海角大神

After a barrage of high-profile hacks, most business聽leaders get it: Data security is critical not just to their reputation but to their business. But the top level executives still struggle to understand the next steps in protecting their businesses.

That鈥檚 the finding of a . More than three-quarters reported an increased level of conversation about cybersecurity within the C-suite.

For those concerned about data security but unsure what to do next, Brett聽Hansen, the executive director of Dell Data Security Solutions, and Michael聽Kaiser of the National Cybersecurity Alliance offered some practical action聽items at a talk at this year鈥檚 SXSW Interactive festival in聽Austin, Texas ().

The first recommendation: Set an example from the top and make security聽a visible priority. Take a cue from the construction industry, for example, where signs on聽the front doors of work sites tally the number of days since the last聽accident.

鈥淵ou need to create that culture within the organization,鈥� said Mr. Kaiser.聽鈥淲hen the C-suite talks about cybersecurity, then everyone talks about聽cybersecurity.鈥�

Other recommendations:

• Inventory your data. Ask your team: What do we have, where is it,聽what is more important, and how will we protect it?
• Create a culture where it鈥檚 okay to come forward and say 鈥淚 think I聽clicked on a link I shouldn鈥檛 have.鈥� Thank employees for self-reporting.
• Teach employees about spear-phishing and other risks.
• Purposefully create security issues 鈥� that are carefully contained 鈥� and offer prizes to employees who find them and report them.
• Let people use the devices that allow them to be more productive 鈥� but do so only after thinking through how to manage your employees bringing their own devices, for example.
• Put conditions on access to data. Like the old James Bond clich茅, keep聽data on a 鈥渘eed to know basis.鈥� And look into a new generation of聽tools that offer contextual access control, meaning an employee聽sitting at the office behind the firewall will have more access to聽files than when she is sitting at the airport on public wi-fi.
• Adopt the five-part cybersecurity framework () from the National聽Institutes of Standards and Technology.

These considerations are just as important for small businesses, which聽represent a growing portion of cyberattack victims (for more on this, ).

A company鈥檚 conversation around data security cannot just be about聽technology, it must involve people and their behaviors, said Mr. Hansen,聽who works with business leaders to shore up their security posture.

鈥淣inety-five percent of breaches originate with us, the end users,鈥� he said.聽鈥淚f you are not talking about people, and how they work, and how their work聽is evolving with mobility, cloud, and collaboration, you are not having a true聽cybersecurity conversation.鈥�

These talks were part of a series of discussions hosted at Passcode's booth at SXSW. See all that Passcode, Dell, Mozilla, and the Center for Democracy and Technology and .