book

People-Centric Security: Transforming Your Enterprise Security Culture

Name: People-Centric Security: Transforming Your Enterprise Security Culture
Author: Lance Hayden
ISBN: 9780071846790

by Lance Hayden

September 2015

Intermediate to advanced

384 pages

11h 40m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
Dedication
About the Author
Contents at a Glance
Contents
Foreword
Acknowledgments
Introduction

Part I Understanding Your Security Culture
Chapter 1 Information Security: Adventures in Culture Hacking
Burnt BaconSafe and Not SecureWhat Were You Thinking?Culture HackingSoftware of the MindA Brief History of Culture HackingSecurity Culture: Hack or Be HackedWho’s Hacking Your Security Culture?Security, Hack ThyselfCulture Hacks: The GoodCulture Hacks: The BadCulture Hacks: The UglySecurity Is People!Further Reading
Chapter 2 Strategy for Breakfast: The Hidden Power of Security Culture
Why Security FailsWe Start with a DesignWarning SignsDoing More with LessWho Moved My Fence?Look Out Below!Getting the DriftThe Opposite of MonocultureCultural Traits in Information SecurityCompeting Values and Security ThreatsThe Change Agents of Security CultureThe C-SuiteSecurity Awareness TeamsSecurity ResearchersSecurity PractitionersMaking Security CulturalFurther Reading
Chapter 3 Organizational Culture: A Primer
The Field of Organizational CultureOriginsOutcomesThe Culture IcebergHidden AspectsPeople PoweredThe Organizational Cultural/Organizational Performance LinkAssessing and Measuring CultureQualitative vs. Quantitative Measurement of CultureQualitative Measures and TechniquesCulture by the NumbersChallenges of Cultural TransformationThere’s No One Right Way to Change CultureYou Have to Include EverybodyYou Have to Build ConsensusYou Have to Evaluate the OutcomesYou Have to Have Good LeadershipAn Ocean of ResearchFurther Reading
Chapter 4 Cultural Threats and Risks
Cultural Threat ModelingCovert Processes and Cultural RiskGetting to Know PEPLPolitical ThreatsEmotional ThreatsPsychological ThreatsLogistical ThreatsCultural Competition as a Source of RiskSizing Up the CompetitionFurther Reading
Part II Measuring Your Security Culture
Chapter 5 The Competing Security Cultures Framework
Measuring Security CultureQuantitative Data and AnalysisQualitative Data and AnalysisCombining the Qualitative and QuantitativeOther Ways of Describing CultureThe Competing Security Cultures FrameworkOrigins of the CSCF in Competing Values ResearchAdapting the Competing Values Framework to SecurityThe CSCF QuadrantsOverlapping and Competing ValuesLimitations of the FrameworkWhy Not Just Use the Competing Values Framework?Security Culture Benefits From a Targeted ApproachNot Everything in the Competing Values Framework Translates WellOrganizational Security CulturesProcess CultureCompliance CultureAutonomy CultureTrust CultureFurther Reading
Chapter 6 The Security Culture Diagnostic Survey (SCDS)
SCDS Format and StructureHow Surveys WorkQuestions in the SCDSSCDS Scoring MethodologyScoring the SCDS ResultsSecurity Culture Diagnostic Strategies: Case StudiesABLE Manufacturing: Measuring an Existing Security CultureCHARLIE Systems, Inc.: Comparing Security Cultures of Two OrganizationsDOG: Comparing Existing to Desired Security Culture
Chapter 7 Creating Culture Maps with the Security Culture Diagnostic Survey
Security Culture MapsMapping Security Culture Using the CSCFComposition of a SCDS-based Culture MapOther Techniques for Mapping Security Culture“When Should I Use Each Type of Map?”Mapping Specific Values and ActivitiesInterpreting and Comparing CultureInterpreting SCDS ResultsComparing Cultures
Chapter 8 Implementing a Successful Security Culture Diagnostic Project
Getting Buy-in for the Security Culture Diagnostic ProjectDirect Benefits of Security Culture ImprovementEstimating the Financial Impact of Security CultureCase Study: FOXTROT Integrators, Inc.Executing a Security Culture Diagnostic Project1. Setting Up the Project2. Collecting Data3. Analyzing Responses4. Interpreting Culture and Communicating ResultsFrom Measurement to TransformationFurther Reading
Part III Transforming Your Security Culture
Chapter 9 From Diagnosis to Transformation: Implementing People-Centric Security
Diagnosis and Transformation: One Coin, Two SidesThe CSCF as a Framework for UnderstandingWhat Is the Framework for Transformation?Behavioral Models for Security Culture TransformationCompliance and Control RegimesSecurity Process ImprovementTechnology and Automation ApproachesSecurity Needs More OptionsFurther Reading
Chapter 10 Security FORCE: A Behavioral Model for People-Centric Security
Origins of Security FORCEHRO ResearchHROs in Information SecurityIntroducing the Security FORCE Behavioral ModelFive Core Values of Security FORCESecurity FORCE Value Behaviors and MetricsSecurity FORCE Value BehaviorsSecurity FORCE Value MetricsThe Culture–Behavior Link in HRSPsFurther Reading
Chapter 11 The Security Value of Failure
What Is the Security Value of Failure?“Failure Is Not an Option”Reevaluating FailureEmbracing FailureFail Small, Fail Fast, Fail OftenFailure Key Value BehaviorsAnticipate FailuresSeek Out ProblemsReward Problem ReportingShare Information About FailuresLearn from MistakesAssessing Your Failure Value BehaviorsThe Security FORCE SurveyThe Security FORCE MetricsImproving Your Failure Value BehaviorsEmbed the Security Value of Failure into PeopleReeducate People on What It Means to FailSet Leadership ExamplesOpen Up CommunicationFurther Reading
