Five-step bulletproofing?

In the course of searching for case study materials and quotations to illustrate October's awareness materials, I came across 5 ways to create a bulletproof security culture by Brian Stafford. Brian's 5 ways are, roughly: 

1. Get Back to Basics - address human behaviors including errors. Fair enough. The Information Security 101 awareness module we updated last month is precisely for a back-to-basics approach, including fundamental concepts, attitudes and behaviors.
   
   
2. Reinvent the Org Chart - have the CISO report to the CEO. Brian doesn't explain why but it's pretty obvious, especially if you accept that the organization's culture is like a cloak that covers everyone, and strong leadership is the primary way of influencing it. The reporting relationship is only part of the issue though: proper governance is a bigger consideration, for example aligning the management of information risks and assets with that for other kinds of risk and asset. Also security metrics - a gaping hole in the governance of most organizations.
   
   
3. Invest in Education - "Any company that seeks to have a strong security culture must not only offer robust trainings to all employees—including the c-suite—but also encourage professional development opportunities tailored to their unique focus areas." Awareness, training and education go hand-in-hand: they are complementary.
   
   
4. Incentivize & Reward Wanted Behavior e.g. by career advancement options. Again, the InfoSec 101 module proposes a structured gold-silver-bronze approach to rewards and incentives, and I've discussed the idea here on the blog several times. Compliance reinforcement through rewards and encouragement is far more positive and motivational than the negative compliance enforcement approach through pressure, penalties and grief. Penalties may still be necessary but as a last resort than the default option.
   
   
5. Apply the Right Technology - hmm, an important consideration, for sure, although I'm not sure what this has to do with security culture. I guess I would say that technical controls need to work in concert with non-tech controls, and the selection, operation, use and management of all kinds of control is itself largely a human activity. The fact that Brian included this as one of his 5 ways betrays the widespread bias towards technology and cybersecurity. I'd go so far as to call it myopic.
   
   

Personally, and despite our obvious efforts in this area, I'd be very reluctant to state or imply that an organization's security culture could ever be considered bulletproof, not even in the purely rhetorical sense. It's an important part of a bigger set of things, one that happens to be relevant to most of information risk, security, privacy, compliance, governance and so on, but culture, alone, won't deflect bullets: knowing that, and being ready and willing to handle the consequences of incidents, is itself characteristic of a robust security culture.