Security Culture Hacking: Disrupting the Security Status Quo
summary
Defines 'security culture hacking' as a teachable set of practical techniques to change an organization’s security culture, using methods such as awareness programs, large-scale learning initiatives, and security champions. Shows how to recognize current security culture, apply those techniques within an organization, and produce an actionable plan for lasting culture change.
AI-written summary · about
chapters (33)
- 0:00Intro
- 0:47Agenda
- 2:14The reality of security culture
- 3:29Security culture goals
- 5:02Avoid the security status quo
- 6:01Security culture is a long game
- 7:46Security culture that lasts
- 9:37Security culture hacking
- 11:16Inverse of a social engineer
- 12:00How to hack a security culture
- 13:20Assessment random sampling
- 13:42A simple self-assessment
- 14:22Case study: water cooler
- 15:21Assessment tips for success
- 16:16Communicate
- 16:29Various communication approaches
- 17:15Case study: scare tactics
- 18:47Communication tips for success
- 18:57Connect
- 19:42Champion case study
- 20:31Champion tips for success
- 21:50Champion activities
- 23:28Educate
- 23:45Mechanisms of security learning
- 24:13Continuous security education case study
- 26:03Continuous security education tips for success
- 28:02Reward using the tools you already have
- 28:49Rewards case study
- 30:03Rewards tips for success
- 30:51Data (Metrics)
- 32:07A "hacked" security culture
- 34:19"Apply" Slide
- 35:18Q+A and Thank you!
related talks
37mSecurity Culture Hacking: Disrupting the Security Status Quo
40mCulture Matters—Put People at the Heart of Security
48mSecurity Champions And Experiments: Building Blocks For Cultural Change
20mOh the Humanity! Building Reliable Cultural Firewalls
44mUnlikely Allies: How HR Can Help Build A Security-First Culture
24mConcrete Steps to Create a Security Culture
46mCultivating a Security-First Culture in Tech Organizations
20mBuilding security culture on infrastructure teams