Magazine menu Close Magazine menu

Cybersecurity training

Latest stories

digital trust

Customers’ trust in tech is changing. What should business do?

  • min read
    • Of course, businesses need customer trust, but understanding what trust means in a digital world is becoming more important. Digital trust is users' confidence that tech, people and processes they engage with are secure and private. Recent research suggests how customers decide where to place their digital trust is changing, so some businesses are changing their approach. As Minter Dial wrote before in Secure Futures, the 2022 Edelman Trust Barometer report shows eroding trust in institutions while remarkably, our trust in business remains. Now, there's an opportunity for business to use integrity, empathy, and privacy and ethics around new tech like artificial intelligence (AI) and customer relationships management (CRM,) to lead the way. Kaspersky's new podcast, Insight Story, unpacks emerging tech trends with global specialists and businesses successfully using new tech. In Episode 4, I discuss what digital trust means and how organizations can grow it with Müge Fazlioglu (US,) Principal Researcher, International Association of Privacy Professionals (IAPP), Malek Ben Salem (US,) emerging tech security expert and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. Unpacking digital trust Digital trust covers much ground, Malek Ben Salem says. "It's about data integrity, technology, people and processes. It's our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with. It's also about how much we trust the information we get as users." Müge Fazlioglu says trust is notoriously hard to pin down. "Our trust when we may or may not share data depends on many things, like our perception of the party we're sharing with, our data's value to them and us. We also weigh the data's sensitivity – what might happen if it were revealed." Trust can make or break a purchase IAPP's March 2023 Privacy and Consumer Trust Report shows privacy concerns influence consumer purchasing decisions. Müge says, "Many people take steps to protect their privacy, like deleting an app or withholding some personal information." So paying more attention to trust could pay dividends. "Organizations gain credibility by taking steps to enhance privacy and data protection. We're now seeing some big brands featuring privacy-related messaging in their advertising and marketing of web browsers and smart home devices," recounts Müge. Trust concerns also make brands hit the headlines for the wrong reasons. Amazon's recent purchase of robot vacuum cleaner brand iRobot triggered privacy objections from consumer and civil rights groups, then an EU investigation. How companies help (and harm) trust Tech research consultancy McKinsey's 2022 Digital Trust report said while 70 percent of people trust companies to protect their privacy, most companies aren't living up to the expectation. So what should companies do? Müge says much best practice is around transparency. "Few consumers have a good grasp of how companies use their information – what they collect, and if they follow good practice. So companies need to ensure they write a simple, clear privacy policy and have an easy-to-use page for people to manage their privacy settings." Regulators also think easy-to-adjust privacy settings matter. The US Federal Trade Commission (FTC) recently fined the company that makes the game Fortnite for its hard-to-use privacy settings. Müge thinks regulators, businesses and consumers can all play a role in improving communication around privacy. "How a company communicates its data practices affects trust – the duty should not be on customers to make daily decisions based on lengthy and complicated legal agreements. Regulators have an important role in raising awareness and providing education. Some, like the FTC and European Union data protection authorities, are starting to do that." Müge also recommends being prepared for how you'll handle a data leak. "Responding slowly means more consumer loyalty lost. Have an incident response plan for the inevitable." Data leaks are common but often have a big impact on business. Kaspersky's 2022 IT Security Economics report found that among 3,230 businesses surveyed, data leaks were the most commonly encountered security issue, with 55 percent considering them the most challenging incidents. Malek points to one business leading in digital trust. "Apple stands out in how it uses privacy-preserving technology to train artificial intelligence (AI) on mobile phones. Devices keep data locally and use it to train user speech-recognition and auto-complete models. Then the models are used to update a central model that can be applied to many users. So the data is not shared or uploaded, but still used to improve the AI." Using cybersecurity to build trust 29 percent of businesses with 500 to 999 employees have experienced a cybersecurity incident, according to Kaspersky's 2022 Small-to-Medium Business Cyber Resilience report.  As your business scales into a larger enterprise, so does the likelihood of a cyberattack or data leak. Malek thinks investing in cybersecurity is vital to protect customer trust. "To build secure infrastructure and allow for secure transactions, you need a cybersecurity strategy and proper governance, and you must hire the right talent. More importantly, be transparent." Or, as Müge says, "Shine a bright light on what you're doing." New technologies are evolving cybersecurity's contribution to digital trust. Malek sees many applications of AI in security tech: "It helps identify who is accessing a system by profiling user behavior. It can detect and respond to security incidents. It can classify unstructured data like business documents, so we don't need people to read them to know what's sensitive or confidential." A relatively new approach to security, zero trust, is influencing what we'll see next. "People will own their full identity and use pieces as needed. For instance, if I want to buy something that requires proof of age, I can share just my age without information the seller doesn't need, like full birth date. Zero-trust principles mean allowing access only to the information needed." But Kaspersky's Fabio Assolini says businesses may not be able to adopt these good practices overnight. "Many networks need adapting for zero-trust principles. It's a challenge for administrators, but it's important they understand how it works and prepare corporate networks for it." He also highlights the value of transparency, not just between businesses and customers, but between businesses and suppliers. "You must be able to trust your cybersecurity providers, especially as we're seeing many targeted attacks that abuse cybersecurity software or infrastructure. Security vendors could be more transparent about their technologies. At Kaspersky, we let customers review our code at transparency centers. We'd like to see other companies doing that." He adds, "Training is also important. Sometimes cybercriminals send a phishing attack to just one employee, so it matters that each employee is trained in identifying attack attempts." Asked for one key recommendation for business in building digital trust, Malek says, consider cybersecurity part of your environmental, social and governance (ESG) framework because "it elevates the discussion." Müge says, "Keep in mind all the smart technology you use. It uses many different kinds of information. Use the privacy features and regularly monitor data sharing." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
behind screen heathrow airport

