Security culture in corporate environments in the context of modern employee education methods

Abstract

Modern enterprises are entities particularly vulnerable to cyber threats linked to social engineering methods widely used by cyber criminals. Today, corporate environments often have to face almost daily attempts at data theft based on many derivatives of modern varieties of phishing, and one of the main ways to combat such threats remains employee education, which can take various forms. A human being is generally identified as the weakest element in the “security chain” of a given correctly configured IT system. This state of affairs is taken into account both by companies preparing educational programs and training for their employees on their own, and those that outsource such activities to external companies. Effective creation of the so-called “security culture” within the scope of a given corporation is an extremely challenging and highly nontrivial task, and this topic is relatively rarely discussed in specialized literature. Continuous revision of the means and methods of conducting programmatic training and simulations, and management of activities contributing to the co-creation of a healthy corporate environment with a satisfactory degree of resistance to external threats, should therefore be one of the main priorities of the units administering local incident prevention instruments within the scope of a given company.