Chapter 12 The Security Value of Operations
What Is the Security Value of Operations?Operational PowerSensitivity to OperationsExpectations and RealityOperations Key Value BehaviorsKeep Your Eyes OpenForm a Bigger Picture“Listen” to the SystemTest Expectations Against RealityShare Operational AssessmentsAssessing Your Operations Value BehaviorsScoring the Operations Value Behavior SurveyFORCE Value Metrics for OperationsImproving Your Operations Value BehaviorsEmbed Operations Value into the Security ProgramThink More Like ScientistsEmbrace the “Sharing Economy”Lighten Up a BitFurther Reading
Chapter 13 The Security Value of Resilience
What Is the Security Value of Resilience?When Bad Things Happen (to Good Organizations)Rolling with the PunchesImagining Failures and DisastersResilience Key Value BehaviorsOvertrain PeopleCreate “Skill Benches”Actively Share ExpertiseEncourage Stretch GoalsPractice FailingAssessing Your Resilience Value BehaviorsScoring the Resilience Value Behavior SurveyFORCE Value Metrics for ResilienceImproving Your Resilience Value BehaviorsEmbed Resilience Value into the Security Program“A Security Incident? I Want In!”Make Security Incidents MundaneFurther Reading
Chapter 14 The Security Value of Complexity
What Is the Security Value of Complexity?Dumbing It DownGrowing UncertaintyIgnorance Is RiskComplexity Key Value BehaviorsDon’t OversimplifyFormalize Your AssumptionsCovet Empirical EvidenceShare the DoubtMake Every Model BetterAssessing Your Complexity Value BehaviorsScoring the Complexity Value Behavior SurveyFORCE Value Metrics for ComplexityImproving Your Complexity Value BehaviorsEmbed Complexity Value into the Security ProgramThink BiggerAccept What We Already KnowFurther Reading
Chapter 15 The Security Value of Expertise
What Is the Security Value of Expertise?Filter Your Water, Not Your InformationStructural Authority vs. Structural KnowledgeWaiting for the Big OneExpertise Key Value BehaviorsAsk the ExpertsSuppress the EgosAllow Authority to MigrateShare CredibilityReward Calls to Action and Cries for HelpAssessing Your Expertise Value BehaviorsScoring the Expertise Value Behavior SurveyFORCE Value Metrics for ExpertiseImproving Your Expertise Value BehaviorsEmbed Expertise Value into the Security ProgramMake Everyone a SensorCreate Decision Fast LanesValue Expertise from the Top DownFurther Reading
Chapter 16 Behavior and Culture: Mastering People-Centric Security
What Does Security Culture Transformation Mean?Describing Transformation in Terms of Cultural Capabilities MaturityThe Cultural Capabilities Maturity Model: Formalizing Cultural MaturitySupporting Security Culture Transformation with Security FORCE ProjectsThe Value of a Security FORCE ProjectManaging a Security FORCE ProjectThe Security FORCE ScorecardScoring the FORCE Survey Questions, RevisitedPooling Your FORCEsSecurity FORCE Metrics and the FORCE Scorecard“Are We a Highly Reliable Security Program?”CSCF and Security FORCE: Aligning Culture and Behavior in People-Centric SecurityChaining Culture and Behavior EffortsUsing the SCDS and FORCE IndependentlyGeneral Alignments Between Security FORCE and the CSCFTaking Advantage of Cultural-Behavioral AlignmentsBlending Security Culture Diagnostic and Security FORCE Projects for Improved Cultural MaturityFurther Reading
Chapter 17 Leadership, Power, and Influence in People-Centric Security
A Crisis of LeadershipThe CISO as a Business LeaderBusiness Leaders as Security EnablersSecurity Power Dynamics“What if I am not a CISO?”Leadership in People-Centric SecurityYou Don’t Lead MachinesInfluence and TransformationAdapting the CSCF and Security FORCE Model to LeadershipThe CSCF, SCDS, and Cultural LeadershipThe Security FORCE Model and Behavioral LeadershipFurther Reading
Chapter 18 Securing a People-Centric Future
The Security of ThingsSocial SecurityAs Many Securities as Things to SecureFraming People-Centric SecuritySecurity Soft PowerThree Takeaways from the BookPutting People-Centric Security to WorkTwo Models, One GoalPeople-Centric Security StrategiesConclusionFurther Reading
Index

Content preview from People-Centric Security: Transforming Your Enterprise Security Culture

CHAPTER

15 The Security Value of Expertise

Over the years that I managed penetration testing engagements, I ran into a curious phenomenon regarding expertise. Expertise should be something respected for its own sake. If you know your stuff, that knowledge should invite respect from others. At least that’s how it’s supposed to work. One of the reasons consultants and specialists (such as penetration testers) are hired and paid premium rates is the assumption that they know more than the organizations that hire them about their particular areas of expertise. That’s why my team of security engineers was routinely hired to test customers’ information security infrastructure for vulnerabilities. Our team would engage a customer, the engineers would ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cloud Backup Management with PowerHA SystemMirror

Publisher Resources

ISBN: 9780071846790

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

People-Centric Security: Transforming Your Enterprise Security Culture

by Lance Hayden

CHAPTER

15

The Security Value of Expertise

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.