WEBVTT

1
00:00:00.350 --> 00:00:06.600
In the next few minutes, you'll learn the five security rules every Northmere employee and contractor must follow.

2
00:00:06.600 --> 00:00:12.165
You'll also learn how to spot a phishing message and exactly what to do when something goes wrong.

3
00:00:12.515 --> 00:00:17.059
Northmere holds customers' addresses, delivery records and payment details.

4
00:00:17.059 --> 00:00:21.017
You might think security incidents start with clever hackers.

5
00:00:21.017 --> 00:00:27.900
In fact, most start with one person clicking a link, reusing a password or leaving a laptop unlocked.

6
00:00:28.250 --> 00:00:31.728
Everything comes down to five rules that apply to everyone.

7
00:00:31.728 --> 00:00:34.591
Use a strong password and two-step sign-in.

8
00:00:34.591 --> 00:00:36.813
Stop and check before you click.

9
00:00:36.813 --> 00:00:38.890
Lock your devices when you leave them.

10
00:00:38.890 --> 00:00:44.662
Keep customer data in approved systems, and report problems fast.

11
00:00:45.012 --> 00:00:45.619
Rule one:

12
00:00:45.619 --> 00:00:50.808
your work password must be at least 14 characters long, and used nowhere else.

13
00:00:50.808 --> 00:00:54.177
Let the company password manager keep track of it.

14
00:00:54.177 --> 00:01:00.509
Two-step sign-in, a second check on top of your password, is required on every work account.

15
00:01:00.859 --> 00:01:02.763
Rule two is about phishing:

16
00:01:02.763 --> 00:01:05.300
fake messages designed to trick you.

17
00:01:05.300 --> 00:01:09.557
Watch for pressure to act now, like an account closing in 30 minutes.

18
00:01:09.557 --> 00:01:12.267
Look for a sender address that's slightly wrong,

19
00:01:12.267 --> 00:01:14.679
a request to skip the normal process,

20
00:01:14.679 --> 00:01:18.124
or a link that goes somewhere unexpected when you hover over it.

21
00:01:18.474 --> 00:01:20.962
If a message makes you unsure, pause.

22
00:01:20.962 --> 00:01:23.385
Don't reply and don't click anything.

23
00:01:23.385 --> 00:01:26.756
Instead, use the Report phishing button in your email,

24
00:01:26.756 --> 00:01:30.384
or forward it to security at northmere dot example.

25
00:01:30.734 --> 00:01:31.492
Rule three:

26
00:01:31.492 --> 00:01:34.385
lock your screen every time you step away,

27
00:01:34.385 --> 00:01:38.971
and never leave a laptop or phone in a vehicle overnight.

28
00:01:38.971 --> 00:01:39.776
Rule four:

29
00:01:39.776 --> 00:01:42.913
keep customer data in approved systems.

30
00:01:42.913 --> 00:01:47.309
That means no personal email, no personal cloud storage,

31
00:01:47.309 --> 00:01:51.034
and no pasting it into tools the company hasn't approved.

32
00:01:51.384 --> 00:01:52.348
Rule five:

33
00:01:52.348 --> 00:01:53.794
report it fast.

34
00:01:53.794 --> 00:02:00.730
If something looks wrong, report it within one hour, even if you're not sure, and even if it was your mistake.

35
00:02:00.730 --> 00:02:07.408
Speed matters, because the company may have to tell the customer and the regulator within 72 hours.

36
00:02:07.758 --> 00:02:09.926
Here's what to do when something goes wrong.

37
00:02:09.926 --> 00:02:12.784
Clicked a link or entered your password?

38
00:02:12.784 --> 00:02:17.998
Change it straight away, then call the IT security line on extension 911.

39
00:02:17.998 --> 00:02:20.166
Lost a laptop, phone or badge?

40
00:02:20.166 --> 00:02:26.163
Call that line at once, at any hour, so the device can be locked and wiped remotely.

41
00:02:26.163 --> 00:02:28.770
Sent customer data to the wrong person?

42
00:02:28.770 --> 00:02:30.240
Don't fix it yourself;

43
00:02:30.240 --> 00:02:31.108
report it.

44
00:02:31.458 --> 00:02:34.177
You will not be punished for reporting a mistake,

45
00:02:34.177 --> 00:02:37.459
but hiding one is a disciplinary matter.

46
00:02:37.459 --> 00:02:39.921
And timing changes everything.

47
00:02:39.921 --> 00:02:44.844
An incident reported in the first hour is usually contained.

48
00:02:44.844 --> 00:02:47.752
One found a week later rarely is.

49
00:02:48.102 --> 00:02:49.573
Working away from the office?

50
00:02:49.573 --> 00:02:58.516
Use the company VPN, a protected connection to company systems, on any network that isn't ours, including home and hotel Wi-Fi.

51
00:02:58.516 --> 00:03:02.412
Don't work on customer data where your screen can be seen, such as on a train.

52
00:03:02.412 --> 00:03:04.364
And use only company devices;

53
00:03:04.364 --> 00:03:08.736
personal laptops and tablets aren't allowed for customer data.

54
00:03:09.086 --> 00:03:13.620
Every employee follows the five rules and completes this training once a year.

55
00:03:13.620 --> 00:03:19.643
Managers make sure new starters complete it in their first week, and remove access on a leaver's last day.

56
00:03:19.643 --> 00:03:25.156
IT security answers every report within one hour and runs a phishing test each quarter.

57
00:03:25.505 --> 00:03:26.109
To recap:

58
00:03:26.109 --> 00:03:29.593
use a strong, unique password with two-step sign-in.

59
00:03:29.593 --> 00:03:31.610
Stop and check before you click.

60
00:03:31.610 --> 00:03:35.791
Lock your devices and keep customer data in approved systems.

61
00:03:35.791 --> 00:03:39.485
And if anything looks wrong, report it within the hour.

62
00:03:39.485 --> 00:03:49.022
Breaking the policy on purpose or repeatedly can lead to disciplinary action, and the full policy, IS-01, is on the intranet under Policies.