When thinking about security in these times of heightened cyber threats we are often drawn to technical solutions. However, our investment in cyber security technology can be circumvented if we do not have good security culture. And good security culture is an extension of organisational culture.

The perpetrator of the alleged rape of Brittany Higgins is said to have previous form with respect to his attitude toward security. If someone places their priorities over their organisation’s, their personal preference over the security of their colleagues, then they will probably have lower thresholds of regard for other values-based requirements such as fraud and anti-corruption or respectful workplaces.

What is your organisational culture? What is your organisation’s security culture? Are they aligned? If integrity is rated highly then security is also expected to be high. It means that people will do the right thing and make that incident report or intervene to correct a security weakness independently, without direction. And they can only do this if they are taught what good security practice is as this is the foundation for a good security culture. Just as people can only contribute to good workplace culture if they know an organisation’s values and expected behaviours.

I remember with pride as a Chief Security Officer seeing security behaviour align with organisational values whilst viewing CCTV footage of a security incident. Whilst our security guards were distracted at reception a member of the public in the foyer tailgated a staff member. That’s when a female staff member intervened, spoke to the intruder, and brought him back into reception. She had the commitment to act when she observed an issue and she trusted that her actions would not be questioned or challenged by her organisation for doing the right thing. In turn, the organisation could trust her to do the right thing when other security layers; guards, passes, and swipe turnstiles; had failed. Both trust and commitment were among our organisation’s values at the time.

Consider a possible alternative. What if that person was an important and valued visitor and she, despite acting in accordance with policy, was chastised for embarrassing them? How would her security vigilance and behaviour be after that?

So, if security is sorted, it’s likely other things are as well. And conversely, if people are behaving in accordance with their organisational values then it is likely that security behaviours will be practised as well.

Next in this series, is Whistleblowers and Canaries.