The number of apps and web tools that employees use on a regular basis continues to increase. Most departments have about 40-60 different digital tools that they use. 71% of employees feel they use so many apps that it makes work more complex.

Many of the apps that we use every day have various alerts. We get a “ping” when someone mentions our name on a Teams channel. We get a notification popup that an update is available. We get an alert of errors or security issues.

App fatigue is a very real thing and it’s becoming a cyber security problem. The more people get overwhelmed by notifications, the more likely they are to ignore them.

Just think about the various digital alerts that you get. They come in:

• Software apps on your computer
• Web-based SaaS tools
• Websites where you’ve allowed alerts
• Mobile apps and tools
• Email banners
• Text messages
• Team communication tools

Some employees are getting the same notification on two different devices. This just adds to the problem. This leads to many issues that impact productivity and cyber security.

Besides alert bombardment, every time the boss introduces a new app, that means a new password. Employees are already juggling about 191 passwords. They use at least 154 of them sometime during the month.

How does app fatigue put companies at risk?

Employees begin ignoring updates
When digital alerts interrupt your work, you can feel like you’re always behind. This leads to ignoring small tasks seen as not time-sensitive. Tasks like clicking to install an app update.

Employees overwhelmed with too many app alerts, tend to ignore them. When updates come up, they may quickly click them away. They feel they can’t spare the time right now and aren’t sure how long it will take.

Ignoring app updates on a device is dangerous. Many of those updates include important security patches for found vulnerabilities. When they’re not installed, the device and its network are at a higher risk. It becomes easier to suffer a successful cyber attack.

Employees reuse passwords (and they’re often weak)
Another security casualty of app fatigue is password security. The more SaaS accounts someone must create, the more likely they are to reuse passwords. It’s estimated that passwords are typically reused 64% of the time.

Credential breach is a key driver of cloud data breaches. Hackers can easily crack weak passwords. The same password used several times leaves many accounts at risk.

Employees may turn off alerts
Some alerts are okay to turn off. For example, do you really need to know every time someone responds to a group thread? Or just when they @name you? But, turning off important security alerts is not good.

There comes a breaking point when one more push notification can push someone over the edge. They may turn off all the alerts they can across all apps. The problem with this is that in the mix of alerts are important ones. Such as an anti-malware app warning about a newly found virus.

What’s the answer to app fatigue?

It’s not realistic to just go backward in time before all these apps were around. But you can put a strategy in place that puts people in charge of their tech, and not the other way around.

Streamline your business applications
From both a productivity and security standpoint, fewer apps are better. The fewer apps you have, the less risk. Also, the fewer passwords to remember and notifications to address.

Look at the tools that you use to see where redundancies may be. Many companies are using two or more apps that can do the same function.

Consider using an umbrella platform like Microsoft 365 or Google Workspace. These platforms include several work tools, but users only need a single login to access them.

Have your IT team set up notifications
It’s difficult for users to know what types of notifications are the most important. Set up their app notifications for them. This ensures they aren’t bombarded yet are still getting the important ones.

Automate application updates
A cyber security best practice is to automate device and software updates. This takes the process out of employees’ hands. It enhances productivity by removing unnecessary updates from their view.

Automating device updates through a managed services solution improves security. It also mitigates the chance there will be a vulnerable app putting your network at risk.

Open a two-way communication about alerts
Employees may never turn off an alert because they’re afraid they might get in trouble. Managers may not even realize constant app alert interruptions are hurting productivity.

Communicate with employees and let them know they can communicate with you. Discuss how to use alerts effectively. As well as the best ways to manage alerts for a better and more productive workday.

The need to back up data has been around since floppy disks. Data loss happens due to viruses, hard drive crashes, and other mishaps. Most people using any type of technology have experienced data loss at least once.

There are about 140,000 hard drive crashes in the US weekly. Every five years, 20% of SMBs suffer data loss due to a major disaster. This has helped to drive a robust cloud backup market that continues to grow.

But one thing that’s changed with data backup in the last few years is security. Simply backing up data so you don’t lose it, isn’t enough anymore. Backing up has morphed into data protection.

What does this mean?

It means that backups need more cyber security protection. They face threats such as sleeper ransomware and supply chain attacks. Cloud-based backup has the benefit of being convenient, accessible, and effective. But there is also a need for certain security considerations with an online service.

Companies need to consider data protection when planning a backup and recovery strategy. The tools used need to protect against the growing number of threats.

Some of the modern threats to data backups include:

• Data Center Outage: The “cloud” basically means data on a server. That server is internet accessible. Those servers can crash. Data centers holding the servers can also have outages
• Sleeper Ransomware: This type of ransomware stays silent after infecting a device. The goal is to have it infect all backups. Then, when it’s activated, the victim doesn’t have a clean backup to restore.
• Supply Chain Attacks: Supply chain attacks have been growing. They include attacks on cloud vendors that companies use. Those vendors suffer a cyberattack that then spreads throughout their clients.
• Misconfiguration: Misconfiguration of security settings can be a problem. It can allow attackers to gain access to cloud storage. Those attackers can then download and delete files as they like.

