Exclusive: Achieving a modern security approach within a corporate culture

Understanding and dealing with the path security is heading towards can mean it is difficult to install a modern approach within a corporate culture.

Most people acknowledge that security is impactful and necessary, but it is also important to ensure that modern security practices are fully embedded into the corporate culture.

Security awareness in any company is not something that can be embedded into the corporate culture instantly, it takes time and continuous nurturing from subject matter experts to train employees on the positives and importance of security awareness in the business.

Investment in the security culture is extremely important and this can be achieved by offering online security awareness training modules, round table discussions, inviting security talks from external Subject Matter Experts (SME), liaising with the local law enforcement to highlight all areas of security not only from a business perspective, but from a community perspective as well.

New standards, rules and regulations are being published globally each year, so new security standards and guidelines must be kept up to date and these help to offer new solutions. Improving and adding new security standards are important to provide relevant methodologies for safeguarding and adding quality assurance for the company.

External reviews and audits are invaluable and can offer recommendations by conducting assessments of current security risk mitigation designs and search for vulnerabilities, this is a great way to minimise the threat landscape of the company.

By having security controls in place that comply with accredited certifications, this will help to minimise and mitigate security risks and prove that the company has understood the threats and followed good practice within the industry. Security awareness helps to understand the low-level security matters and to be able to deliver this, the correct and depth in insight must be explained to any level of employee and should be delivered in a fun and modern approach, creativity can be added to do so.

The security culture

A maintainable security culture has several benefits. The essential need of a security culture is to recognise change and improve security, so it is adaptable to change within the business.

All employees should be onboarded with the security culture from the very beginning with an enjoyable yet important approach.

To increase engagement, employees should believe that they are security advocates and a part of something bigger than themselves, like to know that they are actively helping the business with security, for example certificates can be rewarded for participation in security awareness training or local training that may be offered from an outside source such as the Counter Terrorism Course (ACT) where certificates of completion are given to show participation.

For any organisation to create a security culture, it must be understood that the employees are the key to success.

By driving security advocacy, each employee plays a part and the results will create the positive response needed for a successful culture and improve the security posture all around.

Update the vision or goal to explain that security is non-debatable. The key is the significance of security from all levels of the business.

All employees, from leadership to the frontline, who represent security, are given the training and tools they need to be secure and are expected to practice security awareness in their day-to-day duties.

By Jonathan Gigg, Lead Physical Security Specialist at Rackspace Technology