Transformational Security Awareness

5Culture Management 101 for Security Awareness Leaders

The importance of a strong cybersecurity culture cannot be understated. It transcends technologies, processes, and even people. It is bigger than security awareness. Security culture becomes ingrained everywhere you look and touch. It is aligned with the objectives of the business. Everybody doesn't just practice security, they also own it.

Dan Kaplan, Trustwave¹

It's flashback time. Early in the previous chapter, I used a quote from BJ Fogg stating that, “Humans are lazy, social, and creatures of habit.” Throughout that chapter, and in previous chapters, I've referenced the social components of belief and behavior. Here is where the rubber really meets the road: culture. A positive security culture is a force multiplier for behaviors, beliefs, and messages; it represents a critical social component that will either work for you or work against you. And the ability to shape the security-related aspects of your organization's culture represents the pinnacle of our journey into transformational security awareness.

NOTE

A security culture lives and breathes within every organization. The question is how strong, intentional, and sustainable is your security culture, and what do you need to do about it?²

MENTAL NOTE: THINKING ABOUT THE SEMANTICS OF CULTURE

Here's an interesting question posed by consultant, podcast host, and author, Bruce Hallas. Bruce asks, “Are we looking for a security culture; or are we looking ...