MGT521: Leading Cybersecurity Change: Building a Security-Based Culture

Overview

Section 1 begins by demonstrating how cybersecurity management is ultimately about organizational change. Technology alone will no longer solve security problems. We explain what culture is and how it applies to cybersecurity, how to map your organization's overall culture, and then determine the security culture you want and how to align it with your organization's culture. We will then cover organizational change and different models for changing an organizational culture.

Exercises

• Exercise 1.1: Map Your Organization's Culture
• Exercise 1.2: Survey Your Security Culture
• Exercise 1.3: Define Your Desired Security Culture
• Case Study: Project Charter: Vulnerability Management Case Study

Topics

• Human Side of Security
• Case Study - Equifax Congressional Report
• Defining Culture
• Mapping Organizational Culture
• Defining and Mapping Security Culture
• Identifying Desired Security Culture
• Defining and Leveraging Change Management Frameworks
• ADKAR
• Kotter 8 Steps
• Project Charters

Overview

Section 2 focuses on motivating people and explaining the "why" in change. Far too often, security fails because it dictates what people must do and how to do it but never explains why. As a result, there is a great deal of resistance to attempts to change workforce behavior and implement security initiatives such as DevSecOps or vulnerability management. In this section, we'll walk you through the key elements of explaining why change is needed, including leveraging marketing models, implementing incentive programs, and targeting both specific and global audiences.

Exercises

• Exercise 2.1: Password Management Deployment
• Exercise 2.2: Developer Personas
• Exercise 2.3: Marketing DevSecOps

Topics

• Safety: Survive vs. Thrive

• Start With Why

  • WIIFM

• Know Your Audience

  • Marketing Personas

• Marketing Change

  • AIDA Marketing Model

• Motivating Global Change

  • Security Ambassadors

• Incentivizing Change

  • Recognition

• Motivating Stakeholders

  • Stakeholder Support Matrix

Overview

Communicating with people and engaging and motivating them is only half the battle. We also have to enable people to change. This begins with imparting knowledge - that is, training people and providing them with the skills to be successful. We then simplify what is expected of them by making security as easy as possible. Far too often, the policies, processes, and procedures we create are complex, intimidating, or difficult to follow. Finally, we'll cover how to track, measure, and communicate the impact of your change.

Exercises

• Exercise 3.1: Learning Objectives
• Exercise 3.2: Human Sensor Network
• Exercise 3.3: Security Culture Survey Design

Topics

Cognitive Biases

• Curse of Knowlege

Building Knowledge

• ADDIE Model
• Learning Objectives
• Kirkpatrick Evaluation Model

Simplifying Security

• System 1 vs. System 2
• Choice Overload/Defaults
• Policy Design

Measuring Change

• Capturing Metrics
• Communicating Metrics

Overview

Up to this point we have covered how to communicate with your workforce and engage and motivate various departments. In this section we cover how to do the same thing with your business leadership. A strong cybersecurity culture depends on the support of your executives, but to get their support you have to speak their language. In this section we cover the key elements and frameworks for putting together a high-impact business case, including a dive into financials.

Exercises

• Exercise 4.1: Develop a Clear Business Case
• Exercise 4.2: Create a Multi-Year Budget

Topics

Building Your Business Case

• Anatomy of a Business Case
• Executive Summary
• Definition of the Problem
• Comparison of Solutions
• Recommendation
• Moving Your Business Case Forward

Financing Your Business Case

• Finance 101
• CFO 101

Communicating Your Business Case

What Will This Make Possible?

Overview

In this final course section you will combine and apply everything you have learned through a series of labs. Your mission is to work as teams to make some very tough decisions as you attempt to secure Linden Insurance during a crisis. The decisions you and your team make in each lab will impact your team's Culture Score. Each of the six labs builds on the previous labs, with the decisions you make in each lab impacting not only your score but what decisions you can make in future labs - just like in real life!

Exercises

• Exercise 5.1: Define Culture
• Exercise 5.2: Identify and Define Training Topics
• Exercise 5.3: How to Engage and Motivate
• Exercise 5.4: How to Train and Enable
• Exercise 5.5: Define Metrics
• Exercise 5.6: Create and Present a Business Case