Enterprise security can be messy: Building a Security-Aware Culture
Your executive team gets it. They've approved the budget, they mention security in board meetings, they understand the stakes. You're not fighting for recognition at the top anymore.
But then you look at what's actually happening three levels down. The marketing team is sharing credentials to social media accounts. Sales is pushing back on MFA because it adds seconds to their login process. Developers are storing API keys in public repositories because it's faster than the approved method. Remote employees are working from unsecured networks and don't think twice about it.
The executive commitment is there. The company-wide behavior isn't. And that gap is where breaches happen.
This is the challenge that keeps security leaders up at night. You have the mandate from above, but translating that into thousands of daily decisions made by people who have completely different priorities is a different game entirely.
It happens because cybersecurity teams do not design for efficiency and believe that security trumps everything else. If they understood that security, just like anything else, is there to drive the business, they'd perhaps sit down with people doing the work. And then figure out how hard it is to share a simple file or a photo, take it to the print shop as one can't plug in their private USB stick, or how annoying it is to develop Linux IoT firmware on WSL, or how annoying it is to get logged out every 2h.
Because unless you do, people will adopt behaviour that makes them productive, and instead of increasing security, your policies will drive it down.
This is not a result of "bad employees": this is a result of bad security policies.
Yes, i couldn't agree more with this. The problem these "bad employees" earns wage by getting results and not entering multiple times mfa codes during day or repeating same logins. And talking from experience: these secure practices starting to approach at least hour of productive time everyday, which is literally robbing time
Well, that's because somewhere between the executive team, which "gets it", and "three levels down"... somewhere between 1 and 2 levels down, there is a team that translates "security" into some compulsory training, scanning internal software/apps/libraries/libraries using crappy automated vendorware, and counterproductive/arbitrary password requirements.
After that, "security" starts to mean "ticking all the boxes to keep the scan happy and stay off the report" (even if the scans are wrong, out of date, littered with false positives, and lacking the ability to find basic problems) and stops having anything to do with actually being secure.
"..teams not design..efficiency.."
Enough truth in that.
Need hours back and forth w/the end user, moderately sophisticated UX designers (eg. empathy, anybody?) user education (not mandates) and training, an actually useful help desk, efficient equipment... And real time graduated enforcement that impacts all levels, not just the bottom level perp-scapegoat.
No security works unless it is enforced and there are severe consequences
> Marketing team sharing credentials
Fireable offense, immediate firing first time this happens, won’t happen again after that, both of person who shared the credentials and person who used the shared credentials
> Sales MFA
Prevent login without it, let them bitch about it for a week
> API keys in repos
Fireable offense not just for commiter but entire team
If you made API keys in the repo a fireable offense for the whole team, people would stop using the repo. There's already a constant problem at my company with people not merging into main/master in order to avoid the overbearing automated security scanning.
[dead]