Religion and security with Karen Renaud and Marc Dupuis
In this thought-provoking episode of Cyber Ways, Tom and Craig discuss the intriguing topic of cybersecurity and religion with guests Dr. Karen Renaud and Dr. Marc Dupuis. Karen and Marc share insights from their research exploring the intersection of cybersecurity and world religions, offering a fresh perspective on enhancing cybersecurity practices.
Key Points Covered:
- The innovative research by Karen and Marc on leveraging positive values from world religions to influence cybersecurity behavior.
- The discussion on the drawbacks of fear-based cybersecurity practices and the importance of fostering a positive culture within organizations.
- Insights into the role of community, belonging, and sacred values in both religious communities and cybersecurity environments.
- The parallels drawn between religious principles and cybersecurity practices, emphasizing adaptability, forgiveness, and the sense of belonging.
- The significance of incorporating nonnegotiable values and building a culture that supports cybersecurity from top to bottom within organizations.
As Karen and Marc shed light on the impact of incorporating religious values into cybersecurity, they advocate for a different perspective on how a sense of community, forgiveness, and grace can transform cybersecurity practices. Join Tom, Craig, Karen, and Marc as they explore the potential for positive change in cybersecurity culture by drawing upon timeless principles from world religions.
Don't miss out on this enlightening episode of Cyber Ways and discover the transformative power of integrating religious values into cybersecurity practices. Tune in to gain a new perspective on building trust, community, and resilience in the ever-evolving landscape of cybersecurity.
Subscribe now to Cyber Ways for more insightful discussions on innovative approaches to information security and stay ahead in the realm of cybersecurity. Go to https://cyber-ways-podcast.captivate.fm to subscribe.
Guest bios
Karen Renaud is a Scottish computing Scientist at the University of Strathclyde in Glasgow, working on all aspects of Human-Centered Security and Privacy. She is particularly interested in deploying behavioural science techniques to improve security behaviours, and in encouraging end-user privacy-preserving behaviours. She collaborates with academics in 5 continents and incorporates findings and techniques from multiple disciplines in her research.
Marc J. Dupuis, Ph.D., is an Associate Professor within the Computing and Software Systems Division at the University of Washington Bothell where he also serves as the Graduate Program Coordinator. Dr. Dupuis earned a Ph.D. in Information Science at the University of Washington with an emphasis on cybersecurity. His research focuses on human factors related to cybersecurity, especially how psychological traits affect cybersecurity behaviors.
Transcript
Hi, folks. This is the Cyberways podcast, and we
Speaker:translate our academic knowledge about information security into stuff that you
Speaker:can use as a security professional. We think it's a unique mission. We think you'll
Speaker:like it. I'm Tom Stafford. Craig Van Slyke. Tom and I are your hosts on
Speaker:your journey to knowledge. CyberWays is brought to you by the Louisiana Tech
Speaker:College of Business' Center For Information Assurance. The center offers
Speaker:undergraduate and graduate certificate programs in cybersecurity and
Speaker:sponsors academic research focused on behavioral aspects of cybersecurity
Speaker:security and information privacy. Hello, everybody, and welcome back to
Speaker:Cyberway. It's a production of the Louisiana Tech University Center For Information
Speaker:Assurance supported by a Just Business grant from college of business
Speaker:Dean Chris Martin. Today we have with us Karen Renaud
Speaker:and Mark Dupuy. They are doing some fascinating
Speaker:research on cybersecurity insights taken from world
Speaker:religions. Recent article appeared in Computers and Security. Doctor
Speaker:Renault is a Scottish computer scientist at University of Strathclyde in
Speaker:Glasgow, works in all manner of human centered security and
Speaker:privacy. Doctor Dupuis is an associate professor with the Computing
Speaker:and Software Systems Division, University of Washington, Bothell, where he also serves
Speaker:as the graduate program coordinator. He has his PhD information
Speaker:science from the University of Washington with an emphasis in cybersecurity.
