Make sure to add us or contact us for the latest news
 |
 |
 |
 |
 |
 |
 |
Real-Time Service Alerts
Why a Strong Security Culture is the Magic Bullet You’re Looking For (and 3 Ways to Help You Build It)
The importance of building a strong security culture is something that is always considered a best practice for building a strong defense against cybercrime. But what does that really mean, and does it actually work? Data from several recent projects show that building a strong security culture does have big benefits – and neglecting a company’s security culture has big downsides too. From reducing employee errors leading to a data breach to sniffing out malicious insiders faster, a real dedication to security on everyone’s part just keeps businesses safer. These three ways help you boost your security culture.
Business Cybersecurity Has Plenty of Room for Improvement
IBM describes security culture in its blog as “both a mindset and mode of operation”. That’s a crucial distinction. Security today is about much more than just the solutions that you have working for you and dangers presented to tech teams. It’s equally as important that your people at every level are committed to making security a priority because they understand the importance of cybersecurity in the success of your organization. An estimated 60% of organizations that fall victim to a cyberattack go out of business within a year, and no one wants to join that club.
Yet, the state of business cybersecurity is still dire in many businesses. A report in CISO Magazine detailed the danger: one in three small businesses with 50 or fewer employees rely on free or consumer-grade cybersecurity tools for all of their cyber defense, and one in five companies do not use any endpoint security whatsoever. The tidings from a survey by the Small Business Administration (SBA) are also grim. Just under 90% of small business owners think that their business is open to a cyberattack – and SMB owners are notorious for underestimating their risk.
Although it seems hard to believe; a great many businesses of every size still haven’t gotten the message that cybersecurity is directly tied to their success, this is a bit of a wakeup call about the danger that even the smallest businesses face from cybercrime and we can make an enormous difference in the success of that defense plan.
one in three small businesses with 50 or fewer employees rely on free or consumer-grade cybersecurity tools for all of their cyber defense, and one in five companies do not use any endpoint security whatsoever.
Security Culture Starts at the Top
Many businesses may form a weak security culture because the executives who make the budgets and sign the checks simply don’t make cybersecurity a priority and aren’t willing to pay for it. A report in Security Intelligence details the problems that security teams can face from an executive team that just doesn’t see why it’s a big deal. Just 9% of survey respondents cited digital security as the most important factor facing their businesses, and 18% ranked defense against cyberattacks, even insider threats, as the least important factor in their company’s success. An astonishing 60% of business leaders surveyed revealed that they didn’t have a defense against cyberattacks in place at all, let alone an incident response plan. Some of the executives surveyed knew that information security was important but hadn’t done anything about it, with 25% of them admitting that they wouldn’t know where to even start with SMB cybersecurity.
That is a huge problem for trying to develop the kind of security culture that stops cyberattacks. IBM cites simple bravado followed by unfamiliarity with potential risks as a strong driver of failure in top-down security culture – 60% of SMB owners feel that they will not face any kind of cybersecurity incidents. That’s far from the truth. In 2020, 80% of firms have seen an increase in cyberattacks, and for two in five that came in the form of a ransomware attack. Phishing is even more dangerous and misunderstood by business leaders. Getting executive buy-in is the biggest hurdle companies have to overcome to help establish the security culture that is needed.
Blockers Stand in the Way of Progress
There are always obstacles to progress, and there are quite a few to overcome here, even after you see that you’re in danger of a cyberattack or data breach. Three major blockers stand between you and the kind of robust security culture that really increases cyber resilience and strengthens defenses. Addressing these points can help break through barriers and develop a solid foundation for building the security culture and cybersecurity savvy that you need to succeed.
While some companies are willing to buy solutions that can protect them from things like phishing, they’re not willing to really lay out the time or money necessary to make employees better at avoiding social engineering and other cybercriminal bait. The survey showed that a shocking 75% of the security awareness professionals surveyed spend less than half of their time on the job actually promoting security awareness.
