Скачать или смотреть Building A Resilient Security Culture

Strengthening Your Security Culture 2025 12 17
What makes an organization resilient to a security attack? A colleague of mine at the Society for Information Management has a mantra: “People, Process, Technology – in that order, don’t screw it up.” A resilient organization is built on trust. Trust requires open and honest communication. How can you build that? It starts with tone at the top. If your senior leadership team encourages open dialog, your team will do so as well.
From a social psychology perspective, about 3 percent of the population is likely to violate norms. Most people are inclined to do the right thing, as they see it, and not disrupt their colleagues unnecessarily. We can count on that. By modelling the behavior we wish to encourage, we help folks make good choices: report likely problems, question obscure requests, consider possible reasons behind someone’s apparently odd behavior. Making that a part of the daily routine for senior leaders sets a standard for behavior and interaction that will move the organization in a healthy direction.
At the Gartner Information Security Conference in its first decade, one of our keynotes was Bob West, then CISO for Fifth Third Bank. He talked about how he created a corps of Local Security Administrators. These people, often administrative staff, got training in security policy and had hints and tips for their colleagues. They met every month or so to have a luncheon and hear a presentation on some aspect of information security, and they got a badge “I’m your Local Security Administrator!” This recognition created a lively and enthusiastic team of ambassadors for good cyber hygiene.
What more can you do? In the intelligence agencies, they typical motive for someone to turn against their organization is “MICE” - Money, Ideology, Coercion, Ego. We’re not trying to play super spy, but we do want to help people make good choices. So being aware of your team members and what they are worried about can help you guide people away from causing harm. Get to know your team.
The best way I’ve found so far, is to ask questions. How are things going? And when they answer, pay attention – the goal is not to have the answer, but to understand the world view of your colleague. What do they want from the job? What do they like and dislike about the environment? You may find some things you can do to make work better
Do you know your team? Do they know you? How do you build a healthy and open culture, where people share ideas freely with each other and surface their concerns? Every day doesn’t start with “Heigh, Ho, Heigh Ho, it’s Off to Work we Go!” but you as a security leader – and you wouldn’t be listening to this talk if you weren’t a security leader – can make things better, safer, and more secure.
A Bit of Security for December 17, 2025
Building A Resilient Security Culture
How can you build a strong, resilient, security-aware culture? Listen to this -
Let me know what you think in the comments below or at [email protected]
#cybersecuritytips #Culture #communication #securityawareness #BitofSec