When discussing the evolving nature of cybersecurity, whether that means the impact of DNS hackers or how more organizations are putting in place Zero Trust security architecture, there’s one area that may be less often discussed but perhaps most important—the role of employees and people within your organization.
A critical part of holistic cybersecurity relies not just on the right technology, but also your people. That means that your employees are well-trained in cybersecurity best practices and are held accountable for their role through the implementation of formal governance.
According to statistics cited by Tech Radar, 90% of data breaches are caused by human error. These statistics come from research done by Kaspersky Lab that shows public cloud infrastructure incidents are more likely to stem from employees of a customer than by something the cloud provider does on their part.
Often, organizations make the mistake of being more concerned about external threats, such as those posed by the use of external cloud platforms, and they tend to misunderstand or fail to recognize the internal threats that exist.
As we move forward with cybersecurity, there should be an increasing focus on the role of employees and the human factor. In order to address human-related cybersecurity issues, organizations should work toward fostering a culture of cybersecurity.
Understanding the Importance of a Cybersecurity Culture
Even when an organization spends a significant amount of time and money on security-based technology investments, if they don’t pay attention to the human element, then they are still at risk. Cybercriminals very frequently use phishing emails and other tactics directed at individuals as their way to breach a network.
You have to think about the fact that it’s not going to be a computer or network device that’s going to click on a malicious link—it’s going to be a person who does.
Employees are the people who have access to your computers and your systems, and they can be your biggest cybersecurity asset or your main liability.
A cybersecurity culture is one that makes it a priority. There aren’t just policies put in place without explanation, and cybersecurity is more than an IT issue—it’s a company issue.
With a security culture, there is not only awareness but robust explanations as to why certain policies are in place and what the employee’s role is in ensuring these policies are adhered to. In a cybersecurity culture, there is accountability, as well. Employees gain an understanding of the implications of their actions, and they also know the consequences of said actions.
What Inhibits a Culture of Cybersecurity?
Understanding what not to do when it comes to cybersecurity can be just as important as understanding what to do.
There are certain things that serve as roadblocks to the facilitation of a culture of cybersecurity.
Perhaps one of the biggest is a lack of employee buy-in. This often happens because employers don’t reinforce the importance of cybersecurity and the individual’s role in implementing best practices. Most employees have never received any formalized cybersecurity training, and this can be a big reason why human error is the top reason for attacks.
Even when employees do receive training, it tends not to be engaging or personalized. It can seem like it’s used to check a box, rather than to actually help employees learn with context.
It’s not just a lack of employee buy-in that inhibits a culture of cybersecurity—the same can stem from executives. Leadership teams often have the same level of misunderstanding about the importance of cybersecurity as their employees.
Leadership and executives may think cybersecurity is important but that it’s best left to IT, and that’s not the reality.
Implementing a Cybersecurity Culture
Once you identify some of the main roadblocks, you can start building a culture based on a foundation of cybersecurity.
As you’re doing this, begin with the basics. Sometimes when it comes to training employees on issues related to cybersecurity, organizations will make the mistake of thinking employees know the basics, and that may not be the reality.
One of the most important basics? A strong password policy. When you have this, it’s going to serve as an excellent defense against attackers.
When you’re building out the basics, you should also make sure that your access control settings are up-to-date. You should make sure everyone has access to only what they need to do their job, including systems, software, and data.
If an employee doesn’t work with you anymore, you should have a policy in place for how their access rights are terminated without the risk of your data being utilized.
Then, once you have the basics in place, you can move on to the development of cybersecurity training.
Cybersecurity training needs to be relevant to your employees. It needs to be presented within the context of their day-to-day responsibilities and job duties so that they see why it’s important for them to understand. The more contextual and relevant you can make training, the more engaging it’s going to be for employees.
Keep training interactive and hands-on, and use real-life examples that are pertinent not only to the employee but to your organization.
Cybersecurity training is important, but it can be fun. Think about making it competitive and using elements of gamification.
Another thing that should be part of your training is assessment.
If you use e-learning, it simplifies how you not only deliver employee cybersecurity training but also how you assess whether or not it’s working. Use quizzes and tests both before and after an employee completes a training module.
Regularly check-in with assessments to determine if skills refreshers are needed.
Finally, make a culture of cybersecurity part of your organization’s brand and mission. It can also be part of your employer brand as well as your customer brand. When you make it apparent you value cybersecurity, customers are going to feel more comfortable buying from you because they are ultimately the ones impacted by a breach.