What to look for in a data protection backup system

Just backing up data isn’t enough. You need to make sure the application you use provides adequate data protection. Here are some of the things to look for when reviewing a backup solution.

Ransomware Prevention
Ransomware can spread throughout a network to infect any data that exists. This includes data on computers, servers, and mobile devices. It also includes data in cloud platforms syncing with those devices.

95% of ransomware attacks also try to infect data backup systems.

It’s important that any data backup solution you use have protection from ransomware. This type of feature restricts automated file changes that can happen to documents.

Continuous Data Protection
Continuous data protection is a feature that will back up files as users make changes. This differs from systems that back up on a schedule, such as once per day.

Continuous data protection ensures that the system captures the latest file changes. This mitigates data loss that can occur if a system crashes before the next backup. With the speed of data generation these days, losing a day’s worth of data can be very costly.

Threat identification
Data protection incorporates proactive measures to protect files. Look for threat identification functions in a backup service. Threat identification is a type of malware and virus prevention tool.

It looks for malware in new and existing backups. This helps stop sleeper ransomware and similar malware from infecting all backups.

Zero-trust tactics
Cyber security professionals around the world promote zero-trust security measures. This includes measures such as multi-factor authentication and application safelisting.

A zero-trust approach holds that all users and applications need ongoing authentication. So, just because a user is logged into the system today, doesn’t mean they are completely trusted.

Some of the zero-trust features to look for include:

• Multi-factor authentication
• Distinct file and folder permissions
• Contextual authentication
• Verification of permissions for file changes

Backup Redundancy
If you back up to a USB drive or CD, you have one copy of those files. If something happens to that copy, you could experience data loss.

Cloud backup providers should have backup redundancy in place. This means that the server holding your data mirrors that data to another server. This prevents data loss in the case of a server crash, natural disaster, or cyberattack.

Air gapping for more sensitive data
Air gapping is a system that keeps a copy of your data offline or separated in another way. This would entail making a second backup copy of your data. Then, putting it on another server. A server disconnected from external sources.

This is a feature that you may want to seek out if you deal with highly sensitive data. It helps to ensure that you have at least one other copy of your backup. A copy walled off from common internet-based attacks.

Since the pandemic, employers around the world have needed to change. They’ve had to shift how their employees operate. Remote work is very much here to stay. Organisations and employees can both benefit from the work-from-home and hybrid work revolution.

Cost savings is a driver for supporting remote work. Employee morale and productivity also can be higher when employers grant this flexibility.

A majority of organisations support some type of remote work. Statistics show that:

• 16% of companies are completely remote
• 40% support hybrid office/remote working
• 44% don’t allow employees to work remotely

While there are benefits, there are also challenges to this new environment. Employers worry about the cyber security risks of remote teams. Managers can find it more challenging to make sure employees are doing what they should do.

The remote and hybrid work environment has led to the rise of employee monitoring tools. These tools have mixed reviews from employees.

What is Employee Monitoring Software?

Employee monitoring software tracks digital movements. This can include everything from general clock-in clock-out tracking to taking screenshots of an employee’s computer several times per hour.

Tracking tools like Hubstaff and BambooHR track many activities on a person’s computer. The information is then sent in a daily or weekly report to the company.

Items that these tools can track are:

• Time clock
• Keyboard activity
• Keystrokes
• Mouse activity
• Websites visited
• Screenshots of the desktop
• Apps used and how long in use

The most invasive of tools can even track the sounds and video of the employee. Tracking can be visible, so the employee knows about it or hidden from the employee. It depends on the tool used and the ethical considerations of the employer.

This type of monitoring can benefit an organisation worried about “productivity theft.” But it can also alienate good employees and torpedo morale and trust. We’ll go through the pros and cons to weigh before you set up this type of system.

Pros of Activity Monitoring Tools

Helps managers understand how employees spend their day
One feature of many tracking tools is the ability to track time by project. This helps managers understand where employees are prioritizing their time. Knowing how much time employees spend on a project helps with ROI projections.

Reduces non-work activities during working hours
One thing that employers worry about with remote employees is that they will waste time. A manager doesn’t want to pay someone only to find out the employee spent half their time on Facebook.

About half of monitored employees spend 3+ hours per day on non-work activities. When employees know that their boss is monitoring their app usage, they’re less likely to goof off.

Can be an easy way to track time for remote workers
Smaller companies that work with fully remote teams may find tracking tools convenient. Employees or freelancers can track their time at the click of a button. Employers can put an hour-per-week cap on time. They can also manage payments automatically through the app.

Cons of Activity Monitoring Tools

Hurts employees’ morale & productivity
Many employees feel they are put in a cage when monitoring is introduced. Morale can plummet, which takes productivity along with it.

Instead of focusing on work completely, various thoughts go through employees’ minds. Such as, “If I think about this problem too long, is the tracking going to give me a low productivity score?” Or “What happens when I’m on the phone with a customer and not moving my mouse around? Will the tracking make it look like I’m not working?”

