Findings from the latest report from the Security Research Initiative (SRI) highlight the importance professionals place on building a strong security culture in facilitating excellence, while also acknowledging the challenges of doing so.
Image credit: Andriy Popov
Entitled ‘The importance of Security Culture in Facilitating Security Excellence’, the research is based on the views of security professionals from both in-house and contract positions, as well as other security experts.
Among several findings, the report outlines the importance professionals place on security culture, but that it isn’t always easy to achieve. Fundamental to doing so requires the security department to effectively engage with other areas of their organisation and to showcase how security can go beyond its traditional remit and actively contribute to overall organisational success.
A copy of the report is downloadable for free from the Perpetuity Research website.
The report’s lead researcher, Professor Martin Gill, highlighted some of the key takeaways:
- Security culture is very important to a successful security operation – culture sits alongside other key aspects such as effective leadership, clear objectives and an effective security strategy.
- Culture is at least as important as strategy – Culture brings life to strategy and defines the extent to which strategy is executed – a third cited culture as more important than strategy.
- Security culture and organisational culture are linked – There is a relationship between security and organisational culture, with a good organisational culture enabling good security culture, but a bad one would create challenges.
- Security professionals do not believe organisation workforces are sufficiently engaged in security – While two thirds of respondents felt the workforce values physical security measures, they were less inclined to view the workforces as strongly engaged with security.
- The barriers to engagement need to be overcome – There are several reasons for a lack of engagement, including lack of senior level ‘buy in’, lack of investment, negative perceptions of security and lack of communication, among others. Meanwhile, new trends such as working remotely may compromise the quality of security and ability to develop a security culture.
- Communication of the value of security is key – More focus is required on engaging the workforce and ultimately, effective communication of the value of security is key to overcoming the barriers. Messages need to be tailored for leadership and the right audience, to demonstrate the benefits of security.
“Good security culture is essential… but can be hard to obtain”
Professor Martin Gill who led the research noted:
“Our research suggests that security professionals are unequivocal about the value of security culture in supporting security excellence. Good security culture is an essential ingredient but one that can be hard to obtain.
“The key, according to our participants, is to effectively articulate the value of security in ways that are meaningful to different audiences within an organisation. This means stepping beyond the notion that security is only there to deal with a crisis and demonstrating that security is an enabler of operations and moreover a contributor to the overall success of an organisation.
“If good security is about engaging the hearts and minds of stakeholders, not least staff and hierarchies, then our results suggest that the security sector is struggling. Worse still some recent societal trends are complicating the problem and increasing the difficulty of the challenge.”
IFSEC Insider spoke to Professor Martin Gill on episode 14 of the Security in Focus podcast. Listen to the discussion, centred around last year’s SRI report on security’s influence over budgets, via the player below…
