{"id":4215,"date":"2024-06-27T09:00:00","date_gmt":"2024-06-27T14:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/cybersecurity-operations\/achieve-next-level-security-awareness-by-creating-secure-social-norms"},"modified":"2024-06-27T09:00:00","modified_gmt":"2024-06-27T14:00:00","slug":"achieve-next-level-security-awareness-by-creating-secure-social-norms","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/06\/27\/achieve-next-level-security-awareness-by-creating-secure-social-norms\/","title":{"rendered":"Achieve Next-Level Security Awareness by Creating Secure Social Norms"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

COMMENTARY<\/span><\/span><\/p>\n

In the world of cybersecurity, we often hear the saying, “It’s not a matter of if, but when.” While this is said mostly in reference to <\/span>security breaches<\/a><\/span>, it could also be used to remind us that secure social habits reduce the likelihood of those breaches happening in the first place.<\/span><\/p>\n

Throughout my career in cybersecurity, I’ve observed a high level of security carelessness, even among security professionals. This is problematic because one individual’s insecure behavior can cause others to be less secure as well. Remember the human behavior studies that showed the <\/span>tendency to litter<\/a><\/span> is higher if a person sees litter all around them? It’s the same for cybersecurity. If we see insecure behaviors all around us, we are less motivated to improve security practices.<\/span><\/p>\n

The good news is that change can truly happen, and it can start with one person: you.<\/span><\/p>\n

What Are Secure Social Norms, and Why Create Them?<\/h2>\n

Social norms typically are informal, unwritten rules that guide acceptable behavior among members of a group or society. Secure social norms can be established at two levels: The general level that focuses on what everyone needs to know about protecting information, and the role-based level that pertains to groups of people performing specific tasks.<\/span><\/p>\n

Consider the example of <\/span>protecting personal identifiable information (PII)<\/a><\/span>. While organizations are bound to protect the personal information of their employees and customers, it is up to individuals to take action to secure their data, and to help others learn how to do so as well. Not doing this can lead to financial loss, identity theft, and so much more.<\/span><\/p>\n

Security professionals have a unique opportunity to transform security awareness concepts into social norms and actions. By doing so, we elevate the security culture all around us. Now is the time to step up and become the team member who practices secure behaviors and inspires others to do the same.<\/span><\/p>\n

Steps for Establishing Secure Social Norms<\/h2>\n

Below are some practices security practitioners can adopt to establish secure social norms for ourselves and everyone around us.<\/span><\/p>\n

1. Make data security relatable and actionable.<\/h3>\n

Launching a <\/span>security awareness campaign<\/a><\/span> that helps people understand PII in tangible, everyday terms can be a great way to teach people how to protect their personal data. Always use brief, clear language to explain security words and topics. When sharing tips and best practices, provide examples. And be sure to spell out the specific actions to take to be more secure, as well as the positive impact it can have.<\/span><\/p>\n

2. Educate people on what constitutes PII and how to protect it.<\/h3>\n

The more we use apps and websites, the more important it is to know how our personal information can be accessed, how it might be used, and when we should not share it. Below are some key examples to help develop a security mindset:<\/span><\/p>\n

\n