This session links security culture and program performance, providing tools and guidance that will enable attendees to measure, manage and transform their own organizations’ security culture. Cases studies will be reviewed, and attendees will receive access to proven models, frameworks and tools for measurably improving the cultural maturity and behavioral reliability of their security program. (Source: RSA USA 2016-San Francisco)

1. SESSION ID:
People-Centric Security:
Transform Culture, Reduce Risk,
Drive Success
HUM-R04
Masha Sedova
Senior Director, Trust Engagement
Salesforce
@modMasha
Dr. Lance Hayden
Managing Director, Security
Culture Prac4ce
Berkeley Research Group
@hay_lance

2. Today’s Agenda
Introduc?ons
Understanding and measuring security culture
Case study: Security culture in prac?ce at Salesforce
How to transform your own security culture
Applica?on and call to ac?on
Q&A
2

3. IntroducFon - Lance Hayden, Ph.D
3
Managing Director at
Berkeley Research Group
Leads BRG’s Cybersecurity
Culture Prac?ce
Research and consul?ng to
help organiza?ons
understand, measure, and
transform security culture

4. IntroducFon - Masha Sedova
4
Senior Director, Trust
Engagement @ Salesforce
Run a team of 6+ people
focused on security culture
Scope includes internal
employees, engineers,
developers, customers, and
vendors

5. #RSAC
Understanding and Measuring
Security Culture

6. A Comment on Theory…
In theory there is no difference
between theory and prac4ce.
In prac4ce there is.
Yogi Berra
6
Depositphotos

7. What is Security Culture?
“The way we do things
around here…”
Invisible un?l you clash
with a different one
Incredibly hard to
change unless you are
star?ng one from
scratch…
7

8. Culture and Behavior
8
“Culture eats strategy
for breakfast.”
Peter Drucker
Depositphotos

9. What is Security Culture?
Corporate Culture and
Performance (KoYer &
HeskeY)
Research (and
anecdotal) evidence
that culture impacts
organiza?onal
performance
9
Revenue +682%
Workforce +282%
Stock +901%
Income +756%
“Good” Culture
Revenue +166%
Workforce +36%
Stock +74%
Income +1%
“Bad” Culture

10. Security Culture and Security Risk
10
Culture is about values and priori?es
(assumed and unspoken, “invisible”)
Security risk increases when different
values, priori?es, and cultures compete
for scarce resources
“I have 3 goals to accomplish, and the
?me and resources to complete 2…”
Security o[en loses out to the
compe??on (efficiency, usability, profit)
Depositphotos

11. Culture and Performance in Security
11
For the source of these findings, see http://securityispeople.lancehayden.net/2015/11/the-cost-of-a-bad-decision-measuring-the-impact-of-security-culture/

12. The CompeFng Security Cultures Framework
Think of the CSCF as a
personality test for your
security program…
Is your program a control
freak? A conformist? A
cowboy? A community
builder?
How do different
personali?es get along?
12
Process Culture!
Managed Coordination!
Core Values:!
Stability!
Visibility!
Standardization!
Cardinal Directive:!
Enforce Policy
Tight Control
External!
Focus
Internal!
Focus
Loose Control
Compliance Culture!
Rational Goals!
Core Values:!
Conformity!
Repeatability!
Documentation!
Cardinal Directive:!
Pass Audits
Trust Culture!
Human Relations!
Core Values:!
Communication!
Participation!
Commitment!
Cardinal Directive:!
Empower People
Autonomy Culture!
Adaptive Systems!
Core Values:!
Flexibility!
Agility!
Innovation!
Cardinal Directive:!
Get Results
From People-Centric Security by Dr. Lance Hayden

