Security Consulting: Service Providers

How to create a positive and effective cybersecurity environment instead of a shameful culture

You can catch more flies with honey than vinegar. Learn some tips to establish a positive reinforcement cybersecurity culture rather than a blame-and-shame game.

I once worked in an environment where adding users to Active Directory privileged groups was forbidden except via an official request approved by the individuals' managers. This was carefully monitored, and on one occasion an email went out to a massive group of people stating the policy had been violated and someone who was named directly in the email had updated a group without permission.

Several managers admonished the sender for calling out the alleged perpetrator, and one produced the very request that authorized the change, exonerating the individual and causing embarrassment for the accuser, who did apologize. However, that entire email thread should have been a face-to-face, private discussion with the employee and their manager.

This episode shows the wrong way to go about cybersecurity. Another is testing, like sending company-originated phishing emails to internal recipients to see if they can be tricked into clicking links which then take them to a page scolding them for falling for the content. That simply builds a wall between the end-users and the IT/security departments making users less likely to respect these groups. Positive reinforcement is the key to encouraging employees to want to comply for their good and that of the company, rather than fear of retribution or embarrassment. Even simple recognition from management for reporting phishing emails or completing training can suffice to build a positive environment promoting cybersecurity principles across the organization.

Information Security Consulting Services:

Shame is always a bad way to motivate an individual or the masses. It doesn't work for your kids (we've all tried), and it doesn't translate well to any other population. It might trigger some short-term responses, but fosters long-term resentment and a pent-up stockpile of ill will.

The approach should be to increase overall learning and the individual threat intelligence of every user. It's hard, it requires significant patience, but is way more effective than setting a trap and full-scale mockery of the transgressor. No one wants to publish their internal cybersecurity test results.

The general security intelligence of the average user and executives is fairly low so it's rare to see anyone airing their dirty laundry.

Openly discussing security initiatives, assisting your team in internalizing the global impact, and promoting wide-scale security evangelism as an organizational imperative, rather than an IT mandate, goes a very long way to securing the organization—certainly much further than the fired employee who was the poster child for the failed shame game phishing test.