Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Building a Cybersecurity Culture: What's Love Got to Do With It?
Newest First  |  Oldest First  |  Threaded View
nealof
nealof,
User Rank: Author
11/21/2019 | 12:00:13 PM
You forgot about data ethics
Data ethics is growing rapidly as part of security culture because it trains and empowres employees to see and handle sensitive data in a different way. Risks can be significantly reduced when there's a culture of personal care and responsibility for data, and not just a broad awareness of risks.

And it can work very well as a risk management tool because being ethical is second nature to most humans.

This is where AI is already influencing security culture, and in a very surprising way.
tomcartermba
tomcartermba,
User Rank: Apprentice
11/20/2019 | 10:35:37 AM
Re: Language is Key
Great Article Joan. I recently left Gartner to join a start up who is empowering organziations to create a positive security culture. The team at Elevate Security has finally found a way to measure employee behavoir and celebrate the people who adopt a stronger security mindset. Along the way we found ways to make it fun and work towards Cyberlandia as Jon Check referenced! 

We are giving $100 to a charity of your readers choice for anyone who gives us the opportunity to provide a demo of our new approach. Not a super sales focused experience, more of peers talking about what works and how to messure it. 

 

Cheers,

Tom Carter

Elevate Security

[email protected]
J@wn007
[email protected],
User Rank: Strategist
10/29/2019 | 4:53:07 PM
Language is Key
Even guidance documentation needs to be presented with a less perjorative term than "must". Being told to do something in this way creates a natural unconcious resistance. Depending on the reader, this resistance can filter out what may be critical instructions, and increase the probability of a mistake. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Creating an Effective Incident Response Plan
Security teams are realizing their organizations will experience a cyber incident at some point. An effective incident response plan that takes into account their specific requirements and has been tested is critical. This issue of Tech Insights also includes: -a look at the newly signed cyber-incident law, -how organizations can apply behavioral psychology to incident response, -and an overview of the Open Cybersecurity Schema Framework.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-34654
PUBLISHED: 2022-11-28
Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.
CVE-2022-38140
PUBLISHED: 2022-11-28
Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.
CVE-2022-4104
PUBLISHED: 2022-11-28
A loop with an unreachable exit condition can be triggered by passing a crafted JPEG file to the Lepton image compression tool, resulting in a denial-of-service.
CVE-2022-4169
PUBLISHED: 2022-11-28
The Theme and plugin translation for Polylang is vulnerable to authorization bypass in versions up to, and including, 3.2.16 due to missing capability checks in the process_polylang_theme_translation_wp_loaded() function. This makes it possible for unauthenticated attackers to update plugin and them...
CVE-2022-41732
PUBLISHED: 2022-11-28
IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 237407.