13. Measuring and Mapping Security Cultures
A measurement
instrument (Security
Culture Diagnos4c Survey)
provides data allowing
visual mapping of a
security culture
Priori?es, biases, and
compe?ng priori?es
become visualized
13
People&Centric-Security:-Transforming-Your-Enterprise-Security-Culture-by#Lance#Hayden
SCDS:#Instructions#for#Survey#Owners# # page#2#of#4#
#
1. What’s)valued)most?) Score)
A. Stability#and#reliability#are#valued#most#by#the#organization.#It#is#critical#that#everyone#knows#the#rules#and#follows#
them.#The#organization#cannot#succeed#if#people#are#all#doing#things#different#ways#without#centralized#visibility.#
#
B. Successfully#meeting#external#requirements#is#valued#most#by#the#organization.#The#organization#is#under#a#lot#of#
scrutiny.#It#cannot#succeed#if#people#fail#audits#or#do#not#live#up#to#the#expectations#of#those#watching.#
#
C. Adapting#quickly#and#competing#aggressively#are#valued#most#by#the#organization.#Results#are#what#matters.#The#
organization#cannot#succeed#if#bureaucracy#and#red#tape#impair#people’s#ability#to#be#agile.#
#
D. People#and#a#sense#of#community#are#valued#most#by#the#organization.#Everyone#is#in#it#together.#The#organization#
cannot#succeed#unless#people#are#given#the#opportunities#and#skills#to#succeed#on#their#own.#
#
Total)Score) 10)
2. How)does)the)organization)work?) Score)
A. The#organization#works#on#authority,#policy,#and#standard#ways#of#doing#things.#Organizational#charts#are#formal#
and#important.#The#organization#is#designed#to#ensure#control#and#efficiency.)
)
B. The#organization#works#on#outside#requirements#and#regular#reviews.#Audits#are#a#central#feature#of#life.#The#
organization#is#designed#to#ensure#everyone#meets#their#obligations.)
)
C. The#organization#works#on#independent#action#and#giving#people#decision#authority.#There’s#no#one#right#way#to#
do#things.#The#organization#is#designed#to#ensure#that#the#right#things#get#done#in#the#right#situations.)
)
D. The#organization#works#on#teamwork#and#cooperation.#It#is#a#community.#The#organization#is#designed#to#ensure#
everyone#is#constantly#learning,#growing,#and#supporting#one#another.#
)
Total)Score# 10)
3. What)does)security)mean?) Score)
A. Security#means#policies,#procedures,#and#standards,#automated#wherever#possible#using#technology.#When#people#
talk#about#security#they#are#talking#about#the#infrastructures#in#place#to#protect#the#organization’s#information#
assets.#
)
B. Security#means#showing#evidence#of#visibility#and#control,#particularly#to#external#parties.#When#people#talk#about#
security#they#are#talking#about#passing#an#audit#or#meeting#a#regulatory#requirement.#
)
C. Security#means#enabling#the#organization#to#adapt#and#compete,#not#hindering#it#or#saying#“no”#to#everything.#
When#people#talk#about#security#they#are#talking#about#balancing#risks#and#rewards.#
)
D. Security#means#awareness#and#shared#responsibility.#When#people#talk#about#security#they#are#talking#about#the#
need#for#everyone#to#be#an#active#participant#in#protecting#the#organization.#
)
Total)Score# 10)
SCDS available from lhayden.net/culture

14. Measuring and Mapping Security Cultures
14
1
2
3
4
5
6
7
8
9
10
0 1 2 3 4 5 6 7
5.5
5
4.5
5
3
6
2
3
5
4 1
2
3
4
5
6
7
8
9
10
0 1 2 3 4 5 6 7
1.5
3
2.5
1
2
2
2.5
4
1
2.5
1
2
3
4
5
6
7
8
9
10
0 1 2 3 4 5 6 7
1
1
1
1
3
0.5
2
2.5
1
11
2
3
4
5
6
7
8
9
10
0 1 2 3 4 5 6 7
2
1
2
3
2
1.5
3.5
0.5
3
2.5
Process Compliance
AutonomyTrust
External
Loose
Internal
Tight
0
1
1
2
3
4
5
2345
Process Compliance
AutonomyTrust
External
Loose
Internal
Tight
Granular SCDS response visualization Allows for more intuitive
cultural “shapes”
Which become comparative cultural “maps”
showing potential conflicts and cultural risks

15. #RSAC
Case Study: Security Culture in PracFce
at Salesforce

16. PercepFon is Reality
16
pixabay.com
flickr.com [martin]
pixabay.com
flickr.com [sean macentee]

17. Salesforce and the Culture Framework -
Where We Were & Where We Wanted to Go
17
Process Culture!
Managed Coordination!
Core Values:!
Stability!
Visibility!
Standardization!
Cardinal Directive:!
Enforce Policy
Tight Control
External!
Focus
Internal!
Focus
Loose Control
Compliance Culture!
Rational Goals!
Core Values:!
Conformity!
Repeatability!
Documentation!
Cardinal Directive:!
Pass Audits
Trust Culture!
Human Relations!
Core Values:!
Communication!
Participation!
Commitment!
Cardinal Directive:!
Empower People
Autonomy Culture!
Adaptive Systems!
Core Values:!
Flexibility!
Agility!
Innovation!
Cardinal Directive:!
Get Results
pixabay.com
pixabay.com
Assessment revealed a
Compliance Culture
Company has a Trust Culture
Mismatch!

