Normalizing Security Culture: You Don't Have to Get Ready If You Stay Ready

COMMENTARY

October is National Cybersecurity Awareness Month in the US, when IT teams prepare their annual security education and awareness training program. For many employees, this may be their only interaction with the security team outside of onboarding, submitting a help ticket, or reporting a potential incident. But every person plays a part in the security function of the business every day, whether or not they realize it. As they do, they have the potential to be an asset or risk to the team's security posture.

According to Verizon's "2024 Data Breach Investigations Report," 68% of all breaches include the human element, with people being involved either via error, use of stolen credentials, or social engineering. While exploiting technical vulnerabilities is rising in frequency as the initial way in for an attacker, stolen credentials and phishing still account for the lion's share of recorded breaches.

Prioritizing security as a critical element to an organization's effectiveness and success will reduce the risk of incidents, while benefiting the whole team and the organization's reputation.

Putting a Price on Trust

Security is a core business function, as crucial to an organization's success as finance, revenue generation, or product departments. It's also a key factor in shaping an organization's reputation, specifically influencing public and internal perceptions of whether the organization is trusted and reliable. To understand the profound impact of perceived security (or insecurity) on both public image and the bottom line, one need only examine customer reviews or stock prices of major businesses before and after a publicized breach or outage.

Security has a particularly significant impact on whether the company is seen as reliable and safe for business. The difference between a successful or vulnerable security program comes down to whether that value is communicated regularly and effectively.

What's Measured Matters

In some organizations, a CISO or CIO can advocate for security at the executive level, informing other leaders and stakeholders of its needs and value. In most businesses, however, this responsibility falls to the IT team leader, adding to their already substantial workload.

While it may seem like self-promotion or extraneous work, it's extremely valuable to take the extra time to summarize threats stopped, processes improved, projects completed, and team members modeling strong security behavior. This effort ensures that the benefits and value of the security program remain a priority for leadership, rather than being overshadowed by the next quarter's budget concerns or the hope of avoiding bad news.

Before starting from scratch, find existing resources by asking vendors and partners what performance reports and metrics they can provide. Many tools should already have audit or other templated reporting functions, and some may even offer custom summaries or executive briefings designed to update leaders on progress.

When choosing metrics, ask whether they truly advance effective security goals. As one example, a common phishing training misstep is solely tracking the number of people who click the link before and after training. While reducing risky clicks is valuable, reducing that number to zero is unlikely. Instead, focusing on how quickly someone reports a phish can materially reduce the time it takes to detect and stop a real-world attack. Now training can emphasize the importance of reporting suspicious activity, even if an employee initially fell for the phish. This approach encourages openness rather than silence born from fear or embarrassment, and rewarding proactive behavior can significantly increase the likelihood of team members reaching out when something's up.

Remember, what gets measured gets managed. Carefully selecting and tracking meaningful security metrics improves security posture and demonstrates the tangible value of a security program to the organization. This data-driven approach can help secure necessary resources and support for ongoing security initiatives, turning the security function from a cost center into a value driver for the business.

Shedding the 'Department of No' Reputation

There's an oft-repeated cliche of security as the Department of No: a roadblock to productivity, best unseen and unheard. And if most security interactions are perceived as tedious and/or confusing or frustrating and/or terrifying, people will go out of their way to avoid future interactions.

In reality, security works tirelessly to keep the organization and people within it safe and protected from innumerable risks. What may feel like an arbitrary refusal from a teammate's perspective may very well be backed by good policy.

Improving this perception doesn't mean abandoning controls or approving every request. Instead, it requires clearly explaining why policies are in place, regularly collecting feedback on processes that prove to be roadblocks, and showcasing wins as part of the normal business cadence.

Errors can be more than additional help tickets for IT teams to triage or irregularities to investigate: They can provide invaluable feedback where a process is unintuitive or misunderstood. Talking through why someone wanders off the authorized path can help identify confusing documentation, unconsidered use cases, or other qualitative feedback that slips through what can be captured in a system log.

What Have You Done For Them Lately?

Most people don't have security experts on call in their personal lives, and this gives security teams a unique opportunity to help, while building on their relationship with the team at large. Instead of just rolling out click-through training modules to meet insurance and compliance requirements, treat education like another opportunity to provide an employee benefit.

Inform employees about trending attacks and scams, so they can be aware and inform potentially vulnerable family members. Teach them about good security hygiene, not only on work systems but also on sites that they're likely to use in their daily life, like social media or personal banking. Not only does this practice help keep your team safe from threats when they aren't at work, it also feeds back into organizational security by making them harder targets for attackers. It would be great if attackers took off nights and weekends, but in reality we know they'll go after access wherever (and through whomever) it's available.

Sharing a few tips every week during team meetings, on team chat, and at all-hands updates is also more digestible for people. It's easier to absorb a few tips each week than resist the urge to tune out a dry, monotone hours-long training session.

This approach also improves retention. According to Hermann Ebbinghaus's research on memory and the "forgetting curve," we forget the vast majority of newly learned information within a couple of days of learning it. However, the second iteration of reviewing that same information will increase both the percentage of information recalled and how long it will be remembered. Regular refreshers and expansions on a topic will result in a more complete understanding and a resilient recall of the topic.

Stronger Together

Shifting the relationship of security from one of avoidance to one of reinforcement, safety, and reliable guidance will motivate people to listen more carefully to security messaging. Greater understanding and buy-in cultivate a stronger security mindset across teams, defining security as a shared, proactive function rather than a specialized, reactive one.

Security is a collective effort, and helping your team stay safer inside and outside of work will benefit both them and the organization. By redefining security as a trusted ally rather than a dreaded email or meeting invite, we can create a more resilient and secure environment for all. Remember, when it comes to security, we are, indeed, stronger together.