Cybersecurity Basics Everyone at Work Should Know

Most security incidents at work do not begin with sophisticated technology. They begin with an ordinary person clicking a link, approving a fake payment request or reusing a password. That is why cybersecurity is not only the IT department's job. Whether you work in accounts, sales, HR or reception, a few simple habits protect you, your colleagues and your organisation. This guide covers the basics every employee should know.

Why it matters for everyone

Organisations hold valuable information: customer details, payroll data, bank account information and business plans. Criminals target people rather than systems because people are easier to trick. A single successful attack can lead to stolen money, leaked personal data, regulatory trouble under the Data Protection Act, 2019 and lasting damage to customer trust. Your everyday choices are one of the strongest defences your organisation has.

Recognise phishing emails and messages

Phishing is a message designed to trick you into clicking a link, opening an attachment or sharing information. It can arrive by email, SMS, social media or a phone call. Warning signs include:

• Urgency or pressure, such as "your account will be closed today".
• A sender address that is slightly wrong, for example a misspelled company name or a free email address claiming to be a bank.
• Links whose real destination does not match the text. On a computer, hover over the link before clicking; on a phone, press and hold to preview it.
• Unexpected attachments, especially compressed files or documents that ask you to enable macros.
• Requests for passwords, PINs or one-time codes. Legitimate organisations do not ask for these by email or phone.

If a message seems suspicious, do not reply or click. Contact the sender using a phone number or website you already know, and report the message to your IT or security team.

Watch for invoice and payment fraud

One of the most damaging scams targets finance teams. A criminal pretends to be a supplier or a senior manager and asks for an urgent payment, or announces that the supplier's bank details have changed. The message may even come from a real email account that has been taken over.

Protect your organisation with simple rules:

• Never change supplier bank or mobile money details based on an email alone. Call the supplier on a number from your records, not one in the message.
• Require a second person to approve new payees and changes to payment details.
• Be extra careful with urgent requests from senior staff to make payments outside the usual process, especially on Friday afternoons or before holidays.

Use strong, unique passwords

Reusing a password means that a leak from one website can unlock your work email or systems. Every important account needs its own password.

• Use passphrases: several random words joined together are long, strong and easier to remember than short complex passwords.
• Use a password manager approved by your organisation to store and generate passwords.
• Never share passwords with colleagues, even to cover leave. Ask IT to set up proper shared access instead.

Turn on multi-factor authentication

Multi-factor authentication (MFA) adds a second check, such as a code from an authenticator app or an approval prompt on your phone, when you sign in. Even if someone steals your password, they cannot get in without the second factor. Turn MFA on for email, cloud storage and any system that offers it.

Be careful with approval prompts. If your phone asks you to approve a sign-in you did not start, decline it and tell IT immediately, because it means someone has your password. Identity and Access Management explains how organisations manage accounts, permissions and sign-in security properly.

Protect your phone and phone number

In Kenya, your phone number is linked to mobile money, bank alerts and one-time codes, which makes it a target. Criminals may try a SIM swap, convincing a provider to move your number to a new SIM.

• Set a SIM PIN and a strong screen lock on your phone.
• Never share one-time codes or your mobile money PIN with anyone, including people claiming to be from your provider or bank.
• If your phone suddenly loses network for no clear reason, contact your provider quickly from another phone.
• Install apps only from official app stores and keep your phone updated.

Keep devices updated and locked

Software updates fix security weaknesses. Install updates for your operating system, browser and apps promptly, and restart when asked. Lock your screen every time you step away (Windows key plus L on a Windows computer). Never leave laptops unattended in public places or visible in a parked car.

Be careful on public Wi-Fi and with USB devices

Public Wi-Fi in cafés, hotels and airports may not be secure. Avoid signing into sensitive systems on open networks unless your organisation provides a VPN, and prefer your phone's mobile hotspot when you need to work on the go. Do not plug unknown USB drives into work computers, as they can carry malicious software. Network Security Essentials covers how networks are protected behind the scenes.

Handle personal data with care

Kenya's Data Protection Act, 2019 sets rules for how organisations collect, use, store and share personal data, and the Office of the Data Protection Commissioner oversees compliance. For employees, the practical rules are clear:

• Collect and access only the personal data you need for your work.
• Do not send customer or staff data to personal email accounts or messaging apps.
• Share files with specific people, not with "anyone with the link".
• Lock away printed documents and shred them when they are no longer needed.

Kenya Data Protection Act Compliance for Businesses explains your organisation's obligations in more detail and is useful for anyone who handles customer or staff records.

Report incidents quickly

Mistakes happen. If you click a suspicious link, send data to the wrong person or lose a device, report it to your IT or security team immediately. Fast reporting can stop an incident from spreading, and organisations may have legal deadlines for notifying a data breach. A good security culture thanks people for reporting rather than blaming them.

If you are interested in supporting colleagues with these issues as part of your job, IT Support and Helpdesk Fundamentals is a practical entry point into IT support work.

A quick personal security checklist

1. I can recognise the warning signs of a phishing message.
2. I verify any change to payment details by phone, using a known number.
3. Every important account has its own strong password, stored in a password manager.
4. MFA is turned on for my email and work systems.
5. My phone has a SIM PIN and a screen lock, and I never share one-time codes.
6. My devices are updated and locked when I step away.
7. I handle personal data only as my job requires.
8. I know how to report an incident, and I would do it straight away.

For a structured programme on protecting organisations, Cybersecurity Fundamentals covers threats, controls, security operations and incident response in depth.