Security Culture Why You Need One and How to Create It Masha Sedova - - PowerPoint PPT Presentation
Security Culture Why You Need One and How to Create It Masha Sedova Co-Founder, Elevate Security About me Cyber Analyst for Co-Founder, building the defense community Behavioral Security Platform Built and ran Salesforce Passionate about
Why You Need One and How to Create It
Masha Sedova Co-Founder, Elevate Security
Elevate Security
2
About me
Built and ran Salesforce trust engagement team Co-Founder, building the Behavioral Security Platform Passionate about the intersection
Cyber Analyst for defense community
Elevate Security
3
Customer trust is built on security
Elevate Security
4
Elevate Security
5
52% of all breaches in the last year were due to hacking -VDBIR
Elevate Security
6
Culture
Elevate Security
7
What is culture?
Behavior Artifacts Beliefs Values Assumptions Experiences
“The way we do things around here....” Our experiences shape our beliefs, values, assumptions Our behaviors are driven by beliefs
“Culture eats strategy for breakfast.”
Elevate Security
9
Security Culture is a Subset of Enterprise Culture
Enterprise IT Security
Elevate Security
10
Positive vs Negative Security Culture
Elevate Security
11
Competing Priorities
Pick two
Elevate Security
12
Deadlines Cost Bonus Security Security Failure Security Debt
Opposing forces in an employee’s business decisions
Elevate Security
13
The Competing Security Cultures Framework
Process Culture
Goal: Enforce Policy
Compliance Culture
Goal: Pass Audits
Trust Culture
Goal: Empower People
Autonomy Culture
Goal: Get Results
External Focus Internal Focus Tight Control Loose Control
Elevate Security
14
Process Culture
Managed Coordination Stability Visibility Standardization
Goal: Enforce Policy
Compliance Culture
Rational Goals Conformity Repeatability Documentation
Goal: Pass Audits
Trust Culture
Human Relations Communication Participation Commitment
Goal: Empower People
Autonomy Culture
Adaptive Systems Flexibility Agility Innovation
Goal: Get Results
External Focus Internal Focus Tight Control Loose Control
Elevate Security
15
Results of SCDS
Elevate Security
17
Elevate Security
18
The Five Whys Tool
Ask the five whys to get to the root of a problem.
Elevate Security
19
Problem Statement:
My car battery is dead
its useful service life and has never been replaced.
alternator belt according to any recommended service schedule.
Elevate Security
20
Do it! Changing mindset is the hardest way to go about enforcing change.
Communication, marketing, awareness campaigns
Training and skills
Management alignment
Gamification and incentives
Motivation Ability Trigger
Key components of behavioral science
Elevate Security
23
Behavior change model
*Dr. BJ Fogg
Motivation Ability
High Low Hard Easy Triggers Fail Triggers Succeed
Elevate Security
24
Behavior change model
*Dr. BJ Fogg
Motivation Ability
High Low Hard Easy Triggers Fail Triggers Succeed
Elevate Security
25
Remember 20 unique characters across 40+ sites Install a password manager Install a man-trap or in/out badging Social accountability Look up correct email, reporting guidelines & send Install a “report” button
Security action can be simplifjed
Have secure passwords for all sites Report suspicious activity Stop tailgating
HARD EASY
Elevate Security
26
*Dr. BJ Fogg
Motivation Ability
High Low Hard Easy Triggers Fail Triggers Succeed
What about things that are hard to do?
Elevate Security
27
Elevate Security
28
People will do things because they matter, they are interesting, part of something more important.
Daniel Pink, Drive
Elevate Security
29
How to Create Positive Motivation
Competition Altruism Access Achievement Status
Elevate Security
30
Elevate Security
31
Control Keep Your Account Safe 108 of your friends use extra security settings. You can also protect your account and make sure it can be recovered if you ever lose access. Keep Your Account Safe You can use security settings to protect your account and make sure it can be recovered if you ever lose access. Social context
1.36x more successful when using social proof
Elevate Security
32
Compromised Rates
Elevate Security
33
Password manager
Elevate Security
34
Applying Gamifjcation
Elevate Security
35
Understand your security culture Assess if its a positive or negative security culture Identify the blockers to positive security culture Reinforce and motivate positive behaviors
Takeaways
Elevate Security
36
Q&A
Masha@ElevateSecurity.com