Security cultures don’t exist within organizations because IT wills them to. With the increase in attacks, organizations need internal advocates for the necessary shift in corporate culture to occur.
Just about every attack type in 2018 – ransomware, cryptojacking, encrypted attacks, and data breaches – are on the rise. Organization like yours are heavily invested in stopping these attacks using security solutions that protect the perimeter, endpoints, and data – and yet, attacks still gain ground, leaving victims in their wake.
Attacks are on the rise is because cybercriminal organizations are seeing increasing degrees of success with each new iteration. What’s helping these attacks is a lack of a security culture. In most organizations, IT and Security teams are the only ones concerned about the threat of attack. The rest of the userbase go on about their daily tasks not caring about cyber security – all because your organization lacks a proper security culture.
The use of security-centric solutions (e.g.: 2FA), logon banners, and Security Awareness Training all establish and repeatedly emphasize the organization's need for security. But, like any new application, platform, or process, without user adoption, it’s doomed to fail.
What’s needed are internal security champions – tech-savvy, non-IT, users who understand and promote the need for incorporate good security practices into everyday work.
Your security champions can be used to help in the following ways:
- Get users to focus on the issue of security. IT and Security teams can send emails until they’re blue in the face; a fellow user leading the charge for heightened security will get the attention of users far more quickly.
- Promote the need for Security Awareness Training to educate employees on the state of threats, the impact of those threats, and to elevate every employee’s sense of security-mindedness.
- Promote the need for incorporating security best practices into processes and tasks.
- Assist when fellow users encounter suspicious email or websites to minimize the success of attack.
Cultivating security champions will require some careful selection and some formal processes on the part of IT. But, by using security champions, your organization will help to reduce the security burden on IT and the risk of successful attack.
