You're reading from A CISO Guide to Cyber Resilience

Product type Book

Published in Apr 2024

Publisher Packt

ISBN-13 9781835466926

Pages 238 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Debra Baker

Table of Contents (20) Chapters

Preface

1. Part 1: Attack on BigCo

2. Chapter 1: The Attack on BigCo

3. Part 2: Security Resilience: Getting the Basics Down

4. Chapter 2: Identity and Access Management

5. Chapter 3: Security Policies

6. Chapter 4: Security and Risk Management

7. Chapter 5: Securing Your Endpoints

8. Chapter 6: Data Safeguarding

9. Chapter 7: Security Awareness Culture

10. Chapter 8: Vulnerability Management

11. Chapter 9: Asset Inventory

12. Chapter 10: Data Protection

13. Part 3: Security Resilience: Taking Your Security Program to the Next Level

14. Chapter 11: Taking Your Endpoint Security to the Next Level

15. Chapter 12: Secure Configuration Baseline

16. Chapter 13: Classify Your Data and Assets

17. Chapter 14: Cyber Resilience in the Age of Artificial Intelligence (AI)

18. Index

Why subscribe?

19. Other Books You May Enjoy

Security Awareness Culture

This chapter is about developing a security awareness culture. No matter what tools and security controls you have deployed, you still need security awareness training for everyone in your company. You’ll want to make it fun. It’s great to come up with a slogan. I took the MIT Sloan Executive Education Cybersecurity for Managers: A Playbook class, and one of the big points was to come up with a slogan for your company. You can make it fun or in a way that fits well with your company’s culture. Gamifying your security awareness is another way to make it more interesting for your employees.

In this chapter, we’re going to cover the following main topics:

Security awareness training is foundational
Cybersecurity awareness training products
Security is everyone’s responsibility
Security awareness is mandatory and tracked

Security awareness training is foundational

Security awareness training is mandatory for all companies under any compliance framework. It doesn’t matter what standard or framework your company adheres to; security awareness training is required. You can see this in Table 7.1 which maps security standards and frameworks to the sections that cover security awareness training:

Security is everyone’s responsibility

When I was a CISO at RedSeal, the company had already built a culture of security that was great to build upon. Every employee was referred to as a cyber warrior. This made it easy for me to build upon this security-minded culture. One thing that everyone needs to know is that security is not simply the information security team’s responsibility. Security is everyone’s responsibility, from the CEO down to every employee. As more and more regulations are enacted, security being everyone’s responsibility is becoming more laser-focused and required.

The Security Exchange Commission (SEC) issued a final rule on July 26, 2023, which requires disclosures on “cybersecurity risk management, strategy, governance, and incidents.”

The SEC ruling mandates that material cyber incidents be reported on Form 8-k item 1.05. In addition, the board and executive management need to be fully aware of the actual risks...

Security awareness training is mandatory and tracked

Once your company begins on its compliance journey, whether it is SOC 2 Type 2 or ISO 27001, you will need records showing that every employee has taken annual security awareness training. Don’t worry if you haven’t been doing this in the years prior to getting SOC 2 Type 2 or ISO 27001. When you are ready to go for compliance, the security awareness training is mandatory once you are in your audit window. It is good to start doing security awareness training as soon as possible, and using one of these great platforms such as Curricula, KnowBe4, or Ninjio will make the process super easy. One thing to be aware of is that once you are in an audit period (for example, with SOC 2 Type 1), it

is a point-in-time (PIT) audit. The auditors come in and check the controls for a particular day and conduct the audit. For SOC 2 Type 2, you will decide on an audit reporting period from 3 months to 1 year. During that audit reporting...

The rest of the chapter is locked

You have been reading a chapter from

A CISO Guide to Cyber Resilience

Published in: Apr 2024 Publisher: Packt ISBN-13: 9781835466926

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime}

Authors (1)

Debra Baker

Debra Baker has 30 years of experience in Information Security. As CEO of TrustedCISO, Debra provides strategic cybersecurity CISO Advisory Services. She has an AI first startup aiming to power through the pain of Third Party Vendor Assessment and Compliance. Previously, Debra was CISO at RedSeal where she led the security program successfully getting SOC2 Type 2. Previously, she served as Regulatory Compliance Manager at Cisco. While at Cisco she founded the cryptographic knowledge base, CryptoDoneRight in collaboration with Johns Hopkins University. Debra was named one of the top 100 Women in Cybersecurity, "Women Know Cyber: 100 Fascinating Females Fighting Cybercrime."

See other products by Debra Baker