{"id":22784,"date":"2022-08-08T14:38:59","date_gmt":"2022-08-08T14:38:59","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=22784"},"modified":"2022-08-08T14:54:14","modified_gmt":"2022-08-08T14:54:14","slug":"cybersecurity-culture-change-needed","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/trends\/cybersecurity-culture-change-needed\/","title":{"rendered":"Cybersecurity Training and Tech Aren’t Enough; ‘Culture Change’ Needed"},"content":{"rendered":"\n

Companies spend a staggering amount of money on cybersecurity products<\/a> to defend their networks and data from hackers, but a couple of industry pros say that money is wasted if companies don’t change their internal cybersecurity culture.<\/p>\n\n\n\n

In September 2021, Cybersecurity Ventures<\/a> anticipated in a report that the total global cybersecurity spending would exceed a staggering $1.75 trillion by 2025. The report projected another year of growth in investment for the sector, this time at 15%.<\/p>\n\n\n\n

Companies continue to invest in protecting their increasingly digitalized business assets. From Internet of Things (IoT) devices<\/a> to the cloud<\/a> and hybrid work endpoints<\/a>, cybersecurity spending has also grown and shifted since COVID-19 changed the way the world works.<\/p>\n\n\n\n

\u201cIn 2004, the global cybersecurity market was worth just $3.5 billion,\u201d said Steve Morgan, founder of Cybersecurity Ventures. \u201cNow it\u2019s one of the largest and fastest-growing sectors in the information economy.\u201d<\/p>\n\n\n\n

Security executives have been adding features focusing on zero-trust technology<\/a>, automation, responsive SOAR platforms<\/a>, secure access service edge (SASE)<\/a> models, and deception technology<\/a>, among others.<\/p>\n\n\n\n

But that technology can at best limit damage if the human element doesn’t improve.<\/p>\n\n\n\n

Also read: Best Cybersecurity Awareness Training for Employees<\/a><\/p>\n\n\n\n

The Key to Cyber Defense is Security Culture<\/h2>\n\n\n\n

PwC\u2019s 2022 Global Digital Trust Insights<\/a> report reveals that the spending trend for cybersecurity shows no signs of slowing down. In fact, 69% of surveyed organizations predict an increase in their security spending for 2022.<\/p>\n\n\n\n

But two veteran security experts, Peter Carpenter and Kai Roer, at employee cybersecurity training<\/a> leader KnowBe4 say business leaders are overlooking a hacker\u2019s primary way into a system: vulnerable and exploitable human workers. They say that the best defense against cyber threats is in an organization\u2019s security culture.<\/p>\n\n\n\n

Their latest book, The Security Culture Playbook: An Executive Guide to Reducing Risk and Developing Your Human Defense Layer<\/a>, combines the insight of 35 years of security culture experience with data-driven insights from over 40,000 global organizations. They believe that promoting security awareness isn\u2019t enough; organizations must \u201cbake security into their culture.\u201d<\/p>\n\n\n\n

Carpenter spoke to eSecurity Planet<\/em> about the importance of a strong security culture. Carpenter said organizations have become experts in technology-based security tactics such as firewalls<\/a>, email gateways<\/a>, endpoint protection<\/a>, and more. However, despite advanced defenses, organizations still face massive data breach problems.<\/p>\n\n\n\n

\u201cTechnology-based defenses have made it so difficult to hack into organizations that cybercriminals are increasingly turning to social engineering<\/a> (tricking humans) to accomplish their goals,\u201d Carpenter said.<\/p>\n\n\n\n

The industry has to direct as much effort into preparing human-based defenses as they have their technology defenses. Carpenter\u2019s recommendation is to put more intentional time, effort, and investment into building this layer of defense.<\/p>\n\n\n\n

\u201cThis means focusing on our cybersecurity ABCs: awareness, behavior, and culture,\u201d Carpenter said.<\/p>\n\n\n\n

Improving Cybersecurity Communication and Metrics<\/h2>\n\n\n\n

Carpenter revealed a simple formula that describes the basic flow of executive communication and is designed to improve every cybersecurity message. It all starts with the information that creates a narrative or story. The story is vital for workers to identify with the issues. This way they will remember concepts better.<\/p>\n\n\n\n

\u201cThe person sharing information needs to find ways to connect the information to something bigger, broader, and more emotional than simple facts and figures,\u201d Carpenter said.<\/p>\n\n\n\n

The formula is:<\/p>\n\n\n\n

Information ? Story\/Narrative ? Transparency and Metrics ? Insight and Direction.<\/p>\n\n\n\n

In this formula, facts, figures, and supporting details should only be introduced in ways that support the broader story. It is also of vital importance, when introducing metrics, to interpret them transparently, clearly, and honestly. Metrics in cybersecurity and security culture can be victories, stumbling blocks, or challenges that move the story from one point of the plot to another. This is where insight and direction come into play.<\/p>\n\n\n\n

Measuring the security culture of an organization is increasingly important to gain a 360-vision into the company\u2019s strong and weak points. Carpenter\u2019s method to gauge a security culture goes well beyond others, measuring seven dimensions through technical and scientific approaches.<\/p>\n\n\n\n

\u201cWe break security culture into seven distinct, measurable dimensions. They are: attitudes, behaviors, cognition, communication, compliance, norms, and responsibilities,\u201d Carpenter explained.<\/p>\n\n\n\n

Each one of the dimensions can be measured by direct observation or by looking at evidence or data. One of the methods used is their proprietary Security Culture Survey. The survey includes a set of scientifically based questions that are designed to get to the heart of each of the seven dimensions.<\/p>\n\n\n\n

\u201cOne of the secrets to getting accurate answers in a survey like this is that we don\u2019t ask someone what their specific behavior or understanding is; instead, we ask them how they perceive other people or groups in their organization,\u201d Carpenter said, adding that such indirect questions invite greater honesty.<\/p>\n\n\n\n

The benefit of measuring the security culture of an organization in seven dimensions is it provides a much more detailed view of the issues that need to be addressed. Additionally, each dimension has a gravitational effect on the others. If an organization focuses on improving one or two dimensions, the others are expected to improve as well.<\/p>\n\n\n\n

Protecting Your Data Through a Strong Security Culture<\/h2>\n\n\n\n

For years, technology-based tactics have been preached as the ultimate defense against cyberattacks. However, a Verizon<\/a> report reveals that 82% of all breaches are linked to the human element. Organizations will continue to be exposed to attacks\u2014no matter how strong their cyber defenses are\u2014because sophisticated cyber criminals today are targeting the weakest links of a system: its workforce. These weak links can only be strengthened by strengthening the security culture.<\/p>\n\n\n\n

Read next: Top Cybersecurity Companies for 2022<\/a><\/p>\n\n\n\n

We may be compensated by affiliate links or sponsored partnerships that appear on this page, but any affiliation has no influence on our editorial content. For more info, visit our\u00a0Terms of Use page<\/a>.<\/em><\/p>\n\n\n

\n \n\n \n\n
\n \n <\/path>\n <\/svg>\n <\/div>\n \n
\n
\n

\n Get the Free Cybersecurity Newsletter <\/h3>\n \n \n

\n Strengthen your organization's IT security defenses by keeping up to date on the latest cybersecurity news, solutions, and best practices. Delivered every Monday, Tuesday and Thursday <\/p>\n <\/div>\n\n

\n
\n \n Email Address\n <\/label>\n \n <\/div>\n\n
\n
\n \n \n By signing up to receive our newsletter, you agree to our Terms of Use and Privacy Policy. You can unsubscribe at any time. <\/label>\n <\/div>\n <\/div>\n \n