# Another Look at Cybersecurity Awareness Programs

S. Solms, Jaco Du Toit, Elmarie Kritzinger

► To cite this version:

S. Solms, Jaco Du Toit, Elmarie Kritzinger. Another Look at Cybersecurity Awareness Programs. 17th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2023, Kent, United Kingdom. pp.13-23, 10.1007/978-3-031-38530-8_2 . hal-05462120

HAL Id: hal-05462120

https://inria.hal.science/hal-05462120v1

Submitted on 16 Jan 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Another Look at Cybersecurity Awareness Programs

S. H. von Solms<fnref n="1" />(✉) , Jaco du Toit<fnref n="1" /> , and Elmarie Kritzinger<fnref n="2" />

**Abstract.** Cybercrime has become one of the biggest forms of crime in the world today – if not the biggest form. Everybody is seeking ways to address this growing cyber risk. Cybersecurity awareness of end users is an important component of helping to prevent cybercrime. However, research indicates that traditional cybersecurity awareness programs are not very successful. Budgets for cyber protection programs keep increasing, but there is no evidence that the levels of cybercrime are decreasing. Companies (across the globe) are searching for new ways and approaches to make their end users more cyber aware. What has become clear from many efforts and approaches in making end users cyber aware, is that an approach emphasizing the technical aspects alone does not work. A complementary human oriented approach is also needed. This paper advances 3 new possible approaches which can be considered in the challenge to create more cyber aware end users. The first approach, called the ‘Fighter’ approach, is taken from the area of firefighting, where employees are trained to fight a fire in an emergency. The second approach, called the ‘Ownership’ approach, is from the operational technology (OT) area where machine operators are trained to take ownership of their machines and safely operate their machines. The third approach, called the ‘Workplace’ approach, is taken from the area of workplace training where being cyber-awareness is seen as a part of a secure workplace. All three these approaches are based on primarily on letting the end user realise that cybersecurity awareness is actually part of their daily job environment.

**Keywords:** Cybercrime · Awareness

## 1 Introduction

One of the biggest risks, if not the biggest, faced by all companies, and especially small and medium companies, is cybercrime. Cyberattacks have become extremely sophisticated, and Covid-19 has resulted in an unprecedented rise in cybercrime [1, 2].

However, the so-called 4th Industrial Revolution (4th IR), or Industry 4.0, with its advanced technologies like Artificial Intelligence, Machine Learning, The Internet of

<footnote n="1">¹ University of Johannesburg, Johannesburg, South Africa
{basievs,jacodt}@uj.ac.za</footnote>

<footnote n="2">² University of South Africa, Pretoria, South Africa
kritze@unisa.ac.za</footnote>
Things and more, will just fuel this rise. *'Industry 4.0 will expose (the) maximum personal information the world has ever seen'* [3]. The 4th IR will create massive benefits for humankind, but will also create more and serious risks. According to Dagada (2021), *'Along with the huge advances being made in technology as the Fourth Industrial Revolution hurtles forward is an equally huge increase in cybercrime and politically motivated cyberattacks. This is fertile ground for criminals, terrorists and geopolitical strategists. It's a war out there'* [4].

Therefore, protecting against cybercrime has become a massive challenge for companies, and new strategies are needed to address this growing challenge. In preventing cybercrime, it has become very clear that technology-oriented cybersecurity protection measures on its own are not sufficient anymore. The core role played by the humans has clearly indicated that new strategies for cybersecurity protection measures must concentrate on employees and end users as they are core to a well-balanced cybersecurity protection plan. The most widely used cybersecurity protection approaches for employees and end-users today concentrate on classroom presentations with large numbers of slides and lecturing. However, experience clearly shows that cybersecurity awareness programs as presently used, are not very effective and are not providing the desired results in increasing employee risk awareness of cybersecurity risks [5].

A wide range of reasons are given for such lack of effectiveness, but one which needs special attention is the fact that employees, in many cases, do not really understand the need for cybersecurity and do not see how it relates to their everyday work in the company.

Cybersecurity awareness programs must be integrated into the essence and culture of the cybersecurity approach within an organisation.

