登录查看更多内容

Last updated on 2024年6月2日

How do you create a culture of security responsibility?

由人工智能和领英社区提供技术支持

Security is not just a technical issue, but a cultural one. Creating a culture of security responsibility means fostering a mindset and a behavior that values and protects the confidentiality, integrity, and availability of data and systems. In this article, you will learn how to design and implement a security architecture that supports this culture, and how to overcome some of the common challenges and trade-offs involved.

此文章中的业界达人

由社区从 10 条内容中精选。了解更多

1 Define security goals and principles

The first step to creating a culture of security responsibility is to define your security goals and principles. These are the high-level objectives and values that guide your security architecture design and decision-making. For example, you might want to achieve compliance with certain standards or regulations, minimize the risk of data breaches or cyberattacks, or ensure the reliability and performance of your systems. Your security principles should reflect your organizational culture and mission, and be aligned with your business and technical requirements. They should also be clear, concise, and communicated to all stakeholders.

添加您的观点

Sagar Navroop

? Architect | ??????????-?????????????? | Technologist
(已编辑)
举报内容
To promote a culture of security responsibility, start by defining clear security goals and principles aligned with business goals. Design security architectures with layers and domains, and implement controls like encryption, IAM, and monitoring. Educate and empower users through training and awareness programs. Review and update security architecture iteratively using DEVSECOPS practices to integrate security into the development lifecycle. Promote a culture of shared responsibility by involving all stakeholders in security decisions and actions. If on AWS; use IAM, Config, and Security Hub to aid in implementing, monitoring, and enforcing security measures in alignment with the above principles.

已翻译

赞
Nadia Dehkordi, MBA, CXO Strategist

Board Advisor | CXO Strategist | Fractional Executive |Driving Innovation & Transforming Businesses Across Industries
举报内容
Defining your security goals & effectively communicating them to stakeholders and department heads is essential to establish a culture of security responsibility. The key lies in expressing these goals in terms that resonate with each audience, ensuring they understand the significance and benefits of the proposed changes-meaning addressing the 'WHY' behind the change. Clearly articulate WHY, the importance, how it contributes to the overall security posture, and WHAT positive outcomes can be expected- as well as the potential consequences if not done properly | at all. In doing so, you can cultivate understanding and buy-in from stakeholders and department heads-paving the way for collaboration and support throughout its implementation.

已翻译

赞
Vadivel R

Product Security Architect & Technical Product Owner @ GlobalLogic | Building Secure Products
举报内容
Creating a culture of security responsibility begins with education and awareness. Conduct regular training sessions to educate employees about cybersecurity risks and best practices. Encourage open communication and reporting of security incidents without fear of punishment. Implement policies and procedures that promote security, such as strong password policies and data encryption. Foster a sense of ownership by involving employees in security decision-making processes and recognizing their contributions. Lead by example, with senior management demonstrating a commitment to security and reinforcing its importance throughout the organization.

已翻译

赞
Preity Gupta

??International Award-Winning Cloud Security Advisor. Aspiring CIO, CISO, CEO?? Author of Bestselling 'Cost Savvy Secure Cloud' ??Expert in Governance, Cost optimization & AI-Enabled Security Solutions
举报内容
*Ensure that senior management prioritizes security and visibly supports security initiatives. *Allocate resources for security training, tools, and personnel. *Define and communicate security policies and expectations clearly. *Include security objectives in the company’s mission and values.

已翻译

赞

2 Design security architecture with layers and domains

The next step is to design your security architecture with layers and domains. Layers are the logical or physical components that make up your system, such as the network, the application, the data, and the user. Domains are the boundaries or zones that separate different levels of trust, access, or control, such as the public, the private, or the hybrid. By designing your security architecture with layers and domains, you can apply the principle of defense in depth, which means using multiple and complementary security mechanisms to protect your system from different threats and vulnerabilities. You can also apply the principle of least privilege, which means granting only the minimum necessary access or permissions to each layer or domain.

添加您的观点

Iain White

Tech Consultant | IT Leader | Mentor | Virtual CTO | Leadership Coach | Project Manager | Scrum Master | IT Strategy | Digital Transformation | IT Governance | Agile | Lean | Theory Of Constraints | SaaS | Brisbane.
举报内容
Designing security architecture with layers and domains is essential for creating a culture of security responsibility. Layers include components like the network, application, data, and user. Domains set boundaries of trust, access, or control, such as public or private zones. At White Internet Consulting, we applied these principles to enhance security. Once, a multi-layered approach helped us thwart a significant cyber threat. My personal view: implementing defense in depth and least privilege principles ensures robust protection. It's about using multiple, complementary mechanisms to safeguard against threats, granting minimal necessary access to each layer or domain.

