Establishing a Cyber Security Culture: The Balance Between Trust and Risk

Originally published by New Context.

A cyber security culture stems from how an organization communicates the need for security and the technology they provide to enable it. It all starts with awareness, in that employees need to know and understand the rules. Unfortunately, that’s where a lot of organizations fail. They may have protocols laid out but not focus on helping employees understand why they’re necessary.

Every single person at an organization needs to feel accountable for cyber security, whether they’re in technical positions or not. To make this easier, organizations can adopt technology that simplifies security while preserving the business value of assets.

Social Proof and Communication in a Cyber Security Culture

There is a common phenomenon that humans exhibit called social proof. Psychologist Robert Cialdini coined the term as one of six principles of persuasion he examined. Simply stated, it means that people will model the behaviors of others when they’re uncertain about a situation. Like most persuasion principles, it can have a positive or negative effect.

Consider a new employee on his first day at a company. He’s given a handout that explains the requirements for setting a complex security password for network access. As he’s about to do that, one of his new coworkers says, “Oh, we all just use ‘password.’” That new employee is then far more likely to default to an insecure password because it’s what everyone else does at the company.

On the upside, when people see others following the standards of a company, they are more likely to do so as well. That is why it’s so important that upper management establish and model the same security principles that they want to see in their staff.

Another essential part of security awareness is communication. It’s not enough to tell workers what to do. It’s vital to explain why it’s that way. Managers should try to outline how security standards apply to the specific employee. For example, in the password scenario from above, they may bring up a data breach in the past that lead to massive repercussions for the individuals with insecure passwords.

By modeling the behavior they want to see in their workers and communicating the specific reason for security protocols, it’s far easier to establish a solid cyber security culture. Of course, that only gets the company part of the way there. They must also leverage technology.

Using Technology to Enforce the Culture

Very broadly, there are two different kinds of cyber security rules that an organization will deal with: rules enforced through infrastructure and rules established through policy.

Ideally, when an enforced process is feasible, it should be used. Policy-only security protocols should be the exception, not the rule. When used, it’s essential to audit the system and take remedial action with those not meeting the requirement.

Of course, enforced security policies can create some issues when it comes to business value. While the goal is to protect assets, protocols that are too stringent will impede work. They will slow down processes and dissuade employees from completing critical tasks. This is an age-old issue. A task will either be secure, or it will be easy. It’s also one of the biggest problems with agile development methodologies. In the interest of speeding the process, workers bypass necessary security steps. However, this isn’t an insurmountable issue.

The best solution is to make the complex security protocols easy to follow. Consider a common security standard that a lot of people don’t enable—multifactor authentication. Many times, signing in with the password and getting a texted pin seems like too much trouble for what is protected. Some companies, like Google and Apple, have shifted to using biometric identification as the second method. It’s simpler for someone to provide their fingerprint or voice to add an additional layer of security, so they’re more likely to adopt it.

Working with a Trusted Cyber Security Partner

Simplicity for the user is one of the most significant factors to success in building a cyber security culture. When protocols are easy to follow and communicated, company-wide adoption goes up. Individuals are more empowered to take an active role in their organization’s security without disrupting the flow of business processes, and leaders can have greater peace of mind knowing that valuable information has been treated with the utmost care.