• Basic principles of information security
• Awareness of information security threats and risks
• How to recognize and react to unexpected risks and security events
• How to report suspicious activity
• Builds a security culture throughout the organization

Techniques to keep security awareness fresh in user minds include:

• Ensure executive and management support. When top executives and management provide noticeable vocal support, it provides a sense of the importance of information security organization-wide.
• Use awareness aids such as posters, newsletters, email tips, blogs, and other reminders. People are different and learn in different ways. Using different types of aids helps ensure that the message gets through to employees in many different areas of the organization.
• Focus on changing behaviors. The goal is to create a culture of security. One way of doing this is relating awareness to employee’s personal life, family, and home. This allows employees to share security materials and information outside of work with family and friends making information security a part of their personal life as well. Make awareness engaging or interactive. This can often be fun for employees.
• Solicit ideas and feedback. Ask employees how security awareness can be improved. This gets employees directly involved in security programs.
• Measure success and growth. Track training completion. Get feedback on what employees like about training and what could use improvement.

References

Johnson, R. (2015). Security Policies and Implementation Issues (2nd ed.). Burlington, MA: Jones & Bartlett Learning.

Lohrmann, D. (2014, March 09). Ten Recommendations for Security Awareness Programs. Retrieved September 20, 2017, from http://www.govtech.com/blogs/lohrmann-on-cybersecurity/Ten-Recommendations-for-Security-Awareness-Programs.html.

The post Basics of Security Awareness: Users are the Weakest Link appeared first on .

In flat organizations, there are less layers between management and employees so decisions and problem solving generally happens faster and at a lower level. Smaller organizations tend to be flat and often exhibit looser or more relaxed relationships between managers and employees since they overall work more closely together making decisions and running their area of the organization. This often results in a decentralized management structure where employees might have more leeway in their behavior and the application of policies might be more relaxed. Application of policies is more direct with the decision on how policies are applied and enforced is done on a lower level.

With flat organizations, managers are much closer to lower levels which tends to give them an increased span of responsibility, and oversight of a wider area of the organization. With this wide span of responsibility, it becomes difficult to escalate every issue to higher management for resolution, which forces managers to make quicker, and sometimes inconsistent decisions.  This inconsistency can be a problem with information security, for example, conflicting statements and enforcement between front-line and high level managers. This is why clearly defining security policies in a flat organization is of paramount importance

Hierarchical structures are usually a necessity in large organizations. Senior leadership is more detached from lower level employees by several layers of management which results in a different dynamic than is found in flat organizations. The application of policies is more abstract with lower level employees seeing policy decisions as coming from on high. Application and enforcement of policies is more formalized throughout the structure with policies being constructed by high level managers, and enforced throughout lower levels. This often results in employees following policies more out obligation and with a sometime sense of apathy, rather than a sense of belonging found in smaller work units

Hierarchal organizations have the challenge of enforcing policies consistently because of the disconnect between lower and higher levels of the organization which can result in a reduced sense of accountability. High level managers responsible for constructing policies must take a proactive approach and lead by example to emphasize the importance of following policies. Additionally, there is a greater number of touch points and personalities that must be engaged when implementing policy. As the number of touch points increases, the more complex the relationship matrix becomes.

Other considerations include employee apathy which often manifests through an attitude of just going through the motions, or by just doing the minimum to get by. Well-defined security policies recognize that there will always be a certain level of apathy and non-compliance towards policies, and seeks strategies to reduce apathy and compliance issues. The following are strategies to overcome apathy towards security policies:

• Engaged communication. Leaders should make a conscious effort to listen and understand reason for worker apathy. Policy should be adjusted as a way to demonstrate that workers concerns are important.
• Ongoing awareness. The message of value and importance of information security should be continually reinforced. Awareness can be an effective measure against apathy.
• Set expectations. Monitor compliance and enforce accountability.
• Create layers of redundancy. Avoid reliance on single points of failure such as one person or one technology.
• Reward compliance. Recognize individuals and groups who model desired behavior. Something as simple as public recognition from an executive can be effective.

Coy, C. (2013, March 17). Office Hierarchies – Which One Is Best for Your Business? Retrieved September 4, 2017, from https://www.cornerstoneondemand.com/rework/office-hierarchies.

Elmy-liddiard, M. (2002). SANS Institute InfoSec Reading Room. Building and Implementing an Information Security Policy. https://www.sans.org/reading-room/whitepapers/policyissues/building-implementing-information-security-policy-509.

The post Implementing Security Policies in Flat and Hierarchical Management Structures appeared first on .

Risk management is essential to the success of every company

Revised July 1, 2023

Risk is an inherent aspect of business operations, representing the likelihood of a loss occurring when a threat exposes a vulnerability. While organizations need to take risks to thrive, they must also recognize the importance of managing those risks. To effectively mitigate risks, it is crucial to understand the threats and vulnerabilities involved and take appropriate measures to reduce vulnerability or minimize the impact of the risks. Consider the following risk-related concerns:

1. Compromise of Business Functions: The activities performed by a business to sell products or services can be negatively affected by threats. If these essential functions are compromised, the organization may experience a significant loss of revenue.
2. Business Assets: Business assets encompass anything of measurable value to a company, which can be tangible or intangible. This includes items such as repair costs, lost revenue, loss of future revenue, cost of gaining customers, customer influence, IT system equipment, network equipment, software, and data. Protecting these assets is vital for the overall well-being of the organization.
3. Driver of Business Costs: Risk management controls add an additional cost to running a business. While managing risks is essential, it is crucial to strike a balance between risk mitigation and cost-effectiveness in order to optimize business operations.
4. Profitability vs. Survivability: Profitability reflects a company’s ability to make a profit, while survivability refers to its ability to withstand losses resulting from risks. It is important to allocate funds for risk mitigation while considering their impact on profitability. Risk management should involve weighing the cost of risk controls against the potential threats that can jeopardize the company’s survivability. Over-investing in risk controls can hinder profit generation and fail to adequately address significant threats, potentially leading to business failure.

The National Institute of Standards and Technology (NIST) Special Publication 800-30 provides a guideline for applying risk management frameworks to federal information systems. This publication emphasizes that organizations heavily rely on information technology and systems to carry out their missions and business functions. Recognizing the growing danger posed by threats, it is crucial for leadership at all levels of an organization to prioritize the management of information system-related security risks and implement well-defined risk management systems.

In summary, since risk can result in losses that negatively affect business functions and even cause a business to fail, implementing a comprehensive risk management program is essential for the success and sustainability of every company.

References and Related Articles

https://csrc.nist.gov/publications/detail/sp/800-37/rev-2/final

https://www.forbes.com/sites/steveculp/2020/10/01/why-risk-management-is-more-important-than-ever/?sh=7ee5469a30b6

Additional Articles

Sarbanes-Oxley Act (SOX): Strengthening Financial Reporting and Accountability

Compression of Network Data and Performance Issues

Cloud Architecture Models

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Note: This article has been drafted and improved with the assistance of AI, incorporating ChatGPT suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Risk management is essential to the success of every company appeared first on .