Some of the feelings that employees can have when monitored are:

• Betrayed
• No longer trusted
• Loss of company loyalty
• Hurt
• Treated like a number instead of a person

“Activity Monitoring” doesn’t mean productivity
Many of these tracking tools send employees and employers “activity reports.” These reports simply look at keyboard and mouse activity during a specific time.

But what if the employee must solve a workflow issue and needs to use their brain, not the mouse? What if a salesperson is on the phone with a customer, not using their keyboard? Zoom calls bring a similar quandary. If you’re in a Zoom call, your mouse and keyboard aren’t being actively used as they would if you are typing.

Yet, the activity report doesn’t include this information. It will simply give a score of x% based on keyboard and mouse activity. This could make an employer think a worker was goofing off when they were actually working hard.

Costs organisations good employees
Nearly half (47%) of surveyed tech employees stated they would quit if their boss tracked them. Employers implementing monitoring can alienate good employees and make them feel untrusted. They can also feel unappreciated.

When you relegate everyone to a number of keyboard strokes, you constrain creativity. Good employees often stay with companies where they feel appreciated and can grow. Once that’s gone, they’re likely to leave.

Finding a balance
A few things to think about when finding the right balance between tracking too much or too little are:

• What do you really need to track?
• Should you treat all employees the same?
• What do your employees think about monitoring?
• Are you trying to solve a problem that doesn’t exist?
• What features are unnecessary that you can turn off?
• Is the tool giving you accurate data related to productivity?

No business wants to suffer a data breach. But unfortunately, in today’s environment, it’s difficult to completely avoid them. Approximately 83% of organisations have experienced more than one data breach. (IBM Security 2022 Cost of a Data Breach Report)

These breaches hurt businesses in many ways. First, there is the immediate cost of remediating the breach. Then, there are the lost productivity costs. You can add lost business on top of that, and lost customer trust. A business could also have extensive legal costs associated with a breach.

According to IBM Security’s report, the cost of a data breach climbed again in 2022. The global cost of one breach is now $4.35 million, up 2.6% from last year. If your business is in the U.S., the cost rises to $9.44 million. In Canada, the average data breach costs companies $5.64 million.

Costs for smaller companies tend to be a little lower. But breaches are often more devastating to SMBs. They don’t have the same resources that larger companies do to offset all those costs.

It’s estimated that 60% of small companies go out of business within six months of a cyber security breach.

Companies don’t need to resign themselves to the impending doom of a data breach. There are some proven tactics they can take to mitigate the costs. These cyber security practices can limit the damage of a cyberattack.

All these findings come from the IBM Security report. They include hard facts on the benefits of bolstering your cyber security strategy.

Cyber security tactics to reduce the impact of a breach

Use a Hybrid Cloud approach
Most organisations use the cloud for data storage and business processes. Researchers found that 45% of all data breaches happen in the cloud. But all cloud strategies are not created equally.

Breaches in the public cloud cost significantly more than those in a hybrid cloud. What is a hybrid cloud? It means that some data and processes are in a public cloud, and some are in a private cloud environment.

What some may find surprising is that using a hybrid cloud approach was also better than a private cloud.

Graph from: IBM Security/Ponemon Institute 2022 Cost of a Data Breach Report

Put in place an incident response plan & practice it
You don’t need to be a large enterprise to create an incident response (IR) plan. The IR plan is simply a set of instructions. It’s for employees to follow should any number of cyber security incidents occur.

Here is an example. In the case of ransomware, the first step should be disconnecting the infected device. IR plans improve the speed and effectiveness of a response in the face of a security crisis.

Having a practiced incident response plan reduces the cost of a data breach. It lowers it by an average of $2.66 million per incident.

Adopt a zero trust security approach
Zero trust is a collection of security protocols that work together to fortify a network. An example of a few of these are:

• Multi-factor authentication
• Application safelisting
• Contextual user authentication

Approximately 79% of critical infrastructure organisations haven’t adopted zero trust. Doing so can significantly reduce data breach costs. Organisations that don’t deploy zero trust tactics pay about $1 million more per data breach.

Use tools with security AI & automation
Using the right security tools can make a big difference in the cost incurred during a data breach. Using tools that deploy security AI and automation brought the biggest cost savings.

Data breach expense lowered by 65.2% thanks to security AI and automation solutions. These types of solutions include tools like advanced threat protection (ATP). They can also include applications that hunt out threats and automate the response.

How to get started improving your cyber resilience
Many of these ways to lower data breach costs are simply best practices. You can get started by taking them one at a time and rolling out upgrades to your cyber security strategy.

Working with a trusted IT provider, put together a roadmap. Address the “low-hanging fruit” first. Then, move on to longer-term projects.

As an example, “low-hanging fruit” would be putting multi-factor authentication in place. It’s low-cost and easy to put in place. It also significantly reduces the risk of a cloud breach.

A longer-term project might be creating an incident response plan. Then, you would set up a schedule to have your team drill on the plan regularly. During those drills, you could work out any kinks.