Creating a Cybersecurity Culture. Recommendations, 5 things to do and 5 not to do

Expanding the Reach of Cybersecurity: Strategic Awareness for Leaders

In recent days, various experts have emphasized the need to expand the reach of cybersecurity, and I want to take this opportunity to join that line of strategic awareness for leaders of organizations of all sizes.

While reviewing Gartner’s Top Security Projects for 2020–2021—essential for all security and risk management leaders—I reflected on where Kymatio can best help our clients improve (which, by the way, are many).

Then a LinkedIn post caught my attention from J. Eduardo Campos (EMPA, CISM, CISA, CISSP, CPP), who stated:

“Make the human factor the best link by investing in people's training, awareness, and well-being.”

This, of course, aligns perfectly with our philosophy. Campos’ comment was a response to a post by Bret Arsenault, Corporate Vice President and Chief Information Security Officer at Microsoft, who said:

“Creating a cybersecurity culture at work becomes both more important and more challenging when employees work at home. Regardless of whether they're in the office or working remotely, employees are your last line of defense against cyber bad actors. Adopting interactive training and frequently testing with realistic scenarios can help drive an effective cybersecurity culture.”

Arsenault—recognized across the industry for innovative leadership—recommended reading Mark Soten’s article Creating a Cybersecurity Culture Starts With Your Team, published on SecurityIntelligence.

How Kymatio Helps Achieve These Objectives

From the “Do’s”:

• Do test your employees monthly.
  Kymatio operates on a periodic basis with employees, with a default monthly cycle.
• Do allow for a simple process to report suspicious emails.
  Kymatio goes further by preparing people to understand the motivations behind psychological manipulation techniques.
• Do report program results to the C-suite.
  Kymatio provides clear, digestible metrics at both the organizational and personal level, tracking evolution over time.
• Do use constructive, collaborative criticism.
  Kymatio quickly identifies where cultural change is needed and supports its implementation.
• Do use interactive training before testing.
  Kymatio combines chat-based interactions to understand employee needs with situational cyber test sessions.

From the “Don’ts” (aligned with Kymatio’s philosophy):

• Don’t be overly forceful with the program.
• Don’t forget to involve managers, stakeholders, and IT teams.
• Don’t repeat the same phishing test patterns.
• Don’t start with overly complex concepts.
• Don’t forget that security culture extends beyond the office.

At Kymatio, we are fully aligned with the spirit of Mark Soten’s words:

Your employees are the last line of defense against threat actors.

Read the full article here:
Creating a Cybersecurity Culture Starts With Your Team

📩 Contact us to learn how Kymatio allows you to manage human cyber risk.

Related information:

• New Kymatio module prepares employees for social engineering techniques
• Kymatio launches a module to manage the risks of employee's digital exposure