Why An Effective Security Culture Is Essential For Your Organisation

With data breaches spiralling out of control, it’s time that organisations change their approach to fighting information security threats.

There’s a long-held, mistaken belief that this is an IT issue that can be fixed with more reliable software and a keener eye on technological flaws. In reality, employees are just as likely to cause a data breach as a bug in your system, and unfortunately there’s no simple patch for human error.

Rather, it takes an organisation-wide commitment to security, as you educate staff on the risks they introduce to your business and get them to break bad habits.

The problem with staff awareness training
When experts talk about educating employees, they generally refer to staff awareness training. In most organisations, this takes the form of online or in-person courses that take place once a year. More vigilant organisations might run two or three a year, but they’re nonetheless rarities – distractions from your everyday work – rather than part of an ongoing, structured approach to cyber security.

It’s not hard to see why employees might resent these courses. They interrupt their working week and knock them off schedule, and tend to comprise being lectured on how to do seemingly simple tasks, like sending emails or creating passwords.

This is why staff training alone can only do so much. Sure, employees will retain some of what they’ve been told, but true progress takes a willingness to learn.

That means building a culture of cyber security in which organisations take the time to show staff the real-world consequences of poor data protection practices.

It’s one thing to give them a PowerPoint presentation with stats like “23 million people in the UK use ‘123456’ as their password”, but it’s something else to explain why that’s a bad thing. The answer might sound obvious, but you’d be surprised at how often there are knowledge gaps between the errors that cause data breaches and the advice for preventing them. 

Let’s take a look at some examples.

Where employees are going wrong
Employees are generally aware that passwords should be a combination of at least eight letters, numerals and special characters (although there are arguably better ways of creating strong passwords), but that doesn’t really cut to the issue.
As a result, employees might create passwords such as ‘Password#1’. It meets all the criteria, but it’s not going to protect your account – being, as it is, a minor variation on one of the most popular login credentials.

The same thing applies to phishing emails. You can warn staff all you like to look out for suspicious messages and unsolicited, urgent requests, but the scams are successful not necessarily because victims are ignorant but because they’re careless.
Victims of phishing emails are, in many cases, aware of the threat of these scams but were caught out in the heat of the moment.

That’s exactly why phishing is so dangerous: the seemingly urgent nature of the messages can make us ignore any faint alarm bells that ring as we dimly recall a warning from a training session we once took.

The only way to tackle people’s impulse to click phishing emails is to engrain good habits into them. Employees should be capable of immediately recognising suspicious emails in the same way that they should intuitively know what makes a strong password.

Because contrary to a lot of evidence, staff awareness training doesn’t have to be complicated. The only thing that’s lacking is the time and commitment towards rooting out bad habits.

Creating a culture of cyber security
Developing a culture of cyber security is as simple as making staff awareness part of your day-to-day operations.
Training courses should remain the backbone of your efforts, and e-learning is an ideal way of delivering lessons. It’s affordable, staff can take the course at a time that suits them and it gives you a reliable audit trail. That means you can see who has taken the course and, just as importantly, who hasn’t.

You should complement training with visual reminders that enforce these lessons, like posters and email signatures containing security advice.

Perhaps the most important thing you can do is to practise ‘nudge theory’. This is a type of behavioural science that prompts individuals to make smart decisions by using indirect suggestion and positive reinforcement.
The approach is intended to help employees rationalise why certain processes are necessary, meaning they’re making smart choices by habit rather than from memory.

Subtle things like these might not seem as though they’ll make a huge difference, but remember: the devil is in the detail.
Just as you break bad habits in your personal life through small, routine gestures and reminders of your bad ways rather than one grand statement, so too does effective data protection require regular nudging. 

So don’t leave your organisation’s information security wellbeing to your IT department or staff awareness training providers. Make it a part of your day-to-day activities and encourage everyone to play their part.

About The Author: Luke Irwin
Luke Irwin is a writer for IT Governance. He provides news and opinions on a variety of information security topics, and was nominated for the 2019 European Cybersecurity Blogger Awards.

 

 

 

« New York’s Albany Airport Pays Ransom
5G Will Reduce Car Accidents »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Bob's Business

Bob's Business

Bob's Business adopts a fresh approach to information security awareness and compliance training, delivering key information through the use of short animated movies.

NextLabs

NextLabs

NextLabs provides data-centric security software to protect business-critical data and applications.

CionSystems

CionSystems

CionSystems provides identity, access and authentication solutions to improve security and streamline IT infrastructure management.

Cleafy

Cleafy

Cleafy protects web and mobile applications from tampering attempts and deploys countermeasures to guarantee data and content integrity at scale.

CyberPilot

CyberPilot

CyberPilot ApS is a Danish cybersecurity company. We work with all types of companies and organisations, both large and small, who want to achieve effective cybersecurity.

NetGuardians

NetGuardians

NetGuardians is a leading Fintech company recognized for its unique approach to fraud and risk assurance solutions.

Ten Eleven Ventures

Ten Eleven Ventures

Ten Eleven is a specialized venture capital firm exclusively dedicated to helping cybersecurity companies thrive.

Acmetek Global Solutions

Acmetek Global Solutions

Acmetek is a Global Distributor and a Trusted Advisor of PKI /IOT & SSL Security Products and a Managed Services Company.

CrossCountry Consulting

CrossCountry Consulting

CrossCountry Consulting is a trusted business advisory firm that provides customized finance, accounting, human capital management, risk, operations and technology consulting services.

Ghost Security

Ghost Security

Ghost is a venture backed, product-led startup building the new standard in application security for the modern enterprise.

Exalens

Exalens

With deep roots in AI-driven cyber-physical security research and intrusion detection, at Exalens, we are enhancing operational resilience for cyber-physical systems at the OT edge.

PolySwarm

PolySwarm

PolySwarm is a crowdsourced threat intelligence marketplace that provides a more effective way to detect, analyze and respond to the latest threats.

Kaesim Cybersecurity

Kaesim Cybersecurity

Kaesim are a global team of cybersecurity experts protecting businesses since 2015. We stop bad people damaging your business, your data and your reputation.

Prembly

Prembly

Prembly are a compliance and security infrastructure company.

Ofcom

Ofcom

Ofcom is the UK's communications regulator. We regulate the TV, radio and video on demand sectors, fixed line telecoms, mobiles, postal services, plus the airwaves over which wireless devices operate.

WillJam Ventures

WillJam Ventures

WillJam Ventures are a private equity firm focused on investing in world-class cybersecurity companies that will become the next generation of leaders in protecting the world’s digital assets.