We'll start by discussing the kind of behavior you might find from an oblivious, non-malicious insider threat. Oblivious employees aren't motivated by any desire to cause harm, or even by laziness or resistance to protocol; they simply don't understand that the actions they're taking, or forgetting to take, cause holes in their organization's security.

Unattended computers are a hazard

One classic form of oblivious behavior is leaving computers unattended when outside the organization – I've seen this many times at conferences, even security conferences. People go and check in their laptops along with their coats! They hand the laptop over for a checkout ticket, getting a false sense of security and trust because they've got the checkout ticket in their possession. That makes them feel like the laptop's safe; when really, it's been taken by an individual you don't know, to a place you can't see.

This happens at restaurants as well, and it's obviously risky behavior, especially for an executive. They might think that they don't want to bring the laptop case to their table because it's more secure with the checkout kid in the coat check. This is not a rational decision, but people can convince themselves of almost anything. In fact, I've seen people ask the bartender to put their devices under the bar. There's zero protection, but we've been socially engineered to think if it's OK for my coat, why not my computer? Let me make it clear—even in secure establishments, it's terrible cyber hygiene to leave your computer in somebody else's hands.

Many employees are under the impression that leaving a computer with someone else is totally fine as long it's off. This is a common mindset–if it's turned off, it's safe. In reality, that's patently false, as any computer can be accessed and hacked even when turned off, through a cold boot attack. Any device that has privileged company information on it needs to be locked down at all times when it's not in the hands of the designated employee.

Maintaining privacy while working remotely

Another risky behavior is not thinking about someone peering over your shoulder. Often, employees do not understand the need for privacy screens on computers, tablets, and smartphones when working remotely. This phenomenon becomes most problematic when working remotely on confidential documents in public places such as airports and coffee shops.

Employees need to understand that there are many ways for a breach to happen after some looks over your shoulder to see what you are working on. It only takes a few seconds for someone to grab your credentials, such as your username or password.

Even worse, they can use any information they can gather for a phishing or social engineering attempt. Avoid these pitfalls by investing in a privacy screen. It's an inexpensive and practical way to keep your documents and credentials confidential in a public setting.

Carrying around sensitive information

Yet another risky behavior that we see among employees is carrying around unnecessary sensitive or confidential data on one's computer, tablet, or smartphone. It's easy to imagine an employee who's finished a project, no longer views information about it to be sensitive because it's finished, and who doesn't bother to delete it from their device. Alternatively, think about what happens when an employee upgrades their device to a new one – and doesn't wipe the old one. This happens every day across the globe, as people sell used equipment that still contains sensitive information.

For example, there have been cases reported in which unwiped remote access equipment was sold online, and gave access to sensitive information that put the company at risk. That was only discovered due to the honest nature of the buyer. A worse scenario is what would happen if you sold a used VPN remote access kit that wasn't properly wiped. This could potentially give the buyer access to the entire network, with live data.

To reduce risk, protocol should be stringent, and demand full deletion of sensitive or confidential information the moment the employee does not need access to it. Human behavior is tied to meaningful information. If the information is no longer meaningful to an employee, the level of discretion and importance of protecting that information drops. Without a firm protocol to follow, it's easy to forget to delete "old" data, and eventually that will open up a straight line of access to someone who wants to lift that information.

Whether information is old or new, it remains very valuable in the eyes of a hacker. It's obvious why new information is valuable; but bad actors can also use old information to gain the trust of someone else within the organization. Leveraging that trust, they can gain access to everything, using intel acquired from seemingly outdated information.

The good Samaritan – beware of unintentional risky behavior

Another pitfall is an oblivious employee unintentionally becoming an attack vector themselves. For example, picture an employee driving to work on a Monday morning. They park their car and proceed to walk into the building. By the front door, they see a USB drive with the company logo printed on it. They pick it up thinking it may have some valuable company information on it. So, like a good employee, they walk it into the building and bring it to their office. Then they plug it into their computer to see what information was on there, in order to figure out which person needs their drive back. While the oblivious employee's intentions were honorable at every step, this remains a clear example of a non-malicious insider threat.

