The Academic Perspective

Academic research follows high standards that often require peer review, ethics reviews, and usually focuses on granular detail. This is great when it comes to understanding the nuances and the different impacts that certain behavioral interventions, training messages, or other tactics may have. It is also extremely helpful when examining isolated elements and their relation to other elements of culture. The challenge, though, is that most academic research is very narrowly focused. It only tells a small part of the story, leaving the rest to interpretation or to be tackled in a later study.

Another challenge is that academics from a wide range of scientific fields of study—from computer scientists to psychologists, and from organizational theorists to economists, to name just a few—are looking into security culture from their own perspective without communicating and sharing their learning across the different fields. This means that the growing body of research is fragmented and difficult to follow, and that sometimes the debate feels more like a turf-war than a mutual interest in furthering the field of research.

The upside is that security culture is being researched from all these different angles, which will be extremely helpful to anyone willing to assemble learnings from across all these disciplines.

The final challenge with academic research is the lack of distribution outside of academic circles.

The Practitioner Perspective

Practitioners in our industry agree that security culture is a vital component of their cybersecurity program. As we mentioned in Chapter 1, however, research shows that security practitioners have difficulty agreeing on what security culture is. This may be because the phrase security culture is rather new, leading to some confusion. Our industry has talked about security awareness for a long time, leading to some security people thinking security culture is just awareness with a new name. Another bias we see, particularly in some industries where safety is key to success, is a definition of security culture as though it is safety culture: dealing with the physical world instead of the abstracted world of information. It is much easier for us as humans to understand how a hard hat will protect our head from falling debris versus understanding how sharing our credentials in a phishing scam can injure us and our employer.

Talk of security culture is sometimes met with skepticism. Is it not only smoke and mirrors? Is it just awareness rebranded? This skepticism is warranted. We've seen smoke-and-mirror security culture marketing before. But, thankfully, we've recently seen the market offering a bit more substance. That's encouraging. Some of this might even be due to our own efforts in this space, such as Kai's creation of the Security Culture Framework and the Security Culture Survey (which we'll be covering in the next few chapters), Perry's research and writing around awareness, behavior, and culture, and Kai's research into seven specific dimensions of security culture.

Understanding that security culture is really a combination of several observable and measurable components (or dimensions) is fundamental to finding ways to intentionally influence and improve security culture.

This understanding also allows for clear reporting to executive teams, boards of directors, employees, and more. In fact, these seven dimensions of security culture and the Security Culture Survey form the foundation of another of Kai's efforts: the annual Security Culture Report.

Security Culture as Dimensions

From a research perspective, we define security culture as a set of seven interdependent dimensions that together capture the phenomenon that we call security culture. Each dimension is found in academic research geared toward the study and measurement of culture from a sociological perspective. As of this writing, our research suggests that these seven dimensions are the most influential cultural elements related to security.¹ Culture is more than just these seven dimensions, and your perspective will often determine which other elements you want to include in your own studies.

Each of the dimensions influences the other dimensions, creating a multitude of layers of influence, both direct and indirect. This complexity is supported by other research in the field—for example, the knowledge-attitude-behavior model proposed by Stephen Allen Robert (Roberts, 2020). This complexity may initially feel overwhelming, but trust us, it pays off. If you want to measure and influence culture, then you need the precision offered by this kind of model.

Attitudes

The attitudes employees have toward security is a critical factor. If employees are negative toward security, they are much less likely to abide by the rules and to act securely. For example, research has shown that the best predictor of behaviors is not knowledge (training) but the employee's attitudes toward security. This means that finding ways to foster positive attitudes toward security can be a great strategy to improve behavior.

Behaviors

What employees see other employees do is very impactful on their own behavior. Most people are likely to adopt the behaviors that they see modeled by others when they are in a group. We are also very likely to do what we are told by someone in authority, suggesting that leadership should be actively involved in security.

Cognition

What employees know can influence their behavior. However, just because someone is aware doesn't mean that they care! And even caring doesn't always translate to behavior. This is what Perry calls the “knowledge-intention-behavior gap.” Training is an important part of any security culture program, but it is not the end-all. Instead, consider training as only one of many tools in your toolbox. Support it with strong messaging from the executives and leadership, and make sure the employees understand why security is paramount. Further support your training program through behavior design initiatives and by trying to foster other areas of influence, such as reward and reinforcement systems.

Communication

One of the skills of great leaders is their ability to communicate. Often you will hear them repeat the same vision many times over, in many different forms and forums. Great leaders recognize the importance of setting the agenda and repeating the message so that every employee can understand and relate. Security is no different: If you want it to happen, repeat your values often and find ways to make people talk about it.

Compliance

Organizations need rules to ensure that employees know what is allowed and what is not. Some organizations are very good at implementing policies and incentives, whereas others are not. If your security policies and procedures are not being followed, it may be because employees are unaware of the policies and procedures, or your policies and procedures are too difficult to follow, or because you need other methods and systems to support compliance.

Norms

Norms are the informal rules, those policies of the group that are not written down and formalized. Some norms may contradict policies. People are more likely to follow norms than complying with policies due to perceived peer pressure. Norms in your organization are “just the way things are done around here.” Seek out any disconnects between your norms and your policies. Find ways to influence your norms to better align with policy. This is accomplished through a combination of communication, social pressures, behavior design, and traditional training methods.

Responsibilities

An organization where every employee actively takes part in the security program is a good organization. Empowering employees to make relevant security decisions in their workday is a valuable strategy. Likewise, making sure employees understand that even a tiny action can make a huge difference will be important. Try to focus on the positive change the employee can make instead of dreaded and ineffective fearmongering.

Normalized Use of Unauthorized Services

Employee use of unauthorized services, often referred to as shadow IT, poses a threat to organizations on many levels. Traditionally, it has been difficult to measure this phenomenon, usually because employees are not very likely to admit to breaking the company rules. The Security Culture Survey circumvents this bias, giving us a unique peek into how large a problem shadow IT is.

As shown in Figure 6.2, employees report that unauthorized use of cloud services and file sharing services is considered normal by a minimum of 20 percent of employees, all the way up to 54 percent of employees in Asia. Depending on where your organization operates, between one in two and one in five employees consider it normal, and thus okay, to circumvent organizational security policies to get their job done. What security norms exist in your organization? How are those norms impacting your risk?

Confidentiality and Insider Threats

Here's another example. We wanted to study how well employees are able to determine what confidential information is in the context of their workplace. Our research shows that many employees do not know what is considered confidential information. As shown in Figure 6.3, this lack of understanding represents a serious insider threat, as between 20 percent and 40 percent of employees globally struggle to know what company confidential information is and what it is not.

Understanding what is considered as confidential within an organization represents an issue within the cognition dimension of your security culture. You can address this via the dimension of communication. This can also be addressed by social modeling via norms and responsibilities.