Why cybersecurity education is taking off at Heathrow Airport

  • min read
    • You might not think of cybersecurity first when it comes to airport safety, but Jasvinder Pham, Head of Cyber Development and Assurance and Matthew Bourne, Cyber Security Manager, believes it's at the heart of London Heathrow's safety practice. And education is their most important protective gear against cybercriminals that use psychological tricks, also known as social engineering, on their staff. In Tomorrow Unlocked's video Next Departure: Fighting Cybercrime, Pham and Bourne outline how they're helping Heathrow staff see through cybercriminals' mind games. What is social engineering? And Pham says it's a common tactic. "Nine out of ten breaches are done through social engineering. At Heathrow, we tend to get scattergun emails across the whole estate. We call that phishing. They'll ask a user to enter login and password details or click a link." Learning to recognize the mind tricks Where phishing emails are a scattergun approach, the Heathrow cybersecurity team responds with carefully targeted cybersecurity education. They use internal advertising to raise staff awareness of social engineering techniques, then send out their own phishing-style test emails to see who takes the bait. It's part of a wider cybersecurity education program based on identifying those who can benefit most from the learning. Bourne says, "We've turned training courses on their head by asking the questions first. If you answer them all correctly, you don't need the training. If you don't, you can sometimes complete training in less than 10 minutes." Bourne believes cybersecurity training should resemble real-world cyberthreat situations. "We've started using live actors to get a bigger impact and bring it to the context of the airport." Customers are ready for better security Pham says Heathrow wants to be on the cutting edge of security technology, but it's not always easy. "We want to stay one step ahead, but I feel like we're one step behind." But Pham believes one thing on their side is staff and customer readiness to embrace the latest security features. "People use services like WhatsApp and multi-factor authentication in their home. They want more, so we need to make sure we don't miss out."
financial times report cybersecurity skills