In organisations where there is a silo-based approach to cyber security awareness and training, employees see cybersecurity training and awareness as just another tick box to be completed [6]. This results in limited interaction and incorporation within the cyber culture of the organisation to be sustained in the long term.

Employees also often experience cybersecurity awareness programs and courses as 'scary, dull, and confusing' [7]. This underlines that cybersecurity programs are not seen as part of the essence of protecting the company. One can think of this as an add-on that can be changed and left out when needed, optional rather than critical.

The challenges are to bring such cyber-awareness training more directly in line and relevant to the employee's daily job and to make it more interesting and enjoyable and to ensure it has a long-term effect. One way to achieve that is to ensure such programs and courses are business-relevant so that employees can evaluate the benefits of such courses in relation to their day-to-day business actions. *'Connect awareness to business benefits'* [8].

It is the purpose of this paper to precisely do that – create a clearer understanding by employees of what role they can play in cyberprotecting the company. This understanding should clearly indicate to employees that they are part of defending their company against cyberattacks which may hurt the company. The purpose of cybersecurity awareness efforts should therefore create a clear link and bridge between the employees' daily work role, the consequences of successful cyberattacks against the company and their responsibility as a co-cyber defender of the company against such attacks.
The paper wants to find specific clearly understandable goals that the end user employee can understand to strive for to become part of a cyber-aware workforce as a co-defender against cyberattacks.

The rest of the paper is structured as follows to explain the suggested three approaches to try to achieve these goals:

* Section 2: The ‘Fighter/Protector’ approach - Fighter and Protector of security

* Section 3: The ‘Ownership’ approach - Ownership of security

* Section 4: The ‘Workplace/Collaboration’ approach - Integrating cybersecurity holistically in the total workplace environment.

## 2 The ‘Fighter/Protector’ Approach

This approach is based on the ideal situation that every end user will be a (cybercrime) fighter to prevent cybercrime and to protect the company against any damage from cyber-attacks and resulting cybercrime. The analogy in this approach is taken from firefighting courses and training. Let us investigate this area a little more to see how the area can help to change traditional cybersecurity awareness approaches. Firstly, it is interesting that employees are not doing a fire-awareness course, but a firefighting course. It is easy to let the employee understand that a fire can damage and destroy the company’s buildings, which can cause massive losses – financial losses, job losses and even the closing of the company. The employees are therefore clearly made aware that they must help protect the company against damaging fires. Such a firefighting course consists of theoretical and practical parts. Aspects like how to recognise the signs of possible places where fires could erupt, how to identify possible fire hazard and how to act to eliminate such potential sources, are usually part of such a course. The purpose is therefore to make let them understand that they must act as fire fighters when necessary, to protect the company. Every employee is therefore basically a fire fighter, and knows precisely how to act to fight a fire if such a fire is noticed. The employee therefore has a direct link from the benefit of such courses and training to the benefit for company in general, and even to themselves. Furthermore, no firefighting course can ever be successful if it is only done in a classroom or lecturing situation. Such courses do cover classroom work, for example looking out for and recognising potential fire hazards and reporting such hazards. This background is then followed by practical training where the employee is actually given a fire extinguisher to physically put out a fire. Basically a culture is developed where every employee therefore clearly understands his or her role as potential fire fighters on behalf of the company.

The challenge is how to develop this fire fighter culture as far as cybersecurity is concerned. This is discussed below.

