When it comes to remote working, who’s responsible for security? According to research from Capita, approximately 90 per cent of employees believe it’s their employer’s responsibility to ensure IT security when working remotely. While organizations must ensure they are implementing proper security controls for their users, employees must also be accountable for their actions and how they contribute to an organization’s security. A combination of security tools and user awareness is necessary for organizations to increase their security posture. With an organization’s workforce so spread out, employees need to be more engaged with security. Implementing a people-centric security strategy will empower employees and make them feel more involved. 

Source: ZDNet

Why Make Your Security Strategy People-Centric?

An effective security strategy has clearly defined policies and procedures and outlines roles and responsibilities for members of an organization. A people centric approach acknowledges the role employees play in an organization’s overall security posture and creates a culture of cybersecurity designed to change employee behaviour and encourage employees to think with a security mindset.

3 Ways to Adopt a People-Centric Security Strategy  

1. Asses User Risk

Start by establishing a baseline of user risk. This can be done by testing employees with simulated phishing tests. Simulated phishing tests enable users to experience real life phishing attacks in a safe environment. It records users who click on phishing links and sends them to remedial training to strengthen their responses. Simulated phishing tests give organizations an idea of how many users are susceptible to these kinds of attacks and can help them determine their vulnerability level so they can implement better security controls moving forward. 

Exposing users to phishing attacks reminds them to inspect their emails more carefully and teaches them how to spot these kinds of attacks. Simulated phishing tests should be done more than once so that organizations can track user progress over time. With phishing being the most common type of cyber attack, it’s important that users strengthen user reactions to these kinds of attacks. 

2. Hold Users Accountable

Employees must be willing to be accountable and take personal responsibility for their actions. To encourage accountability, organizations should implement an end user security policy that employees must read and sign-off on.

Your end user security policy should review security best practices you expect every employee to follow. Such actions can include locking screens, using strong passwords and implementing multi factor authentication. You should explicitly outline consequences of misuse and hold users responsible if they violate the policy. Ensure your policy is simple and easy to read so that employees understand your security policy.

3. Provide Access to Resources

Motivate and engage users to take responsibility for security by providing them access to high quality resources like security awareness training. Online security awareness training is a great way for users to learn about various cybersecurity topics at their own pace. New methods of online training like gamification and online quizzes make training more fun for users and helps them be more attentive in retaining information.  

Access to other online resources like infographics, cyber tips or news articles gives employees tools they can use to refer to and refresh their memory. If users understand how cyber threats like phishing and social engineering affect their lives both at work and at home, they will feel more connected to the issue.  

Jolera’s Secure IT User Defence solution is designed to empower your employees to be the first line of defence. The solution includes simulated phishing tests, online cyber awareness training and credential monitoring. For more information on how Jolera can protect your organization, contact us today.