Why successful companies invest in cybersecurity skills

  • min read
    • Arming your cybersecurity team with the right skills and experience is a crucial first step in facing down threats. In partnership with Longitude, a Financial Times company, Kaspersky surveyed 750 leaders at enterprises around the world about their approach to cybersecurity. The research found a small group of companies strongly believe their cybersecurity training programs can keep pace with the ever-changing threat landscape. Dubbed the Skills Leaders, these businesses have better security outcomes. About three-quarters (74 percent) say they're prepared for employees accidentally creating a cybersecurity threat – such as falling for a phishing scheme – compared with only half (49 percent) of the rest. This is good news, because cybersecurity skills are in short supply. In 2021, Microsoft announced the US is facing a cybersecurity skills crisis, citing that more than one in 20 of all open jobs in the country require cybersecurity skills. In the same year, research by Information Systems Security Association (ISSA) and industry analyst firm Enterprise Strategy Group (ESG) found 95 percent of cybersecurity employees globally believe the skills gap has not improved in recent years. Our research found one-third (34 percent) believe this shortage will get worse in the next two years. But the Skills Leaders are a small group — just eight percent of the research sample. How can more organizations follow their lead? Three ways to upskill your workforce in cybersecurity 1. Train everyone, not just IT It's not just the cybersecurity team that should be on constant alert for threats. Employee-wide updates and reminders help make security part of company culture. "People need to keep their software up to date, understand how to encrypt their internet traffic and not use public Wi-Fi," says Shawnee Delaney, CEO of US-based insider threat specialist Vaillance Group. "These are general cyber hygiene practices, and they're critical. Reducing human error is crucial. Technology researchers Gartner predicts that by the end of 2025, more than 99 percent of cloud breaches will arise from preventable user misconfigurations or mistakes. One way to reduce these errors is to introduce cybersecurity 'tests' to see how employees respond to threats and increase training for those who fail them. This is what Ricardo Lafosse, Chief Information Security Officer (CISO) at Kraft Heinz, does. "It's probably one of our best ways to see whether a malicious actor could mislead our employees and get into our organization using phishing techniques," he says. 2. Update your coaching techniques Training must also move with the times to keep up with the evolving threat landscape. The Skills Leaders identified in the research seem to understand this. They're more likely to be forward-thinking with their training. About two-thirds (67 percent) say it will be very important to carry out immersive cybersecurity training (gamification and simulations to recreate real attacks) in the next two years, compared with less than half (49 percent) of the rest. "Cybersecurity training is often perceived as a formality, but one-off training is not enough," says Evgeniya Naumova, Executive Vice President of Corporate Business at Kaspersky. "Behavioral change won't appear with the wave of a magic wand. It takes commitment and practice for acquired skills to become habit. Continuous learning is especially important for enterprises to prepare teams for the evolving threat landscape." Staying up to date also means being able to change strategy fast. To combat new threats as effectively as possible, Kraft Heinz's Lafosse prioritizes agility and flexibility in his cybersecurity team. 3. Put cybersecurity at the heart of recruitment Upskilling in cybersecurity will inevitably involve addressing the skills gap. And that could force companies to take an innovative approach to recruitment, like hiring candidates with non-IT backgrounds. The research found the Skills Leaders are more likely to embed cybersecurity awareness in their recruitment and onboarding processes, stressing the need for high cybersecurity standards from the start. Enterprises with a multinational presence must ensure they approach cybersecurity consistently across their global operations. It only takes one cyber threat in one region to potentially wreak havoc across the whole organization. The skills gap is a big challenge for enterprise cybersecurity teams. To be protected against the full range of evolving threats, enterprises must do all they can to fill it. That means expanding recruitment, preparing their existing workforces by keeping them abreast of changes and training them right from the start. This content was paid for by Kaspersky and produced in partnership with the Financial Times Commercial department.
identity theft university

