5 Tips to Build a Culture of Security at Your Company

Despite increased cybersecurity capabilities and awareness, threat actors’ sophistication has increased in parallel, leading to an uptick in cyberattacks. An IBM report placed the global average cost of a data breach at $4.88 million U.S. dollars.

Cybersecurity is more crucial than ever. However, code doesn’t become secure on its own. Besides buying and implementing software that can improve code quality and security and establishing cybersecurity policies, organizations must build relationships and collaboration between teams to build an organizational culture of security.

Here are five tips to get started.

1. Start At the Top

Cybersecurity must be a top-level concern that all C-suite executives and managers take seriously. Support from higher-ups will encourage developers to listen to your security team and prioritize cybersecurity. 

Organizations can foster a culture of security within the higher-ups by giving the C-suite and managers specialized training about the importance of cybersecurity. This training should help them:

• Understand the risks of cybersecurity gaps, including data loss, data theft, reputation loss, hefty fines, and lawsuits. For example, an organization that fails to protect customers’ protected health information (PHI) from theft is out of compliance with the Health Insurance Portability and Accountability Act (HIPAA), resulting in penalties of $100 to $50,000 per individual violation.
• Identify cybersecurity risks, including emerging industry-specific risks.
• Prioritize security investments to prevent assessed cybersecurity risks. 
• Understand why the organization’s cybersecurity policy and rules exist. The C-suite is much less likely to ignore a cybersecurity policy or rule if they understand its rationale. For example, the C-suite is more likely to follow password rules if they comprehend how frequent password rotation and encryption prevent hackers from gaining access to a network.
• Understand the importance of and how to build processes and tools into the fabric of the company culture. The C-suite must know how to integrate processes, including philosophies, policies, and tools, into the company culture to help the company prioritize cybersecurity.

2. Ensure Security Policies Aren’t a Burden

Developers may hesitate to adopt security policies if they believe following them takes too much time and effort. Accordingly, ensure cybersecurity policies don’t create significant time and work burdens. 

For example, if the organization decides to shift security left, make sure the change does not disrupt workflow or increase work for the development team. Ideally, the security team and policy designers should meet with developers to see if the policies align with their goals and expectations.

Shift left involves moving testing and quality assurance tasks to earlier stages of the software development life cycle (SDLC) to identify and fix problems as soon as possible rather than waiting. Adopting a shift left can lead to several benefits, including faster feedback loops, improved software quality,  faster time-to-market, and improved cost efficiency.

3. Create Opportunities for Development and Security Teams to Mingle

Talk to each other. It’s a wild concept, right? But communication makes things happen and a lack of communication is frequently a cause for projects that stall. Depending on the configuration and size of the organization, you can seat them close to each other or have them regularly meet during some or all of the development teams’ weekly meetings. During remote meetings, managers can ask developers and security staff questions about each other’s personal lives, concerns, and many other themes. This will encourage teams to better understand each other’s limitations and expectations.

4. Provides Channels and Space to Voice Concerns

In some organizations and industries, developers may see the security team as out-of-touch rule enforcers who don’t understand the struggles or practical limitations of the SDLC.

To avoid security breaches, managers and security teams need to maintain a humble attitude. While they should be strict about security policies, they should also be open to feedback and willing to change when needed. If developers are hesitant to share their opinions, managers can encourage open discussions by asking open-ended questions about their workload and deadlines. Additionally, security teams should conduct regular code reviews and provide constructive feedback to developers on how they can improve their security practices.

In addition to receiving feedback from the development team, the security team should seek input from other organization stakeholders. Gathering more feedback will help the security team refine its policy.

5. Implement Ongoing Security Training

There are always new cybersecurity threats on the horizon. As such, organizations should implement ongoing security training to keep developers aware of the latest security vulnerabilities and threats. The training should also refresh and drill developers about coding best practices, such as: 

• Error handling is the recovery and response procedures from a software’s error conditions
• Access control systems and software are when companies control who can access and use company resources and information. There are two main types of access control: 1) physical access control, which includes limiting access to buildings and other physical assets, and 2) logical access control, which limits access to networks, computers, and other sensitive data, such as usernames and passwords.
• Cryptographic practices involve safeguarding data using coded signatures, hashes, and algorithms. The information can be in transit, at rest, or in use.
• Authentication and authorization are often confused. They are distinct terms. The former involves validating a user’s identity, while the latter grants a user permission to access specific capabilities or resources once their identity is verified.

Kiuwan Can Help Build a Culture of Security

Kiuwan’s code security tools—static application security testing (SAST), software composition analysis (SCA), and code quality and governance—are effective strategies for encouraging security by eliminating vulnerabilities in the codebase, identifying open-source components, and more. To experience the Kiuwan difference, request a free trial.