3.4 Creating a Security Conscious Culture

00:09

lesson for creating a security conscious culture.

00:21

If I asked you what you think, we're the main things that make us adopt new behaviors, you would probably have been thinking along the lines of consequences which could be good or bad

00:32

recognition for conformance,

00:35

the way we were treated on the norms that are accepted in the environment in which we find ourselves in. These are the basic components that create a culture on which shape our behaviour.

00:48

Now, if this sounds a little touchy feely for a hard nosed in for sick professional like you, though, worry this lesson is not about making intersect people into a fluffy bunny. This lesson is really focused on some straightforward and practical steps that you can take to win the support of your colleagues.

01:10

Culture is often described as what happens when no one is looking.

01:15

I prefer to think about it. Does the things we do without really thinking about it, such as cueing or holding a door open for someone who is following us through it,

01:25

something that results in an automatic, almost subliminal response, something we do subconsciously, we don't need to refer to a training guide on what to do when you're going through a door and someone is following you. This behavior has been learned and is just part of our normal behavior.

01:42

So culture is generally accepted behaviors and standards

01:49

in terms of establishing culture. One way that is virtually guaranteed to fail is to tell people that they need to change their behavior because you want them to.

02:00

Even when you have the weight of policies and common sense behind you. It's difficult to get people to do things differently unless there are positive consequences. The challenge for the cyber security specialist is to take the organization with you

02:15

to get your colleagues to be proactive members of your overall cyber security strategy.

02:21

So we need to change some aspects of their behaviour. And to do that, you need to be able to influence their behavior in some way.

02:30

I can almost feel the trepidation here where you may be thinking, Well, we're I t security specialists, not workplace psychologists. We neither have the skills nor the resources to get the attention we need. When the audience is so large and diverse, let alone get them to change their behavior

02:49

well, you may be more powerful than you think. Many of the tools that we are going to focus on in this session our tools and techniques that you can deploy at little or no cost to apply positive influencing techniques within your organization.

03:05

There were three aspects. The positive influencing that we could include in our cybersecurity program. First, there's the principle of catch them doing something right. Basically, this means saying thank you. When users do the right thing,

03:22

I think about it. Most crisp management metrics are focused on capturing metrics related to exceptions things that went wrong or we're not done correctly. But what about capturing things that were done right on giving positive feedback?

03:37

A further important part of achieving behavior change is related to consequences for compliance. In other words, we undergo a positive experience for acting in a way that we are being encouraged to do. This does not have to be a huge financial reward.

03:53

It could be a thank you or even better, some other kind of recognition.

03:59

Much of what we have discussed in this module needs to be managed to ensure that all these initiatives maintain traction in your organization.

04:06

They'll need focus and ownership. So you'll need to think about how all of the things we have discussed in this module come together on workers. An ongoing process in most organizations, this will require allocating some dedicated resource ah, human resource to act as a catalyst to give the process momentum

04:26

adapted to changing circumstances,

04:29

as well as providing upward and downward feedback on results and performance.

04:33

Job titles of Rebel A Vint. But you might want to label this resource the security education lead whose overall role is the champion. The delivery and development of your security education program throughout the organization.

04:55

No

04:56

catch them doing something right.

04:58

What this means is that the people in your organization who are doing the right things know that you know they are doing the right things.

05:06

Quite often, the majority of people get nothing for doing the right thing effectively. They get the silent treatment for doing the right thing.

05:15

Let's think about this in the context of a clear desk policy. When a cleared escort it is performed in most organizations, the people who don't have a clear debts will get some kind of ticking off note or an email from whoever has performed the ordered. But how about this is an approach.

05:32

What about leaving a thank you card on the desk of the people who do have a clear desk

05:36

and nothing for those who don't

05:40

this achieves to Ames. Firstly, it says thank you to the people who are complying

05:46

but also gives a subtle message to those who didn't have a clear desk.

05:50

Just a small dose of the silent treatment can make people feel marginalized and separated from their peers. This one's against our nature as humans we want to belong. So this approach gives you two positives. Making the majority feel that their observance of rules is appreciated,

06:09

or those who don't receive a more subtle and effective means of encouragement to comply.

06:15

How much does this cost? Virtually nothing. Just the cost of printing a few cards.

06:20

Ah, further opportunity to say thank you occurs when a suspicious email is reported. All too often, these reports and actions disappear into some kind of black hole on. No feedback is received by the person who took the initiative to make the report.

06:35

Here's a few tips that you can use to show your colleagues that you've caught them doing something right

06:42

on that, you appreciate their effort.

06:45

Firstly, if you have a suspicious email reporting button built into your outlook ribbon, why not create some draws on the inbox? Associate it with the reporting button so that it automatically generates a thank you response? Sending a thank you note shows your colleagues that you recognized that they have done the right thing.

07:04

Secondly,

07:05

provide feedback on the report, particularly if the user correctly identified a suspicious email. When you've investigated the report, let the person who created it know the outcome. It will make them feel that they and their efforts have been appreciated by in for a sec.

07:27

Giving individuals recognition for their actions is a great way to influence behavior throughout the organization.

07:32

For example, let's say a colleague has referred a suspicious email to you, and he turns out that it contains a zero day exploit. Obviously, you'll need to address this a soon as possible, warning the organization or maybe tweaking the controls on your email Gateway. But when this has been done,

07:53

how about a bit of praise for the person who first spotted it?

07:58

There is enormous influence in mileage in making an internal media splash when a colleague spots a real threat on facilitates the efforts of in for sick Why? Because it shows the whole organization that some colleagues are really walking the talk and getting recognition for doing so,

08:16

showing that doing the right thing has positive consequences is a major factor in influencing others to do the right thing.

08:24

So when this happens, use the mass communication tools that are available in your organization, such as Internet email and social media. Toe publicly praised the individual who spotted the threat on for taking the right action at the right time.

08:41

Also, do you remember the ambient influences we discussed in earlier lessons? This approach is also an Ambien influencer because it's an unexpected and out of the blue message received in a familiar communications context on dhe centers around someone who may be familiar to a number of people in the organization.

09:03

Again, this costs absolutely nothing on uses facilities that you already have available to you within your own organisation.

09:18

To implement the principles of making it stick, you will need to consider how you will organize, coordinate and deploy your security education program, dedicated time and focus will be needed to establish and maintain the threat recognition capabilities of your organization.

09:35

So this is not a one off project nor a periodic intervention. It's a process of continuous development, so consider establishing a role of security education lead to create the infrastructural process for delivering on managing your security education program.

09:54

As you can see, I have given an outline of the high level responsibilities of this role

10:07

that concludes the final session in this course, making it stick. In this final lesson, we have looked at ways in which we can encourage our colleagues to acquire and adopt the skills we need them to have and to keep themselves and the organization secure.

10:22

We've looked at the concept of catching them, doing something right on sending the message that doing the right things is noticed. Appreciated on will result in colleagues receiving recognition when they do so.

10:35

Our final topic was focused on establishing an organization and structure to maintain traction for the security education program and adapted to changing circumstances.

10:48

Thanks for watching and listening

10:50

Links to some additional resources will follow together with a brief recap of both modules one and two