Question

Develop a plan for a program to promote a security culture for the company. What framework will you use for your program? What strategies will you use to change behavior to one of security? What Security Awareness strategies will you employ?

Answer 1

A healthy security culture in an organization is that everyone in the organization is aware of security policies and follows the security procedures set by the company.Security is the combined effort in an organization. Everyone in the company is responsible for security.

Security culture= acquaintance of security policies + adhere and follow the procedures.

Promoting security culture in an organization is allowing employees to change social habits, actions in a way to avoid security incidents, threats to the company.

----

Framework is a repeatable set of actions to promote security culture in the organization.

It can be a simple PDCA cycle.

• Plan.
• Do.
• Check.
• Act

Set Security goals, metrics and security campaigns.

Perform Gap analysis of existing security loop holes in the organization. For example, very few employees attend the security trainings etc.

Perform activities to enhance security. Examples: Security drills, training sessions, Do’s and Don’ts in the company, Choose the right security team. The team should be passionate to install, spread the security culture within the organization.

Monitor and Measure the effectiveness continuously using metrics. Promoting security culture is not a one- time effort.

----------

• Trainings,
• Enforcement of crucial policies,
• Security campaigns.

Security Trainings within the organization would change behavior. Enforcement of policies would drive the change in the employee behavior towards security. For example, if the employee doesn’t change the workstation password. A change in the system administrator group policy would drive employees to change passwords every 90 days etc.

Banner hangouts of important security policies in the company,

Display of security policies in meeting rooms, cafeteria etc.etc.