The USB in question could very easily be a hacker's way of social engineering their way into an organization. This is a simple but powerful social engineering technique, similar to the baby shower cake example. Something as simple as a USB drive with a company logo that became immediately trusted because of a logo. It belonged, it was familiar, it felt safe—never mind that the hacker loaded a USB with malware hoping an employee of the company would plug it into the network.

Betting on the "good Samaritan theory" – that a noble person would plug it into the network to identify its rightful owner, since it had the markings of the organization imprinted on it – it would seem, "the right thing to do." Best practice here would be to take the USB drive and deliver it to the security team in the organization and explain how and where it was found.

Oblivious behavior is in some ways easier to deal with – the employee doesn't know that their behavior is threatening to the organization, and if they're educated properly and become part of a security culture, those behaviors will stop. Negligent non-malicious behavior, on the other hand, is when the employee knows that their action causes a security risk. They simply underestimate the risk, and overestimate the convenience of the risky action. These employees need to be convinced not just of what to do, but also of how important it is that they do it, and the possible consequences of not following the protocol.

Leaving the door open – the problem with recycled passwords

Coming up with a new password is often a task one faces without preparing for it – a reminder pops up and, suddenly, you need to invent a password. This leads to negligent employees using the same passwords and usernames that they've already used for websites and other accounts. This, unfortunately, is a very common problem in most organizations. More often than not, employees utilize the same two or three passwords and usernames across all their accounts, as well as the websites they visit.

These habits often jump from personal devices to company devices. People mistakenly believe that they can use the same username and password for both their personal and work life because they're not connected. After all, it can be hard to remember so many passwords and logins, so it's easier just to standardize them across the board.

Herein lies the problem: Bad actors can first hack unprotected or lightly protected websites to gain access to the list of usernames and passwords. After swiping that information, they can use this list for the real targets where they're hoping to gain access. Traversing these steps, they're counting on the fact that one or more accounts and their access will line up exactly.

Unfortunately, the prevalence of recycled passwords means hackers have pulled this off many times. For example, hackers used an employee's recycled password they obtained from a past LinkedIn breach to access information on 60 million accounts from Dropbox.

I've found it's incredibly important educate your employees about the dangers of reusing passwords and usernames. Instead, have them utilize a password-encrypted app or password minder if they have trouble remembering too many of them. You can also make use of multifactor authentication, which is an important, reliable vector for identity and trust.

Not to be shared – a password should remain secret

Another big problem you'll face is maintaining the personalization of your employees' passwords. A password is what is means – your access to where you need to go. Sharing passwords, especially administrative credentials, is a sure way to cause a breach. Even if you keep your passwords in an encrypted password keeper, you can't share them. When a negligent employee shares their passwords, they've just left another door open for the leakage of information through human error. Even with a trusted person, the chance of human error doubles when a password is passed to just one person other than the intended user.

Walking through executive suites on my way to deliver presentations, I've seen passwords on Post-it notes attached to the desks or screens of employees. Trying to lighten the mood while giving a stern warning, I would bring up how openly displaying passwords is a prime example of poor cyber hygiene. The misguided response was enough to make me cringe: putting passwords on Post-its was totally permissible, because it's the executive suite and only executives are allowed in this area. Therefore, they trusted employees who would traverse that allegedly secure area.

I could hardly believe their retorts. I pointed out that I was walking there freely, just like anyone else invited to meetings there. Scores of people likely did the same, and they would now have these passwords that could grant access to everything. Never mind the nightly cleaning crew, or any other third-party vendor who came to perform repairs or install something new. Access was right there for them as well, if they choose to use the information right in front of them.

This nearly comical blunder is seen in many kinds of organizations, including finance, healthcare, security, and many more. Entry into an organization's network can come from any point, even one as simple as a password on a lifted Post-it that was attached to a computer or desk.

