People-centric security : transforming your enterprise security culture - People-centric security : transforming your enterprise security culture -

I Understanding Your Security Culture Information Security: Adventures in Culture Hacking Burnt Bacon Safe and Not Secure What Were You Thinking?Culture Hacking Software of the Mind A Brief History of Culture Hacking Security Culture: Hack or Be Hacked Who's Hacking Your Security Culture?Security, Hack Thyself Culture Hacks: The Good Culture Hacks: The Bad Culture Hacks: The Ugly Security Is People!Further Reading Strategy for Breakfast: The Hidden Power of Security Culture Why Security Fails We Start with a Design Warning Signs Doing More with Less Who Moved My Fence?Look Out Below!Getting the Drift The Opposite of Monoculture Cultural Traits in Information Security Techno-romanticism Defeatism Exceptionalism Paranoia "I Just Know What They Could Do..Competing Values and Security Threats The Change Agents of Security Culture The C-Suite Security Awareness Teams Security Researchers Security Practitioners Making Security Cultural Further Reading Organizational Culture: A Primer The Cultural Success of Apple The Field of Organizational Culture Origins Security and Global Culture Outcomes The Cultural Failure of Enron The Culture Iceberg Hidden Aspects People Powered The Organizational Cultural/Organizational Performance Link The Cultural Migration of PayPal Assessing and Measuring Culture Qualitative vs. Quantitative Measurement of Culture Qualitative Measures and Techniques Lord Kelvin's "Meagre Understanding"Culture by the Numbers Challenges of Cultural Transformation There's No One Right Way to Change Culture You Have to Include Everybody You Have to Build Consensus You Have to Evaluate the Outcomes You Have to Have Good Leadership An Ocean of Research Further Reading Cultural Threats and Risks Cultural Threat Modeling Covert Processes and Cultural Risk Getting to Know PEPL Political Threats Turf Wars A Battle for Control Vendor Bias Emotional Threats Fear, Uncertainty, and Doubt Emotional Logic Psychological Threats Statistical Alchemy Cognitive Limitations With the Audience in Mind Cognitive Differences Logistical Threats Incompatible Systems Exceptions as the Rule Incompatible Outcomes Cultural Competition as a Source of Risk Sizing Up the Competition Competing Security Stakeholders Competing Security Priorities Competing Security Values Further Reading II Measuring Your Security Culture The Competing Security Cultures Framework Measuring Security Culture Quantitative Data and Analysis Nominal Data Ordinal Data Statistical Terms Interval Data Ratio Data Qualitative Data and Analysis Qualitative Approaches Revisited Artifacts as Data Combining the Qualitative and Quantitative Interviews Surveys Other Ways of Describing Culture Cultural Archetypes and Stereotypes Cultural Frameworks and Models Visualizing Culture The Competing Security Cultures Framework Origins of the CSCF in Competing Values Research Clan Cultures Adhocracies Hierarchies Adapting the Competing Values Framework to Security Degrees of Control Internal vs. External Focus The CSCF Quadrants Overlapping and Competing Values Limitations of the Framework Why Not Just Use the Competing Values Framework?Security Culture Benefits From a Targeted Approach Not Everything in the Competing Values Framework Translates Well Organizational Security Cultures Process Culture Core Values of the Process Culture Examples of Process Cultures Compliance Culture Core Values of the Compliance Culture Examples of Compliance Cultures Autonomy Culture Core Values of the Autonomy Security Culture Examples of Autonomy Cultures Trust Culture Core Values of the Trust Culture Examples of Trust Cultures Further Reading The Security Culture Diagnostic Survey (SCDS)SCDS Format and Structure How Surveys Work Questions in the SCDS What's Valued Most?How Does the Organization Work?What Does Security Mean?How Is Information Managed and Controlled?How Are Operations Managed?How Is Technology Managed?How Are People Managed?How Is Risk Managed?How Is Accountability Achieved?How Is Performance Evaluated?SCDS Scoring Methodology Scoring the SCDS Results Security Culture Diagnostic Strategies: Case Studies ABLE Manufacturing: Measuring an Existing Security Culture Comparing Different Security Cultures Within ABLE Manufacturing Corp.CHARLIE Systems, Inc.: Comparing Security Cultures of Two Organizations DOG: Comparing Existing to Desired Security Culture Creating Culture Maps with the Security Culture Diagnostic Survey Mapping and Visualization Tools Security Culture Maps Mapping Security Culture Using the CSCF Composition of a SCDS-based Culture Map Superimposing SCDS Responses on the CSCF Visual Model Other Techniques for Mapping Security Culture "When Should I Use Each Type of Map?"Mapping