Just like anything else about the atmosphere of your business; security culture requires effort and buy-in from the leadership team to really be seen as a priority for everyone. Employees aren’t going to take security policies or best practices seriously if they know that the boss doesn’t either. In the recently released SANS report Managing Human Cyber Risk 2021, strategic alignment is cited as one of the three biggest blockers to managing risk, with less than half of security professionals surveyed saying that they felt that they had the support that they needed from leadership to grow a strong security culture, and about 10% saying that they had no support at all.
You’d think money would be a notable hazard, but it’s time that was cited as a major stumbling block. Specifically, the time spent on promoting security awareness by the people in charge of doing that. While some companies are willing to buy solutions that can protect them from things like phishing, they’re not willing to really lay out the time or money necessary to make employees better at avoiding social engineering and other cybercriminal bait. The survey showed that a shocking 75% of the security awareness professionals surveyed spend less than half of their time on the job actually promoting security awareness. In an era of ever-growing risk and rapidly evolving threats that is not a good sign for many businesses.
The final piece of this terrible trio is the manner in which companies undertake security awareness training. Specifically, the fact that most companies sub training duties out to members of their IT staff. While those folks may be skilled cybersecurity hands, they are often not the people with the best “soft skills” to really impress upon their coworkers the real danger of phishing or the importance of taking security policies seriously. The SANS survey cites a lack of ability to distill complex technical jargon into understandable lessons for non-tech coworkers as a major flaw of handling training this way. Executives also have trouble believing that bringing in a training solution that includes automation will be less expensive than just having staffers handle it, no matter how much more effective it might be.
How You Can Help
Close Training Gaps
More than 60% of businesses don’t do enough cybersecurity awareness training. Eliminate the time crunch for trainers by offering a better, easier to use security awareness training solution that’s totally affordable. Rather than relying on an ad-hoc educational system run by tech personnel when they have time (which is generally never), BullPhish ID offers an affordable training solution that can be automated to make training painless. (ask us how we can implement this solution in your business environment.)
- Using plug-and-play phishing simulations, any business can run smooth, regular training nearly effortlessly. Plus, BullPhish ID goes way beyond just training employees about phishing.
- They’ll also learn the basics of compliance, how to spot threats like ransomware, good password handling practices and other cybersecurity essentials.
- All of this training can be delivered through a personalized portal that serves up memorable lessons using video that don’t include “geek speak”.
- Performance and improvement can be easily measured and demonstrated in simple, clear reports.
Start With Small Changes That Make a Big Impact
We can guide you in helping to determine exactly how to go about building a strong security culture into an area of security awareness that will give you plenty of bang for their buck: password safety. Over 40% of respondents in a 2020 study said that their organization had been compromised because of a bad, stolen or cracked password. Fortunately, that’s something that we can help you. fix with REACH OUT TO LEARN MORE.
Keep an Eye on People Who Aren’t Getting with the Program
We encouraging you to foster an atmosphere that encourages honesty about security blunders. A third of employees in an IBM survey say they don’t report incidents for fear of getting in trouble, losing their jobs, being ridiculed or being forced to take security awareness training (which should never be used as a punishment). The unfortunate consequence of fear is that employees also won’t feel compelled or supported to turn in other employees that they see engaging in potentially malicious behavior like selling their password on the dark web. That’s where Dark Web ID comes in.
- The thriving cybercrime-as-a-service economy is tempting far too many employees to sell credentials and access, a quick way to turn a profit.
- We encourage you to keep an eye out for company credentials that pop up in dark web markets no matter how they get there using a 24/7/365 monitoring dynamo like Dark Web ID.
If you’re ready to get started on building a stronger security culture with support from IntegraMSP, we’re ready to help. Contact one of our security solutions experts today and let’s get started.
Dark Web ID’s Top Threats This Week
AC Wireless
Exploit: Ransomware
SAC Wireless: Mobile Network Services
Risk to Business: 1.486 = Extreme
AC Wireless, a US-based Nokia subsidiary, has disclosed a data breach following a ransomware attack attributed to the Conti ransomware gang. The company disclosed that personal information belonging to current and former employees (and their health plans’ dependents or beneficiaries) was also stolen during the ransomware attack. Conti ransomware gang revealed on their leak site that they stole over 250 GB of data. The investigation and remediation is ongoing.