The takeaway is clear: Never share passwords, and never keep them in a place where they can be lifted and used by others.

Failure to report a lost or stolen device

Another form of risky behavior arises when employees fail to report lost or stolen laptops, smartphones, or USB drives that contain confidential data in a timely manner. Employees might be dissuaded from reporting such an event because they're fearful of repercussions, afraid of losing their job, or didn't even realize that anything was missing. All three of these cases are negligent, but the first two are far more common.

I can't stress enough how much timely reporting is critical in minimizing the risk of a breach. The sooner the organization knows, the sooner they can act to protect themselves. Linking back to the discussion about training and global awareness steps to achieving cyber hygiene, it's imperative to have open and honest communication with all of your employees.

Having the foundational discussions around all areas including human error will prove to be very valuable. Lay the groundwork for an organization where employees understand that human error absolutely will occur, and when it does, they'll work together as a team to minimize the fallout and mitigate risk.

Unsecured Wi-Fi is a no-go

It might be convenient, but accessing Wi-Fi via unsecured wireless networks is a big no. This a common and commonly accepted protocol for employees to follow, but most people do it anyway, without taking a moment to realize the consequences of their actions.

In reality, it's a very risky behavior; but the draw to engage in this behavior, the sheer convenience, remains a powerful motivator. Imagine yourself sitting in a coffee shop, or at the airport and remembering those last few emails you just have to get out. Let's face it: VPN-ing is not at the forefront of your mind when you want instant access to Wi-Fi.

In fact, tests conducted around public Wi-Fi and the public's love for it have found that finding free Wi-Fi feels like a win in most people's book. There have even been instances where the Wi-Fi names were obviously malicious, like IwillStealYourData, IamAHacker, or DataGrabber, and even that didn't stop most people. People clicked on it to grab the free Wi-Fi without stopping to think if it was a smart choice to do so. For the bulk of folks, convenience and speed outweigh any thoughts around security.

No one has the mindset that they will be the ones to get hacked or breached. We often fall into the trap of wishful thinking that there have to be more compelling targets than us, and we can't be that important in the grand scheme of things. This line of thinking is incorrect.

In general, hackers cast a wide web and try to garnish as much information from as many people they can at once and will later attempt to make that data work for them. In sum, everyone who accessed these Wi-Fis are at risk.

To avoid creating unnecessary risk, always have your employees securely VPN in, and discourage public Wi-Fi use. In the end, grabbing information via a public Wi-Fi is just a popular and easy way into your organization for hackers to use. Another way into your organization, which makes use of a combination of oblivious and negligent behaviors by your employees, is social media.

Many people don't realize that social media is one of the biggest portals for data breaches, phishing attempts, and social engineering. Given that social media has many risks from many different vantage points and plays an outsized role in modern life, let's explore every angle of the risks in detail.

As a rule of thumb, when it comes to using social media within an organization, employees will feel secure for the most part because they believe that they're safe at work. From an employer perspective, organizations may be under the impression that by having a firewall they can stop access to some social media sites during work hours. Those who believe this have obviously not thought about the realities of living in an age of BYOD (Bring Your Own Device).

We all know BYOD has become very popular in recent years because we all do it. Many of us carry around two phones: a work phone and a personal phone. Inevitably, we bring both into the work environment. Perhaps we even bring our own laptop to the workplace, because we feel more comfortable on a device we purchased ourselves. BYOD means that any attempts to stop employee use of social media during work hours are probably dismal failures.

Social media use is inevitable, but the kind of oversharing that undermines your cybersecurity is avoidable. Your employees need to fully understand the risks involved in oversharing and how their innocent actions can have dire consequences.

When information is overshared, or privileged information is shared online, via social media, it typically falls under the non-malicious insider threat category. Management can attempt to monitor work accounts or handles, but in most cases they are unable to keep tabs on their employee's personal accounts. Much to the chagrin of cybersecurity professions, the vast majority of information leakage through social media comes from personal accounts when employees are on lunch break, weekends, or even on vacation.

