1
00:00:00,350 --> 00:00:06,600
In the next few minutes, you'll learn the five security rules every Northmere employee and contractor must follow.

2
00:00:06,600 --> 00:00:12,165
You'll also learn how to spot a phishing message and exactly what to do when something goes wrong.

3
00:00:12,515 --> 00:00:17,059
Northmere holds customers' addresses, delivery records and payment details.

4
00:00:17,059 --> 00:00:21,017
You might think security incidents start with clever hackers.

5
00:00:21,017 --> 00:00:27,900
In fact, most start with one person clicking a link, reusing a password or leaving a laptop unlocked.

6
00:00:28,250 --> 00:00:31,728
Everything comes down to five rules that apply to everyone.

7
00:00:31,728 --> 00:00:34,591
Use a strong password and two-step sign-in.

8
00:00:34,591 --> 00:00:36,813
Stop and check before you click.

9
00:00:36,813 --> 00:00:38,890
Lock your devices when you leave them.

10
00:00:38,890 --> 00:00:44,662
Keep customer data in approved systems, and report problems fast.

11
00:00:45,012 --> 00:00:45,619
Rule one:

12
00:00:45,619 --> 00:00:50,808
your work password must be at least 14 characters long, and used nowhere else.

13
00:00:50,808 --> 00:00:54,177
Let the company password manager keep track of it.

14
00:00:54,177 --> 00:01:00,509
Two-step sign-in, a second check on top of your password, is required on every work account.

15
00:01:00,859 --> 00:01:02,763
Rule two is about phishing:

16
00:01:02,763 --> 00:01:05,300
fake messages designed to trick you.

17
00:01:05,300 --> 00:01:09,557
Watch for pressure to act now, like an account closing in 30 minutes.

18
00:01:09,557 --> 00:01:12,267
Look for a sender address that's slightly wrong,

19
00:01:12,267 --> 00:01:14,679
a request to skip the normal process,

20
00:01:14,679 --> 00:01:18,124
or a link that goes somewhere unexpected when you hover over it.

21
00:01:18,474 --> 00:01:20,962
If a message makes you unsure, pause.

22
00:01:20,962 --> 00:01:23,385
Don't reply and don't click anything.

23
00:01:23,385 --> 00:01:26,756
Instead, use the Report phishing button in your email,

24
00:01:26,756 --> 00:01:30,384
or forward it to security at northmere dot example.

25
00:01:30,734 --> 00:01:31,492
Rule three:

26
00:01:31,492 --> 00:01:34,385
lock your screen every time you step away,

27
00:01:34,385 --> 00:01:38,971
and never leave a laptop or phone in a vehicle overnight.

28
00:01:38,971 --> 00:01:39,776
Rule four:

29
00:01:39,776 --> 00:01:42,913
keep customer data in approved systems.

30
00:01:42,913 --> 00:01:47,309
That means no personal email, no personal cloud storage,

31
00:01:47,309 --> 00:01:51,034
and no pasting it into tools the company hasn't approved.

32
00:01:51,384 --> 00:01:52,348
Rule five:

33
00:01:52,348 --> 00:01:53,794
report it fast.

34
00:01:53,794 --> 00:02:00,730
If something looks wrong, report it within one hour, even if you're not sure, and even if it was your mistake.

35
00:02:00,730 --> 00:02:07,408
Speed matters, because the company may have to tell the customer and the regulator within 72 hours.

36
00:02:07,758 --> 00:02:09,926
Here's what to do when something goes wrong.

37
00:02:09,926 --> 00:02:12,784
Clicked a link or entered your password?

38
00:02:12,784 --> 00:02:17,998
Change it straight away, then call the IT security line on extension 911.

39
00:02:17,998 --> 00:02:20,166
Lost a laptop, phone or badge?

40
00:02:20,166 --> 00:02:26,163
Call that line at once, at any hour, so the device can be locked and wiped remotely.

41
00:02:26,163 --> 00:02:28,770
Sent customer data to the wrong person?

42
00:02:28,770 --> 00:02:30,240
Don't fix it yourself;

43
00:02:30,240 --> 00:02:31,108
report it.

44
00:02:31,458 --> 00:02:34,177
You will not be punished for reporting a mistake,

45
00:02:34,177 --> 00:02:37,459
but hiding one is a disciplinary matter.

46
00:02:37,459 --> 00:02:39,921
And timing changes everything.

47
00:02:39,921 --> 00:02:44,844
An incident reported in the first hour is usually contained.

48
00:02:44,844 --> 00:02:47,752
One found a week later rarely is.

49
00:02:48,102 --> 00:02:49,573
Working away from the office?

50
00:02:49,573 --> 00:02:58,516
Use the company VPN, a protected connection to company systems, on any network that isn't ours, including home and hotel Wi-Fi.

51
00:02:58,516 --> 00:03:02,412
Don't work on customer data where your screen can be seen, such as on a train.

52
00:03:02,412 --> 00:03:04,364
And use only company devices;

53
00:03:04,364 --> 00:03:08,736
personal laptops and tablets aren't allowed for customer data.

54
00:03:09,086 --> 00:03:13,620
Every employee follows the five rules and completes this training once a year.

55
00:03:13,620 --> 00:03:19,643
Managers make sure new starters complete it in their first week, and remove access on a leaver's last day.

56
00:03:19,643 --> 00:03:25,156
IT security answers every report within one hour and runs a phishing test each quarter.

57
00:03:25,505 --> 00:03:26,109
To recap:

58
00:03:26,109 --> 00:03:29,593
use a strong, unique password with two-step sign-in.

59
00:03:29,593 --> 00:03:31,610
Stop and check before you click.

60
00:03:31,610 --> 00:03:35,791
Lock your devices and keep customer data in approved systems.

61
00:03:35,791 --> 00:03:39,485
And if anything looks wrong, report it within the hour.

62
00:03:39,485 --> 00:03:49,022
Breaking the policy on purpose or repeatedly can lead to disciplinary action, and the full policy, IS-01, is on the intranet under Policies.