Cultural Security: Promoting Security Policies Using Organizational Culture

Steven Fox

Cross promoted from the McAfee Security Connected blog

 

Most of us refer to security policies in much the same way as we refer to our car manuals – when something unexpected happens.  We know these documents have useful information.  However, their utility is tied to situations where answers do not present themselves readily.

According to Chris Noel, SVP of Product Management at ANXeBusiness, “security policies communicate organizational culture, set expectations and boundaries, define risk appetites, and establish a legal duty of care.”  Unfortunately, a role-based, functional understanding of security policies is uncommon. So how do we take security policies out of the proverbial glove compartment?  The following tips are based on “Eight Ways to Communicate Your Strategy More Effectively” by Georgia Everse.

Share the spirit of the policies

One of the biggest questions I’ve received when drafting security policies is “why does this matter to me?”  By virtue of their role in the compliance process, most policies share a lexicon only familiar to upper management. The core significance of the policy – the lead story – is often buried.

Eager to capitalize on the investment made in policy creation, one of my clients organized stakeholders from all its functional units to create a messaging strategy that would personalize these documents.  The message described the impact of these policies on the company’s ethos rather than regulatory requirements.  This approach demonstrated awareness and respect for the roles comprising the corporate culture.

Use customer feedback to evolve the policies

Successful companies evolve in response to market forces and customer feedback. Similarly, security policies should be updated to reflect changes in the threat landscape and the organization. This can be done by recruiting the managers of all business units in gathering feedback from their reports.  Once collected, the information can be analyzed and integrated into the existing policies.  Leveraging this feedback appropriately maintains the relevance of the policy content.

Use the right communication framework

Everse emphasizes that “not all messages are created equal.  They need to be prioritized and sequenced based on their purpose.”  Some of my clients have treated policy training like a final’s night cram session.  The outcome usually creates two camps in the organization; one that understands the letter of the law but not its spirit and those who quickly forget what they learned out of frustration with the process.  Policy messaging should model the processes through which other elements of organizational culture are communicated.

Inspire

A policy message that is relevant to the organization, its staff and its customers will inspire confidence.  The message should be supported by the actions of those who promote it.

Educate

Policy awareness is not enough to trump a culture that does not support the policies.  By focusing on the benefits of individuals, and to the groups with whom they affiliate, the organization can leverage cultural influence.

Reinforce

Contemporary policy training uses an annual reinforcement schedule that tends to build a “checklist” mentality among stakeholders.  Organizations that socialize their policies through case studies that illustrate their value have the greatest success.   For example, one of my non-profit clients includes customer-interaction success stories that link back to their security policies as part of their employee newsletter.

Build alliances to support the policies

Upper-management support is not enough.  Many of my policy development engagements have revealed office politics with players across the organizational chart.  At a healthcare organization in Southern Texas, for example, some of the executive assistants wielded significant influence in how policies were perceived by employees in their functional areas.  Policy marketing should use a viral model, using the influence of these individuals to stimulate dialogues around policy success stories.

Optimal utilization of security policies relies on the audience for which they are created.  Policy creation and marketing must recognize and capitalize on organizational culture to promote its value proposition.  People can be the strongest link in the security chain.

For more insight from the world of enterprise security, be sure to follow @McAfeeBusiness  on Twitter for future updates.