We all know, however, that
knowledge doesn’t always change
behavior. Tons of people will tell
you that they know they should
adopt better behavior patterns
around what they eat, their financial habits, and more. So, in the
same way that technology alone is
not sufficient for protection, knowledge alone isn’t the answer either.
To add an effective human
layer of defense, we need to embrace what is commonly referred
to as the ABCs of cybersecurity: awareness, behavior, and culture.
That recognition is why we are seeing a surge in people using the
phrase “security culture.” But here’s the thing: So many people
are throwing around the phrase without actually knowing what it
means. They know that a good security culture must be a positive
thing, but there is no precision or general agreement about what
a good security culture looks like or how to achieve this promised
security culture goodness.