Moving Toward Better Security for Today and Tomorrow

Establishing an organizationwide culture of cybersecurity is top-of-mind for many security leaders. It is well understood that people are a key to success when it comes to resiliency against attackers. Attackers know that the path of least resistance and a foothold into the business can be found by exploiting people. However, employees who are properly conditioned to recognize and report suspicious activity provide intelligence that security teams can leverage if attackers bypass technology defenses.

When employees’ behavior changes as a result of an immersive program, the security team gains a number of human sensors, which is vital to resiliency.

A cybersecurity culture focuses heavily on behavioral change. Additionally, employees’ believing that they contribute to the greater good of the organization, their personal lives and society as a whole are also part of the culture. Combined, organizations’ programs mature and employees are viewed as part of the solution, not the problem. In the end, the culture needs to extend across all levels of the business with the security team constantly working with enterprise leadership and employees toward a better security tomorrow...and today.

Leadership and Communication

Leadership is crucial to success when improving the security culture. There is a need for strong leadership among the security team to help build and retain the team.¹ An additional benefit of a strong internal security team is that it, too, helps with creating a strong security culture. After all, it is in the security team’s best interest to help cultivate a culture that will only benefit it in the long run as its coworkers become allies and contribute to the greater good.

Getting the security team on board is really an important component to success. Historically, security people have a tendency to intimidate coworkers. Whether they realize it or not, they may be viewed by their nontechnical coworkers as unapproachable, and employees fear being looked down upon because they do not understand some security principles and desired behavior. When employees do not feel they can openly communicate with the security team, they may completely avoid it altogether, which is a lost opportunity to gain an internal security partner.

When it comes to communicating security requirements and interacting with employees, tone and demeanor are important. It is not what is said, but how it is said, and the sooner the security team recognizes this, the better. This is a good reason why when hiring security practitioners, it is important to look beyond formal education and credentials. Are credentials and education imperative? Yes, but take a look at the employee as a whole. The industry needs a variety of people to ensure a diversified and well-rounded team. Hire for personality and train for skill.

Network and Collaborate

The security team must be known across the enterprise when establishing a cybersecurity culture. The first time business units meet the security team should not be during a time of crisis. A security team that is out of sight and out of mind may have trouble getting buy-in from the business. Getting out of the office and meeting with other business units gets conversations going and builds comradery. Security leaders and the team who start to develop rapport with the business will have a better working relationship. The security team learns firsthand what business units care about and how they are able to help them be successful. It is also a chance to work toward problem resolution and areas where security may be inhibiting the business in its operation.

Vision and Trust

If people are going to support the security program, employees need to understand the vision. Starting from the top and going down through all employees, the vision needs to be shared and clearly articulated. Share enterprisewide where the program is going and how employees can help contribute to its success. Furthermore, the vision must be sustainable.

Sharing the vision is especially crucial when attracting new and retaining current security talent. Money is always a factor, but beyond that, people want to work for something with purpose and meaning. Being open and clear with where the team is going will help the team understand and champion the message organizationwide.

When sharing the vision, the organization must trust the team. There cannot be any perceived hidden agendas, or the team will not follow the lead. Keep in mind that tone, communication style and body language will be observed carefully. Nonverbal communications speak the message, too.

Form an Advisory Board

All enterprise areas must buy in to the importance of cybersecurity to promote it throughout the organization. A security advisory board expands the reach of security efforts and brings in diverse areas of the enterprise. The advisory board fosters the aforementioned collaboration and also ownership in the success (or failure) of the program. Oftentimes, board members include executive sponsors, risk management, legal, human resources, IT, audit, finance, marketing and communications. Members of the board will absorb and relay the message and support the overall mission. Granted, there will be times where members will debate security recommendations, but this is also healthy and expected. However, the advent of this team brings together diversity and support to help the security program be successful for the betterment of the business.

Employee Engagement

When it comes to cybersecurity, employees are an asset, not a weakness. All too often, employees are touted as the weakest link. Employees are not a weak link when they are properly conditioned and, as a result, change their behavior. No technology solution is 100 percent effective, and employees who are conditioned to recognize and report (for example) phishing emails that have bypassed technology can provide the security team with invaluable data.

Long, drawn-out computer-based training (CBT) programs are not the answer. This information is soon forgotten weeks or months later. To really improve the program, security teams need to condition fellow employees with realistic simulations (phishing is the dominant example). For example, phishing simulations that are regularly conducted (e.g., every 1-2 months) and are not solely focused on click rate are able to tell a measurable story about resiliency when employees report the email. What this does is illustrate that employees know what to do when faced with phishing, and that is to not fall for the phish and to report it to the security team for additional analysis and remediation.

In cases where employees continue to succumb to assessments that show their weaknesses, it is recommended to not punish the employee. A “three strikes and you are out” approach does not improve a security culture. All it does is erode trust and invoke fear. To make matters worse, this approach is generally targeting regular employees only and not leadership, which is a double standard.

To reach employees, there need to be examples to show them their role and how they can help contribute to the security of business and their own well-being at home. Security teams should be empathetic with employees as opposed to condescending to help build stronger relationships across the enterprise.

