Understanding and Transforming Organisational Culture

Since the introduction of computers, information systems and data have been repeatedly undermined by design flaws, weak passwords, lost media, social engineering and numerous other bad practices. These risks continue to grow with the increasing complexity and connectivity of modern business systems. But actions by people are not only the cause of incidents, they are also the means to prevent, detect and resolve them. People design, implement, operate, use and abuse information systems. And in the process they make mistakes or create weaknesses that enable criminals to steal, corrupt and manipulate information assets. Addressing these risks cannot be done through technology and process alone. It requires an understanding of the principles for understanding organizational culture, creating awareness, and changing attitudes and behaviour. This paper presents a range of observations about the nature of organizational culture, as perceived by an experienced information security director, as well as a set of practical techniques, based on psychological principles, that have been found to be effective in helping to achieve desired changes in human security behaviour.