Speaker 1: Welcome to the deep dive. We take source material and
Speaker 1: try to find the really interesting stuff, and today we
Speaker 1: are diving deep into security culture. We're looking at the
Speaker 1: Security Culture Playbook.
Speaker 2: Great choice.
Speaker 1: You're clearly interested in the human side of cybersecurity.
Speaker 2: Absolutely, and it's a good.
Speaker 1: Thing because technology alone can't really.
Speaker 2: Secure anything right now, that is one hundred percent correct.
Speaker 2: It's people who use that technology. They make the decisions. Ultimately,
Speaker 2: they determine how secure an organization is.
Speaker 1: The book starts with a pretty intriguing comparison. It says
Speaker 1: that security culture is a bit like Bigfoot. Okay, everyone's
Speaker 1: heard of it, some claim they've seen it, but it's
Speaker 1: pretty hard to define.
Speaker 2: Yeah, that's such a great analogy. Security culture is this
Speaker 2: elusive concept that organizations struggle to define, let alone measure
Speaker 2: or improve. We talk about it, but do we really
Speaker 2: know what it is or how to cultivate it.
Speaker 1: Yeah, and the authors Perry Carpenter and Chiro Roar, they
Speaker 1: should know what they're talking about. I mean, they've got
Speaker 1: over thirty five years of experience in this field for sure.
Speaker 1: And what's interesting is they point out a major flaw
Speaker 1: in traditional security programs.
Speaker 2: Yeah, for a long time, we focus so much on
Speaker 2: the technology, on the firewalls and intrusion detection systems, we
Speaker 2: kind of forgot about the people using those systems, right,
Speaker 2: So it's.
Speaker 1: Like we have all these fancy tools, but then somebody
Speaker 1: clicks a fishing link and boom, the whole networks confromise exactly.
Speaker 1: In the book sites some pretty alarming statistics. Yeah, did
Speaker 1: you know that by twenty thirty one, experts are predicting
Speaker 1: a ransomware attack will occur every two seconds.
Speaker 2: That's that's a scary thought. It really kind of drives
Speaker 2: home the point that we need to get security culture right.
Speaker 2: There's a study by Noah Jay four. They found that
Speaker 2: employees and organizations with a weak security culture are fifty
Speaker 2: two times more likely to fall for phishing scams. Fifty
Speaker 2: two times fifty two times. Wow, that's a big difference.
Speaker 1: That's huge. So clearly, building a strong security culture is
Speaker 1: not optional, right, It's not negotiable, it's essential. So how
Speaker 1: do we actually go about building this human firewall?
Speaker 2: So the Security Culture Playbook provides a framework with seven
Speaker 2: dimensions of security culture, and I think it's really helpful
Speaker 2: to think of these dimensions as as interconnected gears in
Speaker 2: this complex machine.
Speaker 1: Okay, I like that analogy. Let's break down these gears.
Speaker 1: Let's start with attitudes.
Speaker 2: Okay, So attitudes are all about how employees feel about security.
Speaker 2: Do they see it as a priority or is it
Speaker 2: just another box they have to check.
Speaker 1: I imagine a positive attitude goes a long way in
Speaker 1: shaping behavior. Yeah, and that leads us to the next dimension, right,
Speaker 1: behaviors exactly.
Speaker 2: Behaviors are those actions that employees take. Are they following
Speaker 2: the protocols? Are they being careful about what they click on?
Speaker 2: What they download?
Speaker 1: This is where it gets interesting. The book talks about cognition,
Speaker 1: which seems to go deeper than just knowing the rule right.
Speaker 2: Cognition is about understanding. It's about having the mental models
Speaker 2: to make informed decisions, like recognizing a phishing email even
Speaker 2: if it's really well disguised, or knowing how to report
Speaker 2: a potential security incident.
Speaker 1: So it's not enough to tell people what to do.
Speaker 1: They need to know the why behind.
Speaker 2: The rules precisely. And that brings us to communication, which
Speaker 2: I think is the oil that keeps that security culture
Speaker 2: machine running smoothly.
Speaker 1: Because if nobody understands what's going on or why it matters.
