When it comes to security threats, insider risk is a term we’ve heard about a lot – and for good reason.

Whether the intent is malicious (e.g., obtaining unauthorized access to corporate systems to steal valuable information) or benign (e.g., accidentally putting sensitive company data in the public cloud), employees can pose a serious security risk to their organizations.

But, what we don’t often hear about is how they can also serve as their company’s first line of defense against today’s cybercriminals. And the most effective way to prepare them for this role is to create a cyber security culture that encourages and rewards security awareness and safe online behavior.

Developing a strong cyber security culture takes time and effort, but the end result is well worth the upfront investment.

Here are four best practices to help you build a successful cyber security culture from the ground up.

1. Prioritize education and training.
Employees can’t be security experts if they aren’t aware of the risks facing them. Implement education and training programs that teach employees about cybercriminals’ attack methods and tactics, such as ransomware and phishing, as well as how they should react if a threat is identified.

To enhance security awareness, make it topical and relevant to employees’ day-to-day activities and online experiences. Many IT and security professionals are still training employees on security basics, such as how to create strong passwords, that most already know – largely because they aren’t sure if more advanced cyber security information and best practices will be understood.

But the reality is that online users have been exposed to malware and other cyber security risks for years, and they need to be kept up-to-date on the latest attack methods, risks and security developments. Employees will be more likely to digest security information and translate that knowledge into safe online behavior, if it’s relevant to their daily lives.

2. Reward safe cyber security behavior.
As part of your education and training programs, it’s important to clearly explain how employees should manage their online activities, as well as define acceptable and unacceptable ways to access and use company networks, software and devices. To promote adoption of safe cyber security behavior and boost employee engagement, consider implementing recognition and reward programs, running monthly contests or rolling out gamification programs.

3. Enable easy reporting.
Ensuring employees are aware of potential risks and acceptable user behavior is only half the battle. To make sure they can put this knowledge into action when a concerning situation arises, a detailed reporting policy must be in place. But, it must be an easy process - complicated policies and procedures could deter employees from reporting potential threats or suspicious behavior.

A good way to make reporting a simple affair is to add a “one-click” link to your email platform that allows users to forward suspicious emails directly to the IT team for review. If your company has an intranet, you can also add a link to the home page that enables employees to report cyber security concerns or recognize good behaviors.

4. Lead by example.
Building a strong cyber security culture isn’t the responsibility of IT alone. To achieve positive outcomes and desired results, there must be firm commitment from all levels of the organization – including board and c-suite executives. Behaviors are learned and reinforced by watching leaders, and when they are engaged and committed to safe cyber security behavior, it will be that much easier to create a corporate culture that makes employees a vital part of your security strategy rather than a liability.

If employees understand their role in keeping company networks and data protected, they’ll be more inclined to uphold their responsibilities, follow company policy and maintain safe online behavior. The powerful combination of awareness, training and clearly defined security policies lays the foundation for a solid cyber security defense.

Perhaps the most important thing to remember is that, when we talk about “culture,” we are referring to automatic user behavior, or actions that employees take without having to stop and think. To achieve this desired state, security must be present all the time – an annual cyber security training program or an “awareness month” will not get the job done.

Making security a fundamental part of all business operations and keeping attacks, countermeasures and best practices front and center year-round will help you build a strong cyber security culture. And while this may not mitigate all risk for your organization, you can remain confident knowing that company employees are part of a community that makes cyber security a top priority.

Register or login for access to this item and much more

All Information Management content is archived after seven days.

Community members receive:
  • All recent and archived articles
  • Conference offers and updates
  • A full menu of enewsletter options
  • Web seminars, white papers, ebooks

Don't have an account? Register for Free Unlimited Access