Changing Red Flags to Red Teams

Do not punish or embarrass employees for poor security behaviour. Reward them for positive steps and reinforce safe behaviour. Humans may look like your weakest links, but they can also be knock-out moves.

- By Pratima H

Will Candrick, Senior Director Analyst, Gartner, takes us through the human piece in the security puzzles that Enterprises are dealing with. Is it still the weak ankle that brings everything down, or can an opponent be shocked and defeated by using this supposedly broken part as an advantage? Does it sound like an MMA plot? We don't blame you. The current threat landscape is kind of like that. We take Will's help in figuring out why a Southpaw stance with humans in security rings can be a good move. Time for some unboxing.

Your talk at the recent Gartner summit, 'Security Awareness is Dead, now what?' underlined behavioural science in security strategies. Is this critical security element being handled in the right way? Specially the part about punitive action?

What we see is that many enterprises focus on negative reinforcement instead of positive ones. 'Failing to take the security test' should be focused on more compared to 'failing the test'. Then, there are two ways to announce the test results. One is saying - Your performance will be communicated to your manager - Bad news. The other is saying - Join this security webinar and fix what's wrongGood news. We need to understand that punitive action does not alter behaviour. We need to change the perception that security is a roadblock to daily work.