Speaker 1: How can they follow the rules?
Speaker 2: Exactly? Communication needs to be clear, consistent, and engaging. It's
Speaker 2: not just sending out those occasional security awareness emails. It's
Speaker 2: about making security a part of the entire organization's communication strategy.
Speaker 1: Okay, so we've got attitudes, behaviors, cognition, and communication. What's next.
Speaker 2: Well, compliance is really important.
Speaker 1: Okay.
Speaker 2: It's about making sure people understand and follow security policies.
Speaker 2: But it's more than just having those policies right. It's
Speaker 2: making sure they make sense, that they're practical, easy to follow.
Speaker 1: Because if there are one hundred pages long and written
Speaker 1: in legal ease, nobody's going to read them, let alone
Speaker 1: follow them, right.
Speaker 2: Right, exactly. The goal is to create a culture of
Speaker 2: compliance where people understand the rules and they choose to
Speaker 2: follow them because they see the value.
Speaker 1: Okay. Next up is norms, which sounds a bit more
Speaker 1: subtle than some of the other dimensions.
Speaker 2: Norms are those unridden rules, those unspoken expectations about what's
Speaker 2: okay and what's not okay? Uh huh, Like is it
Speaker 2: normal to share passwords or leave your computer unlocked? These
Speaker 2: norms they can either help or hurt your security efforts.
Speaker 1: Right, because if everyone's sharing castwords, it doesn't matter how
Speaker 1: strong your password policy.
Speaker 2: Is, right exactly.
Speaker 1: And finally, we have responsibilities, which seems pretty self explanatory.
Speaker 2: It might seem that way, but this dimension is all
Speaker 2: about clarifying who's in charge of what. Okay, do employees
Speaker 2: know what their role is in protecting sensitive information? Do
Speaker 2: they know how to report an incident? And do they
Speaker 2: feel empowered to do so?
Speaker 1: So it's about creating a culture of accountability where everyone's
Speaker 1: taking ownership of security.
Speaker 2: Exactly. These seven dimensions they all work together to create
Speaker 2: this strong security culture where security is a part of
Speaker 2: the DNA of the organization.
Speaker 1: Okay, so we've laid out the framework, but how do
Speaker 1: we know where to start? The book mentions shadow it
Speaker 1: as a potential red flag, right, what exactly is that?
Speaker 2: Shadow it? Is? When people use unauthorized software or cloud services.
Speaker 2: Ok So, imagine an employee is storing sensitive company data
Speaker 2: on their own personal dropbox account because it's just more
Speaker 2: convenient than using the company system.
Speaker 1: Uh huh, So it's kind of like going rogue with technology.
Speaker 2: Yeah, kind of.
Speaker 1: And I can see how that would create security.
Speaker 2: Risks, Absolutely it can and what's surprising is how common
Speaker 2: it is. Yeah, studies have shown that like twenty to
Speaker 2: fifty four p sent of employees admit to using these
Speaker 2: unauthorized cloud services.
Speaker 1: Wow, I wouldn't guess the numbers were that high. So
Speaker 1: if we're seeing shadow it happening, that's a pretty clear
Speaker 1: sign that something's off with the security culture.
Speaker 2: It's a sign that we need to dig a little deeper.
Speaker 2: Why are employees bypassing the security measures? Is it because
Speaker 2: they don't know any better, or they find the tools
Speaker 2: to be clunky and hard to use, or is there
Speaker 2: just this cultural norm that needs to be addressed. Shadow
Speaker 2: it it's a symptom, not the disease itself. It's a
Speaker 2: sign that there's this disconnect between what the organization says
Speaker 2: about security and what's really happening.
Speaker 1: So we've identified these gaps. Maybe we see some shadow
Speaker 1: I tea going on, phishing attempts are getting through. How
Speaker 1: do we actually start to improve things?
Speaker 2: Well, the playbook it lays out this three step process. Okay, measure, involve, engage.
Speaker 1: Sounds like a good plan. I'm guessing it all starts
Speaker 1: with figuring out where we are, where we stand.
