How can you build a cyber-safe culture at work?

Building a cyber-safe culture begins with the word "culture." By fostering a positive environment where employees feel empowered to ask questions and are praised when reporting potentially suspicious activity, employees can take ownership and see how they play an important role in the security of the organization. Additionally, by utilizing positive reinforcement rather than negative feedback, employees can feel more comfortable speaking up, will be more willing to report something that looks unusual, and their interest may be sparked to increase their own understanding of security best practices.

There are so many different areas to build on personal cyber awareness. For instance, you can grab technical alerts, find control systems reports, google vulnerabilities, or research cyber hygiene appropriate for you or your organization. The National Cyber Awareness System has many opportunities to find resources for technical and non-technical people. One area of cyber awareness is the many types of phishing = 21 - CEO fraud - Cloning - Deceptive phishing - Email phishing - Evil twin - HTTPS - Image phishing - Malware phishing - Man-in-the-middle - Pharming - Picture-n-Picture - Pop-up phishing - QR code phishing - Smishing - SMS phishing - Social media - Spear phishing - Vishing - Water hole phishing - Website spoofing - Whaling Enjoy

To assess your workplace's cybersecurity culture, take these steps: conduct anonymous surveys, review past incidents, evaluate training records, check access permissions, monitor policy adherence, analyze phishing test results, review incident response logs, seek employee feedback, examine security tool logs, and benchmark against industry standards. Utilize these insights to tailor a plan for strengthening cybersecurity culture through training, policies, and communication, with regular reassessments for continuous improvement.

To build an effective security culture, the first step is to understand our audience. We need to comprehend their daily routines and the challenges they face. Without this understanding, we won't grasp that additional security measures can often further complicate their lives. Only by realizing this can we better design our actions to reduce this effect, and perhaps even reverse it.

Cybersecurity transcends beyond just software and hardware—it's an organizational mindset. A holistic approach to building a cyber-safe culture integrates both top-down leadership advocacy and bottom-up employee participation. While defining goals and strategies is essential, continuous education and open communication channels are equally vital. Regularly sharing cyber incidents, both external and internal, can demystify the abstract nature of threats, making them more tangible. Encouraging employees to voice their concerns or suggestions can also foster a sense of collective ownership.

To create a cyber-safe culture, define goals and strategies. Enhance awareness through focused training. Reduce incidents by addressing patterns and optimizing access controls. Improve policy adherence with effective communication and audits. Strengthen phishing resilience with tailored simulations and timely feedback. Enhance incident response with regular testing and feedback utilization. Invest in advanced security tools for real-time threat detection and align practices with industry standards. These goals and strategies will guide your path to a cyber-safe culture.

Defining a strategy is fundamental. But how can a cybersecurity awareness strategy be implemented without hindering others' work? In my opinion, the key element of a well-designed strategy is to integrate it into employees' daily lives, seamlessly embedding security elements into their routines. If we start building burdensome training programs, participation in which is seen as an unpleasant obligation, we will likely fail in our goal. Awareness initiatives must be engaging and demonstrate how they should naturally operate in daily work. To achieve this, we need to understand how the recipients work. The closer the examples are to them, the more effectively they will remember our message.

Gamification of Cybersecurity Training: Instead of traditional training methods, using gamification to make learning about cybersecurity more engaging and memorable. This approach turns learning into a fun, interactive experience, often through competitions, quizzes, and rewards, to encourage employees to actively participate in cybersecurity practices.

All this is true, but I would like to add one key point: exemplarity. You can't ask people to lock their screen and neglect it yourself. If people see this, you lose your credibility. Always make sure you ask people to comply with the practices you actually do as well.

In a recent talk, the CISO of the BBC shared how employees there are rewarded for when they report malicious/ phishing emails by having less training to do. That's an amazing incentive and helps foster a culture of encouraging people to be more cyber aware.

