4. Strengthen Security Culture Through Communications and Awareness Programs

The average executive has probably been briefed on, or read about, security threats often but tends to be personally less knowledgeable than the general public about cybersecurity practices and self-assesses his or her business as not being well prepared. Moreover, we previously cited evidence that business executives tend to not consider cybersecurity strategic (see Chapter 2’s section “Cybersecurity Not Considered Strategic”).

According to a KPMG “U.S. CEO Outlook” study,² executive awareness of cybersecurity threats is high, but that doesn’t translate to being ready.

At the same time, business executives overall have relatively low detailed awareness of basic computer protection, privacy, and physical security according a MediaPro survey:

As discussed in Chapter 2’s section “Working at Cross-Purposes,” business leaders may be at odds with IT (and security) for all sorts of reasons – personal, organizational, and political reasons. Disruptive changes to IT and immaturity of security governance or risk management models contribute to the disconnect. Chapter 7’s section “Address Common Challenges” identifies additional structural difficulties for IT. Namely, digital business strategies often lead to decentralization or fragmentation of IT control as trends such as cloud computing, bring your own device (BYOD), and a new generation of power users devolve application and infrastructure management to business units and/or cloud service providers (CSPs).

In some cases, IT (and security teams) are on board with the growing momentum toward cloud-first strategies and acting as brokers/providers. In others, they are facing a diminishing role as providers of premise-based services with shrinking business unit buy-in. If the business and IT managers or staff perceive any of the following, it can have a corrosive effect on the security culture:

If cybersecurity isn’t considered strategic or business units are disengaged, business leaders are less likely to support sustained efforts to improve security culture. This chapter and the book as a whole proposes multiple recommendations to build better bridges to the business and improve the security culture. But first security leaders must look inward, at their organization, themselves, and their communication styles.

One definition of business culture is “The self-sustaining pattern of behavior that determines how things are done,” and it is further characterized as “An elusively complex entity that survives and evolves mostly through gradual shifts in leadership, strategy, and other circumstances.” The same authors argue that cultures are hard to change: “Cultures are constantly self-renewing and slowly evolving: What people feel, think, and believe is reflected and shaped by the way they go about their business. Formal efforts to change a culture (to replace it with something entirely new and different) seldom manage to get to the heart of what motivates people, what makes them tick. Strongly worded memos from on high are deleted within hours. You can plaster the walls with large banners proclaiming new values, but people will go about their days, right beneath those signs, continuing with the habits that are familiar and comfortable.”⁴

In my experience, security culture inherits many attributes of the business culture. The good news is that security culture is a smaller problem space, and many security behaviors can be improved through targeted awareness campaigns, process changes, and even user experience (UX) changes to technologies – without changing the core business culture.

Every security organization has a culture of its own and the opportunity to influence the security culture across the entire organization it serves. An unhealthy business security culture can emerge, however, when the security organization’s subculture is out of line with the broader business culture.

Both the CISO and the security team create the security organization’s subculture. Although a larger security organization will have multiple teams, one or just a few predominant personality archetypes (e.g., the “cop,” “ex-military,” “auditor,” “techie,” or “business school” type) will tend to dominate the security organization and its communication style. If this style is out of line with the business culture (e.g., highly authoritarian in a consensus-oriented culture or vice versa), the security organization is unlikely to be well regarded.

Even without cultural dissonance between the security organization and the business, security leaders tend to find communicating with executives or peer business leaders challenging. Security leaders, even CISOs, serve a nonrevenue-generating function that’s often positioned too low in the organization chart or informal executive pecking orders. They are often the bearers of bad news about incidents, vulnerabilities, deficiencies, and unwelcome regulatory requirements. To top it off, they may lack strong communication skills. An effort to overcompensate and overplay the fear, uncertainty, and doubt (FUD) card can get attention in the short run but lead to a loss of credibility when feared consequences don’t soon materialize.

Security culture is more than awareness, and as a social phenomenon, it is an outlier to both the business financial metrics and the security technical metrics domains. Measuring whether efforts to improve security culture are effective (or that any single awareness and training campaign has succeeded) is important for our ability to understand what works. However, taking such measurements is challenging.