Speaker 2: Currently exactly you can't fix what you can't measure. The
Speaker 2: book recommends using something called the Security Culture Survey to
Speaker 2: establish that baseline. This survey it assesses all those seven
Speaker 2: dimensions we talked about, and it gives organizations this clear
Speaker 2: picture of their security culture maturity.
Speaker 1: So once we have the data, what's next we involve?
Speaker 2: We involve the stakeholders. Yeah, and the key here is
Speaker 2: using the language of risk, which is something that business
Speaker 2: leaders understand. It's about connecting security culture to business outcomes.
Speaker 1: Because at the end of the day, security is about
Speaker 1: protecting the business exactly right. So we need to show
Speaker 1: those stakeholders why a strong security culture is a good
Speaker 1: investment for sure.
Speaker 2: And once you have buy in from those stakeholders, you
Speaker 2: move to engage where you actually put in place these
Speaker 2: activities and communication strategies to improve the culture.
Speaker 1: Okay, so this is where the rubber meets the road.
Speaker 1: What kind of activities are we talking about?
Speaker 2: Oh, it could be targeted training programs, It could be
Speaker 2: phish simulations to test employee awareness, or even gamification.
Speaker 1: Gamification, Yeah, tell me more about that.
Speaker 2: Gamification is about using game mechanics like points, badges, leader boards,
Speaker 2: things like that to encourage good behavior. Okay, it taps
Speaker 2: into our natural desire for competition and achievement, so it
Speaker 2: can be a really effective way to engage people.
Speaker 1: Okay, I'm getting some ideas here. But beyond specific activities,
Speaker 1: the book also emphasizes the importance of storytelling. It even
Speaker 1: compares it to the transformation of safety culture in the
Speaker 1: oil and gas industry.
Speaker 2: It's a fascinating comparison, isn't it. The oil and gas industry.
Speaker 2: I mean, they used to have a terrible safety record,
Speaker 2: but then they went through this major cultural shift and
Speaker 2: they made safety a top priority and they embedded it
Speaker 2: into everything they did, and storytelling was a big part
Speaker 2: of that.
Speaker 1: Yeah, and I can see how a powerful personal story
Speaker 1: it makes the risks feel more real, much more immediate.
Speaker 1: Stories they resonate with us on a deeper level.
Speaker 2: I think they do. They stick with you.
Speaker 1: Yeah.
Speaker 2: They're more memorable than just you know, drive facts and figures.
Speaker 1: Right.
Speaker 2: Imagine you share a story about a company that was
Speaker 2: that was hacked, right because they had weak passwords. That's
Speaker 2: a lot more impactful, right than just telling employees, hey,
Speaker 2: make sure you have a strong password.
Speaker 1: Yeah, It's like, hey, this could happen to us.
Speaker 2: Exactly.
Speaker 1: But it's not just about scaring people right now.
Speaker 2: It's also about about celebrating those successes, you know, highlighting
Speaker 2: positive security behaviors, recognizing people who are who are doing
Speaker 2: a good job. Right The book calls these people culture carriers.
Speaker 1: The security champions, people who are like really passionate about
Speaker 1: security and they can get other people excited about it.
Speaker 2: Yeah, they're your security evangelists. Yeah, the people who help
Speaker 2: spread the message and make it a priority for everyone.
Speaker 1: Finding and empowering those seems really important.
Speaker 2: Absolutely.
Speaker 1: Now. It strikes me that we've been talking a lot
Speaker 1: about what organizations can do, but what about individuals. What
Speaker 1: role can they play in shaping security culture.
Speaker 2: That's a great question. Individual responsibility is really important. Each
Speaker 2: person needs to be proactive to stay informed about the threats,
Speaker 2: to practice good cyber hygiene, to report anything that seems suspicious.
Speaker 1: So it's about being security minded. Yeah, not just at work,
Speaker 1: but in all parts of our lives exactly. But they
Speaker 1: get a full understanding of security culture.
Speaker 2: Yeah.
Speaker 1: The book goes beyond these practical strategies, and it actually
Speaker 1: includes interviews with experts.
Speaker 2: Yeah, they have a lot of really interesting perspectives in there.
