The Security Culture Playbook

Chapter 10How to Influence Culture

You get the culture you ignore.

John R. Childress

Culture is everywhere. Just as every organization has its own unique organizational culture, every organization also has its own unique security culture. And that means your organization already has a security culture, even if you don't yet have an established culture management program. It's up to you to make sure that your security culture reflects the knowledge, beliefs, values, and behaviors that properly represent the culture you desire.

This chapter explores how you can proactively influence your organization's security culture. Culture change can be both difficult and time consuming, but it doesn't have to be. By applying the right mixture of actions, at the right place and time, you can shape new ideas, shift behaviors, and improve perceptions of security.

Culture is constantly evolving and changing; it has an in-built plasticity.

Culture is constantly evolving and changing; it has an in-built plasticity.

This property of culture allows it to inform its members of what is accepted and what is not, as well as be informed by its members about the same. New ideas and behaviors can be introduced and adopted. Old ideas and behaviors can evolve or be discarded. Shaping culture is a constant and ongoing process where you'll always be evaluating (and reevaluating) the tactics needed to adapt to the current state and your target state. Another benefit of this property of culture is that ...