As Managing Director of Layer 8 Ltd, a security company dedicated to using conversations to change culture, I often find myself being asked what the ‘return’ would be on investing in security culture – lots of security professionals still see it as a nice ‘add-on’ but not a priority. My reply is always that a proactive approach to security is a ‘must have’ in the current threat landscape, and that cultural values are the drivers which can transform passive employees into passionate security advocates.
So what are Cultural Values?
Think of the National Health Service. For UK citizens it’s personal: It makes us feel proud, it makes us angry if it’s threatened, it’s an emotional locus of our feelings and beliefs about the provision of healthcare. A recent Guardian article described the commitment of NHS professionals to the founding principles of the organisation, regardless of status or pay-grade, as ‘like a religion’… now that’s cultural values at work.
Cultural values are powerful because they enshrine beliefs which influence our decision-making process. Cultural values remind us of what we as a society believe is acceptable, what is important, what is right. Most important, cultural values pack an emotional punch; they don’t just offer us a theory, they give us a ‘gut-reaction’ as a guide.
The NHS was founded on the cultural value that the service should offer healthcare free at the point of delivery; that it should be available to everyone, and that care should be offered in response to clinical need, not the ability to pay. On a more personal level, the patient is put at the heart of everything they do – and everyone has their own story to share of having experienced this exceptional service, which is as much about dignity and respect – “They couldn’t do enough for me” – as it is about clinical excellence.
Every business has Cultural Values at its core.
Every business is founded on core cultural values – it couldn’t operate if this wasn’t the case. Cultural values are key to the energy, dynamism and momentum and also the future direction of a business. So why don’t we understand them better? It’s back to that emotional punch they pack which makes it difficult to pin them down; a nurse is unlikely to become compassionate as a result of reading a textbook, but she will certainly understand the kind of behaviour required of her if she is asked to treat every patient as though they were personal family members, which is equivalent to placing the patient at the heart of everything she does.
How do Cultural Values translate into behaviour?
Cultural Values serve as the drivers to responsible, proactive behaviours across the organisation. In a recent workshop we discovered that ‘Pride in a good day’s work’ was at the heart of the organisation’s delivery; each employee knew, through in-house training, but more through personal conversation, what constituted a good day’s work, and the ‘cultural norm’ was to attempt to achieve it, however tight the deadline. On closer inspection, we found that ‘security’ had never made its way onto this hallowed ground. We began to find ways to link ‘pride’ with security using word of mouth, appraisals, compliance checks. Within weeks, pride was beginning to be linked to working securely and packing a major emotional punch. How do we know that? Because behaviours started to change; reporting procedures improved, collaboration on solving problems became efficient and proactive, security started to be requested as an agenda item at Team Meetings, and people wanted to be involved in enhancing the security of the business. They were proud to do so.
Why are Cultural Values important to effective security?
Effective security requires end-users to care about securing the business they work for. It’s never going to be enough to learn a few rules, be able to quote the policy, or gain full-points in the compliance test. As human beings we want to care, and we have a number of ways to show that we care; these behaviours are based on our cultural values and they influence everything we say or do. Reminding people of the core values at the heart of the business they work for is often enough for them to find a personal connection and engage at a deeper, more personal level, with the work they are doing and the security of their organisation. Once cultural values are in play, work becomes more meaningful; it starts makes sense beyond the pay-cheque. Once that happens – you know you’re in safe hands.
Layer8 offer workshops and training based on the use of cultural values. On 28th January 2016 Layer 8, in association with Secon, will be running a webinar: How Can Cultural Values Make Your Business More Secure? We will be discussing a range of issues relating to security culture, and Bernie Auguste (Head of Security for Openreach) will offer a Case Study. If you would like to book your free place, please follow this LINK.