Specific Values and Activities Interpreting and Comparing Culture Interpreting SCDS Results Dominant Culture: The Way Things Get Done Cultural Conflict: "You Can't Do That Here..."Cultural Intensity Cultural Anomalies and Disconnects Comparing Cultures Comparing ABLE Manufacturing's Security Employee and Nonsecurity Employee Cultures Comparing DOG's Current Security Culture to Its Desired Security Culture Implementing a Successful Security Culture Diagnostic Project Getting Buy-in for the Security Culture Diagnostic Project Direct Benefits of Security Culture Improvement Increased Security and Efficiency Reduced Risk and Costs from Incidents Estimating the Financial Impact of Security Culture Monte Carlo Simulations Monte Carlo Simulations (continued)Case Study: FOXTROT Integrators, Inc.Assumptions Scenarios The "68-95-99.7 Rule"Testing the Scenarios Using the Results of the Model Executing a Security Culture Diagnostic Project Setting Up the Project Defining the Project Strategy Defining the Context of the Assessment Performing a Cost/Benefit Analysis Engaging Senior Management Engaging Other Stakeholders Building the Project Team and Plan Collecting Data Using the Security Culture Diagnostic Survey Organizing Respondents Data Management and Storage Analyzing Responses Generating Security Culture Scores Creating Culture Maps Interpreting Culture and Communicating Results Aligning Data with Project Goals Communicating Security Culture From Measurement to Transformation Further Reading III Transforming Your Security Culture From Diagnosis to Transformation: Implementing People-Centric Security Diagnosis and Transformation: One Coin, Two Sides The CSCF as a Framework for Understanding What Is the Framework for Transformation?Behavioral Models for Security Culture Transformation Compliance and Control Regimes "Let's Sue the Auditors...""Let's Sue the Auditors..." (continued)Security Process Improvement "But We Don't Do E-Commerce Here.."But We Don't Do E-Commerce Here..(continued)Technology and Automation Approaches Making It Personal...Security Needs More Options Further Reading Security FORCE: A Behavioral Model for People-Centric Security Origins of Security FORCE HRO Research Preoccupation with Failure Reluctance to Simplify Sensitivity to Operations Commitment to Resilience Deference to Expertise HROs in Information Security Studies in Failure Highly Reliable Security Programs Introducing the Security FORCE Behavioral Model Five Core Values of Security FORCE The Security Value of Failure The Security Value of Operations The Security Value of Resilience The Security Value of Complexity The Security Value of Expertise Security FORCE Value Behaviors and Metrics Security FORCE Value Behaviors Security FORCE Value Metrics The Culture-Behavior Link in HRSPs Only the Reliable Survive Further Reading The Security Value of Failure What Is the Security Value of Failure?"Failure Is Not an Option"Reevaluating Failure Embracing Failure Fail Small, Fail Fast, Fail Often Minor Accidents and Near Misses: Tracking the Seeds of Failure Minor Accidents and Near Misses: Tracking the Seeds of Failure (continued)Failure Key Value Behaviors Anticipate Failures Seek Out Problems Reward Problem Reporting Share Information About Failures Learn from Mistakes "That Report Made a Good Paperweight"Assessing Your Failure Value Behaviors The Security FORCE Survey Scoring the Security FORCE Survey The Security FORCE Metrics Using the FORCE Failure Value Metrics Improving Your Failure Value Behaviors Embed the Security Value of Failure into People Reeducate People on What It Means to Fail Set Leadership Examples Open Up Communication Further Reading The Security Value of Operations What Is the Security Value of Operations?Operational Power Sensitivity to Operations Expectations and Reality Security Operations "Unplugged"Operations Key Value Behaviors Keep Your Eyes Open Form a Bigger Picture "Listen" to the System "Well, That's Just Your Hypothesis, Man!"Test Expectations Against Reality Exceptions to the Rules Exceptions to the Rules (continued)Share Operational Assessments Denial Ain't Just a River...Assessing Your Operations Value Behaviors Scoring the Operations Value Behavior Survey FORCE Value Metrics for Operations Using the FORCE Operations Value Metrics Improving Your Operations Value Behaviors Embed Operations Value into the Security Program Think More Like Scientists Embrace the "Sharing Economy"Lighten Up a Bit Further Reading The Security Value of Resilience What Is the Security Value of Resilience?When Bad Things Happen (to Good Organizations)Incident Response: We're Doing It Wrong Incident Response: We're Doing It Wrong (continued)Rolling with the Punches Imagining Failures and Disasters Resilience Under Fire Resilience Under Fire (continued)Resilience Key Value Behaviors Overtrain