The Dark Alley 

Building a culture of security

An individual walks down the street late at night, talking on the phone, heading toward the bus stop. Suddenly, they realize they've missed the last bus and will have to cross a dark, eerie alley in a dangerous neighborhood to get home. With no other choice, they take off their watch, hide the gold chain hanging around their neck, and pocket their shiny new iPhone. They walk quickly through the alley, trying not to draw attention, and soon make it through the neighborhood, continuing their journey safely.

This is a fairly common story, so what does it have to do with building a security culture within an organization? The question we should ask is this: what led this individual to take these precautions before entering the alley? The answer is “their security culture.”

We believe one of the most effective ways to foster a strong security culture is to educate people about the threat and how their actions impact the level of risk.

That night, the individual in our story was convinced the threat was real and that they needed to take steps to protect themselves from it. This conviction may have stemmed from office gossip about incidents that happened in that alley, from a friend who was mugged there, or from news reports about crimes in the area. Whatever the source of information, they were convinced the alley was dangerous and that they could be targeted. The individual voluntarily hid their gold chain, removed their watch, and stowed their phone away because they understood clearly that by taking these specific actions, the risk of being attacked would be reduced. They were convinced the threat existed and knew how their actions would affect their risk (e.g., “if I take off my watch, the risk is lower; if I leave it exposed, it’s higher”).

If an organization's staff is not convinced that a threat is real, and if they do not understand how their own actions impact the risk, they will inevitably, sooner or later, expose the organization’s valuable assets and resources to a dark alley somewhere.