This can be done by training the user through theory and practice, how to recognise a possible cyber attack situation and how to act in such a situation. Users learn about the different modes and ways of cyberattacks and keep their eyes open to recognise such situations in their daily work. Through the training the realise that by recognising a potential attack, and not falling for the attack, they are actually protecting and defending the company against cyberattacks. As an example, the attack method known as Business Email Compromise (BEC) is used. In this scenario, the end user receives an email from
a known party [9]. The email contains info about a payment to be made to the sender's company and provides a specific bank account number. Such transactions happen every day and may be totally legal and in order. However, cybercriminals have been very successful in exploiting such emails. They hack into the sender's or receiver's email system and change the bank account info in the email before arriving at the end user. The receiver accepts the contents of the email and deposits the amount into the account indicated in the email – the cybercriminals account! How can the sender in the company now act as a cyber fighter? Suppose the sender had been made aware of the BEC attack method, and understands the potential risks of the BEC attack method. The sender will now advise the receiver in some way before the email is sent, to contact the sender, using a separate means of communication, like a telephone call, to confirm the bank information before payment. In acting in this way, and because of his or her cybersecurity awareness of BEC attacks, the sender's vigilance would have helped prevent a possible cybercrime incident. The conclusion – Cyberrisk-aware users can prevent cybercrime! A cyber risk naïve sender would not have warned the receiver, and a cyber risk naïve receiver would have trusted the content and transferred the money. Again, if the email had been compromised, the money would have gone to the criminals' account, resulting in a cybercrime and possible financial loss to various parties.

This situation was highlighted in a ruling from the High Court in Johannesburg, South Africa in January 2023. In a property transfer transaction, the relevant company of attorneys sent an email to a client, who was the purchaser of the property. The email informed the client that the transfer had occurred, and that the client must pay the purchase price balance into the attorneys' trust account. The client's email system was hacked, and the hackers changed the bank information. The client paid into the criminals' account, and lost ZAR 5,5 million (about US$ 330 000). The case was taken to court and the Judge ruled that the company of attorneys must pay back the money to the client. In his motivation, he stated that the company was aware of BEC risks and that email systems are not secure. He also criticised the level of cybersecurity awareness of the administrative staff handling such emails and stated that was "hopelessly inadequate" [10]. If the sender had been aware of the risk the company would be exposed to by not taking cybersecurity precautions, the sender would have saved the company a lot of money. The sender would actually have acted as a cybercrime fighter by helping to cyber protect the company. Again, the conclusion – cyberaware users can prevent cybercrime! The main purpose of this approach is to let company end users understand that they actually are working in the frontlines of cyber attacks, and that in their normal business role they can help fight cybercrime.

The "Fighter" approach therefore means that all end users should be trained in such a way that they see themselves as cybercrime fighters to help protect the company against losses resulting from cyberattacks – just as they are fire fighters to help protect the company against fire losses. The goal of a cyber-aware workforce is to strive to become cybercrime fighters to help protect the company - a direct link to the business benefit to the company.

Figure 1 highlights individuals that strive to become cybercrime fighters. Individuals are empowered to “fight fires” to protect the organisation from cyber attacks.
<figure><img src="image_3.png" /><figcaption>Fig. 1. Fighter and Protector Approach</figcaption></figure>

## 3 The ‘Ownership’ Approach

This approach is based on the ideal situation that every end user understands that he or she is probably in the aim of the cybercriminal to launch a cyberattack on the company. By understanding this, they will take extra responsibility for their computing devices (workstations) to protect the workstation and ensure that the workstation is not used as an instrument to cyber attack the company. The analogy in this approach is taken from the manufacturing area and operators who handle different forms of machines. Let us investigate this area a little more to see how the area can help to change traditional cybersecurity awareness approaches.

The concept of Total Productive Maintenance (TPM) [11] includes the idea of developing a culture of total operator involvement, care and responsibility in and for the relevant equipment they are operating. In this culture, operators are trained to develop the concept of ownership for their equipment and become full partners with technicians and management to ensure the safety and protection of the equipment. The culture develops asset ownership in the sense of ‘this is my equipment, and I must protect it to the benefit of myself and my company’. Such a culture challenges the operator to ensure that his or her machine is always operated in an optimal way to ensure that the products created by the relevant machines are as perfect as possible, as that will benefit the operator and the company in general. This is precisely what the term ‘operator care’ means in such a manufacturing environment. It is the process of engaging all employees (and specifically the machine operators) towards a common goal of ensuring the best results and outputs for the company [12].

Let us now investigate how this approach can help to create a cyber-aware workforce. Suppose every end user employee can be trained to see his or her computing device
(workstation) as a ‘machine’ used to help the company succeed. In that case, the idea of operator care has direct relevance. This will challenge the end user to ensure that his or her computing device is always operated in an optimal way to ensure that the company is not negatively impacted. Therefore, training in aspects like phishing, fake websites, deep fakes, BEC and more are now seen as bad things which can happen on their computing devices, and which can potentially impact the company negatively if not stopped. Such bad things must therefore be detected, avoided and reported. The cyber-aware workforce goal to strive for is to take responsible ownership and responsibility for their computing devices and be aware of the type of events which can cause problems – a direct link to the business benefit to the company.

