Answering the WHYS in Cybersecurity BSides Fredericton 2017 Kathryn Chamberlain

How many... Deal with end-users? Run a security campaign? Fix the technology when end-user break things? Are the security ‘lead’ for their organization? Are an advocate for cybersecurity?

About Me Mount Allison University Graduate Venture for Canada Fellow Commerce & Mathematics Employee Engagement & Change Management Research Internships Venture for Canada Fellow Beauceron Security

Today Challenges for End-Users Employee Engagement Organizational Culture Change Management Questions

Why are we talking about “HR STUFF” at a cybersecurity event?

Why do I have a role in this? Why can’t you just fix it? Why does this matter? Why do I have a role in this? Why can’t you just fix it? Why would someone target me anyway? Why would someone want our data? Why should I care?

Top Challenges for Security Professionals Communication Upper Management Support Employee Engagement Other Time Money Culture Enforceability of a program Resources Staff SANS 2017 Security Awareness Report

Today Challenges for End-Users Employee Engagement Organizational Culture Change Management Questions

Employee Engagement

Employee Engagement High degree of emotional and intellectual commitment to the organization; employees fully involve themselves in work, are absorbed, focused and energized, going above and beyond with discretionary efforts, fostering change, and dedication. Kahn, 1990; Macey & Schneider, 2008; Unal, Zeynep and Tu Tugurt, 2015

Common Themes Each person is unique- what engages you doesn’t necessarily engage the person standing next to you.

Some Examples Autonomy Models of upward feedback Career growth opportunities Opportunity to be creative/innovative Clarity of expectations Personality Conscientiousness Psychological Safety Communication Recognition Culture Role Expansion Feelings of energy and empowerment Senior management Feeling Informed Supportive colleagues Flexibility Supervisor commitment Involvement in decision making Values Leadership Styles Work/life balance

Research Study Narrative Inquiry Interviews & Focus Groups Collaborative Effort

A Short Story When asked most engaging experience … Recruiting event for their company Answering questions about the company, Interacting with boss & others Meaningful Assignment When asked about person they trusted most… Getting to know them outside of work Their communication style Feedback Leadership Style Kathryn Chamberlain (2017)

Kathryn Chamberlain (2017)

Engaging Security Programs Meaningful Work - Why does this matter? Ownership - Why is this my job? Problem Solving - What can I do to fix this? Alignment of Mission - Why is this important to me? Feedback - How can we make this better? Personal Histories - Why are you interested in security? Communication - How consistently are you talking about security? Do you walk the talk?

Today Challenges for End-Users Employee Engagement Organizational Culture Change Management Questions

The Way We Do Things Around Here, Everyday. Organizational Culture

Shared Assumptions, Values and Beliefs Amongst Organization Members Organizational Culture

Does your organization value security?

Suggestions 1. Ensure a security representative is attending all board meetings 2. Educate security representative on how to effectively communicate cyber-risk 3. Provide security representatives with business context 4. Clearly differentiate between cyber-risk management and compliance. Fred Kniep from Compliance Weekly

Today Challenges for End-Users Employee Engagement Organizational Culture Change Management Questions

Change Management “Change management is the discipline that guides how we prepare, equip and support individuals to successfully adopt change in order to drive organizational success and outcomes. While all changes are unique and all individuals are unique, decades of research shows there are actions we can take to influence people in their individual transitions. Change management provides a structured approach for supporting the individuals in your organization to move from their own current states to their own future states.” Prosci Change Management Definition

Levels of Change Management Individual Change Management Individual change management requires understanding how people experience change and what they need to change successfully.  Organization/ Initiative Change Management Driving successful individual transitions should be the central focus of the activities in organizational change management. Enterprise Change Management An enterprise change management capability means effective change management is embedded into your organization’s roles, structures, processes, projects and leadership competencies. Prosci Levels of Change Management

Change Agents “Change agents sponsor and promote change initiatives in organization; change recipients are those organizational members who carry out the change measures.” (Klonek, Lehmann-Willenbrock &Kauffeld, 2014) 36 minutes

Change Agent Keys External validation of the method of change 1 Individual change agents need to have some credibility within the organization2 Focus on the big picture- frame initial communications on broad concepts than detailed specifics 3 Bring it back to the individual- why should it matter to them 3 Help provide business context – why should it matter to the organization, what are the lasting impacts of the decision 3 1- Birkinshaw et al., 2008 2- Armenakis et al., 1993 3-Larry Powers at Boxley Group - Consulting Blog

Key Take-Aways Build an engaging security program Think about the impact on each individual user Create a level of ownership Build trusting relationships throughout the organization Identify the level of change you’re making Communicate frequently, consistently and don’t forget to walk the talk.

Challenges to You Think about why you got into security in the first place – talk about that story with your team Have/Attend cross-department meetings – try to understand the challenges they are facing and how security impacts their strategic objectives Leverage your people – find people throughout your organization who believe in a security culture and empower them with the knowledge and resources they need

How can I get involved? Why does this matter? Why do I have a role in this? Why can’t you just fix it? Why would someone target me anyway? Why would someone want our data? Why should I care? How can I get involved?

Questions @_kachamberlain kathrynannechamberlain@gmail.com Kathryn Chamberlain