Organizations and practitioners who are unaware of methods to measure security culture may turn to measuring proxies, such as number of attendees and completion rates of awareness training courses. These metrics are not very useful because they only measure (at best) one or two points along a continuum of security behaviors and ignore other cultural attributes.

If the purpose of security awareness training is to improve the overall culture and not just a single behavior (such as reporting phishing messages), then a set of metrics must be devised to measure a broad set of security culture attributes. Unfortunately, there is no ISO or NIST standard for how to do this nor much research to provide empirical evidence that conventional awareness programs are effective. Such efforts that have been made to measure awareness effectiveness typically use only counts or trends of security-related events and incidents.

Measuring incidents in isolation just creates confusion. If more incidents are reported, does that mean security is getting worse or just that incidents are – at last – being reported? Incident metrics alone won’t resolve uncertainty.

In the “Measure and Improve” section, we’ll discuss Kai Roer’s approach to measuring security culture as well as additional strategies.

Thought leader Edgar Schein once said about business culture in general: “If you do not manage culture, it manages you, and you may not even be aware of the extent to which this is happening.” Likewise, security culture can make or break a security program.

In fact, the root cause of many security breaches is not technology, but a “people” vulnerability such as an employee being tricked by a phishing message or other social engineering exploits into giving away credentials or installing malware. In other cases, a failure to follow a process, such as change control, is the culprit. Often, multiple things go wrong. A breach rarely is, and in fact should not be, caused by just one vulnerability.

Consider your own organization’s security culture, and ask yourself what would happen in the following “day in the life of a security program” examples:

When faced with an apparent no-win choice between business and security values, what will the management team do? Will it reason through the issues to find the least-bad choice or brainstorm a third way out, learn from the experience, and update company policies to clarify similar circumstances in the future?

Or will a series of unproductive meetings end with escalation to the CEO, bad choices, acrimony, and blaming? How did the organization get to this point?

The preceding story illustrates multiple problems. Security-related roles, responsibilities, and accountabilities were unclear, and the CEO placed a low priority on security. Thus, IT, development, and executive management failed to support deploying even such a basic control as data-in-transit encryption. The last paragraph of the story explains in the head of internal audit’s own words why the company’s woes with security stemmed from a cultural problem.

When security issues loom, the business’s fate may hinge on a ripple of knee-jerk reactions preprogrammed into the security culture. We’ve highlighted the possibility of failures – the things you want to avoid. Let’s also consider how a healthy security culture can help an organization avert security failures in most cases and respond well or recover quickly even from serious incidents. Is your organization ready? Do the leaders and staff really value security? Do they realize that it requires teamwork between security and business functions and what role they are to play? Do they buy into the policies they’re expected to observe and know what principles to consider when pressed to make a difficult decision?

Maybe not all that – yet. There probably is no perfect security culture out there. But there are plenty of good models that leading organizations can aspire to:

Bottom line: Businesses can create a security culture that is hospitable to positive models and outcomes like these by establishing and aligning effective security governance, user awareness and training programs, and a process to continuously measure and improve the security culture itself.

Earlier, we defined security culture as an organization or group’s amalgamation of perceptions about and behavior toward its own IT and security systems, security policies, and operational or social security practices and projects.

Figure 4-1 illustrates the interrelationship of perceptions and behavior with other security culture components as described in the report “Security Culture 2018: Measure to Improve.”⁶ Observe that in a security culture, attitudes, norms, cognition, and communication shape perception and behavior. Group perceptions and behavior create better or worse security outcomes. Each component of culture can be measured and has complex interactions with the other components.

Observe how the inputs and impacts (or outputs) of security culture form a feedback loop in Figure 4-1. The book “CISO Soft Skills” (discussed in Chapter 2) analyzes the security program and security culture using system theory. In the authors’ model and this one, negative inputs degrade the system, producing negative outputs and a vicious circle that degrades the culture. Positive inputs and outputs do the opposite. All security cultures have a mix of positive and negative attributes and flows.

Security culture in an organization is part of the larger business culture and needs to align with it. Figure 4-2 depicts various organizational culture concepts which are helpful for security leaders to understand.

