Security is an essential but often overlooked component of a solid business strategy. From lax password habits to clicking untrustworthy links, any one person, at any level of an organization, can create weaknesses that allow a bad actor to strike. One thing is certain – businesses are under attack by these bad actors, and they are becoming more sophisticated each day.
Why is creating a security culture difficult? On the surface, investment and buy-in with an IT security strategy is quite simple, but in practical application, it’s much more complicated. While the objective of a strong security posture is to avoid catastrophic attacks and keep business moving efficiently, internal departments often push back on new protocols and procedures, as new layers of security add time, labor, and ultimately expense.
No matter the size of the organization, there are three primary components to ensure a successful culture of security:
1. Earning buy-in from the top
Getting leadership invested in a security strategy is the first step in creating a security culture that permeates all levels of an organization. Without buy-in from company leadership, it can feel impossible to make tangible change or access the funding needed to implement critical tools and resources.
The challenge lies in the ability to translate security risks into business terms. How do potential threats impact the business? If your company experiences a breach, what financial or operational factors are at risk? How much will an hour of downtime cost? What about a day? Longer?
Providing answers to these types of questions will help leadership teams understand that investing in preventative measures are prudent and less costly than dealing with (and paying for) the aftermath of a cyberattack.
2. Prioritizing security issues
Outlining and identifying the risks can become overwhelming. The previous IT manager configured the firewall without sufficient security modules. You’re not sure when the last vulnerability scan was conducted. The entire company seems to be bypassing the multifactor authentication protocols.
These are just a few examples of security risks that may be on your plate. How do you know where to begin? Do you address the smallest and easiest to resolve issues first or do you prioritize the issues that pose the biggest threat to the company? And what if the resource allocation to tackle these issues has been exhausted?
Put a team together to assess an inventory of the risks and start with documentation and prioritization of risk based on a simple high, medium, or low assessment. Once a foundation of the potential impacts to the company has been built, further leadership buy-in, prioritization, and budget allocation should follow.
3. Delegating security responsibilities
By now, it should be clear that security is not a one-person job. Virtually all security platforms today – physical and infrastructure – require technology oversight. As in connectivity and backup, redundancy in security should be considered an investment.
Security impacts every department, every team, and every employee. Consider security advocates in each department to champion the effort. Share the insights from the risk assessment to ensure vulnerability gaps are closed. If, for example, the HR team shares passwords to access cloud-based tools, it’s their responsibility to adopt a more secure practice (and your responsibility to make sure they follow through).
Helping teams take responsibility for protecting their piece of the organization is a smart strategy. It creates a sense of ownership and helps champion a security culture that protects the company as well as individual employees.
Developing a security culture won’t happen overnight. It takes time and effort to communicate the importance of implementing stronger IT security habits.
For more ideas and strategies to help get your company on board, download our Creating a Company Culture for Security Tip Sheet.
