Published on
This post was written by Chris Romeo during his tenure at Security Journey.
“We don’t need security.”
With our modern dependence on technology and security, nobody would dare to make this statement. Everyone knows how crucial security is and how it must be embedded into everything an organization does. A simple glance at the news provides details on the data breach of the day tied to an application security vulnerability. Take a stroll to the Information Security department and you'll hear about the latest blunder an employee made that resulted in lost data. Security is widespread and mainstream, but security culture has not kept pace with the threat landscape. Tim Ferriss shared his definition of culture as “what happens when people are left to their own devices.” This applies to security culture if we inject “with security” into that definition: Security culture is what happens with security when people are left to their own devices. Do they make the right choices when faced with whether to click on a link? Do they know the steps that must be performed to ensure that a new product or offering is secure prior to ship?
Building a healthy security culture
An organization’s security culture requires care and feeding. It is not something that grows in a positive way organically. You must invest in a security culture. A sustainable security culture is bigger than just a single event. When a security culture is sustainable, it transforms security from a one-time event into a lifecycle that generates security returns forever. A sustainable security culture has four defining features. First, it is deliberate and disruptive. The primary goal of a security culture is to foster change and better security, so it must be disruptive to the organization and deliberate with a set of actions to foster the change. Second, it is engaging and fun. People want to participate in a security culture that is enjoyable and a challenge. Third, it is rewarding. For people to invest their time and effort, they need to understand what they will get in return. Fourth, it provides a return on investment. The reason anyone does security is to improve an offering and lower vulnerabilities; we must return a multiple of the effort invested. A strong security culture not only interacts with the day-to-day procedures but also defines how security influences the things that your organization provides to others. Those offerings may be products, services, or solutions, but they must have security applied to all parts and pieces. A sustainable security culture is persistent. It is not a once-a-year event but embedded in everything you do. Why does an organization need a security culture? The primary answer is something that deep down we all know. In any system, humans are always the weakest leak. Security culture is primarily for the humans, not for the computers. The computers do exactly what we tell them to do. The challenge is with the humans, who click on things they receive in email and believe what anyone tells them. The humans need a framework to understand what the right thing is for security. In general, humans within your organization want to do the right thing—they just need to be taught. Luckily, wherever an organization sits on the security culture spectrum, there are things that can be done to make the culture better.
1. Instill the concept that security belongs to everyone
Many organizations have the opinion that the security department is responsible for security. Sustainable security culture requires that everyone in the organization is all in. Everyone must feel like a security person. This is security culture for everyone. Security belongs to everyone, from the executive staff to the lobby ambassadors. Everyone owns a piece of the company’s security solution and security culture. Samantha Davison, security program manager at Uber, says, “At Uber, we are trying to change our employees' security stories. By creating programs catered to region, department, and role, our people understand that security is part of their story and our culture.” This is an example of a company that truly believes that security belongs to everyone and bakes security into everything they do. You can achieve this “all in” mentality by incorporating security at the highest levels into your vision and mission. People look to these things to understand what they should focus on. Update your vision or organizational objective to clearly articulate that security is non-negotiable. Speak about the importance of security from the highest levels. This does not mean just the people who have security in their title (CISO, CSO), but also from other C-level execs all the way down to individual managers.
2. Focus on awareness and beyond
Security awareness is the process of teaching your entire team the basic lessons about security. You must level set each person’s ability to judge threats before asking them to understand the depth of the threats. Security awareness has gotten a bad rap because of the mechanisms used to deliver it. Posters and in-person reviews can be boring, but they do not have to be. Add some creativity to your awareness efforts. On top of general awareness is a need for application security knowledge. Application security awareness is for the developers and testers within the organization. In your organization, they may sit within IT, or they may be the engineering function. AppSec awareness is teaching the more advanced lessons that staff need to know to build secure products and services. Awareness is an ongoing activity, so never pass up a good crisis. Bad things are going to happen to your organization, and many times they will be tied directly to a security problem. Grow your security culture with these teachable moments. Do not try to hide them under the rug, but instead use them as an example of how the team can get better. Accountability before awareness is crazy. People want to do the right thing, so show them through an awareness program and then hold them accountable for the decisions they make after gaining the knowledge.