People Exploring Human Capital Create "Skill Benches"Actively Share Expertise Encourage Stretch Goals Practice Failing The Unrecovered Country Assessing Your Resilience Value Behaviors Scoring the Resilience Value Behavior Survey FORCE Value Metrics for Resilience Using the FORCE Resilience Value Metrics Improving Your Resilience Value Behaviors Embed Resilience Value into the Security Program "A Security Incident? I Want In!"Make Security Incidents Mundane Further Reading The Security Value of Complexity What Is the Security Value of Complexity?Dumbing It Down Growing Uncertainty CVSS, Heartbleed, and the Uncertainty Challenge in Scoring Systems CVSS, Heartbleed, and the Uncertainty Challenge in Scoring Systems (continued)Ignorance Is Risk My Heat Map and I Have Boundary Issues My Heat Map and I Have Boundary Issues (continued)My Heat Map and I Have Boundary Issues (continued)Complexity Key Value Behaviors Don't Oversimplify Formalize Your Assumptions Covet Empirical Evidence Evidence and Falsifiability Share the Doubt Make Every Model Better Assessing Your Complexity Value Behaviors Scoring the Complexity Value Behavior Survey FORCE Value Metrics for Complexity Using the FORCE Complexity Value Metrics Average number of data points collected in support of individual organizational decisions Number of formal reviews of security plans by non-security stakeholders in the past year Improving Your Complexity Value Behaviors Embed Complexity Value into the Security Program Think Bigger Accept What We Already Know Further Reading The Security Value of Expertise What Is the Security Value of Expertise?Filter Your Water, Not Your Information Structural Authority vs. Structural Knowledge Bob and Clara Revisited: Migrating Authority Waiting for the Big One The Road to Damascus Expertise Key Value Behaviors Ask the Experts Suppress the Egos Allow Authority to Migrate Share Credibility Reward Calls to Action and Cries for Help "We're Changing the World""We're Changing the World" (continued)Assessing Your Expertise Value Behaviors Scoring the Expertise Value Behavior Survey FORCE Value Metrics for Expertise Using the FORCE Expertise Value Metrics Improving Your Expertise Value Behaviors Embed Expertise Value into the Security Program Make Everyone a Sensor Create Decision Fast Lanes Value Expertise from the Top Down Further Reading Behavior and Culture: Mastering People-Centric Security What Does Security Culture Transformation Mean?Describing Transformation in Terms of Cultural Capabilities Maturity The Cultural Capabilities Maturity Model: Formalizing Cultural Maturity Supporting Security Culture Transformation with Security FORCE Projects The Value of a Security FORCE Project Managing a Security FORCE Project Costs and Schedules Leadership Support and Engagement Stakeholder Engagement Respondents and Data The Security FORCE Scorecard Scoring the FORCE Survey Questions, Revisited Pooling Your FORCEs Security FORCE Metrics and the FORCE Scorecard "Are We a Highly Reliable Security Program?"GEORGE G, LLP HOTEL INDIA, Inc.KILO KING Enterprises CSCF and Security FORCE: Aligning Culture and Behavior in People-Centric Security Chaining Culture and Behavior Efforts Using the SCDS and FORCE Independently General Alignments Between Security FORCE and the CSCF Process Cultures and the Security Value of Operations Compliance Cultures and the Security Value of Failure Autonomy Cultures and the Security Value of Resilience Trust Cultures and the Security Value of Expertise Complexity Everywhere Taking Advantage of Cultural-Behavioral Alignments When Culture Makes Behavior Easier When Culture Makes Behavior Harder Blending Security Culture Diagnostic and Security FORCE Projects for Improved Cultural Maturity Further Reading Leadership, Power, and Influence in People-Centric Security A Crisis of Leadership The CISO as a Business Leader Business Leaders as Security Enablers Security Power Dynamics "What if I'm Not a CISO?”CISO Leadership Resources Leadership in People-Centric Security You Don't Lead Machines Influence and Transformation Adapting the CSCF and Security FORCE Model to Leadership The CSCF, SCDS, and Cultural Leadership The Security FORCE Model and Behavioral Leadership Further Reading Securing a People-Centric Future The Security of Things Social Security As Many Securities as Things to Secure Information Infrastructure Identity Privacy Framing People-Centric Security Security Soft Power Three Takeaways from the Book People Are the Most Important System to Secure Strong Culture Equals Strong Security Failure Is a Feature of Complex Systems Putting People-Centric Security to Work Two Models, One Goal People-Centric Security Strategies Improving Board and Business Stakeholder Engagement Supercharging Security Awareness People-Centric Incident Response Conclusion Further Reading