Creating a Culture of Enterprise Cybersecurity

Abstract

In this article I describe the fundamental dimensions of a security culture, a concept that builds on the experience of “safety culture” in several high-hazard industries. After outlining the concept and subtleties of corporate culture, I apply these concepts to issues of security, focusing on issues of trust, identification and authentication in complex environments. These issues become more challenging in virtual environments, as familiar tokens of identity such as face-toface recognition are absent, and where trust becomes a weakest-link problem. I conclude with a description of the challenges of “managing” the emergent phenomenon of culture, and how trust can be cultivated.