Why Security Measures Often Fail

When it comes to security within an organization, having the right tools and processes in place is just one piece of the puzzle. Equally important is the adoption and implementation of these security measures by the entire company. Without this buy-in and compliance, even the best security capabilities can be rendered useless. This is why it is crucial to understand the reasons why security measures are often not adopted and to take steps to overcome these challenges.

TL;DR

3 ways to improve security:

👉🏼 Designate Security Champion per team and track progress with dashboards.

👉🏼 Improve adoption of security tools by supporting risk solution owners.

👉🏼 Keep inventory of best risk solutions and improve over time.

I’m Just Gonna Say It

Your service teams probably don’t care very much. 

Because implementing security is not usually what people get paid to do (or want to do), service teams often get used to neglecting proper security measures, causing complacency and increasing security risks over time.

Another day, another security fail. 

When complacency sets in, it can be tough to change culture and people don’t believe things will change.

Auditors read policies, and that’s about it.

When building a security strategy, many companies don’t even know where to start. As a result, they rely on automated tools to create policies, however, these generated policies often go unused outside of the audit.

‍

A more effective security strategy should start with one goal: adoption. Let’s explore a few practical ways to increase policy adoption.

Designating Security Champions

Assign passionate individuals as "Security Champions" in each team to enhance security posture & ensure adoption of measures. Dashboards showing each team's adoption of risk solutions are effective and can be simple to set up. Security Champions must have authority to hold teams accountable.

‍

The Role of Risk Solution Owners

The risk solution owners also play a crucial role in improving the adoption of security tools and processes. Give risk solution owners the task of helping the organization nail a SUBSET of policies. They should collaborate OFTEN with the security champions to continually improve the adoption mechanisms of these solutions. Making security measures easier to implement and use can go a long way in encouraging their adoption by the entire company.

‍

Importance of Keeping an Inventory

Another important aspect to consider is keeping an inventory of all the risk solutions in place within the organization. This helps to minimize the number of solutions in use and to focus on improving the best ones over time. By keeping things simple and focusing on what works, the company can greatly improve its security posture and reduce the likelihood of a security breach.

‍

Hero Up

Improving the adoption of security measures within an organization is crucial for the overall security posture of the company. By designating security champions, supporting risk solution owners, and keeping an inventory of risk solutions, organizations can create a culture of security and reduce the risk of security breaches. When security is a priority for everyone in the company, you enable more trust with your customers and partners, and the individuals who lead this effort become heroes. 

For more insights into decision-making in cybersecurity, Walter Haydock's 'Who Should Make Cyber Risk Management Decisions?' is a great read. It highlights the need for CEO-led decision-making in cyber risk, complementing our emphasis on practical security measure implementation and advocating a top-down approach for effective organizational policy execution.

Don’t be a Statistic: Up Your Security Game

If you’re interested in learning more about implementing a best-in-class security program, feel free to follow me on LinkedIn, Twitter or subscribe to our newsletter here, where I write about these topics.