How to Build a Security Culture - Whiteboard Wednesday

Summary

In this Whiteboard Wednesday, Beau Kim emphasizes the importance of a strong security culture for organizations, highlighting the need to balance people, technology, and processes. He discusses the significance of leadership support, department champions, effective security awareness training, active security posture testing, and continuous communication to foster a shared sense of security ownership and reduce vulnerabilities.

Takeaways

• 🛡️ The necessity of a strong security culture is underscored by the fact that it involves people, technology, and processes, with a focus on the human element.
• 👥 A company culture, particularly a security culture, is defined by the collective beliefs and behaviors of its employees.
• 📊 The 2017 Verizon DB report highlighted that nearly half of all breaches began with a social attack, emphasizing the importance of focusing on people in security strategies.
• 🔝 Leadership support and buy-in are critical for establishing a strong security culture, as it sets the tone from the top down.
• 📊 Effective security awareness training is essential for employees to understand what constitutes suspicious activity and how to report it.
• 📈 A tiered approach to security training can help cater to different levels of risk and roles within an organization.
• 🔍 Actively testing security posture through social engineering campaigns can help identify and educate on potential vulnerabilities.
• 🔄 Continuous improvement of security awareness training is necessary to adapt to new risks and organizational changes.
• 📢 Transparent and continuous communication is key to maintaining a strong security culture, with quick responses to employee reports.
• 🏆 Recognizing and rewarding employee efforts in security, whether it's an incident or a false positive, helps build a shared sense of ownership.

Q & A

What is the main focus of today's Whiteboard Wednesday discussion?

The main focus is the importance of a strong security culture and the four essential components needed to build one.

Why is it crucial to have a strong security culture within an organization?

A strong security culture is crucial because it helps to ensure that all employees understand what's right versus wrong, how to report suspicious activities, and promotes a shared sense of ownership for security, thereby reducing the risk of breaches.

What are the three major components that need focus when building a strong security program?

The three major components are people, technology, and processes, often referred to as the 'people, technology, and processes triangle'.

According to the Verizon DB report mentioned, what percentage of breaches start with a social attack?

43% of all breaches covered by the 2017 Verizon DB report started with some type of social attack.

How can a company's leadership support the development of a strong security culture?

Leadership can support the development of a strong security culture by providing buy-in, clearly communicating the company's security posture, and aligning security initiatives with larger company objectives.

What is the role of department team champions in building a security culture?

Department team champions provide feedback on new security initiatives and help to reinforce security practices within their teams and departments.

Why is effective security awareness training essential for a strong security culture?

Effective security awareness training ensures that employees clearly understand what's right versus wrong, what data to protect, and how to report suspicious activity.

What is a tiered or targeted approach to security awareness training?

A tiered or targeted approach to security awareness training involves providing different levels of training based on the roles and access levels within the company, with more in-depth training for those with higher risk and access.

How can social engineering campaigns help in testing a company's security posture?

Social engineering campaigns, such as internal phishing campaigns, allow companies to test how well employees can detect and report suspicious activities, thereby identifying areas for improvement.

What is the importance of continuous communication in maintaining a strong security culture?

Continuous communication ensures transparency, approachability of the security team, and quick response to employee reports. It also helps in building a shared sense of security ownership.

How should a company respond to failed phishing attempts during social engineering campaigns?

Instead of punishing, companies should use failed phishing attempts as an opportunity to further educate employees on what could have happened if it were a real attack, reinforcing learning and improving security awareness.