Celebrating success comes in many forms. One popular way is through public recognition and can be better than items such as gifts and money. In general, people like to be recognized, and doing so helps to encourage more of the behavior that was exhibited. The employees can then be used in enterprise-facing communication, and they will be seen as those who are making a difference and changing behavior.

Recruit Security Ambassadors

Security leaders have learned to get creative to supplement the team. Many still seek a typical security engineer or analyst. However, with supply and demand challenges, hiring managers have started looking at other people, often internal, who have valuable skills and can help fill the void.

Security ambassadors, sometimes referred to as security champions, are other people within the organization who can help get involved with security in addition to their current role. Think of security ambassadors as the security team’s extended network to help communicate the security vision and plan of action across the organization. They do not relinquish their current roles, but rather, volunteer time to be part of the security mission. They are a bidirectional asset of communication between lines of business and the security program.

It is natural to gravitate toward the comfort zone with technical employees. A few obvious areas outside of security for technical roles include developers, project managers, system administrators, engineers and the IT help desk. The IT help desk is a crucial ambassador because these are the people who are fielding calls and emails and need to be on board from the start. This goes back to the principle of outward-facing positive communication with employees so that they do not feel repressed. If the IT support team does not work well with other employees or does not have a keen security mind-set, it is missing a real opportunity to improve security because employees may see the first sign of an incident.

One thing that often comes up with ambassadors is the amount of time commitment and compensation. Often, security leaders will position the opportunity in such a positive way that employees will volunteer as opposed to being asked. Being an ambassador is filled with purpose and is a driving factor and the reason many want to be part of the group. There is meaning, purpose and the ability to contribute to a great cause outside of their daily role. Recognition is a fantastic way for people to get motivated about the mission. A catchy name and some collateral materials highlighting the team and why it exists bring together ambassador identity and interest from other employees. For example, a simple note from senior management praising the team goes a long way toward exciting and motivating the team.

As such, money should not be a motivator. If people are only participating for the money, then they are not the right fit. Lastly, the time commitment should be minimal or else it will not get buy-in. Typically, 4 to 8 hours per month is the target. Too much more and it starts to infringe on the ambassador’s primary roles.

Meaningful Metrics

Security will want to be able to tell a story as to the value produced as a result of the newly established cybersecurity culture. Metrics that focus on answering “so what?” can help the business understand what security is doing rather than presenting security as some obscure area that no one understands.

One way to address this challenge is to create two columns—one that is focused on progress (or output), and another consisting of impact (or outcome) effectiveness. This method is designed to help when presenting results that are measured. In the progress column, examples would be CBT or compliance initiatives. However, in the impact column, place initiatives such as reduction in incidents and supporting business goals. It is easy to see that when the need is to tell a story about the state of cybersecurity, the impact column is more significant because it relates more to the business and helps answer “so what?” Reporting that 100 percent of the workforce took a CBT in the year and the average score was 90 percent is not that meaningful. On the surface, this may seem impressive, but it changes when an executive wants to know how much this has helped secure the business. Whereas tracking a reduction in incidents that can be correlated to cost allows for a more compelling story. Imagine the value of presenting a reduction in incidents and costs over time. This has a direct correlation to the implementation of the program, the progress made and the reduction in negative impacts.

A good way to create meaningful metrics is to work with the business to where cybersecurity is able to help it show success. The security team alone should not determine the metrics. Rather, involve the business and then share the results with stakeholders and work in tandem on the next set of metrics if the results are not ideal and there needs to be additional focus on an area of weakness. Business units are not going to want to see their area of responsibility performing poorly. Likewise, there is a sense of pride and accomplishment when a manager’s team is outperforming their peers. But when it is all said and done, security is an organizationwide initiative, and it takes everyone to be successful.

Conclusion and Next Steps

Culture is a crucial aspect of building a security program that reaches all employees. Granted, strategy is involved, but security is not always about engineering. It is people-centric. To develop a security culture:

• Build relationships—With the immediate team and business units, work on building relationships. This is an ongoing process and requirement to be more successful. Relationship building helps with team synergy and retention in addition to hiring. Furthermore, business units will understand the security team’s focus and how they, too, play a part in the cybersecurity program.
• Motivate—Motivation correlates to relationship building. For the internal security team, this is not about compensation, but rather the purpose and call to action they have to protect the business. Illustrating their purpose helps them to understand how they contribute to a greater cause and mission. Likewise, business units are incentivized to drive their team toward the same direction and how they contribute to enterprise success.
• Simplify—Distill complex processes and simplify. Take, for example, reporting a phishing email. Provide employees with simple steps to inform the security team, and ensure the security team communicates back to employees to let them know they are helping. If the process is clear, simple and repeatable, employees are likely to comply. And when they do the right thing, let them know, which may make them more likely to repeat the behavior.
• Communicate a clear vision—Clearly communicate the vision and how each and every person makes a difference. Speak from the heart and involve the team and they will see the direction the security program is headed and will be more supportive of achieving the mission.

Endnotes

¹ Saurbaugh, M.; “Cybersecurity Employee Retention and Management Culture,” ISACA Journal, volume 4, 2018, http://h04.v6pu.com/resources/isaca-journal/issues