Preventing oversharing

To prepare companies for this brave new world, I cofounded SecureMySocial several years ago. SecureMySocial is a technology-assisted self-monitoring tool for employers to give to employees, to help them self-monitor themselves across social media.

There is no big-brothering involved, with real-time warnings and auto-delete capabilities if authorized. You can group employee rules and notifications based on their section of the business, whether it's M&A, HR, Finance, and so on. Using that categorical information, rulesets are deployed that are applicable to them. Moreover, there are no false positives, and warnings are sent to the user's own choice of personal email or SMS.

The program reminds them, in real-time, if information was put out there that would cause data leaks or reputational harm to the organization. It then gives the employee the ability to rectify the situation all in real time, as rapidly reversing any type of leak as swiftly as possible is critical to minimize the risk and damage.

Remember that leakage of information is not typically malicious; it is a way of communicating and sharing. We live in a world where sharing is part of being present and belonging. The more we share, the more relevant we are, the more social we are, the more impact we have, the more we will be noticed and recognized, and the more we become part of the social community. Social media self-monitoring tools allow your employees to think for just a moment longer about what they're posting, and why; it doesn't take away their ability to use social media effectively. Constant sharing is a new area of social life, at the heart of Millennial and Gen Z culture, and it's not going away any time soon.

A real-life example of oversharing on Facebook

Some time ago, I came across an example of how someone can think they're engaging in harmless social media usage, when in reality they're oversharing, and creating an entry point for a breach. At the time, I was doing some consulting for a bank, which was implementing a new piece of internal security in its organization.

One of the bank's engineers, who was part of the implementation group, ran into some difficulty implementing the new security solution and getting it to flow through the organization.

How did he troubleshoot when he ran out of ideas? He did what he typically did when he had questions to be answered, or problems to be solved. He went onto Facebook, where he connected and communicated with a lot of his engineering friends. He posted his questions about the security issues and technological problems he was having while implementing the new security solution, and about the difficulty his team was having getting it to work. He asked if anyone worked with that particular security, and if they had, could they give him some pointers. To him it was an innocent act, merely asking his peers for advice, just so happening to use social media as his medium of communication. At this point, it's important that we don't just blame this guy for oversharing; the bank was not practicing proper cyber hygiene, and did not have appropriate security and communication protocols in place.

Take a moment and imagine the sheer size of the audience for this information, about exactly what new security was being put in place, and exactly what troubles the implementing team were having with it. In a moment, that information was made available to his friends, the friends of his friends, their family members, and so on. The number of people who now had access to all this information could be in the millions. It could have led to a devastating breach. To be clear, this security was never forward facing, and should never have been known by outside parties.

In this specific case, disastrous outcomes were avoided when the company was made aware of this serious breach of sensitive information. The company quickly decided to change the security being implemented, because of the nature of the information that was shared.

As you can see, oversharing can cause massive costs and inconvenience even if it's caught in time. In this case, disaster was averted at the last minute, but it certainly convinced the c-suite of the importance of cyber hygiene, and the tools and protocols their employees needed to use social media in a safer way.

Career-focused websites are conduits too

Another innocent example of oversharing on social media would be to give too much away on LinkedIn. You probably already know that LinkedIn is used as social media for professional networking, people looking for jobs, and organizations posting ads. In most cases, users of LinkedIn display their current job, their job history, schooling, awards, certifications, and current job description as well as a wealth of other information.

Most people like to be as descriptive as possible, sharing as much information about themselves as possible, for a number of reasons: networking, being relevant for headhunters approaching them for their next opportunity, socializing with the right groups, and so on.

In some cases, putting too much information about your current role in your LinkedIn profile can cause more harm than benefit. That's because identifying your exact role in a company can, in some cases, target you as a prime candidate for a phishing or hacking attack.