How one university’s stolen student IDs caused a crime wave

  • min read
    • Cybercriminals see education as an amazing opportunity. But they're not taking classes or gaining qualifications – they target universities and other educational institutions for the wealth of personal information they hold. In Tomorrow Unlocked's video The Backdoor into Campus, Royal Holloway, University of London cybersecurity experts talk about how a major identity theft incident on campus happened and how they're working to keep students and staff safe in future. How educational institutions are attacked Universities and colleges often have many people using their systems, like staff, students and visitors. They also offer many kinds of services online. Mike Johnson, Chief Information Officer at Royal Holloway, University of London, describes a recent security incident. "A staff member's credentials were stolen and used to send convincing offers of part-time work to students. Some students undertook the work and were paid. But they were overpaid, then asked to return some of the money. It was money laundering on a significant scale." Why cybercriminals love stealing identities "Commonly, we find those who try to attack us are looking to harvest identities," says Johnson. "When they've got them, they'll try to harvest more until they're sure they can attack us in the way they want to." Education can stop attacks on education It's all about authentication, says Keith Martin, Professor of Information Security at Royal Holloway, University of London: Knowing the person trying to access something online is the person they say they are. "Imagine a front door. Whoever has the key can open it. To breach that, you need to get hold of the key. Entering a country is more high security: Border control looks at credentials like a passport and the person submitting it." Professor Martin continues, "In cyberspace, it's a bigger problem because we can't see who's asking for access. The most popular authentication is a password, but passwords are like keys – easily copied or stolen. So we need to use the passport model – asking for multiple things to gain access." That's called multi-factor authentication. You'd need more than a password to gain access, such as a code sent by SMS or biometrics, like a fingerprint. Senior security researcher at Kaspersky, Noushin Shabab, says for the best security, multi-factor authentication should combine biometrics like facial recognition with another credential. Developing 'cyber common sense' in education Professor Martin says the most important thing anyone can do to keep their identity safe is to develop 'cyber common sense.' "Hesitate before doing anything in cyberspace – if you're sent a link or a message asking for information, ask, why do they want this?" Johnson feels education institutes are perfect places to learn cybersecurity awareness. "We've got to be willing to have a conversation with students about digital security and what protecting their identities means. We're educators – we're well placed to help people operate in an environment they'll operate in for a long time."
women who shaped computing

