When we talk about cybersecurity culture, we refer to the beliefs, perceptions, values and attitudes shared by your employees. It is essential to care about the culture of cybersecurity in your company, because it greatly influences the behavior of employees, for better or for worse. In reality, every organization has many cultures that reflect the diversity of its people, departments and skills. This means that you already have a culture of cybersecurity, even if you are not actively building it!
We know good and bad behaviors when it comes to cybersecurity, like using strong passwords and keeping devices up to date. Your cybersecurity culture is the set of factors that puts someone in a position to do (or more often, not do) a cybersecurity behavior.
Is your culture proactive, where employees self-engage in cybersecurity best practices, or reactive, where employees only act after you tell them or they try to correct through them even or worse hide incidents? Do employees take ownership of updating their own devices and accounts, or do they expect IT to take care of everything for them? Do the employees help each other when there are technical problems or does everyone manage on their own?
Your organization's cybersecurity culture drives these types of behaviors.
Be honest and take stock: Assess the culture and establish where your company's security currently stands. Understand the approach for addressing audit findings, technology and security priorities, and any metrics in place that measure progress. Also, be aware of practices that may increase risk: bring your own device (BYOD) policies, international travel, unencrypted communication (such as instant messaging), data storage on personal devices, non-standard configuration and the use of software that is not controlled by IT.
Describe your mission: Before you elaborate on specific details, clearly establish what constitutes success for your company's security. Turn the mission into a "clarifying brief" to ensure it can be easily verbalized. Celebrate organizational success to emphasize the value placed on security and further establish the culture of cybersecurity in your company.
Get management support: When leaders support a culture of cybersecurity, they allocate resources to support the message and spark regular discussions about security. Highlight the incident risk costs that come with cyber threats. Finally, point out that cybersecurity protects intellectual property from hacking and keeps it out of the reach of competitors.
Get employee support, too: Cyberattacks making headlines may not seem to affect all departments of your company. Build employee support with cyber threat impact conversations to ensure staff realize the value of good cyber security and are not tempted to circumvent the processes that are in place. The goal here is that your employees feel directly concerned by your new mission.
Define roles and expectations: Eliminate ambiguity with a detailed plan specifying roles, objectives and responsibilities of departments in the event of an incident. Expand the responsibility for promoting security outside of the IT security team by also appointing other members of external departments. Make sure that if an incident occurs, the company's security experts will find solutions, offer assistance and avoid blame!
Invest in training: Turn your users into cybercrime superheroes. Ongoing security awareness education and testing prevents and mitigates risk to users. Each employee must understand how they play a key role in the fight against security breaches and communicate the events well. Present partners with Terranova Security, a leader in Gartner's Magic Quadrant, to deliver a high-quality, customizable training program. With fun and engaging content that is multilingual and accessible on mobile, your users will be trained in IT and security best practices. Since we know that 91% of cyber attacks are due to phishing, the training programs include phishing simulations to teach users how to protect themselves against cyber threats such as phishing, spear phishing, ransomware, malware, social engineering, etc. Allow your employees to be part of the solution, not the problem!
Keep a score: Increase engagement in routine testing with an element of gamification – or an incentive for first responders. For a less individualized approach, departments could compete. Use public recognition to reward employees and affirm the value of good cybersecurity. Alternatively, you can take a punitive approach for faster improvements, through mandatory training.
Create lively conversation: As in any culture, the story is often the backbone. Continuously discuss cybersecurity, leveraging lessons learned from cybersecurity news and keeping employees up to date on best practices. Regular newsletters, forums or training sessions can create regular opportunities to discuss cybersecurity. Foster an environment that encourages questions and make sure employees know who to ask. Equally important: make sure the response does not contain jargon that is only understandable to employees with technical IT knowledge.
In an established cybersecurity culture, employees will accept individual-level responsibility for supporting security and will have the training and knowledge to act and communicate. This collective approach moves employees from risk factor to security advocate, and employees can even proactively protect the business as they become more aware of cybersecurity practices. With the costs of cybercrime rising, a proactive attitude will clearly pay off for individuals and businesses alike.