To foster a cyber-safe culture, educate and train staff effectively. This includes regular cybersecurity awareness training with a focus on phishing. Ensure comprehension of security policies and promote effective incident response. Train on access control and least privilege principles, emphasize strong password practices, and teach secure communication methods. Guide staff on using security tools and conduct regular simulated exercises, like phishing drills, to test real-world responses. Encourage continuous learning in cybersecurity to keep them updated on evolving threats and technologies, empowering them to recognize and respond to security threats adeptly.

One tip that helped me a lot - use gossip! Use gossip as a means of information dissemination! One of the most effective means of conveying information is gossip. A short, concise form, emotionally charged, about people we know. All these elements make gossip intriguing, always accessible, and most importantly... we always remember what they were about. So next time you design training materials, base them on examples from your naighberhood, department etc. Use stories of people who have experienced incidents, show simple but real examples. Package this in short, click-bait formats, and serve regularly. It could be in the form of training, stories, and case studies, or even as short, almost TikTok-like narratives... It really works!

Security is not about being bad cops. Yes, there are rules, policies, guidelines, and procedures. But we obtain better results when we trust people and communicate to them what matters (and why it matters). This educative effort (rather than punitive) requires pedagogy and repetition. Enterprise communication tools or internal newsletters are great ways to send educational reminders about strong passwords, phishing threats, and other cybersecurity good practices.

A great way to communicate to staff is during the onboarding. Every company has turnover and building the cybersecurity awareness at the onset of being hired builds the sense of cyber awareness at day one. That initial communication will flow into daily actions that are emboldened by specific actions also built into the daily activities. When it comes time to complete the interactive training, you can employ metrics to get an understanding of the communication and security awareness environment. You are either doing great or you need to tweak your system.

To promote a cyber-safe culture, engage staff effectively. Maintain open communication about cybersecurity, share regular updates on threats, and organize interactive workshops. Encourage feedback to address concerns and implement a rewards system for contributions. Identify and support cybersecurity champions, use real-life scenarios in training, and create engaging content. Introduce gamification for enjoyable training and ensure leadership actively participates. This approach encourages staff to play a pivotal role in fostering a culture that prioritizes cybersecurity.

To build a cyber-safe culture, it's essential to monitor and measure progress.Regularly assess employee engagement in training and awareness initiatives, tracking participation and feedback to refine your approach Continuously monitor incident reports to gauge the impact of training on incident response and overall security. Measure the adoption of best practices like strong passwords and access control, and track the reduction in security incidents over time. Utilize metrics and key performance indicators to evaluate the effectiveness of your cybersecurity efforts.By analyzing data, you can adapt your strategies and ensure that your organization is making tangible progress towards establishing a resilient and sustainable cyber-safe culture

Create an open community where people can ask questions and discuss without the fear of being judged. This will not only help you monitor, but also establish a mechanism where the community can self-learn and share knowledge. If you and your team are accessible and always willing to help, the entire organization will benefit. Security will have heightened awareness and a community that shares experiences. Employees will feel that security is not just policing but also a friendly presence to talk to when you have doubts.

Reward your staff who report phishing emails that are actually malicious by giving them less training to do, that's an amazing incentive the BBC have as mentioned by the CISO there in a recent talk. If people are incentivized in this way, they're empowered to do more!

Tailor security awareness programs for distinct groups. Collaboration between CISOs and Talent teams is vital in organizing these programs. Engaging employees directly in their learning process is essential for their active participation and relying solely on PPTs won't suffice. Encouraging involvement through incentives, team objectives, and rewards for meeting them is a productive approach. Furthermore, recognizing the growing risks of business email compromise and social engineering attacks, it's imperative to provide tailored training for executives, including the C-suite and board members, addressing their unique needs and vulnerabilities in these areas.

To bolster our corporate cybersecurity, it's essential to make training personally relevant to employees. By integrating personal cybersecurity modules into our current programs, we not only increase engagement but also ensure our employees' digital safety at home, especially for their children. Personalized training using relatable real-life scenarios and providing resources for home use allows us to create a holistic security environment. After all, vulnerabilities at home can translate to risks at work. Such an approach ensures that our employees see cybersecurity not just as a work requirement but as a broader life skill, fostering a robust digital defense both at work and home.