3 Truths Leaders Must Grasp to Foster a Campus-Wide Culture of Cybersecurity
The only way to start gaining ground in the cyber war is to instill a culture of security at every level.
Photo via Adobe, by insta_photos
The cybersecurity world is a mess. It may seem like progress that the rate of publicly reported data breaches this year is on track to be less than in 2020, but let me assure you, it certainly is not progress.
Data breaches have decreased because a more profitable attack has taken its place: ransomware. According to Computer Weekly, ransomware attacks have increased by 93% from the same time period in 2020. Combine this with the FBI’s 2020 report that 57% of all reported ransomware attacks in August and September of that year were targeted at K-12, and the concern should skyrocket. According to CBS News, the average ransom paid by schools was $50,000, and the largest payout was $1.4 million.
However, ransomware and data breaches are the symptom, not the disease. When we as a cybersecurity and physical security community get a handle on ransomware attacks, there will be another type of attack to take its place. The issue is not that there are attacks, the issue is the culture in our schools and universities.
The only way to start gaining ground in the cyber war is to instill a culture of security at every level. The only way this culture can be created is through command emphasis from the top of our organizations. A fundamental culture change must happen in leadership to drive that change. Leaders must understand the challenge they are facing to keep the data and the students they are entrusted with safe.
In this article, I will discuss three topics every leader must understand so they can effectively lead security strategies and create a culture of security.
1. Your Perception of Cybercriminals Is Wrong
We as leaders underestimate our adversary. When we close our eyes and imagine who the hackers are, we envision a person in their parent’s basement, dirty and socially awkward pounding on their keyboards at 3 a.m. This perception is not accurate.
There are entire companies dedicated to stealing your data and making you pay a ransom for the privilege to exist. There are countries with cyber armies in the tens of thousands that can see your vulnerabilities at the speed of light from half a world away. Even beginners have enough free tools and training at their disposal to become a threat in a matter of weeks. Each of these enemies is more dedicated to stealing data that our leaders are not prepared to protect.
2. The Bad Guys Are Motivated and Singularly Focused
It is understandable if you cringed at that last sentence. However, it is the second issue we are missing as leaders: the bad guys are far more committed to stealing an organization’s data and encrypting their systems then an organization’s leaders are to protecting their data and systems.
This is not an issue of competence, but one of time and culture. Cybercriminals have the luxury of being singularly focused on attacking. All of their research and development is aimed at breaking into systems and making money on data theft and encryption.
Because of a lack of understanding about cybersecurity issues at the highest level of most organizations, the commitment to protection is nowhere near the bad guys’ commitment to invasion, which hands them an enormous advantage.
3. Good Cybersecurity Policies and Procedures Are Critical
The third issue is that there is a lack of written down, understandable, and enforceable policies guiding our organizations through this crisis. Schools, institutions of higher education and healthcare facilities must have all aspects of their infrastructure and employee cyber hygiene under control or there will be an attack.
The visibility into organizational vulnerabilities is staggering. Any misstep by an organization can immediately be detected by cybercriminals. The only way to counteract this is with written policies, procedures, and guidelines that are understood and followed by everyone. A framework like the NIST 800-53 or the ISO 27001 must be implemented a taught.
I understand that this is a massive undertaking for campus leadership. Other responsibilities take our time and attention. This problem must be solved by understanding, then delegating.
A competent chief information security officer is a good first step, however, leaders can delegate authority but not responsibility. The responsibility to keep data safe still falls on an organization’s executives.
Every leader must understand who the enemy is, how they behave and why. They must push a culture of leadership through a framework and be as committed to protecting their organizations as the bad guys are to attacking them.
Erick Robuck is CEO CISO of Valander Cybersecurity.
If you appreciated this article and want to receive more valuable industry content like this, click here to sign up for our FREE digital newsletters!
Related Content
Leading in Turbulent Times: Effective Campus Public Safety Leadership for the 21st Century
This new webcast will discuss how campus public safety leaders can effectively incorporate Clery Act, Title IX, customer service, “helicopter” parents, emergency notification, town-gown relationships, brand management, Greek Life, student recruitment, faculty, and more into their roles and develop the necessary skills to successfully lead their departments. Register today to attend this free webcast!