The “Ownership” approach therefore means that all end users should be trained to see themselves as responsible owners of their computing devices and use such devices in a way that will help prevent any damage to the company. The cyber-aware workforce’s goal is to take responsibility and ownership of their devices, ensuring that such devices will not cause any risks to the company.

Figure 2 demonstrates how individuals take ownership of ICT assets and take ownership of their responsibilities in protecting ICT assets from cyber attacks.

<figure><img src="image_4.png" /><figcaption>Fig. 2. Ownership approach</figcaption></figure>

# 4 The ‘Workplace’ Approach

This approach is based on the ideal situation that every end user will feel safe and secure in his or her workplace environment. The analogy in this approach is based on the usual health and safety training that all employees get in any company – in many cases such training is required by law. In general terms, the purpose of health and safety training
can be seen as providing for the safety and health of persons at work in connection with the use of machinery [13]. Health and safety training is important because it equips workers with the knowledge of how to perform their duties correctly and in the most secure and safe way possible [14]. The purpose of such health and safety training is to create a culture of mutual safety and protection in the organisation. Such a culture is an organisational culture that places a high level of importance on security and safety beliefs, values and attitudes—and these are shared by the majority of people within the company or workplace. It can be characterised as ‘the way we do things around here’ [15]. A positive security and safety culture can result in improved workplace health and safety and organisational performance.

In a typical health and safety course, employees will be exposed to many aspects, but one of the main goals is to allow the employee to develop a positive health and safety culture, where working in a secure, safe and healthy environment becomes second nature to everyone. Such courses should create a sense of wellbeing in a specific employee [16]. Such a culture will include emphasising to the employees that they have a responsibility to collaborate to protect themselves, ensure that the company assets and broader surroundings are protected, and that the business is protected against unnecessary insurance claims and/or financial losses that could have been avoided [14].

Some health and safety courses now include online safety and cyber security [17].

By including cybersecurity in a health and safety course, should indicate to an employee that cybersecurity is as important and relevant as other aspects like environmental safety and security, equipment safety, firefighting and employee health resources in the workplace.

The ‘Workplace’ or ‘Collaborator’ approach therefore means that all end users should be trained in a way to let them realise that protecting their computing devices against cyberattacks, is part of the culture that exists in a good workplace. It is not a standalone or strange type of requirement, but just re-emphasises the core benefit to the company as a whole. The cyber-aware workforce goal to strive for is to see cybersecurity as an integral part of normal workplace safety, security and operations.

Figure 3 demonstrates the responsibility a Collaborator has in protecting the ICT from attacks, but emphasises collaboration as an important property in this approach.

# 5 Evaluating the Fighter, Ownership and Workplace Approaches in Creating a Cyber Risk-Aware Workforce

As discussed in the sections above, end users are becoming the main targets for cybercriminals. ‘The human element is the most common threat vector; it was the root cause of 82% of data breaches’ [18].

It therefore seems logical that the most effort should go into creating a comprehensive cyber risk-aware workforce, which is acutely aware of their role and responsibility in the fight against cybercrime. It must become second nature to such end users, realising and understanding that they are actually the company’s first line of defence against cybercrime. Such an approach should advance a ‘cyberattack prevention first’ culture. This means a critical thinking mindset and evaluation in every situation where the end user
<figure><img src="image_5.png" /><figcaption>**Fig. 3.** Workplace/Collaborator Approach</figcaption></figure>

is confronted with emails and telephone calls. In all such cases, cybercrime prevention must drive any action by the end user.

‘It’s common belief that people are the last line of defence during a cybersecurity attack. Wrong. In many instances people are in fact the first line of defence. If your employees are (1) aware and (2) properly trained, then they will be one of your single strongest assets in fighting a never-ending war against cybercrime’ [19].