We should all know about these women who shaped cybersecurity

  • min read
    • The UK's National Health Service (NHS) asks, "Is cyber a man's world?" It's a provocative statement to promote cybersecurity careers to women, but why should we be asking this question today? Surely cyber and computing careers are for everyone. So why are many women tuning out? Today's working wisdom is that diversity benefits teams, but there's slow progress in getting more women to join technology-led careers and keeping them on board. Human computers: The first data scientists The word 'computer,' coined in 1613, was first used for humans who performed computation. Many of the best were women: Nicole-Reine Etable de la Brière Lepaute helped predict Halley's Comet's return in 1758. A century later, Maria Mitchell plotted the planet Venus's motion, earning an astronomy professorship. When the US Civil War ended in 1865, war widows needed to support themselves. Women were hired as human computers. Agnes Meyer Driscoll, known as 'Madame X,' led the decoding of Japanese ciphers and manuals for the US during both world wars. Women solved the ultimate Enigma Britain's Alan Turing is famed for cracking the Nazi's 'Enigma' code during World War II, but it wasn't the work of a lone genius. Of Bletchley Park's codebreaking team, 75 percent were women. Turing's colleague Joan Clarke worked out how to speed up decoding double-encrypted messages, but unlike many of her male colleagues, her technique wasn't named after her. Clarke's job title didn't match her expertise – there was no 'senior female cryptanalyst' role, so she was given the job title 'linguist.' Painstaking calculation devalued as 'kilo-girls' The dominance of women as human computers cloaked an inconvenient truth. Their work was on average better, and they were cheaper than male counterparts. The Harvard Computers, mockingly called "Pickering's harem," supported Edward Pickering at Harvard Observatory in the 1880s, doing work men and scholars found tedious, unpaid or at a fraction of what men earned. The term 'kilo-girl' came about in the 1940s to describe complex calculations seen as 'women's work.' We measure computing power in gigabytes or terabytes, but they measured kilo-girl hours – one kilo-girl was a thousand hours of painstaking calculations. The kilo-girls work was far from trivial: In the 1950s, Gladys West's calculations for the US Naval Weapons Laboratory led to GPS's development. Computing becomes a man's world By the 1960s, human computing had given way to machines. In the 1940s programmers were mostly women, but by the end of the 1960s women made up 30 to 50 percent. Women were still paid less and few were promoted to leadership. The perception computing is for men and boys started at home. A 1984 report showed 1 in 5 girls used a computer at home, compared with 1 in 2 boys. Female computer science graduates peaked in 1984 at 37 percent, before steadily declining. Academic Wendy Hall says by the 1990s, men led professional computing and computers "were sold as toys for boys." Ten women from computer history to know Ada Lovelace invents the first algorithm Publishing the first algorithm in 1843, Ada Lovelace is said to be the world's first computer programmer. She realized Charles Babbage's Analytical Engine could do more than calculation: Combining mathematics and analysis. Ada Lovelace Day celebrates women's achievements in science, technology, engineering and maths (STEM) and encourages young women to follow her path. Hedy Lamarr averts the Cuban Missile Crisis 1940s Hollywood actress Hedy Lamarr co-invented a frequency-hopping method to control torpedoes remotely without the risk of signal tracking or jamming. Naval ships were using the technology by the 1962 Cuban Missile Crisis. It later became part of Bluetooth and Wi-Fi. Grace Hopper invents new ways to code Grace Hopper created the first compiler for a programming language. She programmed and wrote a comprehensive manual for an electro-mechanical computer based on Babbage and Lovelace's Analytical Engine, Harvard Mark I. She wasn't credited for this but is widely miscredited for coining the term 'bug' when a moth caused her computer to malfunction. She later developed computer programming language COBOL (common business-oriented language) and invented new symbolic ways to write code. Margaret Hamilton took us to the moon The 1969 moon landing wouldn't have happened without Margaret Hamilton, who programmed Apollo's flight software.It needed more 'human computing:' After Hamilton's programming, seamstresses hardwired the code by threading copper wire through magnetic