Cyber leaders say culture is hard to track but must constantly evolve
kjekol via Getty Images
By
Chris Teale
Speakers at this week’s Billington Cybersecurity Summit said if even the lowest-level employees are shown where they can make a difference, it can encourage that culture.
In its annual Data Breach Investigations Report earlier this year, Verizon found that, of those public sector organizations that have been hacked, one of the biggest vulnerabilities remains credential abuse, where hackers use stolen usernames and passwords to gain access.
Phishing also remains a major vulnerability, Verizon found, as government employees fall victim to email scams and accidentally let hackers and ransomware attacks access public systems. But in a bid to fight back and reduce these risks, government leaders face an uphill task to encourage a strong cybersecurity culture among their employees.
If they want to do so, those leaders need to make sure that every employee is invested in the cybersecurity mission and know the positive impact they can have, speakers said during a panel discussion at the Billington Cybersecurity Summit this week in Washington, D.C.
“I talk a lot [to employees] about the impact that they have in this role,” said John Godfrey, Kansas’ chief information security officer. “No matter what your job is, the impact is huge. The impact can be felt. And more importantly, I challenge them. I say, ‘when you leave work, go out and look left and right around your house, look at the person in the grocery store, these are the people that we are here helping stay protected. That is the impact.’”
But that will need a culture that is “active, not passive,” Godfrey said, which is constantly proactive and helping people understand “why I matter.” Already, he said that has included simple things like praising and rewarding employees who are the top reporters of potential phishing scams and the state’s internal phishing training emails. He also has had members of his cybersecurity tiger team, which typically work to resolve specific incidents or challenges, walk around the office distributing coffee while getting to know their colleagues.
“We connect humanity to cyber,” Godfrey said. “We make it real, we give you something fun, but more importantly, we reinforce culture in a very subtle way. It allows us to have some very interesting conversations in that process, conversations that you would not have been able to have at those moments otherwise, and, more importantly, you can solve some of the problems that drive the behavior outcomes that you really want from a culture perspective.”
Measuring culture is hard, however. William Johnson, chief of software product delivery at Tensley Consulting, noted on stage that his company has been set a task of “measuring zero trust,” which he said will be challenging on multiple levels, especially as it is a similar task to measuring culture.
Because it is a far more qualitative measurement than quantitative, Godfrey said he has turned to various “indirect methods,” including his praise of top phishing email spotters.
“What if we start tracking the top reporters, and then if someone on the security team comes out, gives you a certificate or something,” he said. “It sounds cheesy, right? Whatever it is, we've done it a variety of ways, but the point here is you reinforce the mission. You build the culture. You show that people's actions and activities not only matter, but they do have an impact, and that, more importantly, you are paying attention, that they are helping.”
Training, too, needs to evolve and be engaging if employees are to feel they are important in protecting an agency’s cybersecurity posture. Too often, speakers said those monthly or yearly training sessions can feel too compliance-based and like something that only must be completed once a year. “Cybersecurity culture is not a project,” Godfrey said. “It's not one and done. We have to screen and point to it.”
Leaders bringing their personalities can help make cybersecurity training more engaging, especially if they themselves have fallen short.
“Real time, current stuff translated either to mission language, business language, or even personal language, can be very impactful,” Godfrey said. “It's the same reason why, around the holidays, we tell people to be careful when you're doing personal online shopping. That connects with people too. I found in my case, there've been some real-world attacks that have nearly tricked me, or maybe one did trick me, and so those are perfect opportunities as well. I use those, and I talk about these internally.”