Did you know that 10% of the top 1,000 Alexa domains currently distribute malware, according to a report published by VirusTotal in August 2022?
Employees are downloading essential app installers with embedded malware from reputable sites with valid SSL certificates. A lot of those apps are high profile, including Skype, Adobe Acrobat, 7zip, Microsoft Edge, and Zoom.
Social engineering is becoming more sophisticated. Even legitimate software can be a significant security risk! To address these new cyber threats, founders need to adopt risk awareness and reporting protocols.
If you’re in the early stages of planning a cyber security culture for your organization, you need to learn:
- What a cybersecurity culture includes and why it matters;
- How to create a cybersecurity culture within your organization;
- How to overcome the most common issues while developing a cybersecurity culture.
Why Creating a Cybersecurity Culture Can Be Challenging
Cybersecurity culture refers to an organization’s practices, attitudes, and values regarding cybersecurity.
These conventions start with your organization’s goals, leadership, and policies.
Users can be your best defense against cyber-attacks. But users can also become your organization’s biggest weakness.
Even adopting a simple measure, like multi-factor authentication (MFA), can be frustrating for your entire organization.
Then you should consider all the other questions, like your security budget, training programs, and executive approval from stakeholders besides the CISO and CIO.
To keep things simple, let’s focus on three foundational challenges:
- Organizational disinterest
- Pre-existing interdepartmental conflict
- Lack of leadership from CISO
Organizational Disinterest
Sometimes, employees may not be interested in the measures you’re proposing. In fact, you may deal with a prevailing attitude of apathy toward security.
What do you do when security operations are neither properly valued nor understood?
When employees don’t care, often the executive team doesn’t either. But pointing fingers or placing blame isn’t productive. Instead, address the root cause.
Apathy towards cybersecurity starts with your organization’s cultural norms. You cannot build a strong security posture without first fostering acknowledgment and appreciation for potential cyber threats.
In short, begin by shaking users from their oblivious state and make them aware of how grave threats like company-wide ransomware attacks can be.
Pre-Existing Interdepartmental Conflict
Perhaps your organization is struggling because of fundamental conflicts of interest between teams.
Your sales team is focused on sales, customer support is focused on the customer experience, etc. These departments are thinking about their own tasks the same way you prioritize cybersecurity when you’re on the security operations team.
In addition, a lack of transparency between the security team and other departments often exacerbates the problem. Your analysts may not only be siloed off from the rest of the organization, but you may even have conflicts within your security team itself.
When most users aren’t aware of the current security issues affecting your organization, each department will remain blind and indifferent to the other’s priorities.
Lack of Leadership From the CISO
Even if you have a capable team of security analysts, you also need someone to lead them over the longer term.
You need to have a dedicated chief information security officer (CISO) and that person has to be thoroughly qualified. However, in the current job market finding a capable CISO is not so easy. Locating a security professional who can establish a cybersecurity culture, manage organizational risks, and fit into the company’s budget poses a conundrum for most organizations.
Without the transformational leadership necessary, you are fighting your organizational disinterest with one hand tied behind your back.
How To Bring Cybersecurity Culture to Life in Your Company
If your employees are returning to the office, then you may also notice that the work-from-home trend has brought with it some bad cybersecurity habits.
For many CISOs, that trend means having to expand oversight into other departments. Planned office re-openings and security protocols need to be implemented strategically to lower the chance of user mistakes and avoid compromising your organization’s security.
To successfully instill a cybersecurity culture into your organization, take the following steps:
- Start in the C-suite
- Gamify cybersecurity training
- Implement a succession plan.
1. Start in the C-Suite
First, begin working within the executive level.
All of your security professionals should understand and align their work with the organization’s long-term goals. Avoid getting stuck in technical cybersecurity metrics and translate them to immediate business impacts. You should convey cybersecurity risks by connecting them with your organization’s goals in terms of their financial impact.
Your C-suite leaders should then set the tone for awareness leading by example for the rest of your organization.
At this stage, correct messaging is key. For example, your executives should actively show the importance of security during corporate events. These demonstrations should be communicated in a way that your users can immediately understand and apply to their own behavior.
2. Gamify Training
After security leaders have collaborated with the C-suite, found alignment with company goals, and laid out associated risks, they can put together an engaging training program.
User training often appears dogmatic, uninteresting, or lacking seriousness. Instead of repeating data or procedures, highlight real-life examples of hacks and the consequences of a weak security posture.
Next, customize training by departments in terms of the relevant threats. This results in a better grasp of cyber hygiene and its many components.
Finally, gamify your training program. Gamification turns the educational setting into a game. The logic behind the gamification of education is that humans naturally practice skills and behaviors by playing games.
In effect, users will learn more (and with less resistance) when elements of game-playing are included in the learning process.
3. Implement a Succession Plan
Even if your other efforts to implement a cybersecurity culture are successful, manage your expectations. Most of the time, truly fostering a cyber-aware environment with employees and executives can take upwards of 5 years.
Meanwhile, the average CISO holds the position for only 2 years. Such short tenure can be caused by factors such as burnout, lack of qualifications, poor performance during a breach, or lack of support from the executive team.
Either way, CISOs need to think beyond their own tenure. To guarantee that your company vision is carried out successfully, you need to determine how a successor to your CISO would be appointed and continue your cybersecurity program.
Crack Down on Social Engineering and Malware Attacks With Managed Security Services
Today, social engineering means stolen SSL certificates, phony favicons, and installers from legitimate domains infested with malware.
Cybercriminals are pivoting to abusing users’ trust rather than opportunistically capitalizing on their mistakes. So as your organization moves into 2023, you will see other companies spending more and more resources on creating and maintaining a sound cybersecurity culture within their organizations.
If you’re concerned about socially engineered malware threats, interested in outsourcing a managed security services provider (MSSP), or committed to creating a cybersecurity culture within your organization, contact our team at Pareto Cyber to schedule your free cyber risk assessment.
