Why look at safety
Aviation and healthcare learned long ago what cybersecurity is only beginning to accept: human behavior, culture and trust are the foundation of reducing risk.
A 2018 report by Ashley Bye, Defining and Developing a Model for an Engaged Information Security Culture, draws the parallel directly. It identifies five dimensions of culture that affect how an organization performs.
Five dimensions
- Just. People are treated fairly when they make an honest mistake, and blame is kept for recklessness.
- Reporting. People report problems, errors and near misses, because they trust what will happen next.
- Learning. The organization draws lessons from what is reported and changes as a result.
- Flexible. The organization can adapt how it works when the situation calls for it.
- Questioning. People keep asking what could go wrong and do not assume that all is well.
The report's conclusion is that culture works like infrastructure. Without it, well-designed processes struggle to take hold. With it, an organization gets better at both prevention and recovery.
What it asks of a security program
Three practices carry these ideas into day-to-day risk management.
- Positive reporting. Teams document the controls they have implemented, so the record starts from work done and the gaps appear as what remains.
- Collaborative problem-solving. When a gap is found, it is treated as an opportunity to improve, and the security office helps work out what to do about it.
- Transparent risk acceptance. When a risk cannot be mitigated right away, there is a clear process for documenting, reviewing and accepting it. The risk stays visible, and nobody is blamed for naming it.
What changes
Where these practices take hold, the relationship between security and everyone else changes in ways people notice:
- Conversations move from compliance checklists to risk-informed decisions.
- Resource teams ask for guidance, and ask earlier in a project.
- Security is considered during planning, which avoids costly retrofits.
- Collaboration replaces an adversarial dynamic, and remediation speeds up.
This is why psychological safety is one of the five principles of participation. The Five Principles of Participation covers it alongside the other four.
Sources
- Ashley Bye, Defining and Developing a Model for an Engaged Information Security Culture, Royal Holloway, University of London, 2018.