How do you overcome cybersecurity apathy in your organization?

由人工智能和领英社区提供技术支持

Cybersecurity apathy is a common challenge that many organizations face. It is the lack of interest, motivation, or awareness among employees, managers, or stakeholders to follow cybersecurity best practices, policies, or standards. Cybersecurity apathy can lead to serious risks, such as data breaches, ransomware attacks, or compliance violations. How do you overcome cybersecurity apathy in your organization? Here are some tips to help you create a more positive and proactive cybersecurity culture.

本文章的要点总结

Harness storytelling:

By sharing relatable cybersecurity scare stories, you engage your team's emotions—making the abstract threat real. Have them check their own digital footprint to personalize the risk and spur proactive behavior.
Evaluate risk appetite:

Aligning cybersecurity measures with your organization's risk tolerance ensures a practical, integrated approach. This resonates better with teams, avoiding a disconnect and fostering a sense of shared responsibility.

本摘要由 AI 和以下专家提供支持

1 Assess the current situation

The first step to overcome cybersecurity apathy is to assess the current situation in your organization. You need to identify the root causes, the level of impact, and the potential consequences of cybersecurity apathy. You can use surveys, interviews, audits, or metrics to gather data and feedback from different groups and perspectives. You should also benchmark your organization against industry standards, best practices, or competitors to see where you stand and where you need to improve.

添加您的观点

Dr. Todd A. Jacobs, CISM CISSP MBA PhD

? CITO (CSO, CIO, CISO, CTO) ? IT Audit Remediation Expert ? Solving Strategic Business Problems Through People, Process & Technology ? Cybersecurity & IT Automation Leader ? Agile Champion
举报内容
Part of any such assessment must include an evaluation of the organization's current goals and appetite for risk. Lacking this context, the assessment is unlikely to accurately reflect fit the company's objectives and is quite likely to be perceived as "ivory tower security."

已翻译

赞

加载更多内容

2 Communicate the value and relevance of cybersecurity

The second step to overcome cybersecurity apathy is to communicate the value and relevance of cybersecurity to your organization. You need to explain why cybersecurity matters, what are the benefits and risks, and how it affects the goals and objectives of your organization. You should also tailor your message to different audiences, using language, examples, and stories that resonate with them. You should also emphasize the shared responsibility and accountability of everyone in your organization to protect the information and assets.

添加您的观点

Dr. Todd A. Jacobs, CISM CISSP MBA PhD

? CITO (CSO, CIO, CISO, CTO) ? IT Audit Remediation Expert ? Solving Strategic Business Problems Through People, Process & Technology ? Cybersecurity & IT Automation Leader ? Agile Champion
举报内容
Security is never an end unto itself. When talking to different stakeholders, you need to address the value _to them_. For example: - Sales cares about how cybersecurity and compliance will make the sales process easier to communicate about with the customers that value or require it. - Engineering organizations care about how security can be integrated without causing drag on their delivery cadence. - Financial stakeholders care about ROI, TCO, CapEx, OpEx, and top- and bottom-line impact. Speak their language. If you can't translate security into domain-specific value, reconsider whether it actually _provides_ real value to the organization.

已翻译

赞

加载更多内容

3 Educate and train your employees

The third step to overcome cybersecurity apathy is to educate and train your employees on cybersecurity topics, skills, and behaviors. You need to provide regular, engaging, and interactive learning opportunities that cover the basics, the latest trends, and the best practices of cybersecurity. You should also test and measure the knowledge, skills, and attitudes of your employees, and provide feedback and recognition. You should also create a learning culture that encourages curiosity, collaboration, and continuous improvement.

添加您的观点

加载更多内容

4 Incentivize and reward good cybersecurity practices

The fourth step to overcome cybersecurity apathy is to incentivize and reward good cybersecurity practices in your organization. You need to align your performance management, compensation, and recognition systems with your cybersecurity goals and expectations. You should also create positive and negative incentives, such as bonuses, gamification, or penalties, to motivate and influence your employees' behavior. You should also celebrate and showcase the successes and achievements of your employees, teams, or departments that demonstrate good cybersecurity practices.

