🔒How to: Build a culture of cyber-defenders

In today's world, cybersecurity is a hot-button issue that effects organizations large and small. A cyberattack can be extremely damaging, and companies have to deal with bad PR and mistrust of customers, compromise of sensitive company or personal information, monetary theft and potentially weeks of downtime and remediation.

Any employee can be the target of a cyberattack that can affect an entire organization. While IT will be a critical resource and may even champion cybersecurity for your business, it isn't practical to rely on one person or department to manage your cybersecurity program. Each department, from finance to HR to IT, comes with its own set of threats and challenges.

The key to tackling these challenges and threats is to build an educated, informed cyber-smart team that has the background, training and tools they need to be effective cyber-defenders.

1. Create the culture

Make cybersecurity a company priority, and make sure everyone in your organization knows from Day One that it is a concern. Introduce your organization's cybersecurity policy to new employees — from the executive team to the intern — discuss it and practice it every day. Show each employee how important their participation is by explaining the specific threats they may face in their role, and by giving them clear and actionable steps they can take to do their part. By making cybersecurity a consistent part of everyone's job, and even part of your job descriptions, you'll be in a much better position to protect against the growing number of cybersecurity threats that could compromise your business.

2. Educate continuously

Providing one-time employee awareness training is a great start, but it really only gets the conversation started. In order to instill good cyber-hygiene in your entire team and keep the topic fresh, it is vital to educate employees regularly with a variety of content. Ongoing training sessions in video format give a regular reminder and teach employees something new each time. Make the training engaging. By tailoring the training to tackle specific threats within each department you will empower your employees to participate in identifying and stopping cyberthreats before they are an issue. You can also consider offering prizes or recognition to employees who engage with training sessions.

Outside of official and scheduled training sessions, you can employ a variety of mediums to enforce the concepts:

• Create eye-catching cybersecurity posters that can hang in your offices.

• Send out quick tips or cybersecurity anecdotes to get everyone thinking.

• Keep employees updated on the latest threats and how spot them.

Each person learns differently, and using a variety of training mediums can help with engagement and information retention.

3. Test and refresh

To ensure that the cybersecurity technology and education that is in place is working, you'll need to test and monitor employee awareness. Send simulated phishing emails to determine whether employees are clicking bad links or opening files they shouldn't. For employees who are fooled by the phishing test, offer training. Once you have the lay of the land you can ensure employees are improving their response and decide if additional training or technology is necessary. It's a win for employees and the company as cybersecurity posture continuously improves over time.

Promoting, educating and living cybersecurity brings your team from a potential liability to an army of cyber-defenders. An educated team is a strong team, one that can protect your business each and every day. In the end, developing the right mindset and culture can make all the difference in the world when it comes to cybersecurity.

Andrew Rinaldi is the co-founder (with Rob Simopoulos) of Portland-based Defendify, an all-in-one cybersecurity platform for small business. He can be reached at  arinaldi@defendify.io