Security systems are only as successful as the people who sit behind them
In May 2020, the personal records of more than 24 million South Africans and nearly 794,000 companies got handed over to someone impersonating a client.
The personal records, identity numbers and addresses of millions of people and thousands of businesses were given to this person because they had fooled the system.
It’s a hard lesson in how important it is to embed security not just into the technology and the devices of a company, but into its people.
According to Anna Collard, SVP of Content Strategy and Evangelist, KnowBe4 Africa, security is not just the responsibility of IT, it is the responsibility of every single person in an organisation.
“It is critical that organisations create a culture of security in order to combat this increasingly hostile security environment,” she adds.
“A successful security culture gets driven by leadership, the human resources (HR) department, internal marketing & communication and ongoing security training. Truly agile and capable security is a people project, not a technology one.”
Successful security balances on three pillars: technology, policy and people.
The technology is the firewalls, the anti-virus, the ongoing alerts and the endlessly evolving bouquets of solutions that are designed to give the business an edge in the war against cybercrime.
Policy is what outlines the processes that people across all levels of the organisation have to follow in order to ensure that the technology can do its job, that checks and balances are in place as well as to guide people on what they can and cannot do in the digital realm.
People are the key to ensuring that both technology and policy actually work.
“This is why HR has to get involved with security. It is fundamental to changing behaviour within the organisation and helping to build a culture that recognises the importance and value of security.
It is, of course, also the disciplinary arm that enforces policy and that ensures there are consequences when people continue to break the rules or fall for phishing scams or perpetually do the wrong things.” says Collard.
Whether the organisation incentivises or punishes – security has to have consequences.
Employees must see that the executive is as tightly bound by the regulations as everyone else.
And they need to understand exactly what these regulations are, why they are important and the implications that failure can have on their jobs and the future of the organisation.
With data protection regulations such as South Africa’s Protection of Personal Information Act (POPIA) in full effect, the cost of an avoidable mistake can result in hefty fines or even imprisonment for the directors of the company.
A mistake that can be as simple as someone clicking on a phishing email, falling for a social engineering call or unleashing a ransomware virus because they didn’t recognise the risk.
This is where good communication becomes as essential as good technology
It’s a blend of HR people practice, security good practice and marketing best practice.
These three elements need to get pulled together to create a cohesive security ecosystem that ensures people truly understand that their actions can have serious consequences.” adds Collard
This level of engagement can be achieved in multiple ways. Empower a person who interacts with the different stakeholders across the business and who has the right support from the executive and HR.
This role will then get committed to ensuring that security culture gets carried throughout the company by implementing the right training platforms, incentivisation/punishment systems and driving participation.
“Success will depend entirely on the level of stakeholder buy-in, the depth of the training and a commitment to ensuring that the training is ongoing and measurable,”
“Security training has to get iterated and repeated constantly to ensure that people are always kept aware of its importance and any changes in attack vector or threat.
Only by keeping security top of mind, all the time, can an organisation truly embed a culture that’s capable of staying secure and alert.”, concludes Collard.
Featured Image: Anna Collard, SVP of Content Strategy and Evangelist, KnowBe4 Africa
Don’t miss important articles during the week. Subscribe to cfamedia weekly digest for updates.
