Adopting a Culture of Cybersecurity, A Necessary Step

Cybersecurity is critical to the success of any organization and can mean the difference between a secure organization that protects data or one that unwittingly leaves a door open for malicious actors.

Basic protections such as multi factor authentication (MFA), end-point and network protections and ongoing awareness training are even more effective when practiced within an organizational culture that actively cultivates a culture of cybersecurity. 

What do we mean by a culture of cybersecurity?

First, organizations need to make cybersecurity a priority. This means ensuring that all employees are aware of the risks of cybersecurity attacks and how to protect themselves and the organization. The importance of regular, ongoing cybersecurity training can not be understated. Employees are the first line of attack, and that means everyone from the CEO to interns and volunteers. All staff must receive ongoing cybersecurity training.

One way to ensure that employees are staying on top of their cybersecurity game is through annual training. This training should cover the basics and update employees on the latest threats and how to address them. Cybersecurity threats are ever-evolving, and cybersecurity training must evolve to meet these changes. Additionally, organizations should regularly test employees’ cybersecurity knowledge. These tests mimic real-world cybersecurity threats and help employees learn how to spot and avoid them. Cybersecurity threats are ever-evolving, so cybersecurity training must evolve to meet these changes.

When in doubt, verify!

An often overlooked, but essential aspect of building a culture of cybersecurity is reinforcing the practice of verification. If an email doesn't look quite right, or a request for an account number or purchase arrives, or an expected message notification — verify first. Ensure that staff know that it is not just ok to verify, it is encouraged.

For example, calling a coworker to ask, "Did you really send me that?" is preferred, even if that question takes time and would be an interruption. Too often people are reluctant to intrude or ask questions and a cybersecurity culture relies on people being willing to take the time to ask those questions. Cultivate a culture where it is safe for staff to take those few minutes to double-check. Create an environment where a staff member feels safe enough to inform IT or their manager if the think they may have clicked on a malicious link or downloaded a bad file.  It's better for the organization when these questions are out in the open and mistakes are caught as soon as possible. It's important to remember that when it comes to cybersecurity, we are always learning. 

The importance of data security in the nonprofit sector cannot be understated. By taking a layered approach to data security and implementing not just cybersecurity tools, but also training and a culture where verifying requests is encouraged, nonprofit organizations can ensure that their data and systems are secure.

If you want to learn more about cybersecurity, join us for RoundTable’s 7th annual Best Free One-Hour Cybersecurity Training Ever on January 26th at 2pm ET.