What is a cybersecurity culture?
A cybersecurity culture is one that values those behaviors that contribute to the promotion of a safe and secure information technology infrastructure. It represents the collective values of the entire organization in adopting and ensuring safe cybersecurity practices. It is usually based on a set of shared values that guide behaviors with respect to cybersecurity.
Cybersecurity conscious culture encourages employees to be aware of security threats and instills in them behaviors that mitigate those potential threats. It involves basic things such as understanding how phishing attacks work, adopting good password hygiene, and following physical security protocols. Such behavior goes a long way in improving the overall security of the organization.
Moreover, the skills necessary for such a culture can be easily acquired and are readily transferable. In addition, there’s a lot of value to be had not just in the workplace but also in the personal lives of the employees. So, once you get the ball rolling, acquiring and sharing cybersecurity knowledge will happen on its own.
But what if you already have security systems in place…
Does your company need a cybersecurity conscious culture?
Security tools will protect you from much of the security threats but they don’t make you invulnerable. Of course, you still need antivirus, anti-malware, firewall, backup solutions, etc. But you should realize that there’s no foolproof IT security system. Cybersecurity isn’t a one-time project that you put in place and forget about. You need to be constantly vigilant because the cyber-criminals don’t need to win every battle, one simple click on a phishing email is sufficient for them to achieve their devious goal.
Do your security tools cover your weakest link?
According to Verizon’s 2020 Data Breach Investigations Report, errors caused 22% of breaches. Errors have been a consistent cause of breaches with the 2019 report pegging it at 21% and 17% in the 2018 report. This is a very disconcerting figure because it implies that roughly 1 in 5 breaches is caused by errors. Seemingly harmless actions such as sending an email to the wrong recipient, storing your password as plain text on your computer, etc. can very easily transform into grave mistakes.
You can’t escape the fact that people can and usually do make mistakes and even though their actions may not be ill-intentioned or deliberate, they can still have a devastating impact on your business. But if you have a security-conscious culture at the workplace, much of the risks arising from careless or negligent human behavior can be mitigated. Keep reading to find out how you can inculcate a cybersecurity conscious culture at your workplace.
6 steps for creating a cybersecurity conscious culture in your company
1. Make cybersecurity everyone’s business
The first step towards building a security-conscious culture is to inspire the feeling that security belongs to everyone. If we draw a parallel to our society, even though the duties of security are delegated to an external party, we still adopt security best practices. For example, security for the most part is the primary responsibility of the police yet we lock our doors and windows, install security cameras, alarms, etc.
Similar behavior in the workplace will create a sustainable security culture where everyone participates actively and feels responsible for the security of the company. A security breach may force the company to close, impacting everyone. Therefore, although IT security is the primary responsibility of the IT security team, everyone in the company must consider themselves accountable for security.
Although many companies do provide cybersecurity awareness training to their employees, they fail to engage them or get their buy-in. Cybersecurity training usually consists of uninteresting instructional videos and dull PowerPoint presentations. So we can’t really blame the employees for not being engaged. Employees don’t understand their role with respect to security. They often view security practices as a chore to be done in addition to their “real” job. When we talk about employee engagement, we often don’t think about the executives and management. They often enjoy special security privileges and access rights, which make their participation even more critical.
By making security everyone’s business we open up avenues for dialog bringing the employees, management, and executives together. This allows them to explore their roles, share experiences and knowledge, building awareness across the different levels of the company.
2. Start with the basic security practices
Cybersecurity is a vast subject and an ongoing process so it’s important to gain those little victories in the very beginning. When you start out, pick the low-hanging fruits such as implementing 2FA (Two Factor Authentication) and a password manager as these are fairly simple to roll out company-wide. Once implemented, encourage their use and gradually make their use mandatory.
Much of the hassle associated with good password hygiene is taken care of by a password manager. It will also help in the implementation of a strong password policy without burdening the minds of your employees. 2FA adds an additional layer of security and makes unauthorized access to your employees’ accounts very difficult. In addition, restricting the physical access to devices such as servers, routers, and switches as well as restricting the access rights to shared drives are easy to implement and go a long way in improving the security of your IT systems.
3. Develop engaging and frequent cybersecurity training
Learning new skills as an adult is difficult at any age, especially if your employees feel that what they are learning isn’t really part of their jobs. Making your employees attend dull presentations and forcing them to change their passwords every month isn’t going to engender a cybersecurity conscious culture. This has been a conspicuous theme across organizations, yet it is rarely addressed.
