CyberSecPsych

“When dealing with people, remember you are not dealing with creatures of logic, but creatures of emotion.”

-Dale Carnegie

The Security Culture Report 2017 – Indepth Insights into the Human Factor, a study done by CLTRe Research, looks at how age, experience, gender and attitudes influence risky behaviors and security culture. The findings highlight how cultural norms have a higher influence in the reduction of risky behavior in an organization, compared to the weak correlation found between formal trainings, knowledge, and behaviors (5).

In parallel, Debra Logan, Vice President at Gartner, expressed during her session, Changing Your Security Culture: Why Change Is Hard and What to Do About It at the Gartner Security & Risk Management Summit, that “security leaders should craft a vision to help the organization understand why it’s necessary to make changes to the firewall, governance, or other security matters. Explain what’s in it for colleagues and the broader organization, and create an emotional connection to help people understand what matters to them at work” (6).

The element of emotional connection in facilitating a strong security culture will be key going forward as organizations shift their focus from technologies to internal employees in an effort to combat the massive amounts of breaches taking place on a daily basis. And as highlighted in the Harvard Business Review, “the higher up you go in an organization, the less important your technical skills become and the more your interpersonal skills matter” (1). So what is the solution for creating the norm of emotional connectedness in the workplace and enhancing the security culture?

The answer is…WOMEN.

The Hay Group division of Korn Ferry conducted a study where they took data from 55,000 professionals across 90 countries and all levels of management, collected between 2011-2015, using the Emotional and Social Competency Inventory (ESCI), and “found that women more effectively employ the emotional and social competencies correlated with effective leadership and management than men,” with women being 45% more likely than men to be seen as demonstrating empathy consistently (2). This norm of showing empathy on a consistent basis, along with other factors of emotional and social intelligence, forges a safe environment for employees to depend on one another, wherein they can share ideas and failures, and enhances organizational security cultures.

Traditionally, most companies have focused on the functional benefits they give to their employees, such as “salary, extra annual leave, drinks on Friday and foosball tables” (5). However, a better strategy when looking to create emotional engagement with employees includes focusing on the societal impact the company is making, repetition of the company’s mission, and promoting how achievement the goal or vision will make employees feel on an emotional level, such as “trust, job security, achievement and empowerment” (5). This emotional engagement creates an intimacy between the employee and the organization and increases responsibility throughout the company.

The Hay Group study also found that the levels of emotional intelligence displayed by leaders are strongly correlated with the duration of time team members plan to stay with the organization. Those with high levels of emotional intelligence are able to create a momentum that inspires team members to work towards the same goals and retain employment with the company, and those with low levels of emotional intelligence have a greater ability to push employees away from the organization (2).

Women are largely underrepresented in the cybersecurity space, with the recent 2017 Global Information Security Workforce Study: Women in Cybersecurity, finding that women make up only 11% of the cybersecurity workforce. Furthermore, it was found that men are four times as likely to hold executive-level roles and nine times more likely to hold managerial positions (3). The study expands further in discussing how factors such as mentoring and support from leadership are significant success factors for women in information security. When we return to the Hay Group study, it was found that “competencies in which women outperform men are coaching & mentoring, influence, inspirational leadership, conflict management, organizational awareness, adaptability, teamwork and achievement orientation” (2). As the two studies clearly show, women are crucial in both setting the stage for organizational emotional connections to be made, as well as excel at the necessary components that promote the success and advancement of women within the industry.

This essential expansion of understanding of how women fit into the cybersecurity space will hopefully broaden the types of roles security organizations should be looking to create and fill. With the research clearly demonstrating that emotional connection is essential in fostering a strong security culture, and women outperforming men in the measurement of emotional intelligence, we can conclude that the creation of more strategic security communication roles in leadership positions will enhance organizational security culture, create a platform for women to excel in the space, and encourage employee retention all around.

1. Edinger, Scott. “Three Ways Leaders Make Emotional Connections.” Harvard Business Review. N.p., 02 Oct. 2012. Web. 23 May 2017. <https://hbr.org/2012/10/three-ways-leaders-make-an-emo&gt;.

2. “New Research Shows Women Are Better at Using Soft Skills Crucial for Effective Leadership and Superior Business Performance, Finds Korn Ferry Hay Group.” New Research Shows Women Are Better at Using Soft Skills Crucial for Effective Leadership and Superior Business Performance, Finds Korn Ferry Hay Group – Media & Press. Korn Ferry, 04 Mar. 2016. Web. 23 May 2017.

3. Reed, Jason , Yiru Zhong, Lynn Terwoerds, and Joyce Brocaglia. “2017 Global Information Security Workforce Study: Women in Cybersecurity.” 2017 Global Information Security Workforce Study: Women in Cybersecurity – Executive Women’s Forum. Front & Sullivan, Center for Cyber Security and Education, (ISC)2 , Executive Women’s Forum , Mar. 2017. Web. 23 May 2017.

4. Roer, Kai , and Dr. Gregor Petric. “Presenting the Security Culture Report 2017 – CLTRe – the Yardstick of Culture.” CLTRe the Yardstick of Culture. CLTRe, 16 May 2017. Web. 23 May 2017.

5. Ross, Marie-Claire. “Why Leaders Who Can Emotionally Connect Work to Employees are the Future.” Trustologie. N.p., 06 Dec. 2015. Web. 23 May 2017.

6. Spender, Andrew. “How to Inspire Change in Your Security Culture.” Smarter With Gartner. Gartner, 09 June 2015. Web. 23 May 2017 <https://www.gartner.com/smarterwithgartner/how-to-inspire-change-in-your-security-culture/&gt;.