Today, most of the cyber-attacks against companies are through their employees, who are in various ways enticed or tricked into helping. Yet, most of all security budgets go to technology. It is time for us to look at the whole picture.
Most people have heard of or been the subject of awareness campaigns aimed at getting people to change their behavior through increased awareness. However, the campaigns are rarely successful and a general example, which illustrates why, is that virtually all smokers are aware that it is dangerous but still smoke. Not even increased knowledge changes behaviors to any great extent.
To explain the difference between awareness, knowledge and culture, I usually use a cyclist and a traffic light. Awareness is then likened to seeing the crossing traffic and the red light at the top of the pole. Knowledge is to know that it is forbidden to drive against red, that there is legal support for it and that it can be both dangerous and expensive if I do it anyway. Culture can be likened to what I actually do there at the intersection and why. Is it worth cycling against red? Is there anyone in my environment who encourages me to stop (the police in the corner, the girlfriend on the bike next to or my son in the child seat?
An example of management system requirements from the Radiation Safety Authority:
§ 6 The management system must support and promote a culture which means that matters of importance to radiation safety receive the attention and priority that their importance requires.
I find it interesting that most of all road users stop at red if they are behind the wheel of a car, many fewer stops when they cycle and among those on scooters it is almost the exception. What happened to the culture when our laws are considered voluntary or that some consider themselves above them? What happens when he on the scooter comes to work and is expected to follow the company’s rules?
Awareness and knowledge are purely intellectual exercises while when it comes to security culture, the heart (in the form of commitment and morality) is also involved. Culture is also something that goes beyond the individual and to the group, it is common, and we create it together and destroy it together. An essential part of a culture is the informal norms. Since the managers are the ones who most often set the rules, follow up and give feedback, they also have the best conditions to change a culture. It is important that leaders encourage the behaviors that are desirable. Since the manager also has the most contact surfaces, you get a good leverage in culture building by letting the managers lead it.
The management’s best tool (in addition to encouragement) for managing the business and culture is the management system (the collection of instructions and guidelines). Utilize its potential and do not let it become a rounding mark.
Another powerful example, on the importance of using your management system, is that during 2023 Swedbank was fined by the Financial Supervisory Authority 850 million SEK because the bank did not follow its own routines for handling changes in IT systems. A good security culture rests on a handful of pillars:
What distinguishes a good security culture from an inadequate one:
In addition to the organization becoming more resilient to threat attacks, there are several other reasons to build a culture for security:
The latter are not least important for everyone deserves to feel good at work and - if we feel good, we perform well - and then it goes well for the business.
The people behind The Security Dragon have combined 25+ years of experience within the security sector.
