:

• Make staff study security policy and enforce this 
• Establish how executive leadership is to be informed about cyber-threats and their resolution;
• Establish a schedule for the testing of the cyber-incident response plan
• Register as many as possible company domains that are slightly different than the actual company domain

• Develop a comprehensive cyber incident response plan and test it regularly. Augment the plan based on results.
• Executive leadership must be well informed about the current level of risk and its potential business impact.
• Management must know the volume of cyber incidents detected each week and of what type.
• Understand what information you need to protect: identify the corporate “crown jewels,” how to protect it and who has access.
• Policy should be established as to thresholds and types of incident that require reporting to management
• Cyber-risk MUST be added to existing risk management and governance processes.
• Best practices and industry standards should be gathered up and used to review the existing cybersecurity program.
• Consider obtaining comprehensive cyber security insurance that covers various types of data breaches.

*Note: Normally human error like CEO fraud is NOT covered by cyber security insurance.

No matter how good your prevention steps are, breaches are inevitable. User education plays a big part in minimizing the danger, so it should be a key aspect of your prevention strategy.

• Start by training staff on security policy. 
• Create a simple handbook on the basics of security to augment the training.
• Training should include reminders to never insert USB drives from outside devices into work machines.
• Training should also review password management and best practices.
• Train users on how to identify and deal with phishing attacks with new-school security awareness training
• Implement a reporting system for suspected phishing emails such as the Phish Alert Button
• Continue security training regularly to keep it top of mind
• Frequently phish your users to keep awareness up

Phishing demands its own training and instruction, as it represents one of the biggest dangers. Let users know that hovering over email addresses and links in messages shows the actual email address or destination URL. Just because it says “Bank of America,” or “IT department” with all the right logos doesn’t mean it’s from that source. Add further instruction not to open unknown file types, click on links, or open attachments from unknown people or entities. Coach them into a suspicious frame of mind regarding requests to send in their passwords or account details. If, for instance, educating a student body in this manner isn’t feasible, put them on a separate network and severely restrict their access to sensitive data.

Security awareness training is strongly recommended. The best security awareness training programs baseline click rates on phishing emails and harness user education to bring that number down. Don't expect a 0% click rate though. Good employee education can reduce phishing success significantly, but there is always someone who doesn’t pay attention, is in a hurry that day, or is simply outsmarted by a very clever cyber criminal.

• Run an initial phishing simulation campaign to establish a baseline percentage of which users are phish-prone.
• Continue simulated phishing attacks at least once a month, but twice is better.
• Once users understand that they will be tested on a regular basis, and that there are repercussions for repeated failures, behavior changes. They develop a less trusting attitude and get much better at spotting a scam email.
• Randomise email content and times they are sent to different employees. When they all get the same thing, one employee spots it and leans out of the cubicle to warn the others. 

Security awareness training should include teaching people to watch out for red flags. Here are the most common things to watch out for:

• Awkward wordings and misspellings
• Slight alterations of company names such as Centriffy instead of Centrify or Tilllage instead of Tillage
• Spoofed email addresses and URLs that are very close to actual corporate addresses, but only slightly different
• Sudden urgency or time-sensitive issues
• Phrases such as “code to admin expenses,” “urgent bank transfer,” “urgent invoice payment” and “new account information” are often used.

• Make sure you backup your data, it will get you out of a hole is all else fails.
• Make sure you check your backup reports.
• Test your backups, regularly to make sure they will get you out of a hole!
• Perform disaster recovery scenarios and document the process.
• Ensure that more than one person knows how to recover data in the event of a disaster.
• Make sure that you have an offline and offsite copy.
•