Bad actors scour social media, looking for the right tidbits of information to create profiles of the people that they think would most likely fall prey to an attack. They might gather information from similar accounts, and invite the target to be part of an exclusive networking group of like-minded individuals. Human nature means people want to belong, and even more so if it involves an exclusive invite-only club.

Another example would be for a bad actor to social engineer their way into the good graces of an employee. They can accomplish this by doing their homework on the company they are targeting, which is easily done on LinkedIn. Step one is to search the employees within the organization, get their names, information, job description, and title. From that information alone, our bad actor can then identify a few employees to social engineer.

Typically, the easiest route is for the bad actor to create a fake LinkedIn account, and make themselves an imaginary employee of the company they wish to infiltrate. Their job description and title would be a few levels up from that of the target.

They would then send the target a direct message saying something along the lines of "I've noticed your work on XYZ project (having grabbed that information from a little digging) and I would love to help you grow within the company," and then send then a LinkedIn request.

The targeted employee would likely approve the connection request, since they would be under the impression that the bad actor works for the same company, knows about project XYZ, and might be a person that they need to facilitate a move up the ranks of the organization. That paves the path to a breach that will greatly damage the organization.

One simple message on social media can lead to an avalanche

It all begins with one simple message that taps into the human factors of trust or want from the targeted employee. Once trust has been established, the bad actor can start requesting a bit more information each time they communicate, all with promises to help the employee move forward in their organization. These kinds of social engineering attacks and phishing attacks are very common; it's a simple use of social engineering, to find the weakest link in the security chain – the human – and use that weakness to break into an organization.

You can prevent a great deal of heartache by educating your employees about what's at stake. Have discussions with your employees about the dangers of phishing and social engineering, and teach them how to stay vigilant on social media. It is important to be clear in employee contracts about what they're allowed to list as their position within the organization, when they put it out there for public consumption on LinkedIn, Facebook, or any other social media.

For example, it's ok to say Director, Managing Director, or even VP, but getting too detailed may prove to be problematic. It's important to note that employees take their social media very personally even as it pertains to LinkedIn, so the best thing would be to make it part of an employee agreement when signing contracts, instead of trying to have a discussion with employees who have been working there for years.

As you'll have gleaned through these examples, when your employees engage in risky behavior, they can actively undermine the thorough security protocols that you've worked diligently to put in place. Employees must understand that when they leave their workplaces, their responsibilities to protect their organizations, as well as themselves, do not cease. Everyone within the organization must practice cyber mindfulness as a way of life, no matter where they are at any given moment. Just as traditional mindfulness encourages you to be aware of your surroundings and the consequences of your actions, cyber mindfulness involves being aware of your online connections and the consequences of your digital actions.

Even at a personal level, cyber mindfulness helps you protect every single facet of your life, including your career, reputation, and family. We live in a fast-paced world where we're constantly on the go, have many duties and desires pulling at us, and are completely connected to the technology around us. When we multitask, we are spread thin, which means we need to introduce the idea of pausing and thinking before we pull a digital trigger. When we act quickly to complete mundane tasks, we often do it without a lot of forethought. If "stop, pause, and think" were ingrained in our mindset, most of these risky behaviors would be curbed, or eliminated entirely.

Over the next few chapters, we'll delve deeper by talking to the experts who will outline what you need to know about their respective fields within cybersecurity. After each interview, I'll discuss and distil these concepts to highlight critical takeaways that I personally believe will be game changers for your organization, and your cyber hygiene.

Cybersecurity is not a standalone concept, and these interviews and commentary reflect that reality. I approach the topic using as many real-world examples from my own career journey and from my interviewees' experiences as possible. These real-world anecdotes highlight problems with relatable and teachable moments, providing you with solutions that can help inform your decisions on how to approach these situations.

First, we'll tackle blockchain, a technology that's already changing the landscape of the digital world. But like any human creation, it's not foolproof. It's still in its infancy, and its real long-term impact remains to be seen.