How can you create a security-aware culture outside of the workplace?

Fostering a security-aware culture beyond the workplace starts with self-education and knowledge sharing: Educate yourself: Utilize resources from reputable organizations like National Cyber Security Alliance or government agencies to stay updated on cyber threats and best practices. Empower others: Share your knowledge through social media, blogs, or community events. This raises awareness and equips others to navigate the digital world safely.

In today's environment every technology company and really any company needs domain relevant cyber security training. This training should be yearly and there are many great places to source the content. This basic education of the risks and the actions required if an incident occurs is vital.

While official sources are vital, connecting with local cybersecurity groups or community forums can offer real-world insights and experiences. Engaging in discussions with peers adds a practical dimension to cybersecurity learning. In these spaces, people share real-life stories about dealing with cyber threats to make the information more relatable and impactful. Participating in these discussions helps everyone understand and contribute to a shared pool of knowledge. This approach turns cybersecurity awareness into a community effort, laying a solid groundwork for a security-conscious culture.

I love educating those around me on safe security practices. Here are some ways that you can too. You can openly discuss online safety tips and common threats with friends and family. Encourage them to ask questions about any security concerns they have. You should also remind them of security best practices in everyday life such as the risks of public Wi-Fi or the importance of strong, unique passwords. You can offer to help them set up multi-factor authentication and recommend reliable cybersecurity resources. By fostering open communication and actively promoting security awareness within your social circle, you can make a significant impact in creating a more secure digital environment for everyone around you.

A lot of articles and blogs are available online to guide people toward good practices. It is a good habit for people to simply follow them into their personal lives to be reflected into their workplace. There also tons of guides to teach good habit for specific situation that everyone face everyday like receiving email, text messages, connecting to a local coffee shop, navigating the Internet, etc.

Leading by example in cybersecurity means consistently practicing safe online habits, such as using strong, unique passwords, enabling two-factor authentication, and staying vigilant against phishing attempts. Regularly updating software and educating oneself about potential threats are also crucial. By demonstrating these behaviors in your own online activities, you inspire others to follow suit, ultimately fostering a culture of security awareness in your social circles and community.

In todays digital age where "information and data are the new Gold", you absolutely must educate end-users on the basics of Cyber Security. I would even go so far as to say everyone, everywhere should be getting weekly updates and monthly re-freshers for any company. Small, medium, or large, with quarterly seminars or Security Hygiene Training. There are so many threat-actors that have evolved so much just since Covid! (Which opened a Pandora's Box of Chaos for those looking for the low hanging fruit and the whales!) Let alone since smartphones came out. With data breaches and ransomware constantly on the rise, the threat exposure is becoming a reality for just about anyone in any industry. It almost always comes down to the human factor.

Foster an environment where questions are welcomed and concerns are taken seriously. Creating a safe space for open dialogue can empower individuals to share their experiences without fear of judgment. Regularly check in with friends and family, asking if they've encountered any suspicious activities online.

IT teams should come up with innovative way to bridge the usual gap between business and IT teams in general. One great idea would be is to conduct weekly floor huddles(10-15 mins) alongside regular trainings where some fun activities can be conducted for business employees. A small gift (souvenir or chocolates or stuff) can be arranged for creative employees. This will remove barrier of infosec as compliance enforcer and users will perceive them more as fellow colleagues and friends. Making feedback culture much easier.

Tailor your approach to your audience. Consider their interests, age groups, and preferred learning styles when designing your activities. The key is to make it relatable, accessible, and enjoyable, ultimately leading to a more secure and informed community.

The industry is constantly moving and there are tons of news and new articles that comes out everyday. Since everyone uses social media in their personal lives, it is a great habit to start following informative accounts which discuss about a specific topic and helps their audience learn about an industry. You can start watching and learning about cybersecurity that way and even learn from an external incident to apply best practices for your workplace. You can also listen to podcast about cybersecurity while you are doing a chore. A great way to optimize your day.

Culture is the values, attitudes and beliefs of people. Culture is informed by attitudes and behaviours. It's important to help family and friends understand the why and how it applies to them just as you would a role based model in the workplace. Those best practices still apply, however might need tweaking slightl of course. The NCA has some great resources which are easy to understand and at a level where people can relate. The National Cybersecurity Centre UK and Action Fraud also are some good resources. What's really helpful is if you help family and friends with tools. One example is password managers It may be helpful to talk to them about these and the opporunity they provide. Setting up MFA is another example.