Quick Look: Incorporating Security Practices into Business Processes
summary
Explains why traditional security awareness programs often miss the mark and shows how to move from blaming users to embedding security behaviours into everyday work. Describes using organisational policies, procedures and guidelines to make security practices part of business processes so employees follow them as part of their normal job. Technologies are not specified; the focus is on process design and procedural integration rather than tools.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:29A Couple Warnings
- 1:10Why Do You Drive Safely?
- 1:39In The Workplace
- 2:01Important = Procedure or Guideline
- 2:22It's Not the same with Security
- 3:30Shoulds versus Musts
- 4:21Awareness Programs Should All Over People
- 4:41Behind Every Stupid User...
- 6:58Sommelier vs. Grandma
- 9:05Countless Processes to Address
- 9:41Try to Get C-Level Support
- 10:22Prioritization
- 11:58Where Can Security be Added
- 13:21For Each Step of a Process
- 14:42Learning From Incidents - R.I.F.
- 15:14Building in Exception Handling
- 16:23ABCs of Awareness
- 17:41Motivation, NOT Entertainment
- 19:03Institutionalizing Peer Pressure
- 19:35Creating a Culture is a Presentation Itself
- 20:54The Books, The Myths, The Legends
related talks
29mUsable Security: A Human-Centric Approach to Security
47mTransforming Security Through Design
40mMaking Security an integrated part of the SW Dev Lifecycle
48mHow to build a security mindset
34mSecure by design - the secret weapon of high-performing organisations
20mBuilding security culture on infrastructure teams
13mPeople-Centric Security: From Awareness to Culture
03mImplementing security into an organization