The three approaches discussed above all work towards creating an instilled culture of some sort, and these different cultures all help towards a culture of ‘cyberattack prevention first’.

With this approach, end users realise and accept their important and responsible role with the overwhelming intention to prevent cybercrime in their company. ‘*Everyone from entry-level to C-suite should know how to identify and report breaches so they can defend the enterprise*’ [20, 21]. ‘*security is everyone’s job*’ [22]. In the next section, we provide some ideas on how to start creating a cyber-risk aware workforce.

Figure 4 shows that a cyber-risk aware workforce contains elements of a cyber fighter, collaborator and owner.

# 6 Start Point for Creating the Proposed Cyber-Risk Aware Workforce

To create a cyber risk-aware workforce of cybercrime fighters, we have to move away from the established (and unsuccessful) methods we have been using up to now. ‘*Training is the most crucial step in this process, and it doesn’t need to include rote messages and endless PowerPoint slides. Learning sessions can be humorous, fun, and—most importantly—educational*’ [21].
<figure><img src="image_6.png" /><figcaption>Fig. 4. Cyber Risk-Aware Workforce</figcaption></figure>

By explaining and elaborating on the three approaches above, cybersecurity awareness training will concentrate much more on the responsibility and ownership role of end users. They must understand that they are actually the frontline protectors against cybercrime. Therefore, it seems to actually build cybersecurity awareness and a cyber-risk aware workforce around the idea of cybercrime fighters, owners and workers. That gives the end user an identity and a goal within which all training and courses are seen holistically as part of cybercrime fighting and is directly linked to the job they perform every day – as end users operating their computing devices.

The challenge is to make it as practical as possible. How can you teach someone about phishing attacks if you do not actually confront the person with such an attack? You can explain it in a classroom, but practically they must be exposed to real simulation exercises where they are receiving such an email and must decide what to do. Present approaches to awareness very often consist of classroom teaching or a webinar session, without any practical exposure. After all, you cannot train an employee to be a fire fighter if you do not expose him to a real fire, give him a fire extinguisher, and allow him actually to make the right decisions and extinguish the fire.

‘...we are continuously testing and training our employees by sending them simulated phishing emails, getting them more familiar with what to look for and how to spot phishing emails. Even just in this last quarter, we saw more employees spot and report the phishing simulation test than ever before’ [22].

This type of training must be integrated with the daily work environment of end users, and they must learn from experience to create the right cyber-risk aware mindset. A cybercrime fighting and prevention program needs to be integrated into employees’ daily work. Researchers and designers need to think of clever ways to increase the cyber risk-awareness of workforces. However, it seems that the concept of a Cyber Risk Aware workforce, supported by a cybersecurity culture is the basic deliverable of
any cybersecurity training Such a culture will be more acceptable to employees if it
highlights some specific goals to strive for. The paper offers three such goals which
employees should strive for:

* Be a proud member of your company's army of cybercrime fighters.

* Take responsibility and ownership of your computing device and

* Understand that cybercrime fighting is part of a well-established secure and safe workplace environment where you work.

The three goals and ideas presented here can be incorporated into organisations' bigger cybercrime fighting and awareness programs to develop a Cyber Risk Aware workforce.

# 7 Summary and Conclusion

In this paper we suggested three possible considerations which can allow cybersecurity awareness programs to be more goal oriented and bring cybersecurity and cybercrime directly into the daily work of an end user. A cybercrime fighting and prevention program needs to be integrated into employees' daily work. Researchers and designers need to think of clever ways to increase a cyber risk-aware workforce. However, it seems that the concept of a cybersecurity culture is the basic deliverable of any cybersecurity course. Such a culture will be more acceptable to employees if it highlights some specific goals to strive for. The paper offers three such goals:

* Become cybercrime fighters.

* Take responsibility and ownership for your computing device and

* Cybercrime fighting is part of a well-established workplace environment.

The three goals ideas presented here can be incorporated into organisations' bigger cybercrime fighting and awareness programs.