rings. Elizabeth "Jake" Feinler organized the internet At Stanford University in 1969, Elizabeth "Jake" Feinler created the first internet directory, ARPANET, alongside mostly female staff. By the early 1970s, they'd put together the first WHOIS directory of web domain ownership. Feinler suggested categorizing domains by where the computer was, like .edu domains for educational institutions. Women who built new audiences for technology Organizing, building relationships and human factors – often thought of as female traits – are critical in computing projects' success and creating demand for new services. Joan Ball set up the first computer-aided dating service in 1964. In 1988, Stacy Horn started a community in New York, the East Coast Hang Out (ECHO,) where users could chat online. Game designer Brenda Laurel's research showed girls wanted to play more interactive character computer games. In the 1990s, her company Purple Moon developed a best-selling game series inspired by that research. In the 1970s, Joan Margaret Winters researched how software should consider human factors for IBM's SHARE project. When you see the iconic trash symbol on your Apple Mac, thank Susan Kare. She worked with Steve Jobs to design its original icons. Today's influencers for women in cybersecurity When young people see people who look like them succeed in a career, they're more likely to choose it. For women considering going into cybersecurity, there's no shortage of inspiration. Parisa Tabriz, the self-styled "Security Princess" (official title: Director of Engineering,) runs Google's security testing labs. Eva Galperin, Director of Cybersecurity at Electronic Freedom Foundation (EFF,) fights for digital privacy, security and civil liberties. Eva Galperin helps women secure their devices against stalkers and spying ex-partners. Rebecca Bace's threat intrusion detection work at the US National Security Agency contributed to famous hacker Kevin Mitnick's arrest. The cybersecurity community nicknamed her 'Den Mother' for her vital mentorship and advice and posthumously inducted her into the 2019 Cyber Security Hall of Fame. Dr. Anne-Marie Imafidon MBE creates skills training and certification to encourage young women to pursue cyber careers through her company Stemettes. Jane Frankland, security entrepreneur and author of InSecurity: Why a failure to attract and retain women in cybersecurity is making us all less safe, helps the C-Suite (senior management) attract and retain women in cybersecurity. Attracting and retaining more women in IT careers In the UK, the proportion of women in IT has stayed at 16 percent for the past decade. But in many countries, such as those in Central Asia, women make up nearly half of the IT workforce. It's the gender-equality paradox: In countries with less gender equality, educated women seek careers with more income security, while in countries with better gender equality, women avoid careers said to discriminate against women. There are green shoots of progress. Kaspersky's 2021 Women in tech report surveyed women in four global regions. Encouragingly, 57 percent say gender equality is improving in their organization. Despite this, 44 percent think male colleagues progress faster. COVID-19 has brought one step forward: 1 in 2 think remote working has improved gender equality – but 60 percent say they're now doing "most" of the housework and homeschooling. In the report, Dr. Ronda Zelezny-Green, Co-Founder and Director of Panoply Digital, says change is slow because "too much activity around gender equality in IT focuses on one-off gimmicks and band-aid solutions that can be spotlighted in the press, instead of focusing on female employees and actions that will make a sustained difference in their professional lives." Dr. Zelezny-Green thinks we should entice more women into the industry by creating new products and services for women. Widely-reported diversity problems with Artificial intelligence (AI) could be seen as an opportunity: "There's huge potential in telling the stories of Timnit Gebreu and Joy Buolamwini, black women leading the charge for more ethical and inclusive AI design. These stories make inroads in IT and tech roles where women are currently underrepresented." In a prosperous future, we won't need to ask, "Is cyber a man's world?" or "Where are the women in cyber?" They're not hiding under the desk. They're making change, but in another industry. We're on the right path, but it's a long journey ahead. With more women, we can better create products that represent users and benefit from a gender-equal computing industry.
cybersecurity champions

