25 Sep How to create a culture of Cyber security in the workplace
Why is it important?
The digital landscape is constantly changing- with the advent of innovations such as Virtual Reality, drones, and the Internet of Things, businesses are scurrying to keep up to date with the newest technology. On the flip side, the Cyber Threat to firms has increased dramatically due to this phenomenon. Phishing emails, ransomware, Denial of Service (DoS) attacks have become commonplace, making cyber security a necessity, not a choice.
We must understand that Cyber Security has three tenets: people, processes, and products and services. These tenets must be aligned to create a holistic approach towards cyber security. The tenet we focus on in this article however, is people.
Why focus on people?
Interestingly, 95 percent of all security breaches are caused by human error. External users may be difficult to monitor but internal employees can be programmed to help prevent cyber security breaches by cultivating a culture of cyber security at work.
Objectives of a culture of Cyber Security
This approach has three primary objectives:
- To identify and safeguard a firm’s intellectual property and internal data.
- To be able to respond effectively and efficiently to a security crisis.
- To resume normal work operations as soon as possible in the case of a cyber-attack.
Cyber Security starts at the top
Every successful change strategy is driven from the top; this case applies to efforts in creating a Cyber Security culture as well. Security is not just the prerogative of the Chief Information/Security officer or the IT department; it requires a complete management buy-in. Since the best way to achieve management buy-in is through the use of financials, that should be the focus of any proposal.
Management teams must understand that it is much cheaper to invest in Cyber Security than it is to take reactive measures in the event of a cyber-attack. According to a study in 2015, average annual losses to firms due to cybercrime exceeded $7.7 million. Not all losses are calculable though. Cyber crime adversely impacts the brand equity and credibility of firms. In terms of prospects, this means declining investor trust and possible declining share prices.
Vulnerabilities in security mechanisms also leaves confidential data to the mercy of malicious hackers and cut-throat competitors. Once senior management understands this, they can be better equipped to make security decisions.
Cyber Security Training is a must
Training in Cyber Security measures, policies and practices should not be an annual occurrence. This should be a flexible, possibly gamified platform that allows employees to access training on the go. There should be constant checks to ensure the effectiveness of such programs.
Designing Cyber Security Policies
Cyber Security policies should be defined keeping in mind the weakest vectors of a company and the most common applications, websites and devices used. These policies also must account for the number of remote, contractual and outsourced workers of the company. These procedures need constant updates and communication to employees.
Empower the people to enforce security
People may be your weakest link but with the right ammunition, they could be your strongest. It is important to align your organizational security goals with those of individuals. In the event of a cyber crime, it is not just company data that is compromised; it’s also employees’. With this understanding, employees are more motivated to take initiatives of their own to secure and protect data.
Partnering with a Cyber Security provider
