Have you designed a business culture around security? Practically, security is a life-long process. However, irrespective of their size both small and large firms consider security issues to be bureaucratic.
Take an example of seat belts. The first car for the masses, the Ford Model T, rolled off the assembly line in the early 20th century. It did not have seat belts. It wasn’t until the 1960s that automobiles in the U.S. were required to be equipped with seat belts. Convincing people to actually use them took years.
Since people are resistant to change, to foster acceptance of seat belts, the masses needed a culture shift, despite being aware of the importance of such safety features. For 25 years, the National Ad Council ran public service announcements urging people to “Buckle Up.” With the added incentive of mandatory seat belt laws, the public eventually complied.
As this example illustrates, to change cultural habits, even for security and safety, you need to involve and educate people in the solution to a problem for positive results. This translates to your organization. When everybody becomes well informed on how their actions can compromise security and the potential damage, that marks the perfect timing to develop a compliance culture.
The current Internet of Things (IoT) is comprised of over 11 billion gadgets. Such functions are cloud-based and include devices of all types from commercial monitoring equipment to your FitBit, TV and thermostat. Hackers can take advantage of these interconnected devices to gain unauthorized access to your sensitive data.
The problem is even more acute in the workplace, where all manner of information is collected and stored, including confidential employee records.
Is absolute security against hackers a possibility? Unfortunately developing perfect codes for total protection is unlikely. The more you link your systems, the higher the risk of security breaches or hacks. All too often your employees will be both the unwitting perpetrators and victims of security attacks. Their remote access to company systems can serve as an open door, and not only to that system, but to others connected to it. The devices they bring to work – smartphones, tablets their wearables – can all be exploited by accomplished hackers to gain access to company records.
You can therefore not expect all your workers to be aware of how to manage the world’s botnets. It becomes necessary therefore that you have an established and tested security culture in place for your organization.
A sophisticated IT department should take the lead in identifying potential security risks and closing the open doors they find. But HR, which, like finance, houses some of the more sensitive company data, needs to be fully engaged in educating employees to develop a security conscious culture. The following five steps will help foster that compliance culture, protecting your company against any security breach.
Analyze the security of your organization — Your first step should be evaluating your organization to establish which areas are most in need of a security boost. In the analysis, perform a social engineering test. These are tests that mimic techniques attackers use to lure people into providing them information they can exploit to gain access. The results will help you identify your business’ weakest points, which are most often people.
Understanding the vulnerable points helps you to identify the departments or employees who need the most assistance. Help them to adapt to your organization’s security culture.
Facilitate self-service — While opening the door wide to information is an easy thing to do, consider a more challenging option. Your business will be more secure if you implement tools, scripts, and processes that give them access to only the information they are allowed to view.
All your workers, more so the heads of department have a role in creating a security culture. Guide your employees about what is ethical to do in the face of security concerns. Additionally, all the departmental heads should be well equipped to offer a valid response to any security query, such as when an employee is denied access to information they want.
Market internally – Typically, your security specialists take the lead in creating acceptable security habits. But, it may be more effective for HR to employ marketing initiatives to establish and strengthen such practices across your business.
It will be prudent, therefore, to invest in security training for your marketing team, They can then develop programs HR can deploy to encourage good security habits.
Make a budget dedicated to security – While not an HR function, ensuring a budget for IT security should have the input and support of HR leadership. A hack of HR records could be more disastrous than the breach of other business records. So the quality and investment in security measures should be measured against the business risk assessment.
While budgeting, make sure to incorporate a robust security plan since creating a business culture around security has some cost implication.
Define all responsibilities — Your head of security should oversee all the safety measures and policies. If this is not yet a defined function, HR should take the lead in promoting it. In larger organizations, this will be a separate and distinct role; in smaller companies, the responsibility typically will fall to whomever heads the IT group.
This person must be present in all security planning projects and needs to be aware of all sensitive data and records.
The marked increase in technological advancement has caused a sharp rise in instances of data breaches, to the extent individuals and organizations are accepting the breaches as a norm. Don’t allow that to happen. Instead, train and regularly remind your employees about online security and the protocols they should be following.
Security breaches are fast becoming a norm, but they don’t have to be yours too. Protect your company from malicious acts by creating a business culture around security. The culture is only achievable when you bring all your employees on board. Give a special focus to the heads of department, the marketing team, and the security personnel to win the fight against information insecurity.
