How to build a security mindset - Anna Lezhikova
Channel: OWASP Foundation
Date: 06/01/2022

Speaker
Anna Lezhikova
Cogo, Lead DevSecOps Engineer

Description
Our security knowledge increases, our tools improve, but breaches still happen.

Studies show that 95% of security breaches are caused by human errors. One strategy to eliminate them might be to automate everything―to use smart technologies. But full automation remains an unrealized desideratum.

Another strategy is to build a security mindset. And here we have a challenge: how do we encourage people to do something that requires effort, that demands a change in behavior?

Recently, I participated in several activities through which I learned about the Maori way of educating people and managing change through storytelling and mutual teaching. It inspired in me the idea that this approach could be effective for educating people about security.

I lead cyber security work at a small company that is rapidly scaling and must significantly improve its security practices. Policies, guides, and traditional learning approaches haven’t changed behaviors by much, and awareness fades quickly after a course or a conversation.

I decided to test a new approach by using insights from the Maori culture of New Zealand to help to change the employees’ security mindset.

Here I share what I did and how it worked out. With these same practices, you may be able to achieve similar positive changes in your own workplace.


Managed by the OWASP® Foundation
https://owasp.org/