What do you do if your organization lacks a culture of cybersecurity awareness?

“La evaluación y el entendimiento del nivel de madurez de la seguridad en torno a los activos de información es crucial, ya que no se puede proteger algo que no se conoce. La concienciación de la seguridad comienza aquí, entendiendo qué protegemos, por qué lo hacemos y qué sucedería si no lo hacemos. Es decir, no solo evaluamos el activo, sino también el panorama de las consecuencias.

If an organization you work at lacks in cyber security awareness, then you be the advocate. The bystander effect happens with cyber security in organizations all the time. Everyone notices the gaps, but no one champions the discussions as they probably assume "it's not my job"; except cyber security is every users job. Start raising awareness through doing your own assessments and ensure you hand-off the report to people who have the authority to make things happen. If nothing happens after a considerate amount of time, escalate it to those higher up the hierarchy until someone listens. The issue with poor security awareness means that when an attack occurs, not if, how responsive will an organization be when they do not care?

Creating policies without ensuring they can be implemented, enforced, and monitored over time is just as useful as having zero security awareness. Having something just to have it does not make an organization more security aligned. Prioritizing what policies are written first is very important since implementation will take a while and maybe having a BYOD policy first is not as useful than having programmatic policies, such as: Incident Response, Business Continuity, Change Management, Disaster Recovery, Risk Management, and Vulnerability Management. Lastly, do not create policies before understanding what regulatory compliances your organization is obligated to follow, as compliances dictate security requirements and methodologies.

La adopción de estándares como la ISO 27001, ISO 27002, ISO 27004, NIST y CIS Control permite crear un conjunto coherente de elementos. Estos elementos son esenciales para desarrollar políticas de seguridad eficaces y apropiadas para la organización. Si nuestra organización es del tipo industrial, no debemos pasar por alto el estándar principal en ciberseguridad industrial: ISA/IEC 62443. En resumen, es fundamental disponer de información que se ajuste a las necesidades específicas de la industria para generar políticas de seguridad adecuadas tanto para IT como para OT

When confronted with an organization lacking a robust culture of cybersecurity awareness, there are several proactive steps that can be taken to address this issue effectively: Firstly, offer comprehensive training to employees to improve their grasp of cybersecurity principles and best practices. Additionally, consistently advocate for cybersecurity awareness throughout the organization to underscore its significance. Deploying appropriate cybersecurity tools and technologies is vital for strengthening defenses against threats. Lastly, vigilantly monitor compliance with cybersecurity policies and procedures to guarantee adherence and efficacy.

La capacitación es sinónimo de aprendizaje; es algo obvio. Por lo tanto, la mejor forma de llevarla a cabo es mediante una dinámica entretenida. He observado diversos modelos de capacitación, desde textos aburridos hasta otros muy dinámicos y entretenidos. Es fundamental comprender que, aunque la tecnología carece de emociones, las personas que la utilizan no. Por lo tanto, la capacitación debe tener la virtud de penetrar y arraigarse profundamente en las personas. No debe ser simplemente una cuestión obligatoria de la empresa, sino algo que forme parte de nuestro día a día, ya que todos somos usuarios de tecnología

Staff training is essential for cybersecurity. Mandatory training on phishing, data security, and online safety, coupled with regular updates and interactive sessions, fosters a culture of vigilance. This proactive approach ensures employees are always prepared to tackle emerging cybersecurity threats.

Durante mi tiempo trabajando en un SOC, me encontré con alertas recurrentes relacionadas con usuarios que intentaban instalar software no autorizado, desinstalar antivirusy, sobre todo, acceder a enlaces desconocidos recibidos por correo (phishing). Aunque teníamos herramientas implementadas para mitigar los riesgos asociados a estas actividades, no solían tener consecuencias graves. Sin embargo, ?qué sucedería si en este conjunto de acciones ocurriera un ataque de día cero (un tipo de ataque para el que no estamos preparados)? A pesar de contar con las mejores herramientas, el eslabón más débil siempre serán las personas. Sin la capacitación correcta, habrán mayores probabilidades de intentos para evadir estas herramientas.

To address a lack of cybersecurity awareness, it's essential to develop a targeted awareness program. Begin by gaining support from the board to highlight its importance (they are legally responsible for this too). Introduce engaging, regular training that relates cybersecurity to both personal and professional contexts, covering threats, best practices, and the consequences of breaches. Promote a culture where cybersecurity is everyone's responsibility, encouraging open reporting of potential threats without fear. Reward positive security behaviours, and continually assess and refine the program based on feedback and emerging threats, fostering a culture of proactive cybersecurity engagement. Oh, and watch my TEDx Talk too ;)