I once observed a rather unique but not so uncommon scenario unfolding. A particular organization had experienced rapid transformation and growth, but was experiencing growing pains that were allowing some dangerous risks to emerge. Additionally, key business objectives completely depended on establishing compliance with certain regulatory requirements - and these were in serious jeopardy. These emergent risks and organizational objectives were on a collision course, and the train wreck was already starting.
The symptomatic issues had been linked mostly to root cause cyber risks, however new issues were emerging daily, giving the sense of continually falling further behind. Remediation activities were being heavily stifled through resistance in providing or completing architectural and other key technical artifacts, poor communication, a hostile political climate driving uncertainty and anxiety, band aid type investments in point solutions, fragmented governance, and in many cases - deliberate obstruction. The remediation activities themselves were being driven by a capable but small group, and on paper should have been a clean execution. However the reality spoke differently - they were highly frustrated and had expressed the sentiment that they were treading water only on the best days, and mostly falling further behind the stated goals and activities. The organization was moving faster than they were.
When digesting this scenario and the deeply rooted manifestation of issues in the organization in question, the usual thought processes attempted to find an elegant solution. They all involved more time, more resources and more money. However, when assessing the cost and impact, it was not long before the realization had occurred that even a very heavy investment was not going to be that helpful. If there was some success, then certainly only to a point in time since the real root causes had not been addressed. They would be stuck with a very costly, short term win with a swift relapse.
Something else needed to happen - it was not a case of grabbing the most fire hoses to fight the fire - it needed a careful and wise perspective to understand the real root causes. The ballpark sense, somewhat naturally, was that shooting for an immediate fix was not the right mindset and that there would need to changes made over time.
Boiling this down, the real issue at heart was not technical acumen. It was not lack of skill or competency. It was not just poor leadership or governance. The real issue was organizational culture, or more precisely, organizational cyber culture. An intangible to solve for and enable tangibles.
Switching gears slightly, one starts to gravitate to the nature of culture in an organization and what specifically is special about cyber culture. Is cyber culture a subset of organizational culture? Is it more acute? Why exactly does it matter? We know that the cyber function in an organization is a highly specialized, focused area. It deals with both complexity and simplicity. It deals with precision and ambiguity, and there is rarely a perfect approach. Aside from our particular example here, we must consider the high performance impact that cyber culture can have. The benefits are powerful and many, such as achieving more with a given budget allocation, or reduced overcompensation on expensive technologies and associated headcount. It may also be the difference between avoiding the headlines or becoming one.
There is much that can be learned from other areas of society regarding culture. A fine example of this is high performing sports teams - and not just any. Particular teams that just had that 'edge', an 'x factor', and they seemed practically unstoppable. Distilling the cultural components of these blazing success stories provides opportunities to understand, learn and adopt within the high performance world of cyber. The New York Yankees and New Zealand All Blacks are two such teams.
The New York Yankees represent powerful figures in the baseball world. Highly successful and admired across the globe, the Yankees have produced some of the finest world championship winning teams in baseball history. The culture of the team is very apparent to see. It extends through the players, the club, and the fans, and the high performance winning culture is palpable. Breaking this down, the following comments give key insights into their championship teams:
1. They were extremely well coached, and they allowed themselves to be coached despite the high caliber skills and strong personalities
2. Although strong as individuals, they found a way to be even stronger together - as a high performance team
3. Humility to ensure improvement areas were identified and given sufficient focus to be addressed.
4. The beliefs, focus, passion and hopes were palpable - this was always in display
5. Precision around and completeness of the fundamentals.
The New Zealand All Blacks can be thought of in a similar vein to the Yankees. The All Blacks have been the unprecedented and dominant force in world rugby for over 20 years straight. Not so apparently outside of the country, rugby players in New Zealand are exposed at a very early age to Maori culture and spirituality. This transposes into the national sport of rugby, resulting in an almost supernatural belief and passion for the sport they love. Breaking down the All Blacks in their best years:
1. An insatiable appetite for perfection. There were times that they won with
record scores, yet the body language showed frustration with anything that was a less than perfect performance.
2. Clinical precision with game fundamentals such as passing, positioning, and technical game craft
3. Spirituality among the team, and group belief
4. Composure under pressure
5. Consistency
Needless to say both the Yankees and the All Blacks are admired among the sporting world for their performance and what they represent. They also attract an incredibly devoted and inspired fan base. So what can be done (borrowed) to help produce a similarly strong cyber culture to drive top tier performance?
1. Strong sense of principles
2. Performing the fundamentals well
3. Collective spirit to resist and overcome
4. Strength of shared common values and beliefs
5. Commitment to excellence fused with hope for the future
These five points actually align well when we revert back to our idea of how modern cyber places unique demands on the organization. This leads to the concept for a modernized 'cyber super culture'.
However, cyber culture applied only to specific cyber security professionals is not enough, it needs to also extend across the entire enterprise both horizontally and vertically. This drives a sense of collective ownership, pride in the larger organizational cyber abilities, and shared achievement of accomplishments, accolades and sustained operational assurance. For specific risk areas such as insider threats and human negligence driven risks, a substantial difference can be made (and proactively), that simply cannot just be achieved consistently through smart cyber professionals, the best and latest tools, or reliance on a defense in depth strategy and compensating controls.
Back to the above unfortunate organizational scenario, these 5 areas were in need of immediate attention and a plan to address - it was not going to be an overnight change, it required some baby steps and motivation to help get things better over time. The weaknesses of our key five items (when switching from a sporting context to a cyber context) simply had exposed the inevitable and it was only a matter of time before serious problems emerged.
In our next article of this three part series on cyber culture, we will dive more into our 5 key identified areas, explore practical ways to implement and adopt them, and discuss further the benefits that drive down real risk and provide more economical outcomes for cyber programs.
Comentários