Creating a Culture of Information Security - Eric Vanderburg, CISSP - JurInnov Ltd.

Cultural Importance Culture is the residue of success. - Edgar Schein  Make or break security + Concern for security + Above and beyond requirements - Uphill battle - Broken record© 2011 JurInnov, Ltd. All Rights Reserved

Cultural Categories Basis of Truth and Nature of Time Motivation Orientation & Focus Rationality Isolation vs. Control, Coordination, & Stability vs. Change Orientation to Work Collaboration Responsibility Chia, P. A., Ruighaver, A.B., Maynard, S.B. (2002), Understanding Organisational Security Culture. Proceedings from PACIS2002: The 6th Pacific Asia Conference on Information Systems, Tokyo, Japan.© 2011 JurInnov, Ltd. All Rights Reserved

Cultural Surface: Artifacts Decision making Conflict process resolution Meeting Working frequency hours and Formality format and authority Dress Social code events Company Rites and Jargon rituals Work/life balance Communi cation© 2011 JurInnov, Ltd. All Rights Reserved

Assessing Culture  Engineer disables FTP authentication to receive time sensitive files  Technician hooks up an insecure wireless access for the visiting CEO  Developer violates security coding practice to get release out the door  Secretary uses a personal laptop to perform business tasks to get around flash restrictions  Employee downloads movies from a torrent site on the company network© 2011 JurInnov, Ltd. All Rights Reserved

Examples  Cultural elements supporting and inhibiting security initiatives  Token authentication  Asset Management  Security Zones  Encryption  Data retention© 2011 JurInnov, Ltd. All Rights Reserved

Cultural Change  Deeper understanding of culture  Leadership’s shaping of culture  Cultural change factors  Enacting transformational change  Barriers  Temporary tradeoffs© 2011 JurInnov, Ltd. All Rights Reserved

Deeper Understanding of Culture Edgar Schein Three levels for understanding and identifying corporate culture Shared Tacit Artifacts Espoused Values Assumptions Visible organizational Strategies, goals and Beliefs and values structures and philosophies processes© 2011 JurInnov, Ltd. All Rights Reserved

Leadership’s shaping of culture  What is paid attention to, measured and controlled regularly  Reaction to critical incidents  Criteria for allocating resources  Role modeling, teaching and coaching  Criteria for rewards and punishments  Recruiting, promoting, demoting and firing© 2011 JurInnov, Ltd. All Rights Reserved

Cultural change factors Lewin Change Model  Evolutionary  Hybridization: secondary contrary or different cultural elements with Disconfirmation primary elements  Growth impacts innovation  Increased assets affects risk tolerance Learning  Transformative  Can a successful organization change without a breach? Incorporation  Lewin Change Model© 2011 JurInnov, Ltd. All Rights Reserved

Enacting Transformational Change  Compelling positive vision  Concrete, measurable, and achievable goals  Formal training of groups, not individuals  Lerner involvement  Pilot group  Change leaders and role models  Feedback  Rewards and discipline© 2011 JurInnov, Ltd. All Rights Reserved

Barriers to Transformative Change Psychological Defensive Fear of Denial – temporary disconfirming incompetence data not valid Loss of Dodging – personal disconfirming identity cause different Loss of group Maneuvering / membership Bargaining© 2011 JurInnov, Ltd. All Rights Reserved

http://www.jurinnov.com	116
http://www.legaltechtoday.com	43
http://www.linkedin.com	1
http://translate.googleusercontent.com	1

Creating a Culture of Information Security - Eric Vanderburg, CISSP - JurInnov Ltd.

by Timothy Opsitnick on Nov 03, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

4 Embeds 161

Statistics

Creating a Culture of Information Security - Eric Vanderburg, CISSP - JurInnov Ltd. — Presentation Transcript