Building a Culture of Cyber Security: Engage Your Staff for a Resilient Organization

Cyber security is a human and a technological issue.

The resilient organization has a positive security culture, nurturing awareness among employees, customers, and partners. Although technical tools such as password managers and firewalls are necessary, a team that is ready to identify and avoid attacks is an essential security ally. Synergy between technology and manpower is essential, because in order for protection to work, employees must use it correctly.

Risks are present on all types of devices

Employees are often diligent about following security best-practices for their work computers, but relax their protective instincts with their phones or tablets. Staff must be reminded that risks are device-agnostic. Opening a phishing email on a phone, or visiting a risky link on a tablet, exposes a company to potential risks. A recent study found that 38% of employers don’t have security measures for personal devices used for work. 

Devices equipped with endpoint detection are often the safest for employees to use, yet the growing trend of “Bring Your Own Device” (BYOD) in many current workplaces can open companies to new attack vectors if employees are not equipped with appropriate software and training. 

Compliance is everyone’s responsibility

Many employees are unaware of the regulatory frameworks that govern their business. While a deep-dive into cyber security regulations may not be necessary for all employees, a basic awareness of noncompliance and its ramifications is enough for employees to start to keep their company’s privacy regulations and guidelines in mind when on their devices. In addition, employees should learn that their company being compliant with regulations does not mean that they can stop being vigilant for threats.  

All data is valuable

Even seemingly insignificant data can give cyber criminals access to high-value information, such as clients’ financial information or addresses. Employees can be trained to learn that there are different security or risk levels to data which will change how it is shared and stored. In order to create a culture of security, companies should have a system to identify which data is “high risk” and instruct employees on how it should be protected and accessed. Users with access to this higher security data should also take additional training, and access should be restricted only to the essential users. 

Regular penetration tests and antivirus software are great but incomplete.

Organizations must focus on cyber resilience, not just cyber security. In a comprehensive framework, a host of tools should be employed as part of a layered strategy to protect an organization’s data.  Penetration tests are simulated attacks that test an organization’s defences and identify vulnerabilities. They provide crucial but limited snapshots of security posture at a given time and may not be able to reveal evolving tactics of cyber criminals. 

Antivirus software detects and removes malicious software (otherwise known as malware) from devices. It is an important defense tactic, but it cannot always protect an organization from all types of malware and cyber threats, such as phishing, ransomware, or denial-of-service attacks. Companies should complement penetration tests and antivirus software with other assessment and monitoring tools that nurture continuous improvement in cyber security. 

Data protection, compliance, security software and device-agnostic vigilance are just a few key cyber security pillars that employees must familiarize themselves with. By addressing common employee misconceptions to create a comprehensive culture of cybersecurity, a company can maximize its security posture and establish itself as a resilient organization. 

To get started on creating a truly resilient security framework contact a Rewterz expert today.