CYBER SAFETY CULTURE: IT’S TIME FOR A CYBER SECURITY RE-THINK

Something has to Change, Right?
Conventional wisdom is that we are losing the cyber security battle. An IBM and Ponemon Institute study in 2016 noted cyber resilience was dropping. They said 66% of organizations won’t recover from a cyberattack, a concerning prediction. Cyber experts are now saying “prevention is futile” and that it’s all about resilience, response, and recovery. They warn that focus on only blocking entry is misguided. Their view is that the crooks are already inside, so companies need to find them and stop them from getting out with their data.

The good news is that there is a growing awareness of the risk among corporate leaders. Cyber risk was ranked number two of all risks by CEOs in the KPMG 2018 Global CEO Outlook. Some experts believe the former dismal outlook is improving slightly as companies are waking up to the likelihood of an attack.

It’s possible that we could be looking at cyber security the wrong way, and many organizations’ focus on building higher and stronger walls is only one piece of the puzzle. It’s time to think differently about cyber security.

Safety Culture Works
So, how should we look at cyber security? Kolochenko also said "Cyber security is not rocket science. Begin by doing the right things right and keeping things simple. Doing the right things right means bringing people, their behaviours and the processes they follow into the picture.” Keeping things simple means a combination of easy-to-follow processes and a dose of common sense.

Our research has found common examples of safety culture in several industries. We can learn from them and apply them to transition to a Cyber Safety Culture.

As early as 2012, it was identified by the Australian DOD Cyber Security Operations Centre that 85% of cybercrime could be mitigated from what are called the cyber security “hygiene” factors. Bad hygiene includes sloppy password protection, inaccurate counts of computer assets and poor patch control. Countering these behaviours is very effective and relatively simple. Would you agree this is an astonishing number given the current focus on expensive complex technology solutions?

A colleague told me a story about hospitals in Australia trying to combat the spread of the flu by educating the public using detailed rational scientific explanations about viruses. Nothing happened. So, they gave up on that and launched a “Wash Your Hands” campaign and infection rates plummeted. This is now ingrained in our habits and culture. It is simple, straightforward, cost effective and it works. This demonstrates the power of culture change – the same concept that we need to combat cybercrime.

This story inspired me to promote Cyber Safety Culture. I believe Cyber Safety Culture is the missing link in our current approach and is the fundamental change required to combat cybercrime more effectively. And we have to build it collaboratively everywhere – not just in North America but around the world.

Creating a Cyber Safety Culture
“Never take candy from a stranger”. These words cite a hugely powerful cultural norm in our society – “stranger danger” – that we have adopted to educate our kids to keep them safe. This is a great example of ingrained safety culture; ubiquitously understood and second-nature in our kids’ awareness and behaviour. What exactly do we mean by a Cyber Safety Culture and how do you build one?

In a nutshell:

• Understand your company’s cyber vulnerabilities in order to measure and manage risk through awareness, trust, education, intelligent pro-active processes, and common sense.