On the other hand, if you make it fun for them, they will surely be engaged. Use gamification, quizzes, and milestones to keep your employees engaged, motivated, and eager to learn. Use Posters, desktop guides, infographics, and catchy slogans to always keep the topic of security in clear sight. Use real-life examples as much as possible to demonstrate cybersecurity risks and encourage them to share their experiences. Reward behavior that promotes a security-conscious culture.
Try to keep your training material relevant. Different departments will likely face different security threats. So, customize the training material focusing on its relevance to those receiving the training. But most importantly, keep reminding them how important their role is and how they can help in promoting cybersecurity.
4. Document your security policies and communicate them often
Your security policy is the foundation on which you build a security-conscious culture. It is a document that describes all the rules, processes, and procedures governing the access and use of the information technology infrastructure of your organization. Your security policy serves as a guide for your employees if they are ever in doubt about anything relating to security.
Your policy document ideally should highlight the importance of cybersecurity in the growth and sustainability of the company, the best practices to be followed, and the role of the employees in your defense against cyber-threats. It must be mandatory for all employees to read and sign off the policy document. This ensures a formal buy-in by the employees.
In addition, the policy won’t be of much use if it’s not enforced. Therefore, the policy document needs to describe how the company intends to enforce the policies. In the policy document, make everyone aware of the tools, processes, and procedures that will be utilized to ensure compliance. But don’t let this be a document that’s used once and forgotten. Encourage your employees to share or review a part of your IT security policy in every meeting. This makes security a ubiquitous theme and keeps reminding everyone to stay vigilant.
5. Conduct phishing drills and mock attacks
It often happens that companies are lulled into a false sense of security if no security incident happens for a long time. When there are no attacks or no breaches, people often falsely believe that they are un-hackable. This is one of the biggest security risks businesses across the globe face. Cybersecurity threats are always evolving and it’s only a matter of time before a static defense is breached. So it is necessary to keep your shields up and to be on your toes.
Phishing drills and mock cyber attacks are a great way to test your company’s preparedness in dealing with security threats. Drills and simulations help your employees react better when there is a real emergency. It is also a good test of the training provided and your company’s post-breach procedures. Drills and mock attacks will help etch your company’s security procedures in the minds of your employees and they are more likely to remember exactly what to do in case someone is phished, what not to do, and whom to contact.
6. Make it easy to report cybersecurity threats
It’s easy to think of the IT security team as one that makes life difficult by forcing password changes, pushing updates at the wrong time, or those you meet if you cause a breach. But this line of thinking doesn't help in creating a cybersecurity conscious culture. The employees need to see the security team as an ally who can help them gain a better understanding of their role in the company’s cybersecurity culture.
The relationship between the IT security team and the rest of the employees is key in building a cybersecurity conscious company culture. There needs to be an open communication channel between them. By making it easy to report bugs or security threats, you will help in creating and sustaining that communication channel. Once such a communication channel is established, your employees will find it easier to reach out to the security experts for advice, for additional training, or to report anything that they find suspicious.
How a cybersecurity conscious culture will benefit you
Creating a cybersecurity conscious culture is not a small investment, but its benefits far outweigh its cost and, more importantly, of the consequences of not having one. If you consider the high costs of security breaches, the cost of downtime, and the loss of reputation, investment in the creation of a cybersecurity conscious culture is definitely worth every penny.
A security-conscious culture also has other positive impacts on your business. Customers are more likely to do business with a company that has a stellar reputation with respect to security. Customers will be at ease knowing that their data is in safe hands. No one would want to knowingly work with a company that has a poor security reputation. So by focusing on your internal security, you will also benefit from a better brand reputation. This will lead to more business and higher profits, which will in turn cover the costs of your investment in security.
If you look at the data, errors, social attacks, and phishing emails compose the majority of the cyber-attacks on businesses. The power to stop these kinds of breaches is very much with the employees. However, it is also notable that the weakest link in cybersecurity is also the employee. Therefore, investing in strengthening your weakest link will contribute to a strong overall defense.
When you create a cybersecurity conscious culture, you get a sustainable security system against human error. Every employee has a role in keeping the company safe and they accept that responsibility. By investing in such a security-focused ecosystem, you can turn your weakest link into your strongest asset.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, Small Business, and Mindfulness. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.