Speaker 1: What insights did you find particularly valuable.
Speaker 2: Well, one recurring theme was that that culture change. It's
Speaker 2: an organization wide thing. It's not just a security issue.
Speaker 2: John Schulders from Pyxis Culture Technologies. He argues that that
Speaker 2: everything shapes culture, from hiring practices to leadership styles.
Speaker 1: So it's not just about what the security team does,
Speaker 1: it's about how the whole organization operates.
Speaker 2: Absolutely, and Michael Lecky from Silverback Partners he emphasizes the
Speaker 2: importance of aligning security culture with business goals security leaders.
Speaker 2: They need to articulate the value of security in a
Speaker 2: way that makes sense to business leaders.
Speaker 1: So it's about making security and a nabler, not an obstacle.
Speaker 2: Right. Another expert, doctor Jessica Barker, She highlighted how effective
Speaker 2: those security Champions programs can be. She argues that having
Speaker 2: those passionate advocates within teams right, can be incredibly powerful.
Speaker 1: So it's like building a grassroots movement from the inside. Yeah.
Speaker 1: And these champions can then use storytelling exactly to connect
Speaker 1: with their colleagues.
Speaker 2: On a personal level.
Speaker 1: Yeah. But while storytelling is important, the experts also said
Speaker 1: that data and measurement are important too.
Speaker 2: Right, how do we know if what we're doing is
Speaker 2: actually working.
Speaker 1: Yeah, that's a key point. It's one thing to talk
Speaker 1: about security culture, but how do we know if it's
Speaker 1: really effective.
Speaker 2: Several experts recommend focusing on metrics that are tied to
Speaker 2: those business outcomes. So are we seeing a reduction in
Speaker 2: phishing attacks? Are we seeing less shadow it? Fewer security
Speaker 2: incidents overall?
Speaker 1: So it's not just about tracking how many people finish
Speaker 1: the training course, it's about seeing if it's actually making
Speaker 1: a difference exactly.
Speaker 2: Mark Macjefski, he's an information security evangelist. He suggests going
Speaker 2: a little deeper with those security culture surveys. He proposes
Speaker 2: questions like is protecting client data a priority in your company?
Speaker 2: These types of questions they get at those underlying values
Speaker 2: and norms that shape behavior.
Speaker 1: It's like getting the real story. Yeah, not just what
Speaker 1: people say on the surface exactly.
Speaker 2: But even with the best data and strategies, they're always challenging.
Speaker 1: Of course, what were some of the sticking points the
Speaker 1: experts brought up.
Speaker 2: Well, one of the biggest was this knowledge intention behavior gap.
Speaker 2: Just because someone knows the right thing to do doesn't
Speaker 2: mean they'll actually do it. Yeah, we've all been there Exactly.
Speaker 2: We might know we need to make a strong password,
Speaker 2: but then we end up just reusing an old one
Speaker 2: because it's easier, right. Or we know we shouldn't click
Speaker 2: those suspicious links, but you know, we get curious.
Speaker 1: Yeah. The book suggests that security leaders they need to
Speaker 1: design their programs with these biases in mind. Right.
Speaker 2: Absolutely, it's not enough to just give people information, right.
Speaker 2: We need to make it easy for them to make
Speaker 2: those secure choices.
Speaker 1: Right. If the tools are hard to use, people are
Speaker 1: going to find workarounds.
Speaker 2: Exactly. People they want to do things the easy way.
Speaker 1: Yeah.
Speaker 2: Another sticking point was this tendency to view security culture
Speaker 2: through the lens of our own experiences. It professionals, they
Speaker 2: might assume that everyone understands how important security is, right
Speaker 2: while other departments so they might be more focused on
Speaker 2: productivity getting things done.
Speaker 1: So we need to get out of our bubbles and
Speaker 1: realize that different people have different priorities.
Speaker 2: Absolutely, the book encourages security leaders to get input from
Speaker 2: different people and really challenge their own assumptions.
Speaker 1: It's about understanding where other people are coming from.
Speaker 2: Yeah, we need to recognize that what seems obvious to
Speaker 2: one person might not be so clear to someone else, right, And.
