How To Build Trust With Customers Through Your Security Posture

January

How To Build Trust With Customers Through Your Security Posture

January 28, 2021

We all know that trust, openness, and transparency are vital to organizations, whether they are municipal governments or operate in the private sector.

The more customers that trust in what you do, the more likely they are to use your services and speak of you positively to family and friends.

This trust also extends to the online services you provide too. The more secure that your customers feel, the more likely they are to transact online, pay online, and trust you to hold their confidential data.

In this article, we will look at what a security posture is, how it can encourage trust in what you do, and the steps you can take to implement a robust security posture in your organization.

What is security posture?

A security posture is an overview of your organization’s security measures. It includes, but is not limited to:

A list of your software and hardware assets. This list needs to include not only the assets you have on-site but anything in the cloud, as well as assets managed by third parties
A list of your networks
A list of the online services you provide and where the data is stored
A list of all the security controls in place, and how effective they are
The potential cybersecurity risks that could affect your organization

It seems like a lot of information to handle, but the more you know about your assets, and the potential risks they bring, the lower the risk of cyberattack.

Why can having a strong security posture encourage digital payments?

91% of on-line visitors are concerned about the privacy of their data. This means it is vitally important to give them reassurance that if they make a payment on your website or through your app, their data will be secure and not at risk of being compromised.

One business is attacked by cybercriminals every 40 seconds — the risk of hackers trying to target your business is high and growing. This risk is increased if you are a high-profile government organization, as hackers often see government systems as an easy target.

There have been many high-profile examples of government organizations being affected by cyberattacks, like when Riviera Beach in Florida had to hand over $600,000 to hackers.

Customer data is not just at risk from cybercriminals either. Staff and third parties could potentially intercept customer information, either unintentionally or maliciously.

If your customers’ bank details are compromised through your application, you may never regain their trust and your brand will surely suffer.

Having a thorough security posture in place will help you to identify the potential vulnerabilities in your own systems and fix them before hackers can exploit them.

How you can implement a security posture that will inspire trust from your customers

You may already have a rudimentary security posture in place, or you may not have one at all. If this is the case, what can you do to strengthen it and improve the security of your online services?

Here are our top five tips.

1. Start off with a detailed audit

When you are determining your security posture, the best place to start is to audit your company assets. After all, if you don’t know what you have in place, you won’t know what to protect.

When you have your list of assets, you need to ask questions for each asset you have, including:

How old is the asset? Some assets deteriorate and become unsupported by manufacturers over time. This makes them more high-risk
Where is the asset located, and what servers does it use?
Who uses the asset?
What software and operating systems run on it?
Is data stored on the asset, or sent to the asset, encrypted at rest and in transit?
How often is the asset backed up, and where are the backup files stored? Are the backups encrypted?
How high priority is the asset? Some assets are more essential than others
How is the asset protected, both physically and/or digitally? For example, is it in a locked room or protected with two-factor authentication?

Although collating this information will take time, it will give you valuable insight into your security posture and help you identify vulnerabilities in your organization.

If you need to, bring in security experts. If you do not have an IT team or they do not have experience carrying out audits, an expert can put your organization on the right track and show your team what they need to do. As your security posture matures, you may also want to consider pursuing a SOC 2 Type 2 third-party audit to further improve, test, and verify your security controls.

2. Update your posture regularly

Once you have your asset list, you need to make sure it is kept updated. The frequency you do this will depend on your organization and how many assets you have to review. If you introduce an updated server or brand new hardware for staff, be sure to refresh your list.

As well as updating your asset list, you need to keep up to date with threats. New cybersecurity threats regularly emerge, so being aware of new developments will mean your IT team can adapt and secure any relevant assets. Social media, newsletters, and podcasts are great ways to keep up to date with all the latest news and developments in the security industry.

According to PwC, only one in three businesses are confident that they are aware of all cyber threats that may affect them, so you need to take the time to eliminate any potential issues before they become major problems.

3. Be aware of all the third parties you use

If third parties like contractors and suppliers have access to any of your data, you will need to factor them into your security posture too.

Third parties are the second leading cause of data breaches, so you need to make sure any suppliers are monitored closely, and you are aware of what information they can access.

When you start working with a third party, ask to see their security policies and accreditations, and don’t be afraid to ask questions to ensure they have thorough processes in place. Where applicable, ask to see their PCI DSS and SOC2 Type 2 Reports.

If you are using a company to dispose of old assets, ensure you use a certified company that will adequately destroy any data and not sell it to 3rd parties. This shocking report showed that out of nine used hard drives that were purchased, they all contained personal data including banking details and medical records.

4. Advise your staff of the part they play

Does your staff use their work laptops at their local coffee shop? Do they forget to lock their computers when they go home for the day? Do they check their personal emails when they’re in the office?

If this is the case, there is the risk that they could inadvertently weaken your security, making it easier for cybercriminals to exploit vulnerabilities and access customer data.

You need to make your staff aware of security and privacy issues and have clear policies in place.

According to PwC, only 34% of businesses have security awareness training programs in place for staff, so make sure that your employees know the advantages of good data hygiene and security and make sure that your security awareness programs are continuous, with annual training.

You can also bring in measures to make it easier for staff to keep data safe. For example, if they have a printer in their office, make it so they have to enter a password to get their printout. This means potentially sensitive information is not left in the printer tray where anyone can pick it up.

5. Tell customers what you are doing to keep their data safe

When you have a healthy security posture in place, you need to advertise this to your customers. This is what will inspire trust in your customers and encourage them to carry out payments online.

Have a page on your website where you explain what you do to keep data safe and the security measures you have in place. Implementing TLS encryption with an industry-standard configuration is mandatory both for regulatory compliance and to inspire confidence in your payment system.

In the worst-case scenario that you are affected by a data breach, tell your customers straight away and advise what you are doing to mitigate and correct the issue. Although 57% of customers will stop doing business with an organization if they do not handle their data responsibly, being open and transparent will increase the chances of regaining their trust.

In summary

In the modern age, customers are becoming more and more mindful of how businesses handle their data. Even if a data breach is not the direct fault of an organization, it can still have many negative consequences including a loss of trust, negative publicity, litigation, and fines for breaching regulations like the California Consumer Privacy Act (CCPA).

Take the time to review all of your assets and identify potential vulnerabilities before they become issues. By doing this, you will increase the number of digital payments on your website and applications, make your customers happy and safe, as well as reduce the amount of administration across your offices.

Sources: