How to create a global culture of cyber security ?

Question

How to create a global culture of cyber security ?

Answer 1

User education is not the answer.

I can personally teach about five people who aren't interested in security per year about security awareness.  If every security professional in the world did this, it would still take hundreds of years to get to everybody.

The trouble with user education is that it doesn't work when the users aren't interested in the subject matter.  People who are interested will learn on their own but these people are few.

The answer is to make not having security more expensive.

If people are hurt by not being secure then they will be much more interested in learning about security.  My house never had an alarm until the day a burglar broke in and stole a laptop, camera and some money.  Our lack of security cost us almost as much money as installing the burglar alarm cost but the difference is that the burglar alarm only costs us once.  The alarm is also externally visible which deters criminals when there are easier houses around.

When a person is infected with a virus, they are inconvenienced enough to ask what they should do and they are told to install anti-virus products and firewalls and to be more careful about what they download and run on their computers.  The trouble is that many viruses these days are sneaky.  They hide in the computer and send out spam.  The users often don't even know they are infected.  Some simply record browsing activity or keystroke and report back to their owners.  They may not even know about the infection on their computer, even after their bank account is cleaned out.

Maybe the answer is to make computers less like a black box and to make average users more aware of what is going on in their computers.  If a user knows what is "normal" then anything out of the ordinary will raise their suspicions.

Answer 2

Teach people how to use firewalls and antivirus programs.