O que fazer se sua organização resistir à mudança e à inovação em segurança da informação?

To overcome resistance to information security improvements: Understand Reasons: Assess cybersecurity awareness. Frame Arguments: Emphasize business impact and cost-benefit analyses. Address Concerns: Acknowledge challenges and offer scalable solutions. Build Consensus: Engage leadership and seek external expertise. Additional Tips: Support arguments with real-world examples and promote cybersecurity education. Remember to be patient, focus on measurable outcomes, and leverage industry resources for support.

Security professionals sometime make the mistake of assuming that other teams in the organization implicitly understand the value of security and will offer their support. But its often not the case. There are different barriers to different sets of audiences. It maybe lack of knowledge, lack of expectation-setting, lack of resources and bandwidth, management unwillingness to invest and prioritize security, etc. Its important to label the barriers and then analyze the reason behind it. Sometimes people have a stronger incentive to not do anything than to do anything. Hence, understanding the mindset of audiences is crucial as you try to break down barriers and resistances to achieve security goals.

While presenting the case and making the top line leadership understand the situation, add the ingredients that they consume better like cost benefit analysis, ROI from enabling a security program. Reduced Opex in the long run as a benefit of reducing attacks or security breaches.

Understanding human behavior is crucial in implementing change and effective security measures. It helps in understanding why people make certain choices and how they perceive risks, and how they would possibly react to change. In my experience, I would identify the roles and motivations of the various change agents within my environment, align the change with strategic business objectives, socialize the intended change around an incident or risk exposure through various formal and informal mechanisms to help reduce or eliminate resistance to information security innovation.

Highlighting risks and impact is one of the most important tool to overcome resistance to innovation. Let management take risk-backed information decisions. Keep your eyes open, and be aware of the prevailing cyber attacks in your industry. List down the common factors between the affected companies and your organisation and highlight these risks with live example. Collaborate with external agencies and keep management informed of the newly released security advisories. Try to identify security gaps and present them to management.

The security program is guided by org policy, guidelines, standards and procedures. It maybe a comprehensive collection of defining the WHAT. But sometimes the HOW is ignored, which makes it less effective for consumption and implementation. Also, not everyone maybe aware of the asks from security. Hence, it is important to spread awareness about this to all audiences within the org, set expectations and drive change. This ensures everyone is on the same page and can channel their combined efforts to common goals.

O envolvimento das equipes e pessoas promotoras desde o planejamento das medidas a serem adotadas pode trazer maior conscientização e facilitar a adoção e uso em fases posteriores. A abordagem inclusiva pode trazer também metas e benefícios a serem atingidos que impactem na produtividade final das áreas. Uma visão holística de segurança, geralmente, é possível quando todas as pessoas conseguem entender riscos de não fazer algo versus fazer e também os benefícios a serem alcançados. Esse equilíbrio deve ser buscado para que também as implementações aconteçam numa medida adequada.