Cyber Risk Management

As a leader in our organization, you have trusted access to highly confidential and proprietary information. This makes you and your administrative support staff prime targets for cyber attackers. Your actions set the standard for
our entire organization. By consistently following these security best practices, you demonstrate a commitment to protecting our Company, associates and stakeholders.

Cybersecurity is shared responsibility. To help keep cybersecurity top of mind, we’ve put together some important best practices that will ensure you and your staff are able to safeguard valuable information and protect our Company.

Incident Notification

If you or your staff notice anything suspicious—such as unexpected requests, unusual system behavior, or possible data loss—report it to the Information Security team immediately.

Password Protection

Protect yourself with strong, unique passwords for each of your accounts at work and at home. Keep your personal and work passwords different. Never share your passwords with anyone else and never ask an employee for their password.

Always enable multi-factor authentication (MFA) on your accounts, especially those with access to sensitive or financial information. MFA provides an extra layer of protection even if your password is compromised. Use Passkey whenever it is available.

Social Engineering Attacks

Cyber attackers will tap into widely available personal and behavioral data online to profile high-level individuals like you with access to the systems or information they need. The realistic messages they craft are designed to trick you into providing highly sensitive information (e.g., employee tax forms), opening an infected attachment or clicking on a malicious link.

Make sure you and your administrative staff know the indicators of these targeted attacks and always follow our security procedures; they are designed to protect you from targeted attacks like these.

Device Security

Only use secure, authorized devices for work activities and make sure they are protected with a screen lock.

Third-Party and Supply Chain Security

Be vigilant about communications from vendors or partners. Attackers may attempt to compromise our Company through third parties. Verify any unusual requests or changes in vendor communication.

Security While Traveling

When traveling, avoid using public Wi-Fi for work activities. If you must connect, use the Company-approved VPN. Never pack computing devices in checked luggage or leave devices unattended.

Artificial Intelligence (Al) Awareness

Al can capture a recording of your voice and use it to create audio that sounds like you to impersonate you. Using this, a cyber attackers could attempt to trick your coworkers into acting. Be cautious of your cyber footprint and remind your teams if something doesn't seem right, say something.

Smishing

SSmishing is very similar to a phishing email but is sent via text (likely to your personal device). Remember: Any request for money should be verified through an alternate contact method before complying. Look out for requests that are overly familiar in tone, have spelling or grammatical errors, or have an urgent timeline. Requests for credentials, especially passwords or PINs, or messages that include links to login pages are indicators as well. Finally, be careful about sharing personal information, such as your cellphone number or email on public sites like Linkedin.

Social Awareness

Be very careful of any personal information you post to your social media accounts like LinkedIn and Twitter. Do not publicly announce your location when you are traveling. This information can easily be harvested and used to target you or our Company.

If your user account, data or any of your devices have been lost, stolen, or you suspect they may have been compromised, notify Information Security know right away.

Leading by example is a crucial part of your role and as an executive steward of Information Security.

Our security policies and practices are designed to protect you, our Company and its data assets. Promote security awareness within your organization. Contact Information Security whenever you have questions or concerns.