5 Cybersecurity Tips for Organizations: Creating a More Secure Workplace

1 – Build a Strong Cybersecurity Culture

Building a strong cybersecurity culture in any organization is paramount to creating a safer workplace. While all the points in the post are extremely valuable and play a key role in increasing security, bypassing [this] for strictly technical controls will ultimately make security an uphill battle. 

It is critical that the cybersecurity culture starts at the top with leadership buy-in. When executives and managers prioritize security, it reinforces its importance across all levels of the organization. That buy-in turns cybersecurity into a shared responsibility and fosters accountability for protecting the organization. By embedding cybersecurity into corporate values and daily operations, organizations can create a security-first mindset that strengthens the overall security posture before technical controls are even mentioned. Lastly, there is a direct correlation with employee buy-in when they see leadership following the same security initiatives. 

2 – End User Education

There is no argument that security awareness training is an important tool that was developed to educate and empower employees. Unfortunately, as time progressed, and the security awareness space grew it appeared to become more of a checkmark in an organization’s compliance reporting. That’s not to say that organizations are effectively using security awareness training to educate and test employees but often it is a rigid process that does not directly improve the security posture of an organization. 

Gartner recently coined the phrase Security Behavior and Culture Programs (SBCP) to shift away from traditional security awareness training. While the journey to building an effective SBCP will differ from organization to organization, the end goal remains the same which is to reduce human risk and align employees with the cybersecurity culture (that is hopefully being championed from the top down). For more information on security awareness and SBCP, click here. 

3 – Understanding the Asset Landscape

It’s been said time and time again that “You can’t protect what you don’t know”. Understanding an organization’s asset landscape is one of the first steps in building a strong security program. There is a reason that the CIS Control 1 is “Inventory and Control of Enterprise Assets” with Control 2 being “Inventory and Control of Software Assets”. Furthermore, it’s critical that this discovery is not just a “point in time” view of an organization’s assets but a continual monitor. From ephemeral assets to asset lifecycle management, the landscape is constantly changing. It’s important to shift the discovery and classification conversation from being reactive to proactive. 

There are a multitude of ways this can be accomplished, one listed here. Regardless of how the organization chooses to accomplish discovery, there are a few key points to be able to answer.

• How recent is the inventory that is being used?
• How sure are we of the accuracy?
• Can we use this data to drive initiatives or projects? 

4 – The Importance of Identity

Implement Multi-factor Authentication (MFA) for network and system access.  Despite best efforts passwords are regularly stolen or cracked which provides someone else in the world a way to impersonate your employees.  Requiring additional proof using something an employee has, such as a token, or something they “are” with biometrics can provide greater assurance of the person gaining access to systems.  Not all MFA methods are created equal so it is important to balance the added security a method provides with the added friction your employees may experience when authenticating. See here for additional insight on identity. 

5 – Continual Review and Optimization

While simple at surface level, it is overlooked enough that it’s worth mentioning. With the everchanging security landscape of solutions, systems, offerings, platforms, applications, widgets, capabilities, innovations (this list can keep going), it’s extremely difficult to stay on top of it all. A solution’s capabilities that were available year one may have drastically been expanded or added by year two or three. As solutions and offerings grow, there will be unavoidable overlap with other tools in the stack. Having an understanding of where the developments or potential overlaps are is a great way to improve an organization’s security posture or remove redundant functionality. 

There are few ways this can be accomplished, typically in the form of a tool rationalization or maturity assessment. These can be done by a 3^rd party, vendor, or internally.  The goal is to make sure the organization is using as many features as possible that are available and understand where overlap may occur. 

Conclusion

It is important to note this list is not comprehensive nor all encompassing. The points listed above are to provide key areas in which an organization can make tangible progress in creating a more secure workplace. 
Questions? Contact us at Sayers today to discuss any one of these points with our subject matter experts.