Security Culture Why You Need One and How to Create It Masha Sedova Co-Founder, Elevate Security
About me Cyber Analyst for Co-Founder, building the defense community Behavioral Security Platform Built and ran Salesforce Passionate about the intersection trust engagement team of security & behavioral science 2 Elevate Security
Customer trust is built on security 3 Elevate Security
4 Elevate Security
52% of all breaches in the last year were due to hacking -VDBIR 5 Elevate Security
Culture 6 Elevate Security
What is culture? “The way we do things around here....” Behavior Artifacts Beliefs Values Assumptions Our experiences shape our Experiences beliefs, values, assumptions Our behaviors are driven by beliefs 7 Elevate Security
“Culture eats strategy for breakfast.” -Peter Drucker
Security Culture is a Subset of Enterprise Culture Enterprise IT Security 9 Elevate Security
Positive vs Negative Security Culture 10 Elevate Security
Competing Priorities Pick two 11 Elevate Security
Opposing forces in an employee’s business decisions Deadlines Security Cost Bonus Security Debt Security Failure 12 Elevate Security
Tight Control Compliance Process Culture Culture Goal: Enforce Policy Goal: Pass Audits The Competing External Focus Internal Focus Security Cultures Framework Trust Autonomy Culture Culture Goal: Empower People Goal: Get Results Loose Control 13 Elevate Security
Tight Control Compliance Culture Process Culture Rational Goals Managed Coordination Conformity Stability Repeatability Visibility Documentation Standardization Goal: Enforce Policy Goal: Pass Audits External Focus Internal Focus Trust Culture Autonomy Culture Human Relations Adaptive Systems Communication Flexibility Participation Agility Commitment Innovation Goal: Empower People Goal: Get Results Loose Control 14 Elevate Security
Results of SCDS 15 Elevate Security
How do we drive change?
Root Cause Analysis 17 Elevate Security
Understanding the Problem The Five Whys Tool Ask the five whys to get to the root of a problem. 18 Elevate Security
The Five Whys- Example Problem Statement: My car battery is dead 1. Why? – The alternator is not functioning. 2. Why? – The alternator belt has broken. 3. Why? – The alternator belt was well beyond its useful service life and has never been replaced. 4. Why? – I have not been maintaining my alternator belt according to any recommended service schedule. 5. Why? I didn’t realize this had to be done. 19 Elevate Security
Investigate Root Cause ● Can this be solved with technology? Do it! Changing mindset is the hardest way to go about enforcing change. ● “I didn’t realize that security was part of my job.” Communication, marketing, awareness campaigns ● “I didn’t know what to do about it.” Training and skills ● “I didn’t have the resources or support to do it.” Management alignment ● “I didn’t want to.” Gamification and incentives 20 Elevate Security
Behavior Change
Key components of behavioral science Motivation Ability Trigger
Behavior change model High Motivation Triggers Succeed Triggers Fail Low Ability *Dr. BJ Fogg Hard Easy 23 Elevate Security
Behavior change model High Motivation Triggers Succeed Triggers Fail Low Ability *Dr. BJ Fogg Hard Easy 24 Elevate Security
Security action can be simplifjed Have secure Report Stop passwords for all sites suspicious activity tailgating Remember 20 unique Look up correct email, Install a man-trap or HARD characters across 40+ sites reporting guidelines & send in/out badging Install a password manager Install a “report” button Social accountability EASY 25 Elevate Security
What about things that are hard to do? High Motivation Triggers Succeed Triggers Fail Low Ability *Dr. BJ Fogg Hard Easy 26 Elevate Security
Most employees will not care about security as much as we’d like them to 27 Elevate Security
What motivates us? “ People will do things because they matter, they are interesting, part of something more ” important. Daniel Pink, Drive 28 Elevate Security
How to Create Positive Motivation Status Competition Altruism Access Achievement 29 Elevate Security
The power of social proof 30 Elevate Security
Social proof Control in security Keep Your Account Safe You can use security settings to protect your account and make sure it can be recovered if you ever lose access. Social context Keep Your Account Safe 1.36x more successful 108 of your friends use extra security settings. You can when using social proof also protect your account and make sure it can be recovered if you ever lose access. 31 Elevate Security
Compromised Rates 32 Elevate Security
Password manager 33 Elevate Security
Applying Gamifjcation 34 Elevate Security
Takeaways Understand your security culture Assess if its a positive or negative security culture Identify the blockers to positive security culture Reinforce and motivate positive behaviors 35 Elevate Security
Q&A Masha@ElevateSecurity.com 36 Elevate Security
Recommend
More recommend
