Chapter 12. Creating a Security Culture

Organizations need to build a security culture to provide a suitable information-protection solution. In this chapter, you will get an overview of the four main pillars of security culture, which are leadership support, efficient training, ongoing testing, and continuous communication to the entire organization and its partners. If you don't establish a security culture, you will have difficulty being successful in every part of an information-protection strategy, because every employee needs to know what information needs to be protected. Furthermore, the introduction of security measures can result in high costs if they are not sufficiently planned and not supported by the management.

An additional focus in this chapter is data classification, as the classification of information provides the basis for most security mechanisms. The classification of information provides context for the factors that lead to security policies taking effect and triggering...

Why do we need a security culture?

The ideas, duties, and behaviors of a group of people influence their security and can put them at risk, hence there is a need for security culture. In the professional world, security culture is used to describe the kinds of behaviors organizations would like to see in their employees in areas such as cyber, physical, and personal security. Security training and the change of the behavior of a co-worker to adapt to the safety guidelines of the enterprise are necessary. The main focus of a security culture is keeping infiltrators or other potentially damaging parties out. In our case, we will focus on the relevance to data security, because to handle the complete field of security goes beyond the scope and focus of this book. So, let's see what this means for us.

Digital transformation has reshaped the way we work. Data has become the new currency of business. Information such as development results, intended company acquisitions, sales account information...

Pillars of a good security culture

Now that we have highlighted the need for a security culture, let's look at its four main components. As we have already mentioned in the introduction, we will discuss the following four areas, which are the cornerstone of a healthy and sustainable security culture:

• Leadership support
• Training
• Testing
• Continuous communication

 

 

You will get an overview and tips that will help to you install a high-quality security culture in your organization. Keep in mind that an organization's security culture is the foundation of any security control and should be supported by an information-protection strategy. In the next part of this section, we will start with the leadership support you need to support an information-protection strategy.

Leadership support

An information-protection strategy and the associated security culture always has to start with the top-level executives and board members. This will provide the funding for appropriate resources to develop, implement...

General overview of data classification

After we describe the necessity and the four central elements of the security culture, we will discuss the data classification to create the basis for a successful solution in the area of information protection. As already mentioned, data classification provides the necessary information and tools for the correct use of protective measures. Let's start with a basic definition of data classification. It is a continuous process of consistently categorizing information based on specific and predefined criteria so that the data can be efficiently verified, effectively identified, and protected. This is why data classification is the foundation of data security.

Successful data classification requires a broad awareness of the needs of an organization and a thorough understanding of where the data assets are located and how data or information is generated. For this reason, finding and identifying existing data on various endpoints, such as network shares...

Azure Information Protection (AIP) overview

Microsoft has developed a complete data-classification and data-protection solution to meet the current and future needs of its customers and partners. AIP was designed based on the following form factors:

• Classify your data based on sensitivity
• Protect your data at all times
• Add visibility and control for users and administrators
• Support a more secure way of collaborating
• Easy-to-use toolset
• High deployment and management capabilities

 

The following diagram shows the high-level architecture of AIP and the related security services. In the coming chapters, we will do a deep dive into each component and build a sample solution configuration:

The following benefits are provided by AIP:

• Policy settings: The administrators of AIP are provided with a set of the most common default labels, which can be modified to fit your requirements and needs

The following example shows the new Unified Labeling capabilities through the Microsoft 365 Security & Compliance...

Summary

In this chapter, we learned why you need to have a security culture in an organization, and how it relates to and is supported by an information protection strategy. Then, we discussed what data classification means and why it builds the foundation of every data security solution. During the general overview of data classification, we looked at the relevance of a data classification scheme and related policies. Finally, we saw a Microsoft AIP solution overview, which builds the technology base for the information-protection solution we'll create in the coming chapters. Using the knowledge you gained in this chapter, you'll be able to define your own classification schemes, rules, and policies. Furthermore, you know which areas are critical in a security culture and you can include the appropriate tasks into your projects.

In the next chapter, we will dive into our first practical experience with AIP: identifying and detecting sensitive data.