18. GamificaFon: It’s Not About Playing Games
at Work…
Though 70% of execs have
admiYed playing video
games at work…
Informa4on Solu4ons Group/PopCap White Collar Gamer Survey
18
flickr.com [downloadsource.fr]
flickr.com [wlodi]

19. GamificaFon Elements
19
3
1
4
5
2
Autonomy: we like having choices
Mastery: we like ge4ng be6er at what we do
Feedback: we like ge4ng feedback on how we are doing
Purpose: meaning amplifies what we do
Social: all this means more with others
Based on “Reality is Broken” by Jane McGonigal

20. Gamifying Security
20
Pick Vital
Behaviors
Connect to
Purpose
Test And Give
Feedback
Reward/
Recognize
or
Educate
Socialize

21. Vital Behaviors:
Phishing, ReporFng, Badge Surfing
21

22. ConnecFng to Purpose
“Can you hold that office door
open for me? My arm’s broken
and this package is heavy…”
“Holy wow! Check out this video
of a giant snake ea?ng a
zookeeper!”
“If you don’t pay the fine, your
files will be locked and you will be
reported to the FBI.”
22
How attackers exploit bugs
in “human hardware”…

23. Test with Feedback
23

24. Recognizing Badge-Surfing Awareness
24

25. Reward: Security Champion Program
25
Basic awarenessNovice
Successful TestingApprentice
DoingKnight
TeachingMaster
InnovatingGrand Master
Trust Points

26. #RSAC
How to Transform Your Own
Security Culture

27. EvaluaFng & Improving Security Culture
You have to know where you are
before you can get where you
want to go
Cultural maturity is about
op?mizing organiza?onal self-
awareness
If culture was easy enough to
change with an awareness
campaign, every company would
be innova?ve, fun, and secure
27
Depositphotos

28. Culture as an OrganizaFonal Capability
Culture is a capability
Maturity is about
measurement
How do you know
culture is changing?
How do you know when
it needs changing?
How do you prove it?
28
1 - Instinct
2 - Awareness
3 - Visibility
4 - Transformation
5 - Mastery
Start
Security Culture !
Diagnostic Project
Security FORCE!
Project
Security Culture !
Transformation Program
3months
6months
9months
12months

29. Mapping out a TransformaFon Plan
Observe the terrain
Orient the map
Take a bearing
Start moving…
29

30. EvaluaFng Cultural Change
Maps show you where to go
They also show you where you’ve been (and how much progress
you have made)
Cultural transforma?on projects must regularly self-evaluate
Repeated SCDS surveys over ?me to see changes in shape
Tying culture and awareness to behaviors and ac?vi?es
Analyzing cultural ROI by tying behaviors to the business
30

31. Salesforce Culture TransformaFon: Outcomes
and Impacts
Increase quan?ty/quality of repor?ng
Social accountability
Rela?onship to failure
31
Depositphotos

32. Incident DetecFon
32
• Salesforce employees trained to report any suspicious
ac3vity.
• Customer reports also welcome.
“Someone just badge-surfed into
3 Landmark…”
“My browser proxy settings were
changed…”
“My mouse cursor is moving by
itself…”
“Is this email really from
American Express..?”

33. Results
33
52%
82%
Less clicks on malicious links by
champion program participants than the
average Salesforce employee.
More reporting of threats than non-security
champion program participants.
350% Increase in reporting rates in 6 months
period across all employees

34. Community and CommunicaFons
34

35. Apply Cultural TransformaFon to Your Own
Security Program
Next week
Ask colleagues which culture you have (process, compliance, autonomy, or trust?) Do you get different answers?
Are there things that always get priori?zed above security? Why?
Review your exis?ng awareness program - is it aimed at changing what people do or what they think?
Over the next 90 days
Download the SCDS and conduct your own informal survey of your security culture; give it to your CISO
Assess your organiza?on’s security culture maturity - can you trace specific behaviors back to priori?es and values?
Iden?fy three improvements to your awareness program that are culturally specific (gamifica?on, champions, etc.)
Over the next 6 months
Document and evaluate how o[en security “loses” to other priori?es - is it a lot?
Measure how well your awareness program improvements have changed the “shape” of your security culture
Formally expand your security awareness program, using your results, to drive culture and not just behaviors
35

36. #RSAC
Thank You! Any QuesFons?