Cybersecurity champions could be your secret weapon in raising employee cyber-awareness

  • min read
    • Now that organizations rate cyberattack as their biggest risk, cybersecurity needs to be everyone's business – not just the IT department's problem. A cyber-secure work culture will make businesses more resilient to threats. Employee behavior is one of the biggest factors behind cybersecurity incidents. Change how your employees understand cybersecurity with a cyber-aware work culture, and you'll substantially reduce the risk of compromise. One way of raising cybersecurity awareness at work is through a cybersecurity champions program. Technology researchers Gartner found although fewer than 10 percent of organizations had one in 2017, they forecast 35 percent would have a cybersecurity champions program by 2021. Why cybersecurity champions change business culture Lena Smart, Chief Information Security Officer (CISO) for MongoDB, calls cybersecurity champions the "cheerleaders and supporters of security" across an organization. MongoDB is a database platform to build web and mobile applications. It powers everything from popular online game Fortnite to dating site eHarmony's real-time communication system. The company is headquartered in the US and has 2,000 employees globally. "We need to assure customers we're keeping our applications secure and we want to show our internal customers they're working in a secure environment," says Smart. MongoDB's cybersecurity champions program was one of Smart's first initiatives when she joined the company last year. A 20-year industry veteran, she implemented two similar programs in previous CISO roles at international electronic trading platform Tradeweb and another at New York Power Authority. Smart says security experts inside an organization may have a limited perspective because they're looking through a tight lens. Weaving security through software development Security champions schemes are adopted most in software development, particularly with the trend toward DevOps. DevOps means combining software development and IT operations teams and processes to speed up development. As the need grew to scale DevOps projects faster while minimizing software vulnerabilities, organizations looked for ways to embed security into the development process. They called the approach DevSecOps. "Security champions programs aim to build a better security culture and get DevOps to create secure software more reliably," says Dan Cornell, Chief Technology Officer (CTO) with US application security company Denim Group. Cornell is a big proponent of cybersecurity champions and has helped many organizations launch programs. He says their aims vary depending on the industry, regulatory environment and company culture. For DevOps, he says, champions make security knowledge more accessible to the development team. Having run successful security champions programs outside of software development, Smart says the rules are transferable. "There's no difference in how you set it up from one company to the next." The champions are colleagues from different roles, teams and departments. Smart particularly wants participants who don't have "security" in their job title or responsibility. "The champions want to learn and understand security and how they can help the company to be more secure," she says. At MongoDB, the program is voluntary and relatively informal. Champions are encouraged to attend monthly meetings with ideas for training and other things they want to do. Building cybersecurity culture from the bottom up Organizations often approach cybersecurity culture from the top down, starting at the C-Suite (executive-level managers.) University College London (UCL) surveyed more than 800 employees in one organization and found attitudes toward security varied greatly between the company's divisions. They recommended a bottom-up approach to help get buy-in from people at all levels. The study's co-author and lecturer at UCL's Department of Security and Crime Science Ingolf Becker thinks a security champions program works because it's a two-way street. "It promotes security at all levels, but it's also an opportunity for management to get feedback about what's happening on the ground." Smart says sometimes the best ideas for improving security comes from people who "don't live under the scrutiny of the CISO every day. It gives you, as the CISO, a view you wouldn't otherwise have." Champions making cybersecurity communication clearer Smart measures the success of a champions program by how much feedback she gets on initiatives and efforts. For example, a new data-retention policy for a communication app the company was using: "Data-retention policies can be disruptive. We wanted to make sure we were asking the right questions and giving the right information to those affected," she explains. She put the champions to work. They met as a group and reviewed the draft memo. The champions took it apart, discussing what could be improved, what needed more information, and so on. That input, she says, saved her security team a lot of angst. "We finessed what was going to be a disruptive piece of communication," she says. She knew it worked because emails came in thanking them for the clarity of the message. People appreciated the efforts put in by those outside the CISO's core team. How to implement a cybersecurity champion program Becker says security champions must not be security people. "They're employees who are 'one of us,'" he says. "I think most organizations could benefit from having this local expertise about what security means to an organization." He says at organizations he's worked with, the program was often organic – started by people or teams who took it upon themselves to promote security. In those instances, formalizing the program helps to provide training and resources to develop it. To start a program, Smart recommends CISOs get executive support. At MongoDB, she started by pitching the idea to her manager, the company's CTO. "He loved the idea," she says. "Support from the top is fundamental, or it won't be a success." You must also work out what kind of commitment participants need, based on how often the champions meet and other tasks they do. The next phase is to promote the program and recruit volunteers – an online survey is a good way. After pitching her idea to the CTO, Smart enrolled the company's communication experts to raise awareness, including the benefits of the program to the organization. When employees stepped forward, their supervisors had to sign off. Smart had conversations with the managers who were uncertain and explained how volunteering could fit around the employee's day-to-day role. "Because it's voluntary, some months you may have five people in the room and some months 20," Smart says. "Don't be disheartened if the numbers go down. They'll come up again." To grow the program, look for ways to promote the champions' work and impact. MongoDB includes "day in the life" stories about the champions in the company's security newsletter. Championing security helps develop careers Gartner says cybersecurity champions programs are a zero- or low-cost way to accelerate your security message. Some organizations may offer incentives, and in DevOps scenarios, being a champion may become a full-time role. At MongoDB, the champions aren't there for perks, but there are benefits. They learn things and serve as leaders to their peers. Smart, too, found an unexpected benefit: Two of the champions later joined her team. "They're now a bridge between the old and new ways of security," she says. Becker believes just about any organization could implement a cybersecurity champions program. But there's one caveat. "You must be willing to listen and change based on the input of champions," he says. Smart notes the champions share a common goal. "We're all trying to solve the same problem: Keeping the data safe and the bad actors out," she says. The program lets her talk to people she rarely speaks to about ways to improve security. "It's a linking of the groups and a linking of the minds," she says. If you want to improve your security culture – and are willing to listen to employees with diverse perspectives – a security champions program is a great way to bring about long-lasting change. This article was published in May, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries