Cybersecurity Culture: How Business Owners Set the Tone for Their Team
Cybersecurity Culture Starts at the Top
Cybersecurity culture is a fancy way of describing something simple: whether the people on your team treat security as part of their job or as something that’s somebody else’s problem. You can have good tools in place, although if employees click every link, share passwords, or stay quiet after a mistake because they’re afraid of getting in trouble, those tools can only do so much.
In its guidance for small businesses, the Cybersecurity and Infrastructure Security Agency points out that a business leader’s commitment to being ready sets the tone for the whole organization. In a small business, that leader is usually you, and your team pays a lot more attention to what you do than to any policy you hand them.
Follow the Rules Yourself
If the owner asks for an exception to multi-factor authentication because it’s inconvenient, everyone notices. If the owner uses the same password everywhere, or keeps full administrator access on a laptop that goes everywhere, the message is that the rules are optional. Owner accounts are also exactly what attackers want most, since an email that appears to come from the boss is the easiest way to trick an employee into sending money, which is how email spoofing scams work.
Going first on the security habits you’re asking of your team does more than any memo. When you turn on multi-factor authentication before everyone else and mention it at a staff meeting, it stops feeling like a burden handed down and starts feeling like how your business operates.
Make Reporting Easy and Safe
The single most valuable habit in a strong cybersecurity culture is people speaking up quickly. An employee who clicks a bad link and reports it within five minutes gives your IT provider a real chance to contain the damage. An employee who clicks the same link and stays quiet because they’re embarrassed can turn a small problem into a disaster that nobody discovers for weeks.
So say it out loud, and say it often: reporting a mistake will never get anyone in trouble, and staying quiet about one is the only thing you’ll be upset about. Thank people when they forward a suspicious email, even when it turns out to be harmless. CISA even recommends rewarding employees who catch test phishing emails instead of punishing the ones who miss them, since people learn faster when it feels like a team effort.
Keep It Short and Regular
Long annual training sessions tend to be forgotten by the following week. A few minutes at a regular staff meeting works much better, whether that’s sharing a real phishing email someone received, mentioning a scam going around town, or reminding everyone how to report something odd. Small and frequent beats big and rare.
It also helps to explain the reason behind each rule. People are much more willing to follow a policy like limiting access to only what each person needs when they understand it protects them too, since an attacker who takes over their account can do far less damage.
Building Your Cybersecurity Culture This Month
Cybersecurity Awareness Month is a natural excuse to start. Bring it up at your next staff meeting, share one simple tip each week through the end of October, and tell your team in plain words that you’d always rather hear about a possible problem than not. None of that costs anything, and it changes how people react when something suspicious lands in their inbox.
Glitch Technology works with business owners on the people side of security as well as the technical side, including short, practical team trainings that teach without embarrassing anyone. If you’d like help getting started, reach out for a free assessment.
Your team will take security exactly as seriously as you do. Glitch Technology provides managed IT services and computer support in Jacksonville, IL. We take full ownership of IT environments for small businesses and municipal organizations through proactive monitoring, preventative maintenance, and strategic planning.