3. If you do not have a secure development lifecycle, get one now
Secure development lifecycle (SDL) is foundational to sustainable security culture. An SDL is the process and activities that your organization agrees to perform for each software or system release. It includes things like security requirements, threat modeling, and security testing activities. SDL answers the how for your security culture. It is sustainable security culture in action. Customers across industries are starting to demand the crazy idea that organizations have an SDL and follow it. If you do not have an SDL at this juncture, Microsoft has released most of the details about its SDL free of charge. The lineage of many industry SDL programs traces back to the Microsoft program. A reasonable place for the SDL to live is within a product security office. If you do not have a product security office, think seriously about investing in one. This office sits within engineering and provides central resources to deploy the pieces of your security culture. While we do not want the entire organization to farm off security to the product security office, think of this office as a consultancy to teach engineering about the depths of security.
4. Reward and recognize those people that do the right thing for security
Look for opportunities to celebrate success. When someone goes through the mandatory security awareness program and completes it successfully, give them a high-five or something more substantial. A simple cash reward of $100 is a huge motivator for people and will cause them to remember the security lesson that provided the money. They also will be quick to tell five co-workers they received cash for learning, and those five will jump into the training quickly. If you are shuddering at the idea of giving away $100 per employee, stop being so cheap and count the cost. The return on investment on preventing just a single data breach greatly outweighs the $100 spent. The other side of reward is security advancement. Provide opportunities for team members to grow into a dedicated security role through advancement. Make security a career choice within your organization. Put your money where your mouth is. If you say security is important, prove it by providing growth potential for those with a passion for security. A final step is to provide an opportunity to earn an advanced degree in security. Many universities now offer a master's degree in cybersecurity. If you can’t find one nearby, create your own. In my previous job, I worked with a large university in California to tailor a degree program that supported the company's security culture. Once again, put your money where your mouth is and sponsor the first group of students. It sends a positive message to the entire organization.
5. Build security community
The security community is the backbone of sustainable security culture. A community provides the connections between people across the organization. Security community assists in bringing everyone together against the common problem and eliminates an "us versus them" mentality. The security community is achieved by understanding the different security interest levels within the organization: advocates, the security aware, and sponsors. Security advocates are those people with a down-home passion for making things secure. These are the leaders within your community. The security-aware are not as passionate but realize they need to contribute to making security better. The sponsors are those from management who help to shape the security direction. Gather all of these folks together into a special interest group focused on security. Security community can manifest as one-on-one mentoring and weekly or monthly meetings to discuss the latest security issues. It can even become a yearly conference, where the best and brightest from the organization have a chance to share their knowledge and skills on a big stage.
6. Make security fun and engaging
Last, but certainly not least, is fun. For far too long people have associated security with boring training or someone saying no all the time. To cement a sustainable security culture, build fun and engagement into all the process parts. If you have specific security training, ensure that it is not a boring voice over a PowerPoint presentation. If you engage your community through events, do not be afraid to laugh and goof around some. In my previous role, at each monthly security community event, we started the meeting off with a game of security trivia with a different security category each month. We did hackers in the movies one month and security news in another. This is just an example of how to bring fun and engagement into the process. Uber's Davison offers:
“Security can be so much more than PowerPoints and videos. Pick a fun theme and parody it—we did Game of Thrones. Give gamification a try. Throw a phishing writing workshop and have your employees write a phishing email for the company. The options are endless when you start to think outside the box.”
What kind of security culture do you have?
Of course, every organization has a security culture. If they say they don't, they are either lying or afraid to admit they have a bad security culture. The good news is that any security culture can positively change how the organization approaches security. But culture change takes time, so don't expect your members of your organization to overnight become pen-testing Ninjas that write secure code while they sleep. With the right process and attitude, you’ll get there.
