Le preocupa el escepticismo del personal sobre la responsabilidad de la ciberseguridad. ¿Cómo puedes cambiar su mentalidad?

To shift staff mindset on cybersecurity responsibility, emphasize its personal impact. Explain that cybersecurity isn't just about protecting company data, but also safeguarding their personal information. Use real-life examples of breaches affecting individuals to make the risks tangible. Encourage them to think of cybersecurity like home security—everyone must be vigilant to protect what's important. By making cybersecurity relatable and showing how it protects them personally, you can foster a collective sense of responsibility and commitment.

I believe that effectiveness in cybersecurity requires a dimensional approach. One component is to make it meaningful to the person in question. If we speak in terms of safeguarding, personal responsibility and accountability then we are directly influencing the meaningfulness of the message. The opposite is true by deploying abstract, bland and personally meaningless policies. We need to chose stories, encouragement, engagement and tailoring our message to the user in question so they can then play their part in cyber safety because its relatable to their role.

Vivemos um mundo onde é mais fácil culpar alguém do que assumir a culpa.. Não tenha dúvidas de que muitos são negligentes com seus dados. Antes de cuidar dos dados da Empresa que você trabalha, é necessário que você cuide dos seus dados.. Já fez aquela revisão de "Quais aplicativos estão usando seus dados, sua localização...", "remover aplicativos que você não usa faz tempo"... E o principal, antes de instalar um novo app ou compartilhar alguma informação sua, LEIA o disclaimer antes de aceitar... Sua negligência não é de responsabilidade de ninguém, apens sua, somente...

To address staff skepticism on cybersecurity responsibility, start by emphasizing relatable, real-world impacts of cyber threats through examples and case studies. Highlight how a single breach affects not just the company, but their personal data too. Emphasize this point, as it's something I've found resonates well with peers. Use clear, non-technical language to explain policies and their importance. Personal stories or anecdotes about close calls or successes can make the message more relatable. Ensuring leadership visibly supports and practices good cybersecurity habits, setting a strong example for everyone to follow. This top-down approach can significantly influence attitudes and behaviors.

Cybersecurity can be very scary and hard to appreciate for our end users. We need to translate it through clear guidelines into a safety and enablement conversation. It needs to be relatable, and personal. It needs to deliver wins rather than blockers. We also need to simplify the message so that the actions required are understood and can be remembered. Perhaps the industry wraps too much up in terms of penalty, problems and complexity. We need to reframe cyber in a personal and enablement way so that our users actually have a chance of helping their org.

obust cybersecurity policies should be easily understandable and accessible. Simplify technical jargon and create straightforward steps for common scenarios. When employees clearly understand expectations and feel confident in following protocols, they’re more likely to take cybersecurity seriously. Relate cybersecurity to personal data protection, making it relatable and emphasizing its importance both professionally and personally. This approach fosters a collective sense of responsibility and commitment.

A Segurança precisa ser traduzida para o mundo "mormal"... Não adianta falar de um ataque DDoS com sua mãe, onde é mais fácil falar que um ataque pode parar uma aplicação ou uma Empresa. Simplifique seu vocabulário com a Segurança, e ajuda a simplificar a vida dos outros...

A liderança tem como foco a propagação da mensagem da Segurança da Informação. Um líder mostra a importância de cuidados simples, que para muitos são banais, mas para a Segurança são vitais...

Cyber threats evolve quickly, and keeping staff updated ensures they are aware of the latest threats and defense mechanisms. Use engaging methods beyond standard presentations, such as interactive workshops, simulations, and gamified learning. These approaches enhance engagement and retention, making cybersecurity knowledge more accessible and memorable. When training is continuous and engaging, employees are more likely to take cybersecurity seriously and feel prepared to tackle potential threats.

Continuous training and engagement is actually a lot harder than it seems. And this is one of the biggest roadblocks to information security programs. I agree that keeping cyber front of mind is sensible, but we do not need to talk to our user base in terms of latest vulnerabilities and trends. Think of it instead as a marketing campaign that strives to keep attention on cyber and actions "front of mind". This requires a multi-modal approach varying the delivery, keeping the content and applicability alive. It needs a function in the business to continually drive and monitor it. And through this process we will also learn. Most training programs fail because the momentum stops or the meaning gets diluted back to security speak.

Recognizing and rewarding proactive cybersecurity behaviors can be a powerful motivator. Acknowledge individuals or teams who excel in maintaining security protocols or identifying potential threats. This approach encourages a proactive stance on cybersecurity and builds a positive association with what might otherwise be viewed as a tedious task. By valuing and celebrating these efforts, you foster a culture of vigilance and shared responsibility.

In more traditional and long-standing fields like health, finance, and transportation (just as examples), it's generally accepted that the individual bears significant responsibility in maintaining their own well-being through things like self care, insurance, and awareness. In the early days of cybersecurity, the responsibility fell on the few with the technical capacity to understand the threats and how to defend against them. As the world's technology footprint and dependance have increased, this has become increasingly unviable. I feel that it's essential for the maturation of cybersecurity that we begin to shift responsibility to the masses. Ignorance is no longer an excuse. Convenience is no longer the priority.