The sophistication and frequency of cyberattacks is on the rise, as is the level of financial and reputational damage that befalls any organization unlucky enough to suffer a successful system or information security breach. However, one thing that remains constant is that in most cases attacks succeed because of human error.
An organization’s employees are its most valuable asset. Yet, the onward march towards digitalization is leaving a paradox in its wake. Because technology is now central to operations and success, when it comes to cybersecurity, an organization’s employees are simultaneously its greatest liability.
From social engineering and phishing to cloud misconfigurations and lost or stolen credentials or devices, human vulnerability is a factor in 74% of successful enterprise attacks.
Increasing reliance on technology has increased the cyberattack surface area of every enterprise. And of course, this has multiplied the number of potential mistakes an employee can make and the number of opportunities or situations that will lead to making it.
Globally, the amount of money organizations spend on cyber security is growing year-over-year and it’s expected to hit $215 billion in 2024 (a 14% increase from 2023). But no amount of investment in tools or infrastructure will provide adequate protection or risk mitigation unless an organization also invests in its people and the creation of a security culture.
What is a security culture?
When every employee recognizes they have an individual and collective responsibility towards keeping the business safe and, crucially, demonstrates that responsibility through their actions, then an organization can claim to have a security culture. It’s about making security a business priority rather than a burden and, in doing so, making employees active participants in risk mitigation. When security is front of mind and adherence to best practices recognized and rewarded, employees are empowered to report concerning behaviors or incidents and understand their role and the actions to take if an incident arises.
A true security culture goes beyond the breadth and depth of an organization’s security team. It removes operational or management silos and directly aligns the C-suite with the CISO and gives all security professionals access to and authority over any risk owner at any position within the business so that they can always act for the greater good of the organization and spearhead any change management initiatives aimed at improving security posture.
From the top: How to develop a security culture
Creating a security culture isn’t only challenging, but once established it must be continually improved and refined as threat landscapes change and new tools and processes are developed. For many organizations, simply establishing a direct link between security and the C-suite can be a tall order. Even as the reputational and financial damage that can be inflicted on an organization following a security breach increases, data shows that many executives still fail to see security as a part of business strategy and a crucial point of positive differentiation. Half of security professionals believe their board views security as a cost of doing business and 65% of executives treat information security as a risk reduction activity.
Nevertheless, open, direct communication between the board and all departments tasked with the mechanics of security is crucial to driving change because, just as with any other aspect of corporate culture, security needs to be sponsored at the executive level. In this respect, security professionals also need to think about how they communicate and articulate their understanding and expertise. Don’t present security and risk mitigation as abstract concepts, ground them in business reality.
Benchmark understanding
Once the C-suite is aligned, it’s possible to make changes at other levels of the organization, beginning with an audit of employee security awareness and training needs. Employee education and ongoing training will be fundamental to instilling security awareness across the organization. However, successfully building an understanding about security risks and the reason why the organization has processes and procedures starts with benchmarking individuals’ existing awareness and understanding. This way, any subsequent training will deliver new insights or reinforce a behavior rather than adding further complexity to roles.
Reminders and reinforcements
Use a company intranet, weekly team meetings or email newsletters to remind employees, in plain language, why the organization has processes and best practices in place. But use the same channels to draw attention to employees who have identified or stopped a potential threat or have passed certain security qualifications. Celebrating these achievements should help motivate others.
Build buy-in
Alongside formal learning and development courses, leverage gamification, whether this is through quizzes with prizes, video-based micro courses or other types of individual or team challenges — to make security awareness engaging and even competitive. This can be taken further by inviting high performers to become involved in the development of new or the revision of existing policies or procedures.
Tailored teaching
As well as initial benchmarking, formal security training should be tailored to the individual’s roles and responsibilities so that it is placed in the correct professional context and therefore easier to assimilate and put into practice. As well as for individual roles, training should, of course, be tailored to new and emerging threats or new standards and processes as they arise.
Cultivate compliance
One of the biggest challenges of creating a security culture is personal accountability. Employees need to be aware of how their actions can impact the wider organization and therefore need to learn to take personal responsibility. This can be achieved in part by increasing or reducing an employee’s levels of autonomy based on their attitudes towards security and by making teams or departments collectively responsible for security — e.g., providing constructive criticism or support to individual members who are less engaged or demonstrate lower levels of understanding. Alongside peer review should be a simple mechanism for employees to anonymously report (without fear of reprisals) what they perceive to be risky behaviors or potential issues that could open the door to an attacker.
Inclusive iteration
Employees should be able to easily provide feedback and opinions or express concerns regarding security policies. These insights should be shared with the wider business to demonstrate that the organization values open conversation and, crucially, if the feedback or insights are important, the organization needs to be seen to be acting on them. This will help to reinforce security as a key element of the corporate culture.
When an organization creates and successfully maintains a security culture, its people become its first and strongest line of defense, rather than the weakest link in the cybersecurity chain. As the frequency, cost and potential reputational damage resulting from data breaches and cyberattacks continues to rise, ensuring your business partners have a best-practice approach to information and system security. Read our latest white paper “Securing your customer experience: How to choose the right CX delivery partner in an age of rising cyber threats” to learn more.