Article 32 GDPR requires the controller and processors to take technical and organisational measures appropriate to the risk: among others encryption, confidentiality and availability of systems, ability to restore, and regular testing. Most problems, however, come from common mistakes, not from sophisticated attacks. Here are the habits that matter most.
Access and passwords
- Use long and different passwords for each service. A long phrase is better than a short, complicated word. Do not reuse personal ones for work.
- If the company offers it, use a password manager and turn on multi-factor authentication.
- Never share your credentials, not even with colleagues or support. Everyone must have their own access, because that is the only way to know who did what.
- Lock your screen when you walk away.
- Open only the data you need for your work. Looking up a customer, colleague or acquaintance out of curiosity is not work and can have disciplinary consequences and, in the most serious cases, criminal ones (for example unauthorised access to a computer system, Article 615-ter of the Criminal Code).
- Check the recipients before sending: autocomplete easily picks the wrong person with the same name.
- When writing to many people who do not know each other, use blind copy (BCC), otherwise you reveal everyone else's addresses to all.
- Health data, identity documents and other sensitive information are sent using the secure tools chosen by the company, for example password-protected files with the password sent by another channel.
- Do not write personal data in the subject line.
Paper, devices and working from home
- Keep your desk tidy and put sheets with personal data in a locked drawer or cabinet. Use the shredder or the dedicated bins, not the ordinary wastepaper bin.
- Do not save data on personal phones, USB sticks or private cloud services unless the company allows it.
- Do not paste customer or colleague data into artificial intelligence tools or online translators unless the company has approved them for that purpose: what you write can leave the company.
- At home or travelling, use a secure connection, do not leave screens visible to others, do not leave the computer in the car and do not talk loudly about customers on the train or in a café.
Phishing
Phishing is a fake message (e-mail, text, call, chat) that wants to make you click, hand over data or pay. The typical signs:
- haste or threats ("your account will be closed today");
- a sender who looks like one you know but has a slightly different address;
- a link whose address does not match the sender;
- an unexpected attachment;
- a fake "boss" asking for a bank transfer or gift vouchers, or a fake colleague asking for your credentials.
What to do:
- Do not click, open or reply.
- Check through another channel: call the sender on a number you already know.
- Report the message to IT support. If you have already clicked or entered data, say so at once: a quick report limits the damage.
The Agenzia per la cybersicurezza nazionale (ACN) (the National Cybersecurity Agency) publishes advice on cyber threats on its website.
Updates and unknown programs
Install security updates when the IT department asks. Do not install programs, apps or extensions on your own initiative and do not plug in unknown USB sticks.
Report the mistake without shame
Anyone can be fooled. The worst thing is to say nothing: the company can only react if it knows in time.