Speaker 1: This brings us back to that idea of measurement. The
Speaker 1: Security Culture Playbook goes pretty deep on the Security Culture
Speaker 1: survey sees. This tool is designed to assess those seven
Speaker 1: dimensions we talked about before, and it's really interesting how
Speaker 1: they developed it. It started with this huge pool of questions,
Speaker 1: and over the years they refined it and now it's
Speaker 1: this concise and effective tool.
Speaker 2: It's powerful because it gives us a way to actually
Speaker 2: measure security culture, so we can track our progress and
Speaker 2: see what we need to work on.
Speaker 1: The book has some really good examples of how to
Speaker 1: use data to improve security culture, like this idea of
Speaker 1: connecting awareness, behavior and culture right.
Speaker 2: Research has shown that that there's a correlation between knowledge
Speaker 2: and behavior. When employees understand the threats and the best practices,
Speaker 2: they're more likely to be careful.
Speaker 1: But the book says, don't assume that one clauses the other.
Speaker 2: Yeah, it's not that simple. Just because someone knows what
Speaker 2: to do doesn't guarantee they'll do it right.
Speaker 1: There are other factors are like attitudes and norms and
Speaker 1: even pressure at work Exactly all those things can affect behavior,
Speaker 1: so it's.
Speaker 2: Not as easy as, let's train everyone and then magically
Speaker 2: they'll be security minded.
Speaker 1: Right. We need to create an environment that supports good
Speaker 1: security habits exactly.
Speaker 2: We can also use data that we already have to
Speaker 2: measure security culture. We can look at incident reports to
Speaker 2: see if there are any patterns, see if there are
Speaker 2: any areas where maybe people need more training.
Speaker 1: It's like we're detect is looking for clues. Yeah, trying
Speaker 1: to figure out the story of the organization's security culture.
Speaker 2: And speaking of stories, the playbook suggests using something called
Speaker 2: ab testing. Okay, this technique comes from marketing. Basically, instead
Speaker 2: of just guessing what will work, we can try out
Speaker 2: different approaches, right and see what works best.
Speaker 1: So, like an organization could could test two different security
Speaker 1: awareness modules, right, and see which one leads to people
Speaker 1: being better at spotting phishing emails.
Speaker 2: Exactly. We want to use data to guide our decisions, right,
Speaker 2: to make sure we're having the impact that we want, and.
Speaker 1: It's important to use metrics from different sources, right.
Speaker 2: Just relying on one metric can be misleading.
Speaker 1: It's like judging someone's health just by looking at how
Speaker 1: much they weigh, right, It doesn't give you the whole picture.
Speaker 2: So we want to combine data from those security assessments,
Speaker 2: the phishing simulations, the incident reports, employee surveys. Right, all
Speaker 2: of that together gives us a much better understanding of
Speaker 2: the culture and.
Speaker 1: Then that really fix the problems exactly.
Speaker 2: You need to be able to identify those root causes.
Speaker 1: Building a good security culture.
Speaker 2: It's a journey, it is.
Speaker 1: Yeah, it takes time, it does.
Speaker 2: We're constantly learning and adapting. We need to be open
Speaker 2: to feedback, willing to experiment.
Speaker 1: The Security Culture Playbook has given us a lot to
Speaker 1: think about. It has It's like a guide to making
Speaker 1: security a part of who the organization is.
Speaker 2: It's about making security part of everyday conversations, decisions, part
Speaker 2: of the values that drive the organization.
Speaker 1: As we wrap up this deep dive, we encourage you
Speaker 1: to think about how you can apply these ideas to
Speaker 1: your own organization. What's one small step you can take
Speaker 1: today to make a difference.
Speaker 2: Maybe share a security tip with your team or talk
Speaker 2: to your manager about security culture. Every little bit helps,
Speaker 2: it does we can all contribute to a more secure
Speaker 2: digital world.
Speaker 1: Thank you for joining us on this deep dive into
Speaker 1: the Security Culture Playbook. We hope you've found it insightful.
Speaker 1: Until next time, stay curious, stay engaged, and stay secure.