Individual Risk : 1.311 = Extreme
SAC Wireless has announced that they believe that the stolen files contain the following categories of personal info about current and former employees: name, date of birth, contact information (such as home address, email, and phone), government ID numbers (such as driver’s license, passport, or military ID), social security number, citizenship status, work information (such as title, salary, and evaluations), medical history, health insurance policy information, license plate numbers, digital signatures, certificates of marriage or birth, tax return information, and dependent/beneficiary names.
Customers Impacted: Unknown
How It Could Affect Your Business: Ransomware gangs are increasingly targeting the partners of major companies to find security flaws that enable them to gain valuable access or information that can then be translated into action against the major target.
IntegraMSP to the Rescue: What happens when you pay a ransom? Nothing good. See how the cash shakes down and how gangs make their money in Ransomware Exposed!. DOWNLOAD IT>>
Boston Public Library (BPL)
Exploit: Ransomware
Boston Public Library (BPL): Library System
Risk to Business: 2.336 = Severe
The Boston Public Library (BPL) has disclosed that its network was hit by a cyberattack leading to a system-wide technical outage. BPL serves almost 4 million visitors per year through its central library and twenty-five neighborhood branches, as well as millions more online. The library experienced a significant system outage and as well as disruption of its online library services. Branch It has been restored and online services are slowly being recovered.
Individual Impact: There has not yet been an announcement that employee, customer or consumer personal or financial information was compromised in this incident but the investigation is ongoing
Customers Impacted: 4 million
How It Could Affect Your Business Government and government-adjacent municipal targets have been especially under the gun recently as cybercriminals seek easy routes to gaining big scores of personal data from targets with historically poor security.
IntegraMSP to the Rescue: Developing safe security practices is essential in today’s volatile threat atmosphere. Our Security Awareness Champion’s Guide helps explain complex risks in a fun way! DOWNLOAD IT>>
Envision Credit Union
Exploit: Ransomware
Envision Credit Union: Bank
Risk to Business: 1.673=Severe
The LockBit 2.0 ransomware group has threatened to publish stolen data of its newest target, Envision Credit Union in Florida, on August 30. Envision Credit Union disclosed to the media that recently began “experiencing technical difficulties on certain systems” after the LockBit announcement went up on the gang’s leak site. An investigation is ongoing and the bank has not yet disclosed exactly what (if any) data was stolen.
Individual Impact: There has not yet been an announcement that employee, customer, or consumer personal or financial information was compromised in this incident but the investigation is ongoing
Customers Impacted: Unknown
How It Could Affect Your Business Financial services and fintec organizations have been a prime target for hackers recently, and regulators have not been shy about raising the alarm.
IntegraMSP to the Rescue:Building a zero-trust framework is a popular and successful planning choice for a reason. Learn more about how it helps mitigate risks like stolen PII. SEE NOW>>
Atlanta Allergy & Asthma
Exploit: Hacking
Liquid: Cryptocurrency Exchange
Risk to Business: 1.917 = Severe
Atlanta Allergy & Asthma (AAA), the largest allergy treatment healthcare business in the region, is notifying 9,800 patients that they experienced a data breach that involved protected health information. Bloggers spotted the data on the dark web, where it had been posted by the Nefilim ransomware group, also known as Nempty. The gang nabbed 2.5 GB of data consisting of 597 files with PHI.
Individual Risk: 1.835 = Severe
The data seen by researchers includes what appears to be thousands of records for patients. The files are not just current or recent billing-related files but also included spreadsheets organized by type of health insurance, records on outstanding claims from 2017 and 2018 and more than 100 audits including a multi-page detailed review of a patient’s case.
Customers Impacted: 9,800
How It Could Affect Your Business Medical data is a big revenue driver for cybercriminals but it is an even bigger revenue disaster for the medical practices that lose it to cybercrime.
IntegraMSP to the Rescue: Organizations are safer when everyone is on the cybersecurity team. Let us show you how to expand your menu into security awareness training in just 15 minutes! WATCH NOW>>
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
Risk scores for The Week in Breach are calculated using a formula that considers a wide range of factors related to the assessed breach.