Parallels: Cybersecurity and Workplace Safety
It’s not a stretch to say that safety in the manufacturing industry is important to a business. Workers can be exposed to a range of potential hazards and workplace safety. Just as no worker wants to work in an unsafe environment, no employer wants to deal with the costs associated with safety incidents. And yet incidents occur. People get hurt, regulators get involved, and companies get in trouble. Frequently, an organization at the center of a safety incident had some kind of health and safety program in place backed by policies, controls, training, and leadership oversight. The problem is that what’s on paper doesn’t always reflect reality. Policies do not always become practices. People do not always do what they are supposed to do, even when they know they should. In other words, a safety program is not the same as a safety culture.
In an environment that can place workers at risk, it’s imperative that safety is not just about rules and preventative measures but also a foundational value that is embedded in an organization’s culture. When safety is relegated to a check-the-box exercise, all companies (manufacturing or other) are more likely to experience stagnant or incremental safety improvements. Organizations that approach safety as part of their culture with a commitment to their people and their work can promote meaningful change that everyone across the organization can and should be a part of. Companies that embed safety into their corporate culture do so by engaging stakeholders across the board, from employees to executive leadership, with continuous and open dialogue to all.
While there is no definitive "record" for companies with the best safety culture, there is a growing body of evidence that suggest safety superstars have the same shared trait: a safety-first mindset throughout the entire organization. I saw this early in my career when I worked for American Electric Power, a utility company based in the Midwest United States. Regardless of their role—whether working in the office (marketing, accounting, etc.) or out in the field on power lines—every department held a monthly safety meeting, and attendance was mandatory for all employees. Safety was deeply ingrained in the organization’s culture, with every individual embracing accountability and responsibility, regardless of their role.
The same approach and principles that companies apply to workforce safety can be applied to cybersecurity. It comes down to culture, which can be difficult to define and control. Leadership cannot just make culture happen or write it into being. There is no “culture button” that one can push or single program to implement. Culture is largely an invisible force that only becomes visible when something goes wrong. It’s ultimately a collection of habits and by understanding and targeting employee habits can an organization expose unsafe cyber behaviors and establish a cybersecurity culture.
A cybersecurity culture, when defined through the lens of workplace safety, is a company mindset where employees actively prioritize digital security and consistently follow established protocols. Just as they would prioritize physical safety measures with a focus on individual responsibility to prevent workplace accidents, exhibiting similar behaviors in the digital world can mitigate risks and contribute to developing a cybersecurity culture. Similarities between cybersecurity culture and workplace safety include:
Leadership Commitment: Just as with workplace safety, strong business leadership fosters a secure environment by actively promoting and enforcing security policies.
Proactive Approach: Like wearing safety gear in a hazardous environment, a strong cybersecurity culture encourages employees to take steps to protect sensitive data, including using strong passwords and being cautious about clicking suspicious links. These are the "safety glasses" of the digital world.
Reporting Hazards: Just as workers are encouraged to report unsafe conditions in the workplace, a cybersecurity culture encourages employees to report any suspicious activity or potential cyber threats they encounter.
Training and Awareness: Similar to safety training for operating machinery, regular cybersecurity awareness programs and “cyber safety drills” educate employees about potential cyber risks and best practices to avoid them.
Culture of Compliance: Just as adhering to safety regulations is expected in a workplace, a cybersecurity culture emphasizes following established security policies, procedures and best practices.
By drawing parallels between workplace safety and cybersecurity, organizations can foster a culture where employees actively consider and prioritize digital security in their daily work practices, just as they would prioritize physical safety measures to prevent accidents.