已翻译

赞

3 Implement security controls and measures

The third step is to implement your security controls and measures. These are the specific tools and techniques that you use to enforce your security goals and principles, and to mitigate or prevent any security risks or incidents. Depending on your security architecture design, you might use different types of controls and measures, such as encryption, authentication, authorization, firewalls, antivirus, logging, monitoring, auditing, backup, recovery, and more. You should also consider the trade-offs between security and other factors, such as usability, scalability, cost, performance, and innovation. You should balance your security controls and measures with your business and technical needs, and avoid over-engineering or under-engineering your security solutions.

添加您的观点

4 Educate and empower your users and staff

The fourth step is to educate and empower your users and staff. Your security architecture is only as effective as the people who use and manage it. Therefore, you need to ensure that your users and staff are aware of their security roles and responsibilities, and that they have the skills and knowledge to perform them. You should also provide them with the tools and resources to support their security tasks and activities, such as policies, procedures, guidelines, training, awareness, feedback, incentives, and recognition. You should also encourage them to report any security issues or concerns, and to suggest any improvements or innovations.

添加您的观点

Preity Gupta

??International Award-Winning Cloud Security Advisor. Aspiring CIO, CISO, CEO?? Author of Bestselling 'Cost Savvy Secure Cloud' ??Expert in Governance, Cost optimization & AI-Enabled Security Solutions
举报内容
*Conduct mandatory security training sessions for all employees. *Include topics such as phishing awareness, password management, and data protection. *Run continuous security awareness campaigns using newsletters, posters, and internal communications.

已翻译

赞

加载更多内容

5 Review and update your security architecture

The fifth step is to review and update your security architecture. Security is not a one-time project, but a continuous process. You need to monitor and evaluate your security architecture regularly, and make any changes or adjustments as needed. You should also keep up with the latest security trends and best practices, and incorporate them into your security architecture design and implementation. You should also conduct periodic security audits and assessments, and test your security controls and measures for any gaps or weaknesses. You should also document and communicate your security architecture updates and changes to all stakeholders.

添加您的观点

6 Foster a culture of security responsibility

The sixth step is to foster a culture of security responsibility. This means creating a positive and proactive attitude and behavior towards security among your users and staff. You should also promote a culture of collaboration and trust, where security is not seen as a burden or a barrier, but as a benefit and a value. You should also celebrate and reward your security achievements and successes, and learn from your security failures and mistakes. You should also foster a culture of innovation and improvement, where security is not seen as a fixed or static state, but as a dynamic and evolving one.

添加您的观点

Michael Marshall

Cybersecurity Analyst
举报内容
Ensuring that all of your staff understands that security events can impact the whole organization will help to encourage them to take more responsibility for being vigilant and proactive against potential threats.

已翻译

赞
Preity Gupta

??International Award-Winning Cloud Security Advisor. Aspiring CIO, CISO, CEO?? Author of Bestselling 'Cost Savvy Secure Cloud' ??Expert in Governance, Cost optimization & AI-Enabled Security Solutions
举报内容
*Encourage teams to consider security implications during planning, development, and deployment phases. *Conduct regular security audits and assessments to identify gaps and ensure compliance with policies. *Implement a reward system for reporting vulnerabilities or successfully completing security training.

已翻译

赞
? Wesley van Hoorn MSc

Securing the energy transition with Enexis | CISSP | SCF
举报内容
The impact on business -- caused by a security incident -- is often not felt by patient-zero. Instead, the impact is felt further up the supply-chain, at the very end. Damage is not distributed proportionally. To assure the end of the chain, you need an aware start.

已翻译

赞

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Security Architecture Design

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you create a culture of security responsibility?

1

2

3

4

5

6

7

1 Define security goals and principles

2 Design security architecture with layers and domains

3 Implement security controls and measures

4 Educate and empower your users and staff

5 Review and update your security architecture

6 Foster a culture of security responsibility

7 Here’s what else to consider

Security Architecture Design

给文章评分

感谢您的反馈

更多Security Architecture Design相关文章

更多相关阅读内容