We talk a lot about building a security mindset. But what is a security mindset and why should this be the goal of security awareness?

What is a security mindset

A security mindset is a way of thinking and an approach to decision-making that prioritizes the protection of personal and organizational assets, including data and networks. Having a security mindset means considering the potential risks and vulnerabilities in any situation and taking proactive measures to mitigate them.

This is easier said than done as having a security mindset applies to every single app, workflow, and situation to which employees find themselves - email, social media, web browsing, Slack, creating and sharing Google Drive files, configuring SaaS apps, texting, making phone calls, on and on. Considering the potential risks and threats in each and every one of these situations is not easy and not feasible unless its built into employee thinking, almost like design thinking is built into everything a good UX designer does.

Why does a security mindset matter

Here are a few reasons why having a security mindset is important:

1. Protecting personal and organizational assets: By prioritizing security, individuals and organizations can prevent the loss or theft of important assets such as sensitive information, financial resources, and physical property.
2. Avoiding costly breaches and disasters: A security mindset can help individuals and organizations avoid costly breaches and disasters that can result from neglecting security measures. For example, a company that doesn't have adequate security measures in place could suffer significant financial losses if a data breach occurs.
3. Maintaining trust and reputation: Having a security mindset can help individuals and organizations maintain trust and a positive reputation. For instance, a business that takes security seriously and invests in appropriate measures is more likely to be trusted by customers and partners.
4. Complying with regulations and laws: Many industries have specific regulations and laws that require organizations to implement certain security measures. Having a security mindset can help organizations comply with these regulations and avoid penalties.
5. Ensuring the safety of individuals: A security mindset can also help ensure the safety of individuals. For example, a person who is aware of their surroundings and takes appropriate precautions is less likely to be a victim of crime.

How do you build a security mindset?

Building a security mindset is like building any other muscle. It takes repetition, variety, and sustained effort. When it comes to building your security muscle, annual security awareness training does not cut it. Neither does annual security awareness training + periodic phishing simulations. What is needed is a sustained and concerted effort to engage and inform all employees throughout the year.

Below is a simple framework for building a security mindset using Haekka. Everything below can be setup and run in the background, collecting and reporting on useful human behavior and risk metrics throughout the year.

1. Train. Establish and maintain a baseline of security awareness at onboarding and annually for audits.
2. Nudge. Engage employees with regular announcements and surveys to give them ownership over parts of their personal infosec data.
3. Subscribe to weekly content. Send fast, relevant teachable moments throughout the year that do require employees to context switch.
4. Triggered intelligence. SaaS is where work happens. Use real SaaS actions and behaviors to trigger training alerts and kudos when employees practice good security hygiene.
5. Phish. Run fast and easy phishing simulations to measure performance of employees and your security awareness program. Make it rewarding, not just punitive.

We’ve made the above framework simple to implement for any size company. Other security awareness vendors will offer 1 or 2 of the above and tell you this is what you need; this is true that 1-2 of the above are all your need, but it’s what you need to check the box for audits and have phishing metrics for managers. It is not enough to build a security mindset and reap the benefits of a security-aware culture.

‍