2 Fast 2 Secure: A Case Study of Post-Breach Security Changes

Abstract

A security breach often makes companies react by changing their attitude and approach to security within the organization. This paper presents an in-depth case study of post-breach security changes made by a company and the consequences of those changes. We employ the principles of participatory action research and humble inquiry to conduct a long-term study with employee interviews while embedded in the organization's security division. Despite an extremely high level of financial investment in security, and consistent attention and involvement from the board, the interviews indicate a significant level of friction between employees and security. In the main themes that emerged from our data analysis, a number of factors shed light on the friction: fear of another breach leading to zero risk appetite, impossible security controls making non-compliance a norm, security theatre underminining the purpose of security policies, employees often trading-off security with productivity, and as such being treated as children in detention rather than employees trying to finish their paid jobs. This paper shows that post-breach security changes can be complex and sometimes risky due to emotions often being involved. Without an approach considerate of how humans and security interact, even with high financial investment, attempts to change an organization's security behaviour may be ineffective.

The boundedly rational employee: Security economics for behaviour intervention support in organizations1

“…Justification: Security influencers must be supported by the larger organization to ensure that security policy choices do not interfere with other business expectations. When business and security goals are misaligned, decision-makers experience friction [33]. Employees should not be forced into a position where they would have to break security rules to maintain productivity [55] or complete other primary tasks.…”

Found in Translation: Co-design for Security Modelling

“…We introduce our approach in the form of a co-design methodology that is a modification of the classical modelling cycle. -In Section 5, we present a case-study which largely shaped our understanding of co-design [10]. Through reflections, we discuss the methods and approaches that worked, as well as shortcomings.…”

“…To demonstrate how an attempt to co-design looks like in a real-world context, as well as reflect on potential improvements, we present an in-depth case-study of a single company, previously published in [10].…”

“…Here we provide a brief profile of Company A, focussing on the historical security context of the organization as well as their current security structure, policies, and processes. A more detailed description of the company can be found in [10].…”

“…The company had a much more informal attitude towards security and only basic controls. Then, Company A suffered an information security breach in the form of an insider attack [10]. This breach seriously threatened the company's financial and reputational stability and could have potentially ended the business.…”