Integrating Security into Organizational Culture

Security becomes truly effective when it stops being perceived as a set of rules imposed by IT and becomes a natural part of how the organization works day to day. HR plays a key role in this cultural transformation, since it manages many of the spaces where that culture is built: onboarding new employees, performance reviews, internal communications and the values the organization chooses to publicly reinforce. Incorporating security messages into these usual spaces, instead of reserving them for specific training sessions, normalizes behaviors such as reporting without fear or questioning a suspicious request. A strong security culture shows when employees themselves, without anyone asking, remind a coworker to verify before clicking.