添加您的观点

Dr. Todd A. Jacobs, CISM CISSP MBA PhD

? CITO (CSO, CIO, CISO, CTO) ? IT Audit Remediation Expert ? Solving Strategic Business Problems Through People, Process & Technology ? Cybersecurity & IT Automation Leader ? Agile Champion
举报内容
Penalties may be necessary, but you get better outcomes by leading knowledge workers with Theory Y and results-based incentives. You get what you measure, so measure things like: - Outcomes, not effort! - Teamwork and collaboration rather than individual contributions. - Steadiness and predictability, not heroic but unsustainable efforts.

已翻译

赞

加载更多内容

5 Monitor and enforce cybersecurity compliance

The fifth step to overcome cybersecurity apathy is to monitor and enforce cybersecurity compliance in your organization. You need to establish and communicate clear and consistent cybersecurity policies, standards, and guidelines that define the roles, responsibilities, and expectations of your employees, managers, and stakeholders. You should also implement and update the technical controls, such as firewalls, antivirus, or encryption, that protect your information and systems. You should also audit and report the compliance status, issues, and incidents of your organization, and take corrective actions when needed.

添加您的观点

Dr. Todd A. Jacobs, CISM CISSP MBA PhD

? CITO (CSO, CIO, CISO, CTO) ? IT Audit Remediation Expert ? Solving Strategic Business Problems Through People, Process & Technology ? Cybersecurity & IT Automation Leader ? Agile Champion
举报内容
Whatever you do, don't mistake cybersecurity or regulatory compliance as a technology function. Real cybersecurity is about managing business risk, brand reputation, and market trust through strategic objectives. If you can't *clearly articulate your vision* for cybersecurity verbally or with paper and pencil—and only _then_ selecting a tool chain that _supports_ that vision—you're simply falling into the trap of allowing tools and sunk costs to _drive_ your processes instead of supporting the needs of your organization. Don't do that!

已翻译

赞

6 Involve and empower your employees

The sixth and final step to overcome cybersecurity apathy is to involve and empower your employees in your cybersecurity initiatives. You need to create a sense of ownership, engagement, and participation among your employees, by soliciting their input, feedback, and ideas. You should also provide them with the resources, tools, and support they need to perform their cybersecurity tasks and duties. You should also foster a culture of trust, openness, and collaboration, where your employees can share their concerns, challenges, and solutions.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Jim Desmond (CISSP, CISM, CFE)

CISO/CSO | Advisor | Leader
举报内容
Storytelling. There is nothing more powerful in cybersecurity awareness and engagement in finding the story that resonates with your coworkers. Get them to sympathize and then empathize with the issue and how it could affect them. Telling a story how someone forgot to check the url of a link in an email, is far more effective if it is something they can see themselves doing, so make it close to home. Give them exercises, like checking their email address in haveIbeenpwned or what googling reveals about them that can be used against them. Bring in a credible speaker that can help them more fully comprehend the threats they face. Find something to drive the cognitive trace that will help them engage in your cybersecurity program.

已翻译

赞

加载更多内容

Cybersecurity

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

How do you overcome cybersecurity apathy in your organization?

1

2

3

4

5

6

7

1 Assess the current situation

2 Communicate the value and relevance of cybersecurity

3 Educate and train your employees

4 Incentivize and reward good cybersecurity practices

5 Monitor and enforce cybersecurity compliance

6 Involve and empower your employees

7 Here’s what else to consider

Cybersecurity

给文章评分

感谢您的反馈

更多Cybersecurity相关文章

更多相关阅读内容

How do you overcome cybersecurity apathy in your organization?

1

2

3

4

5

6

7

1 Assess the current situation

2 Communicate the value and relevance of cybersecurity

3 Educate and train your employees

4 Incentivize and reward good cybersecurity practices

5 Monitor and enforce cybersecurity compliance

6 Involve and empower your employees

7 Here’s what else to consider

Cybersecurity

给文章评分

感谢您的反馈

查看其他技能