Cyber Security is About Culture and People, not Technology

Security isn’t just IT’s problem, but everyone’s problem within the organization. The key isn’t “yet another security solution”, but a changing of the way the organization thinks about cybersecurity.

The key to stopping cyberattacks from being successful revolves around every part of the organization being concerned about security. IT is already on top of this, but you need the C-Suite, HR, and users all on board – each one working towards a more secure way of operating.

The success of security firmly rests in whether a culture exists that perpetuates both the need for security and the use of security in everyday work. This cultural shift requires a paradigm change where nearly every part of the organization plays a role:

• Senior leadership - you are perfectly situated with visibility into the entire organization, able to see the results of a change in culture. You also have the ability to mandate an organization-wide collaboration towards building a security culture.
• HR leadership – you understand the pulse of the organization. As the culture shifts towards including security as a daily aspect of the job, you can ensure employees understand why it’s important, obtaining valuable feedback from users on how the culture change impacts than, providing this to IT.
• IT leadership – you are the bridge between the business, operational, security, and technology requirements necessary to create and maintain this culture change.
• Security staff – you can help assess risk, develop strategy, ensuring reporting and accountability around implemented technologies and processes that drive culture change.
• IT staff – you can help to identify and implement solutions that will augment the security culture. A focus on simplified adoption and ease of use, matched with an actual ability to make the organization safer is something required of someone close to both the organization’s technology and users.
• Users – you can incorporate security awareness into your daily work activities, being cognizant of the need to be on alert when interacting with anything outside the organization (e.g., email, websites, phone calls, etc.), as well as the need for good security hygiene around passwords and data security.

Creating a security culture takes a village – and, in this case, the village is under constant attack. It’s time to do more than just sharpen spears and post lookout points; it’s time to employ the entire village to participate in ensuring security.