Changing Security Behaviors Via a Top Down Approach

In a recent article I discussed the four secrets to building a strong, intentional and sustainable security culture. One of those secrets is focused on viewing security awareness through the lens of organizational culture. As I described in that post, culture is shared, learned and adaptive, but it can be influenced. It takes a group working collectivity, and it begins with the leaders.

In this article, I'd like to go a bit deeper into the role of the leader and how a top-down approach is key when changing security behaviors within a culture.

Leaders are Cultural Beacons

The role of the leader in driving security culture should not be underestimated. When the protective mechanisms of the culture become unstable and seem to fail, people will look for new stability and certainty to hold on to. Leaders are one of the first places people look to for that. A leader that wants to steer his or her team through a period of cultural change must do so on many levels. Let's look at how these key characteristics apply to changing security behavior via security training:

Explicitly: by clearly communicating the new rules, assumptions, beliefs, and expectations for the new situation. This includes the vision, the rules of engagement, the metrics, the intended outcomes—anything that helps people to create a new, consistent belief system with a clearly understood and (relatively) safe place for them as part of that culture. In security training, this begins with taking stock of what your organization has in place: Where are the weaknesses? How susceptible to social engineering are your employees? Where do you need them to be? Do they know how to report suspected security incidents? This should also include baseline testing.

Implicitly: by walking the talk. Consistently act in accordance with the new cultural rules and expectations and consistently address misaligned behaviors and beliefs as they surface. Weave instruction and guidance into the culture of the company. Consider adding mini-tabletop exercises and thought experiments to team meetings where the leader outlines a situation and asks team members who they would/should respond. There are (at least) three up-sides to this approach: 1) the employees can "pre think" through the scenario in a non-emergency setting, 2) the leader can provide positive reinforcement and "light touch" corrective guidance to help steer employees into desired behaviors, and 3) the leader will get a sense of where employees are struggling to align with the desired behaviors.

Symbolically: the leader is not just a person, he/she is also a symbol for security, cohesion and stability. Many leaders underestimate this part of their role. It doesn't mean they must pretend to be who or what they are not, but they do have to play it "bigger than life" from time to time, as part of the symbolic role they play. One way to do this is to create executive videos, blog posts, and other social media content from the leader that will help that leader demonstrate their security decision making. For instance, the leaders simply speaks about their passion… or, even better, they can tell interesting stories about situations from their own life, the life of the company, or interesting news events that will help relate the moral that they want to convey. And, of course, the leader's actions and life must be consistent with their message in order to maintain credibility.

Representationally: as a leader, your team expects you to represent them in the political arena: to procure resources, remove obstacles, and secure recognition for the work they do. How does this work with security training? 1) Get executive buy-in, speak the language of the business and tie awareness training into the way your organization views risk and opportunity. 2) A security leader must work with other departments and generate enthusiasm across an organization. From HR to compliance to marketing, everyone can play a role and can help build, enforce and celebrate good security culture.

Always On: for culture leadership to work, the leader must be a constant force behind it. Appearing and disappearing, jumping in and then ignoring things and unpredictable behaviors, all undermine the much-needed stability people crave from their leaders. Specifically looking at security awareness, this means ongoing simulation testing throughout the calendar year, regular (and customized) educational content and using a variety of tools. It's important to remember that various forms of content resonate differently with different people. Individuals have unique ways of absorbing communication, from newsletters to video - options are necessary to get everyone's attention and focus.

When it comes to changing behaviors and building better security hygiene, the role of the leader is not only critical, but it is the impetus to change. Your organization will be looking to you to steer them, motivate them and demonstrate best practices to them. It's a big job, but one that's a game changer for business success.

About the author: Perry Carpenter is the Chief Evangelist and Strategy Officer for KnowBe4, the provider of the world's most popular integrated new school security awareness training and simulated phishing platform.