Why attempts to raise the level of awareness to information security are failing, and what to do in order to change it.
Written by Eh’den Biber
Prologue – Battlefield
The field of information security is system and technology driven. This is why it is no wonder that the first attempts to make people act according to way we believed is best from information security standpoint was compliance. Oh, and it worked SO great, didn’t it? Dear auditors, this was a rhetorical, cynical question, so let me assure you: when it comes to humans, compliance doesn’t work, sometimes even when you put a gun against someone’s head.
We moved to from compliance to awareness, and we continue to fail.
This article will try to break down multiple elements to why we fail in our information security awareness activities. After years of looking into awareness from educational, psychological, neurological, biological and spiritual perspectives I realised that the reason we are failing to increase awareness is because we never did a true root-cause analysis.
Believe me, I’ve been doing everything I can to avoid writing this article. Like Arjuna the hero of the Bevagad Gita, I tried to avoid going into a battlefield, getting in a collision course with a community of people, some of which I know personally. Every time I wanted to write the article you’re about to read, my subconscious was re-living the times I’ve been ridiculed, judged, kicked around (physically, emotionally, verbally), and eventually, stabbed (yeh, in London). When in a battlefield, it is hard to remember that who you think you are is a mind running on ego operating system, which been optimised to increase your survival rate. This thing, my humanity, was preventing me from writing, in order to prevent the suffering, to increase survival rates. This is what the brain/mind is meant to do, and in my case, my brain was trying to increase my professional survival.
The reason for my long silence in recent months was due to the fact I came to the realisation that our profession is based on pseudo and proto science, that most of what we do can be qualified as cult behaviour (cargo, anyone?), and that our blindness is in the core of our failure to reduce the likelihood of future loss event that is caused by a “human vulnerability” which lead to wrong decision making.
Finally, I said it, and here I am experiencing how it feels to be honest and fearless. Blessed.