Jim Simpson, CEO of Blumira, strives to remove the barriers that prevent smaller teams from achieving successful security programs.
getty
In the past, the general attitude around cybersecurity was that a company’s security team would protect the organization from external threats, or a company might think it was too small to be a target. Companies would lean on technology such as firewalls and antivirus software, believing these solutions alone would be enough to stave off an attack. As digital tools and devices have become a bigger part of our daily lives, cyber threats have become more common and sophisticated.
Now, attempts to hack via phishing are made to individuals through emails and texts—not just behind the scenes. Because a single person’s actions can result in a cyberattack, security teams alone shouldn’t be the only people responsible for a company’s cybersecurity: All of us should be considered members of the organization’s security team. Giving workers tools and cybersecurity knowledge is essential, as human mistakes cause 90% of cyber incidents.
Three Tips To Build A Cyber-Aware Culture
Companies will have the best protection against bad actors targeting human weaknesses by embracing an approach that builds deeper cybersecurity knowledge and awareness. Today, a company’s attack surface is much larger than it used to be, largely thanks to cloud adoption, third-party solutions and remote work infrastructure. Daily activities and key organizational functions often involve multiple platforms and devices. Every smartphone, laptop and IoT device is another opportunity for outside sources to get into a company’s network.
More access points to an organization’s network means that every person must be more aware of what they’re doing to follow security protocols and stay vigilant against potential cyber threats. As organizations aim to mitigate potential cyber risks, they should consider all employees part of their line of defense by giving them the tools to prevent a cyber event.
1. Prioritize cybersecurity awareness training.
Strengthening workers’ cyber awareness starts with giving them comprehensive training. To drive home security guidance, aim to simplify cybersecurity terms and provide a deep dive into common threats such as phishing attacks, ransomware and malware. Security training is even more powerful when relevant to each person’s role. In practice, this could look like demonstrating threats that apply to a certain task or activity and sharing best practices specific to a given role or function in the company. For example, you could train a customer service agent to recognize suspicious callers who might be looking to access a customer’s account without the customer’s knowledge or permission.
Many organizations consider security training a one-and-done experience. However, security education should be ongoing to create a more cyber-aware culture and increase familiarity with emerging threats.
Training is most effective when it includes different activities to engage learners. In addition to traditional virtual training and courses, companies can expand their approach to include multi-model learning opportunities, such as worksheets, discussions and other interactive exercises that allow individuals to test what they’ve learned. For instance, a simulated phishing attack can mimic a realistic scenario that forces recipients to recall and apply their prior instructions. These exercises also help leaders gauge their training methods’ effectiveness and adjust as needed.
2. Engage company executives and leaders.
Fostering a more cyber-aware culture means that everyone—even C-suite executives—is active in the cyber defense process and champions the idea that every worker is responsible for security. Executives may need coaching on how to talk to their teams about cybersecurity and can benefit from a clear outline of what to cover and how to reinforce training with their teams. Advisors can share guidance on how often leaders should address security topics and the best platform, such as in a weekly email, a monthly all-hands meeting or a team offsite.
The overall tone and manner of handling a security issue matters, too. Instead of criticizing workers who make mistakes, encourage empathy when correcting poor behaviors or missteps. As threats have become more sophisticated and challenging to recognize, anyone can fall prey to bad actors regardless of their experience or role at the company. Employees will be more willing to report a problem in an empathy-first environment.
3. Establish clear and accessible security policies.
Historically, a handful of experts within the organization reinforced security protocols and guidance. This approach kept knowledge bound to a limited number of individuals instead of empowering others to build their understanding of cybersecurity best practices. Creating accessible security policies means making best practices simple and easy to understand with no room for confusion. Avoid jargon whenever possible and operate from the assumption that you’ll need to cover a topic multiple times for it to sink in.
Prioritize automated threat monitoring and detection tools that are easy to use and streamline response processes. Regularly update the operating system and other software applications, such as word processors, web browsers and productivity tools. Establish policies that dictate update frequency and prioritization based on criticality, as well as procedures for implementing updates across systems and user roles. It’s also beneficial to create space for collaboration, allowing employees to ask questions and share feedback on any information that needs more clarification or practice.
Don’t Forget The Value Of Technology
Technology plays a vital role in helping organizations strengthen cybersecurity practices. Advanced cybersecurity technologies, such as intrusion detection systems (IDS), security information and event management (SIEM) platforms and next-generation antivirus (NGAV) solutions, are adept at recognizing anomalous behavior and suspicious activities indicative of cyberattacks. Through real-time threat intelligence feeds and machine learning algorithms, these technologies can analyze vast amounts of data to distinguish between benign activities and potential threats, allowing security and IT teams to respond promptly before threats can cause harm to the business.
Cybersecurity Is Everyone’s Job
Maintaining a strong security posture is every employee’s priority, not just the responsibility of a select few. Technological advancements and deeper reliance on digital tech have made it essential for all workers within an organization to participate actively in cyber protection. By following these tips, businesses of all sizes can build a cyber-aware culture in which every member plays a role in safeguarding against potential virtual threats.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
