How to build a culture of cybersecurity | MIT Sloan

cybersecurityorganizational-culturemanagementsecurity

Abstraction: Building organizational cybersecurity culture beyond technology investment

Key points:

Human factor involved in over 85% of data breaches (2021 Verizon DBIR); average breach cost hit $4.24M in 2021, highest in 17 years
Mature cybersecurity culture operates at three levels: leadership (executives visibly champion it), group (watercooler and team discussions include security), and individual (employees know what to do in an incident)
Four steps to drive culture change: appoint a non-technical "culture owner," use language that resonates with employees (one insurer replaced "cybersecurity" with "protect our data and systems"), formally evaluate cybersecure behavior with rewards/consequences, and run tabletop fire-drill exercises
Immature organizations delegate cybersecurity solely to the CIO/CISO; this leaves the "back door" of human behavior unaddressed
Research by CAMS (Cybersecurity at MIT Sloan) led by Keri Pearlson

Connections: Mit Sloan · Cybersecurity Culture · Organizational Behavior · Information Security