Bank of America Custom Supplement - S7

Back up information and databases regularly, and be sure
that all software being used has the latest updates and
patches. Make sure basic operating systems are supported
with security updates - and if they can't be supported,
upgrade to newer software.
Don't forget about the connected devices that make up
the Internet of Things. Identify, classify and locate all
IoT devices connected to the dealership network, and be
sure to keep them secure. IT staff should be responsible
for restricting the access of IoT devices to the broader
network, for keeping the software on those devices
updated and for making all employees aware of IoT
security concerns.
Keep third-party vendor lists updated and regularly reevaluate
vendor access to dealership computer networks. Ask to review
each vendor's own security and backup processes.
Use email filtering software to help identify spam and
fraudulent email designed to trick or compromise employees.
Filtering software analyzes incoming messages, searching for
suspicious header and domain information - for instance, an
email apparently from a company executive that comes from
an external account is an immediate tipoff to directly verify
that request with the executive.
Consider asking criminals' key targets - including executive
assistants, payroll, HR, treasury and F&I staff - to limit the
personal business-related information they share online.
Those bits of personal information can be used to prey
upon employees and fraudulently gain their trust.
Create and carry out a formal process and written plan to
respond to a data breach. Make a list of employees needed
as a response team, and don't forget to include IT, legal
and communications/public relations experts.

Offer a refresher course on
cyber security to all employees
at least once a year
Educate employees about how to keep their personal
phones safe. That includes basic security protocols like
password management, automatic software updates and
multifactor authentication.

Provide a security checklist for employees
working from home or on their personal
devices. That might include salespeople
checking a phone while on a test drive or
a back-office employee working remotely.
The list should begin with these items:
* Every employee should be aware of the
dealership's data privacy policies and make it
a priority to protect customer information.
* Try to avoid printing confidential customer
files at home. If it's necessary to print out
a client record, be sure to keep paperwork
private from family and friends and to
securely dispose of all printouts after use.
* Do not allow anyone else - family, friends
or customers - to use a work-issued device
for any reason, and make sure to turn off the
device when not in use.
* When working off-premises or even away
from your desk, practice cyber security best
practices. Avoid public Wi-Fi and charging
stations, don't transmit sensitive information
over personal devices, and make sure
computer and phone screens are not visible
through a window or to anyone else.
* Regularly back up information on company servers.

Finally, offer a refresher course on cyber security to all
employees at least once a year, with information about
new and emerging threats and best practices. When it
comes to cyber security, there's always something new to
learn, because cyber criminals are always presenting new
approaches. Even the most robust process won't work
without continual updates. The safest business is one
that's aware of what's new.
In extraordinary circumstances, a dealership should be
prepared with accelerated and ongoing training to keep
employees and data safe.
A secondary benefit of regular cyber security training and
awareness is that it can help foster a culture of security
across a company. Everyone feels part of the initiative,
and everyone can feel safer.
BANK OF AMERICA

7
Bank of America Custom Supplement

Table of Contents for the Digital Edition of Bank of America Custom Supplement