General business culture can, according to the Harvard Business Review’s “The Culture Factor’s” research,⁷ be understood in terms of eight distinct cultural styles that fall along two dimensions: how people interact and how they respond to change. In another model, Hofstede Insights analyzes organizational cultures along six dimensions,⁸ including whether they are means oriented or goal oriented, internally or externally driven, easygoing or strict in work discipline, local vs. professional, open vs. closed, and employee oriented or work oriented. Hofstede also provides tools organizations can use to measure their cultures.

National cultures can be compared in many ways and must be considered as well as the general business culture in determining which security culture strategies and governance models (e.g., centralized, decentralized, and matrixed) will be effective. For example, organizations in a country typified by a high power distance⁹ are likely to have better results with a centralized, prescriptive leadership approach, while organizations in a country with a low power distance may align better with a decentralized or matrixed organization’s consensus- and collaboration-based processes.

In addition to national cultures, distinct occupational subcultures for executives/managers, office/administrative staff, developers, and other groups exist in almost all but the smallest organizations. Technology and IT services companies have many “white-collar” knowledge workers and developers. Health care has doctors and nurses; educational institutions have professors and teachers. Organizations in retail, manufacturing, utilities, and transportation have large numbers of “blue-collar” workers staffing factories, facilities, stores, or field operations. Government, financial services, and business services industry organizations have their own unique mixes of blue-collar and white-collar functions. The desired security cultural traits and the awareness methods to instill them may vary between these occupational subcultures, and the differences should be considered in deciding where a more prescriptive and where a more flexible and collaborative security culture strategy, governance, and communications approach would be optimal.

Some businesses – such as Chevron, Google, and Southwest Airlines¹⁰ – have a business culture that is clearly defined and intentionally cultivated in a consistent manner, some do not. One can look at an organization’s vision statement, or mission, to see if it calls out or implies a business culture style. If not, security leaders should look for other clues as to which of the cultural styles the organization seeks to follow.

Multinational businesses sometimes attempt to superimpose a global business culture vision over operating units in different countries; this scenario may dovetail with matrixed business, IT, and security governance (see Chapter 3). Or, local subsidiaries may be encouraged to operate with distinct national or local organizational cultures.

Other considerations: Organizational culture research doesn’t identify a perfect culture, since the efficacy of culture is relative to the goals of the organization. However, much is written about the (numerous) dysfunctional organizational cultures including one short piece from the Hofstede Insights.¹¹ Business leaders often identify and discuss culture issues on their own and may be in the middle of a culture change project.

Today’s users work online in a minefield of malware, ransomware, social engineering, and insecure devices, applications, and networks. Some primary purposes for awareness programs are to improve users’ understanding of cyber threats to themselves and the business as well as teach them to practice basic security hygiene against those threats. Role-based awareness and training can also be deployed to IT, development, and other business areas to reduce human or technical vulnerabilities and/or promote regulatory compliance.

Some of users’ most common insecure practices are

Security leaders (with the support of the business) should use the full array of security program instruments to promote more secure behavior including policy, processes, awareness programs, and tools that either prevent insecure behavior or discourage it. An even better approach is to make secure behavior the path of least resistance; for example, multifactor authentication obviates the need to create highly complex passwords and change them frequently.

Awareness program leaders can identify which kinds of insecure practices are most prevalent or serious for the business by

For further prioritization, the types of insecure practices can be correlated and prioritized for different audiences. Work environment factors to consider are the users’ business roles, hardware and software, IT-related roles, relevant risk scenarios, and defensive controls already in place. Find out whether different populations of users can

Awareness program leaders can then identify a small number of audience types and tailor awareness messaging and training. For example, at a retail company, one might target all employees and full-time contractors for phishing training and phishing simulation testing. However, only office workers with devices would be trained on device security hygiene. Only administrative staff and store managers would be trained on consumer privacy regulatory compliance during an initial awareness campaign.

