May 18, 2007 - #20

You knew it wouldn't be long before I broke out the Culture Club reference. Well today is the day. Boy George lives. I don't know where and I don't much care about that, but he/she lives on and on and on.

Yes, there is a point. The folks that were kind enough to bring me into Columbus, OH for the All-Ohio ISSA/InfraGard/ISACA set up a round table discussion before the cocktail party last night. It was a great crowd and an even better conversation. I was all ready to get discussion moving around incident response and monitoring, but that was not to be.

The only thing the group wanted to talk about was CULTURE. Yeah, I was surprised as well. Sure this is a pretty advanced group in a sophisticated security community, but still. It was surprising that their biggest issue remained how to get everyone on board with the security mindset.

Unfortunately, I don't have any silver bullets or panaceas for that. It takes brute force effort, consistently, over a long period of time to change a culture. And the impetus has to come from the top. One of the folks at the round table made a great comment. He talked about how the C-suite at his company have gotten on board, and basically made it very clear if they have to change passwords and carry tokens and have their web traffic and email monitored and all that other stuff that we security folk do, then the rank and file employee better get on board as well.

Sometimes that's what it takes. Another round table member talked about how they recently did a training for one group of employees where HR, Legal and Security were all there at the same time to make it clear what the acceptable use policies of the organization are and why it's important to adhere to them.