How to create a strong cybersecurity culture in your organization
The cybersecurity culture of an organization encompasses the knowledge, awareness, attitudes and behaviors of employees regarding the threat landscape, cybersecurity and information technologies.
Strong cybersecurity culture starts with building awareness and encouraging best practice cyber-hygiene, normalizing these behaviors so they become second nature to your team.
Why is creating a cybersecurity culture important?
In a nutshell, it’s far better to be proactive than reactive when it comes to cybersecurity. Building a culture of awareness, trust and knowledge in your organization means incidents are less likely to occur, and if they do, you will be much more prepared to deal with the fallout quickly and effectively to minimalize any financial, technical or reputational damage.
Traditionally, approaches to cybersecurity have been reactive, episodic and short term. We’ve all been there; you get a suspicious-looking email from C-level asking you for an urgent request and littered with spelling mistakes. The observant and diligent employee spots straight away that this is ‘phishy’ and reports it to the security team. They get a pat on the back, the rest of the team is named and shamed – people move on.
But this isn’t going to stop cybercriminals attacking and it isn’t going to instill a strong cybersecurity culture into the business. While hybrid working culture has created new opportunities for businesses and employees, it’s also created opportunities for cybercriminals. As many organizations transitioned to a work-from-home model, new security issues and concerns emerged, with communication and education becoming more challenging.
Moving towards a long-term, company-wide, strategic approach
For every employee that takes the time to report anything suspicious during episodic phishing exercises, there’ll be five employees who fail to even spot they’ve been sent the email. Or if they do, they won’t take the time to report it, and they’ll skim over the reprimanding email from the security team.
Creating cybersecurity culture in a business involves implementing long-term strategy across the team, outlining your goals, starting at the top and working down. With working from home and bring-your-own-device (BYOD) work places the norm, creating and sustaining a strong cybersecurity culture is about making security second nature, not a chore. You can start implementing your strategy with this four-step cybersecurity culture framework.
4 steps to a strong cybersecurity culture
1. Promote good cyber-hygiene from the top down
To really have an impact, good cybersecurity practice should come from C-level and filter through your organization. If your CEO is demonstrating positive cybersecurity practices and setting a good example for the rest of the business, the rest of the team is likely to follow suit. Make cybersecurity a priority and set the tone for the rest of the business.
- Encourage your executives to take part in cybersecurity training.
- Enforce security policies and processes across the board, regardless of seniority level.
- Work with policy makers to adapt procedures accordingly depending on how they work for board members – if policies don’t work for board members, they probably aren’t working for others further down the organization.
- Work on the basis that practices take time to cascade down through the business – culture takes time and effort to evolve.
2. Explain what’s at stake and put people at the heart
Why should cybersecurity matter to every employee? How does it directly affect both their personal privacy and customer data?
There are endless technical ramifications, financial implications, PR and brand damage that could occur from a cyber-attack. But at many companies, employees still don’t have awareness of the value of what they’re being asked to protect: explain the importance of keeping customer data private; keeping marketing insight, product research and competitive secrets classified; plus the legal obligation to safeguard certain information. There’s the personal aspect to this too – working from home means any cybercriminal targeting an employee’s business is also targeting their household.
Businesses could be held publicly accountable for any violations or breaches and it’s crucial that employees are aware of this. Employees don’t always realize that no technical safeguard is perfect, and it’s up to them to avoid unnecessary risk and therefore minimize threats.
3. Consistent communication is key
There is so much confusion around security measures and what is and isn’t best practice.
Take passwords; there is so much confusion over what is the most secure password configuration. Is it the longest? The one with lower-case and upper-case letters? The one with random objects listed in succession? And how often should we change our passwords? Every three months? Only if we’re breached?
Create enough confusion and people will go rogue. Creating a cybersecurity culture means being transparent, clear and consistent in messaging.
- Be constructive in your approach to training. Don’t reprimand employees for getting things wrong, treat it as a learning curve and use it to build a culture where no question is too basic.
- Make training engaging and worth their time and, again, encourage people at the top of the business to engage and lead by example.
- Be sure to communicate the reason for any changes to security you are making. Why should it matter to employees if you introduce a Zero Trust mode or ask them to change their password regularly?
- Enforce a clear and easy system for reporting any suspicious activity to your security team.
4. Work on a strategy of zero trust
Security strategies such as multi-factor authentication (MFA) and Zero Trust are frequently discussed among cybersecurity circles as a method of increasing access controls, but Zero Trust has rapidly been gaining popularity and many organizations are now looking to adopt a Zero Trust mindset.
A Zero Trust strategy for corporate cybersecurity is a framework which requires all users to be authenticated, authorized and continuously validated before being granted access to certain systems or company data. This includes users both inside and outside the company’s network as we enter a permanent phase of hybrid working.
Enforcing this model across your business means everyone in your business faces the same security measures, leaving little room for mistakes that could cost your business.
website being exploited by bots?