Why Don’t They Do as They’re Told? Wendy Goucher

Special Note This deck appears as presented at the Malta Chapter conference (with pictures protected). This means there are no notes or explanations. If you want to ask me to explain something then please do drop me an Email to wendy@goucher.co.uk And I will try to explain myself in a slightly more helpful way. Special thanks to everyone for making us feel so welcome

Mobile Working

Risk

Why?

Why?

Because they’re Stupid? “People are the Weakest Link in Information Security” Weakness needs considered handling and exercise

The Challenge of Mobile Device Security Just telling them doesn’t work. Rewards and Punishments are ineffective in the medium term. They are going to be out of your reach.

Internalisation Understand the risk Believe in the risk Trust the solution Believe in their implementation

Wendy Goucher’s work. Please respect my IPR Building Intentions Wendy Goucher’s work. Please respect my IPR

The Road of Good Intentions Gulf of Execution Motivation Deterrent Secure Behaviour Conversion Behavioural Intention Abandoned intention Insecure or lack of secure behaviour Wendy Goucher’s work. Please respect my IPR

GoE Motivators Deterrents External Source External Source Wendy Goucher’s work. Please respect my IPR Management External Source Positive Re-enforcement Lack of trust in source expertise Visible Monitoring Lack of Expertise Employee Participation Resource Scarcity Inappropriate Training Feedback channel Elapsed Time since last performed Internal Source Self Efficacy Commitment Habit Implementation intention Lack of Commitment Response Cost Autonomy Response Cost Tension between task and security Work Pressure Internal Source

Most people care more about Make it Meaningful Most people care more about Personal Risk than Corporate Risk Use That Knowledge

Why don’t they do as they’re told? Because they don’t believe or understand the risks. Because they don’t think the risks are significant. Because they find the controls get in the way of their work. Because they don’t think the effort is worth it.

Operational Compatibility Hints and Tips Communicate the Risk Make their effort meaningful Operational Compatibility Make controls and guidance a matter of principle rather than specifics Operational Compatibility

Any Questions? wendy@goucher.co.uk