By | Quality Links

There’s a saying that a chain is as strong as its weakest link. It suggests that an organization’s success depends on the success of each of its employees, so if one employee fails, the entire organization fails. Statistics show that human error accounts for 95% of cybersecurity breaches, that the average cost of a data breach in the United States is USD 9.44 million, and that the global average total cost of a data breach is USD 4.35 million. These statistics indicate a weakness among employees and, therefore, in the overall organization.

In this article, we will discuss what security culture is, its importance, and how it can be improved to achieve organizational success.

What is security culture?

Security culture falls under the umbrella of company culture and refers to the social behaviors, ideas, and customs shared by a group that influence their security. It is where values and norms fall in line with best practices and policies for information security. A security culture motivates employees to prioritize information security by rewarding them for doing so.

Why is security culture important?

Culture plays a significant role in the social environment of the workplace, as well as the way in which employees behave and perform. It provides a solid foundation for organizational success, and the statistics support this fact. The Global Culture Survey 2021 indicates that 70% of leaders and employees say that when it comes to success, culture is more impactful than operations and strategy. According to 69% of leaders, the majority of their success throughout the pandemic resulted from company culture.

While company culture does come with some negative impacts, it is nonetheless considered desirable because the positive impacts far outweigh the negatives – security culture is no different. A strong security culture is important because, as you can see from the statistics, human error is responsible for over 90 percent of security breaches in organizations.

A security culture serves as a guide to employees in their prioritization of security in their work and supports them along the way. It motivates them to understand security threats, take cybersecurity seriously, and make it a habit.

Consider this scenario: A company’s human resource officer receives a call from a bank seeking to verify an employee’s salary information. While some may do a Google search or use PhoneHistory to verify the caller’s identity before any sensitive information is provided, others may not. It is at this point that adequate cybersecurity training and an IT security policy would step in to guide the officer’s next step.

When a company doesn’t have an IT security policy and doesn’t train its workers enough on best practices, it leaves itself open to data breaches.  

How to build a security culture

Firstly, you need to determine your organization’s current situation. A gap analysis will compare your current situation with your goal and highlight areas that need improvement. It is important to remember that needs will vary based on the department, so analyze them separately. When you are done mapping the activities that will most effectively strengthen your security culture, you then need to work out whether the cost is greater than the value that it creates – whether it is an investment worth your while.

If you do decide to go ahead with trying to develop a strong security culture, however, you will need to choose a qualified person to run it. The following tips will help you lay the foundations for the secure behavior of the company’s staff and strong security culture.

1. Create a policy that is straightforward and transparent

Not only must a security policy be created, but it must also be shared with employees, supported by the organizational structure, and enforced inside the organization.

A healthy security culture is a holistic undertaking that requires the cooperation of employees and managers in the implementation of security policies. Policies can only help foster a security culture if they are attainable, accessible, and supported throughout the hierarchy of the organization.

2. Provide security awareness training for all employees

As you can recall from the statistics, over 90 percent of security breaches in organizations are due to human error. Therefore, it makes sense that teaching employees fundamental skills can significantly improve an organization’s cybersecurity. Combine different training formats, such as seminars, online courses, video tutorials, etc., to ensure maximum involvement and the most successful outcomes. Remember that regular training is essential to keeping your staff up to date on the latest security practices.

3. Prioritize information security

In order for information security to be a priority for employees, it must first be a priority for managers. The number of security breaches in recent years suggests that information security has yet to be a priority in many companies, which therefore highlights the need to remedy this.

In the short term, the costs associated with improving security can be very high, and some organizations would prefer to avoid them. However, it is important to note that the costs that result from data breaches, in some instances, far outweigh these short-term costs.

4. Reward employees for compliance

What makes security culture effective is positive reinforcement. It encourages employees to adhere to security best practices. Research shows that people who are rewarded for adhering to the IT security policy are more likely to be willing to spend most or all of their time engaging in secure behavior than those who are punished for the mistakes they make.

Secure behavior can be rewarded in many ways. Experts at the SANS Institute, however, recommend rewarding employees for following best practices and reporting vulnerabilities with the use of public recognition – for example, praising them in newsletters.

The takeaway

Remember that security is everyone’s responsibility. It requires time and consistent effort. Ensure that you have an IT security policy and that all employees have access to it. Make sure to provide regular security awareness training as well. A strong security culture will only be possible if everyone knows and understands the importance of their actions and the benefits and potential consequences that can result from secure behavior.