# References

1. Buil-Gil, D., Miró-Llinares, F., Moneva, A., Kemp, S., Díaz-Castaño, N.: Cybercrime and shifts in opportunities during COVID-19: a preliminary analysis in the UK, vol. 23, pp. S47-S59 (2021). https://doi.org/10.1080/14616696.2020.1804973

2. Radoini A.: Cyber-crime during the COVID-19 pandemic, vol. 2020, pp. 6–10 (2020). https://doi.org/10.18356/5c95a747-en

3. Onik, M.M.H., Kim, C., Yang, J.: Personal data privacy challenges of the fourth industrial revolution. In: ICACT, pp. 635–638 (2019)

4. Dagda, R.: The escalation in global cyberattacks is an unintended consequence of 4IR technologies (2021). https://www.dailymaverick.co.za/opinionista/2021-09-13-gone-phi shing-the-escalation-in-global-cyberattacks-is-an-unintended-consequence-of-4ir-technolog ies/. Accessed 21 Mar 2023

5. Bada, M., Sasse, A.M., Nurse, J.R.C.: Cyber security awareness campaigns: why do they fail to change behaviour? (2019). https://doi.org/10.48550/arxiv.1901.02672

6. Alshaikh, M.: Developing cybersecurity culture to influence employee behavior: a practice perspective. **98**, 102003–102010 (2020). https://doi.org/10.1016/j.cose.2020.102003
7. Haney, J.M., Lutters, W.G.: "It's scary... it's confusing... it's dull": how cybersecurity advocates overcome negative perceptions of security, pp. 411–425 (2018)

8. Candrick, W.: 3 steps to stop employees from taking cyber bait (2021). https://www.gartner.com/en/doc/3-steps-to-stop-employees-taking-cyber-bait. Accessed 21 Mar 2023

9. Checkpoint Software: Business email compromise (BEC) (2023). https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-email-security/business-email-compromise-bec/

10. Mudau J.: Hawarden v edward nathan sonnenbergs inc (13849/2020) [2023] ZAGPJHC 13 (2023)

11. Scheller E.: TPM and operator asset ownership: This is my equipment! (ND). https://www.reliableplant.com/Read/26763/tpm-operator-asset-equipment. Accessed 23 Mar 2023

12. Gehloff M.: Operator care – 4 elements to enhanced operator inspections (ND). https:// reliabilityweb.com/tips/article/operator_care_4_elements_to_enhanced_operator_inspections. Accessed 23 Mar 2023

13. Labour Guide: Overview of the OHS act (ND). https://labourguide.co.za/health-and-safety/overview-of-the-ohs-act/. Accessed 23 Mar 2023

14. SafetyWallet (Pty) Ltd.: Importance of occupational health and safety training (2023). https://www.safetywallet.co.za/healthandsafetytraining. Accessed 23 Mar 2023

15. The State of Queensland (Department of Justice and Attorney-General): Understanding safety culture, pp. 1–8 (2013)

16. Health and Safety Executive: Why is health and safety training important? (ND). https://www.hse.gov.uk/treework/training-is-important.htm. Accessed 23 Mar 2023

17. Bleich, C.: 15 safety training topics for your workplace (and free courses!) (2023). https://www.edgepointlearning.com/blog/employee-safety-training-topics/. Accessed 23 Mar 2023

18. Kerner, S.M.: 34 cybersecurity statistics to lose sleep over in 2023 (2023)

19. Vener, D.: Create an army of employees to fight cybercrime (2020). https://www.tagsoluti ons.com/create-an-army-of-employees-to-fight-cybercrime/. Accessed 21 Mar 2023

20. Kassner, M.: Cybersecurity pros: Are humans really the weakest link? (2020). https://www.tec hrepublic.com/article/cybersecurity-pros-are-humans-really-the-weakest-link. Accessed 21 Mar 2023

21. Briggs, D.: Smart prevention: How every enterprise can create human firewalls (2019). https://www.darkreading.com/vulnerability-management/smart-prevention-how-every-ent erprise-can-create-human-firewalls. Accessed 21 Mar 2023

22. Scimone, J.: Security is everyone's job in the workplace (N.D.). https://www.technolog yreview.com/2021/11/22/1040358/security-is-everyones-job-in-the-workplace. Accessed 21 Mar 2023