How can companies build a robust information security culture?

September 11, 2023

TAINA Technology recently took the opportunity to explain how businesses can build a strong information security-aware culture.

Everyone knows the pivotal role of information security in today’s fast-paced world. No one wishes to be vulnerable to data breaches, yet they persistently occur.

Many experts highlight that the predominant cause of these breaches is often humans. Statistical evidence reveals that the majority of successful cyber-attacks result from inadvertent human errors. Multiple CTOs I’ve conversed with concur that nurturing an information security-aware culture is the most effective defence.

So, what constitutes an information security aware culture? Essentially, it’s an organisational climate where information security is prioritised, ingrained into daily operations, software development, service provision – basically, every facet of professional life.

But how does one establish this culture? While it’s impossible to provide an absolute shield against cyber adversaries, the following steps aim to equip organisations with robust defence mechanisms:

Leadership sets the tone. Recognising information security is not solely the domain of IT departments or dedicated security teams is crucial. Its importance must be heralded by the CEO and the senior management team, trickling down to every employee. This sentiment was echoed by a CTO who shared a story about a cleaner inadvertently disposing of confidential designs. The lesson? Every staff member plays a part. In many leading organisations, roles such as the CTO and COO jointly oversee information security, underscoring its significance at the top echelons.
Define information security objectives. With the whole organisation aware of information security’s significance, it’s crucial to clarify what this means in actionable terms. Leading firms often establish specific information security objectives, such as frequency of internal audits or training sessions.
Tailor information security practices to every role. The best results come from ensuring that each employee knows precisely what is expected in their role concerning information security. Simplifying guidelines and avoiding technical jargon are key. Examples include user guides for encryption tools or handbooks on password management.
Invest in training. Information security training commences even before an employee’s first day. Organisations must offer role-specific training, maintaining records and frequently updating the team with the latest practices.
Quantify and track. After setting clear expectations and training, it’s vital to measure the efficacy and adherence to security protocols. Automation in data collection and reporting helps streamline this process.
Conduct periodic audits. Regular internal audits ascertain whether everyone is complying with the set guidelines. The aim should be to identify training needs rather than pointing fingers.
Consequences for non-compliance. While most of the emphasis is on positive reinforcement and training, repeated violations of security guidelines can’t be overlooked. Organisations must be prepared to take action against persistent defaulters.
Persevere. Building a culture, especially one centred around information security, is a marathon, not a sprint. Organisations must be ready to persistently and consistently promote information security practices, ensuring they don’t wane due to other pressures.