| | DECEMBER 2022ENTERPRISE SECURITY8By Ian Hill, Director of Cyber Security, BGL InsuranceA major concern of information security professionals is that of the insider threat, and the identification and mitigation of risks posed by deliberate and malicious actions of typically a loan actor or small number in collusion. What is often overlooked are the risks posed by the business culture itself, either directly by facilitating if not encouraging risk taking, or indirectly by creating an atmosphere where people are more likely to make security impacting mistakes, and less likely to own up to them. The overall business culture can have a major influence on the information security posture of the business.As biological organisms, human beings have inherited the natural evolutionary trait of competing to survive, for food, shelter, mating partners etc, and in the modern world, this has evolved towards education, job hunting, sports, material possessions, wealth, and status. In business, and particularly in sales this competitive nature is revered and rewarded while at the same time, other areas of a business are encouraged to work harder and smarter, whereby to achieve this, colleagues are often pitted against each other to drive performance. There are many scholarly articles comparing competitive and collaborative business cultures, but few consider them within the context of Information Security. Competition within a business is healthy while it remains fun and contained within an overarching sense of shared value and working together towards the business goals, but if it's allowed to evolve into a toxic hyper-competitive work environment, it can bring some significant risks to Information Security. When the THE RISKS OF A COMPETITIVE BUSINESS CULTURE TO INFORMATION SECURITYIN MY OPINIONIN MY OPINION
< Page 7 | Page 9 >