{"id":4381,"date":"2020-12-10T14:49:56","date_gmt":"2020-12-10T14:49:56","guid":{"rendered":"https:\/\/blog.oclc.org\/next\/?p=4381"},"modified":"2022-09-29T17:00:16","modified_gmt":"2022-09-29T17:00:16","slug":"mitigate-cybersecurity-threats-with-training","status":"publish","type":"post","link":"https:\/\/blog.oclc.org\/next\/mitigate-cybersecurity-threats-with-training\/","title":{"rendered":"Mitigate cybersecurity threats with training"},"content":{"rendered":"

\"\"<\/p>\n

Computer and internet technologies have brought valuable opportunities and efficiencies to the library and education fields. Unfortunately, this kind of innovation often also brings challenges, especially with security. And although every organization tackles cybersecurity differently, there\u2019s one common denominator. When it comes to security, everyone in your organization plays a role\u2014often a critical one.<\/p>\n

<\/p>\n

As Executive Director for Global Security Services at OCLC, I oversee security, privacy, and compliance protocols for a global technology organization. The security of our hardware, software, and data is obviously important, but my most potent defense against cybersecurity threats is the same as yours\u2014my colleagues, and making sure they\u2019re informed and well trained. So, when I give this message at meetings and webinars, I often get a very positive response from library workers. \u201cTraining? We\u2019re great at that!\u201d<\/p>\n

In those discussions, I also get a lot of questions about what is the best firewall, anti-virus, or VPN solution. That\u2019s all going to depend on your library\u2019s unique technology and needs. What\u2019s never in question, though, is that you have staff and users who probably don\u2019t know everything they should. And the biggest threats you face actually come in through eyes, brains, and hands, not wires and Wi-Fi.<\/p>\n

[bctt tweet=”Mitigate cybersecurity threats with training. #OCLCnext” username=””]<\/p>\n

Four cybersecurity training opportunities<\/h2>\n

Cybersecurity can be complicated. Improving your defenses, doesn\u2019t have to be.<\/p>\n

    \n
  1. Set up a security awareness program for staff and users<\/strong>. Obvious? Perhaps. But you would be surprised how often this gets overlooked. I recommend that every employee learn the basics of cybersecurity\u2014and to repeat that training on a regular basis. Include what to be aware of, how to handle suspicious activities, what to do, who to contact, etc. And don\u2019t forget about your users! Incorporate cybersecurity tips on your website, social media, and other channels that reach them.<\/li>\n
  2. Ensure proper hardware and software set-up.<\/strong> This is, to a degree, part of the job of your IT department, of course. But it also involves training your staff, in many cases, in how to set up their home computers, laptops, tablets, and smartphones. It boils down to making sure your staff knows how to avoid security problems in all aspects of their digital lives.<\/li>\n
  3. Put a robust password policy in place.<\/strong> Many organizations go with the bare minimum for password requirements. The result? Bare minimum protection! I recommend requiring staff to change passwords every three or four months and using a scheme that\u2019s easy to remember but hard to guess. There\u2019s a great XKCD comic<\/a> about how putting together a narrative around four random words is easier for humans to remember but harder for computers (or hackers) to guess. Multi-factor authentication adds another line of defense by verifying a user\u2019s identity with additional credentials like a PIN.<\/li>\n
  4. Learn about partner and vendor security policies<\/strong>. That\u2019s something we at OCLC take an active role in, both with our library customers and with our \u201cupstream\u201d vendors. One example is how OCLC researches, manages, and purchases SSL certificates on behalf of our EZproxy<\/a> customers. Our efforts help prevent phishing and data breaches. I recommend doing this with your IT providers (like OCLC and other vendors), and on behalf of your staff and end users.<\/li>\n<\/ol>\n

    Keeping systems updated requires training, too<\/h2>\n

    Lastly, I\u2019d like to stress the importance of keeping your systems updated. That includes the ones you install yourself, and those that you work on through partnerships with organizations like ours. For example, after its next release, EZproxy will have built-in security protocols that can automatically detect and disable compromised user accounts, making it easier to prevent data breaches. In some cases, it may be the only system on campus that can detect compromised accounts. But guess what? If you don\u2019t upgrade to the latest version, you\u2019ll miss important new updates.<\/p>\n

    Which (now that I think about it) brings us back to training.<\/p>\n

    Like great libraries, great security starts and ends with people<\/h2>\n

    One thing I\u2019ve learned from my time working with libraries is that from the outside, people often focus on the materials\u2014the books, databases, movies, music, maps, etc.\u2014whatever content they might need on their next visit. But from the inside, we know it\u2019s the people who make the library work, and the people who come there who inspire us. It\u2019s a community first.<\/p>\n

    The same should hold true for how you think about security\u2014make it a community effort. It\u2019s not just about technology and tools, but privacy, safety, efficiency, and reliability. So, if you understand why your staff and users need to be informed, the how and what will follow.<\/p>\n

    \n

    Learn more about cybersecurity from Anthony in a\u00a0<\/em>recent webinar<\/em><\/a>. To get the latest EZproxy updates, visit oc.lc\/ezproxy<\/a><\/em>.<\/p>\n

    \n