Having selected the target behaviors and populations, identify specific awareness/training objectives, audiences, messages, and medium(s). Note that IT staff and developers might merit awareness and training on some of the same issues as end users, but the messages and training content could vary. For example, both end users and IT staff could be cautioned against sharing accounts. IT staff could also be advised of acceptable organization-standard account sharing workarounds such as password vaults for break glass access¹³ but cautioned to adhere to policies against granting excessive privileges to colleagues or end users.

Larger organizations under medium or high security pressure should have a group dedicated to awareness training and a communications organization providing content preparation and delivery. In smaller organizations, or organizations lacking staff dedicated to awareness and communication, the security leader responsible for the program should consult with internal marketing staff and/or supervisors to learn which mediums (e.g., videos, email newsletters, lunch and learn sessions, posters, etc.) would be most effective for each audience.

In “Transformational Security Awareness,” Carpenter repeatedly emphasizes the need to work with human nature, not against it. People tend to resist doing things that are difficult, awkward, or require change. We tend to quickly forget about 90% of our training unless it is reinforced through use. Carpenter writes that instilling knowledge and awareness is like “an exercise in cutting through the noise and slipping past the brain’s defenses” to motivate users, give them the ability, and continually prompt them do the right thing. Facing this challenge, it is generally best to automate the desired task or behavior whenever possible.

Awareness professionals must adjust content and tactics to the following user behavior groupings: Those motivated and able to perform a duty, those motivated but not able, those able but not motivated, and those with neither motivation or ability. That’s how deep security user awareness and training can get into behavioral science, multimedia content development, and attention management. Carpenter notes: “Being a security expert doesn’t naturally transfer to communicating security-related information to people outside the field.” Therefore, in my experience, successful awareness programs rely heavily on non-technical people with a background in marketing, education, or communications to work with technical experts.

Business people are more likely to be influenced by awareness and training if their managers and executives support the program.

Security leaders responsible for the awareness program should establish relationships with business or LOB executives, gain their trust, and seek their buy-in and support for the strategic use of awareness programs.

Once management is supportive, role- or audience-specific awareness and training doesn’t necessarily require an over-sized budget. The awareness program can reach out to influencers in the organization as well as security team members and IT staff to get some assistance. Consider using customizable curricula with a “train the trainer” approach. Engage experienced staff to introduce, explain, or add context to generic or third-party training content for their colleagues.

Involving IT or business-level staff in customizing role-specific training or awareness content not only builds the library of training materials but is also more engaging and memorable to the staff themselves. Role-specific training can be tied to corresponding security processes, such as how should

See Chapter 6’s Table 6-3 to identify which control domains engage which business functions. Consider training needs for managers and staff in the roles needed to implement each control domain according to the organization’s security or business processes. As the awareness program builds a network of key influencers throughout the organization, its ability to create a healthy security culture grows.

What if some of security culture’s woes are self-inflicted (see the “Ineffective Security Communication Styles” section)? Why then it would be useful to measure the progress and effect of efforts to apply the guidance in the “Make Enhancing Communication a Top Security Team Priority” section. CISOs can

Set targets for improvement based on the data and measure again after a period of time.

We can often measure the effectiveness of programs to promote more secure behavior by analyzing IT artifacts before and after awareness or training campaigns. Examples include events in logs, device or account security configuration settings or passwords, and test results such as the output from phishing simulations. In some cases, one must get creative about identifying IT artifacts that are outcomes of the behavior, such as the number of files flagged for containing sensitive data outside authorized repositories. Still other behaviors don’t produce IT artifacts but must be measured by human observation.

For other attributes of the security culture (see Figure 4-1) we can measure norms and attitudes through user surveys, and cognition or compliance through testing and observation.

Some of the industry insights provided in this chapter might not have been realized were it not for The Security Culture Report 2018.¹⁵ The results from the report demonstrate the value of being able to measure security culture. Repeating measurements at the organization level enables businesses to understand how their security culture improves or worsens over time and fine-tune awareness, training, and other programs to correct course as needed. Improvements in culture can also be cited in audit or compliance reports as evidence that “people and process” controls are operating effectively.

The CLTRe toolkit¹⁶ measures the attributes of security culture listed in Figure 4-1: attitudes, cognition, communication, compliance, norms, and behavior.