Security Culture for Leaders

This Security Culture for Leaders course will teach and enable today’s cybersecurity leaders to build, manage, and measure a strong security culture. Cybersecurity leadership is no longer just about technology. It is ultimately about culture – not only what people think and feel about security but how they act, from the Board of Directors to every corner of the organization. As a result of this cyber security culture course, students will not only create an engaged and far more secure workforce, but also lead more effective and successful security initiatives

Course Key Learnings:

• Explain what organizational culture is, its importance to security, and how to map and measure both your organization’s overall culture and security culture
• Align your security culture to your organization’s strategy, including how to leverage different security frameworks and maturity models
• Effectively communicate the business value of security to your Board of Directors and executives and more effectively engage and motivate your workforce
• Enable and secure your workforce by integrating security into all aspects of your organization’s culture
• Dramatically improve both the effectiveness and impact of your security initiatives, such as DevSecOps, cloud migration, vulnerability management, Security Operations Center, incident detection & response and other related security projects
• Create and effectively communicate business cases to leadership and gain their support for your security initiatives
• Ability to measure your security culture, how to make those measurements actionable, and how to present the maturity and value of your security culture to leadership
• Leverage numerous templates and resources from the Digital Download Package and Community Forum that are part of the course and which you can then build on immediately

BUSINESS TAKEAWAYS

• Create a far more engaged and secure workforce, not only in their attitudes about security but also in their behaviors
• Dramatically improve the ROI of security initiatives and projects through increased success and impact
• Strengthen communication between the security team and business executives
• Instill stronger and more positive attitudes, perceptions, and beliefs about the security team
• Construct simpler, more effective security policies and governance

Course Content:

Module1: Fundamentals of Culture and Organizational Change

Overview

Section 1 begins by demonstrating how security is no longer just about technology but also about people and culture. We then explain what culture is, why it is so important and how it applies to security. We then demonstrate how to identify and map your organization’s overall culture, identify your organization’s current security culture, than determine the security culture you want to achieve. We will then cover several models and the best approach on how to achieve your desired security culture.

Exercises

• 1.1: Map Your Organization’s Overall Culture
• 1.2: Survey Your Security Culture
• 1.3: Define Your Desired Security Culture
• 1.4: Action Your Security Culture

Topics

• Human Side of Security
• Case Study – Equifax Congressional Report
• Defining Culture
• Mapping Organizational Culture
• Defining and Mapping Security Culture
• Identifying Desired Security Culture
• Change Management Frameworks
  • ADKAR
  • Kotter 8 Steps
  • CPNI’s 5Es
• Motivating and Enabling Change

Module2: Motivating Change

Overview

Section 2 focuses on motivating people and explaining the “why” of security. Far too often, security fails because security teams simply mandate what people must do and then punish those who fail to follow policy or exhibit the desired behaviors. As a result, there is a great deal of resistance from the workforce. In this section, we’ll walk you through how to effectively engage and motivate your workforce, including leveraging marketing models, implementing incentive programs, and targeting both specific and global audiences. As a result security and the security team are perceived as helpful, collaborative and enablers, your first step to building a strong security culture.

Exercises

• 2.1: Password Management Deployment
• 2.2: Developer Personas
• 2.3: Marketing DevSecOps

Topics

• Safety: Survive vs. Thrive
• Start With Why
  • WIIFM
• Know Your Audience
  • Marketing Personas
• Marketing Change
  • AIDA Marketing Model
• Motivating Global Change
  • Security Ambassadors
• Incentivizing Change
  • Recognition

Module3: Enabling and Measuring Change

Overview

Section 3 begins with the concept of Curse of Knowledge, the more of an expert you are at security the more likely you don’t realize just how confusing and difficult security is for others. One of the most common reasons organizations have a toxic security culture is security overwhelms people. We have to enable people so security is simple for them. This begins with imparting knowledge – that is, training people and providing them with the skills to be successful. We then simplify what is expected of them by making security as easy as possible. Far too often, the policies, processes, and procedures we create are complex, intimidating, or difficult to follow. Finally, we’ll cover how to track, measure, and communicate the impact of your security culture.

Exercises

• 3.1: Learning Objectives
• 3.2: Human Sensor Network
• 3.3: Security Culture Survey Design

Topics

• Cognitive Biases
  • Curse of Knowledge
• Building Knowledge
  • ADDIE Model
  • Learning Objectives
  • Kirkpatrick Evaluation Model
• Simplifying Security
  • System 1 vs. System 2
  • Choice Overload/Defaults
  • Policy Design
• Measuring Change
  • Capturing Metrics
  • Categorizing and Actioning on Metrics
  • Presenting Findings and Values

Module4: Making the Business Case

Overview

Up to this point we have covered how to create a strong security culture within your workforce. In this section we cover how to do the same thing but with your executive leadership. A strong security culture depends on the support of your executives, but to get their support you have to speak their language. In this section we cover the key elements and frameworks for putting together a high-impact business case, including a dive into financials.

Exercises

• 4.1: Develop a Clear Business Case
• 4.2: Create a Multi-Year Budget

Topics

• Building Your Business Case
  • Anatomy of a Business Case
  • Executive Summary
  • Definition of the Problem
  • Comparison of Solutions
  • Recommendation
  • Moving Your Business Case Forward
• Financing Your Business Case
  • Finance 101
  • CFO 101
• Communicating Your Business Case
  • What to present
  • How to present
• What Will This Make Possible?

Module5: Capstone Workshop

Overview

In the final section you will combine and apply everything you have learned through a series of interactive, team labs. Your mission is to work as teams to make some very tough decisions as you create a strong security culture at Linden Insurance. Each of the labs build on the previous labs, with the decisions you make in each lab impacting not only your score but what decisions you can make in future labs – just like in real life! For the capstone you will leverage the Cyber42 simulation game environment, spurring discussion and critical thinking of situations that you will encounter at work.

Prerequisites