Section 27.262 Creating a Culture of Security Flashcards
Objective 5.6 Given a scenario, you must be able to implement security awareness practices
Creating a Culture of Security
Importance of Security Culture
■ A culture of security is crucial for safeguarding an organisation
■ Technical security solutions are ineffective if employees do not value security
Creating a Culture of Security
Requirmenets/goal
Involves integrating cybersecurity into the organisation’s ethos, behaviors, and decisions
■ Requirements:
● Organisational change management
● Strategic planning
● Execution
● Monitoring
● Reporting
Goal: Embed cybersecurity into every aspect of the organisation to protect
valuable information
Organizational Change Management
■ Recognises the role of the human element in security
■ Emphasises staff engagement and adherence to security policies and procedures
■ Begins with commitment from executive leadership
■ Communicates cybersecurity as a shared corporate responsibility
Development Phase
■ Involves developing specific and actionable security plans
■ Allocates resources to support plans
■ Create comprehensive policies
■ Educate employees on threats
■ Establish guidelines for data handling
■ Focuses on empowerment and employee confidence in recognising and responding to threats
Execution Phase
■ Ongoing process, not a one-time event
■ Includes rolling out policies, conducting training, and adapting to evolving
security threats
■ Requires regular training updates, simulated cyberattacks, and consistent threat communication
Reporting and Monitoring
■ Begin with initial monitoring after the rollout of a security program
■ Conduct recurring check-ins to maintain program integrity
■ Assessing employee compliance with security protocols
■ Identifying areas for improvement
■ Creating a culture of reporting suspicious activities
■ Establishing feedback loops to adapt based on insights from monitoring and
reporting
Benefits of Security Culture
■ Resilience against cyberattacks
■ Employee vigilance becomes inherent
■ Improved operations and trust-based reputation
■ Proactive security posture for future uncertainties
