Hannover/Tripwire security survey emphasizes culture
"Building a culture of security within the organization as well as compliance with regulations, standards, and policies are the most important security capabilities for executives and non-executives: the surveyed information security managers were most likely to give these capabilities the highest overall importance ranking."
So says Hannover Research's CISO Pulse Survey aka CISO Insight Survey*, a small-scale study on behalf of Tripwire. Whether you consider the 100 or so mostly North American respondents a valid sample of the population is your decision, but let's just say that their conclusions are "unsurprising".
Unfortunately the report does not explain what 'building a culture of security' actually involves. It's a shame that the security culture is so often mentioned glibly in such vacuous, throwaway statements. The concept may gets heads nodding sagely but, in my experience with a few exceptions, information security professionals, managers and executives rarely have much of a clue about how to do it. It's the elephant in the room. Everyone agrees that something must be done, but presumably expects someone else to do it!
An information security awareness program is a vital part of establishing and maintaining the security culture provided it is done well - and by that I'm getting at things such as:
- Being overtly supported by all levels of management, top-to-bottom;
- Addressing the entire organization, not just "end-users" (a horribly demeaning term, and an IT-centric one at that);
- Being creative, appealing and motivational;
- Being topical and current, keeping up with what's hot in this dynamic area;
- Presenting useful, interesting, well-written content in forms and styles that suit the intended audiences (note the plural: we each have our own communications needs and preferences, so carve up the population into distinct segments rather than trying to paint them all with the same broad brush);
- Being broadly-based, taking in a wide variety of topics, some of which are tangential but still important in this sphere (compliance being a classic example: compliance with information security and privacy laws is but a small part of the compliance imperative);
- Being relevant and applicable, promoting information security as a business issue with genuine business value rather than for its own sake.
When I get the chance, I'll be critiquing and scoring the specific metrics mentioned in the report using the PRAGMATIC method, here on the security metrics blog.
PS As if that's not enough, we've just published a complete security awareness module on social engineering, social networking and human factors which includes a paper on security metrics in this area.
PPS I did have time to continue the bloggings after this introduction. By all means take a look at parts one, two, three, four and five of this series.
* The survey is, of course, part of Tripwire's marketing, hence they squeeze us for our contact details prior to releasing the report. Let's hope they are responsible marketers with an appreciation of our privacy rights.
PPS I did have time to continue the bloggings after this introduction. By all means take a look at parts one, two, three, four and five of this series.