Speaker:Welcome, Karen and Mark. Thank you so much. Thank
Speaker:you. Let's start with the big question that I
Speaker:think is gonna underlie a lot of what we talk about today.
Speaker:What's wrong with the way we currently practice cybersecurity? Rita,
Speaker:Janet, I'm not It's not working because there's no
Speaker:the number of attacks are not abating at all. So
Speaker:when when you keep doing the same thing and it's still not working, you have
Speaker:to think about, well, what do we what could we do differently in order to
Speaker:have more success? So at at a meta level, seems like
Speaker:we're not very successful. And I think in an organizational
Speaker:setting, I think one of the things that's not working is it's often kind of
Speaker:a us versus them. And if you think about it in an organizational
Speaker:setting, why are we doing that? It should be us,
Speaker:the employees, and the leadership against them, the
Speaker:people that are trying to cause harm to us as opposed to,
Speaker:the infighting that often takes place. It's it's counterproductive. And
Speaker:as Karen said, we're not we're not getting anywhere. We're not we're not,
Speaker:making improvements, and that's the problem. The other thing is that we have
Speaker:this paradigm in organizational cybersecurity, which is
Speaker:formulate the policy, disseminate the policy, and
Speaker:enforce the policy. And then when things go wrong, we just go
Speaker:back to disseminate again, and then we enforce again.
Speaker:And so it's almost as if it's it's like a vaccination. And if you just
Speaker:make the vaccination take, everything's gonna be fine. But
Speaker:this is we've been doing this for over 2 decades, and it's not very
Speaker:successful. So we have to start asking ourselves, what could
Speaker:we do differently? So one of the things that I was looking at
Speaker:y'all's body of research. One of the the things that struck
Speaker:me was that we seem to
Speaker:focus way too much on, negative emotions.
Speaker:You think that's one of the problems? Well, so Mark and I met at
Speaker:Hicks some the very first time. And I said to him,
Speaker:Mark, I want to do some research into the use of fear in cyber. And
Speaker:Mark was on board. That was the first paper we did.
Speaker:And we felt that a lot of the dissemination that is done in
Speaker:cybersecurity is a hook into people's minds was
Speaker:if you don't do this stuff, things are gonna be really bad. You're gonna get
Speaker:punished, and the hackers are gonna get in and so on. And so fear is
Speaker:being weaponized. And what Mark and I discovered was
Speaker:that this is a very damaging thing to do to people because fear is
Speaker:is an emotion that actually hurts you, and it lasts for much longer
Speaker:than we realize. But, Mark, maybe you could tell them about the password
Speaker:one that well, maybe I should we shouldn't go into that kind of depth
Speaker:now. Sorry. Well yeah. You know, I I think I'll just just briefly I
Speaker:think the thing I'll say is with with fear and other
Speaker:negative emotions, when when people get scared, they don't make
Speaker:the best decisions, but yet we're trying to use these negative emotions like fear to
Speaker:try and get them to do what we want them to do. So it's it
Speaker:seems kinda silly in in many respects that we're trying to get them to
Speaker:be compliant with these policies by scaring them
Speaker:when all of a sudden, and from a cognitive standpoint, they're gonna be less adept
Speaker:at doing what we want them to do. So I I you know, it's just
Speaker:it's very, counterproductive in many respects. And
Speaker:as, you know, some of our research has shown too that not only are we
Speaker:eliciting fear, but we're also increasing other negative emotions and
Speaker:decreasing positive emotions. So what are the other implications for this?
Speaker:Mhmm. Your concern is But we have this extensive criminal
Speaker:justice lens through which we view cybersecurity, and those of
Speaker:us who go to the to all the rude meetings see it all the time.
Speaker:All the leading authors started with a perspective of
Speaker:enforcement as as Karen so aptly put it. You know, promulgate
Speaker:the policy, enforce the policy, punish the people that don't adhere to it.
Speaker:It just doesn't feel like good organizational
Speaker:behavior, from a managerial perspective to be trying to get
Speaker:people to do the proper thing with
Speaker:negative reinforcement as opposed to building a positive
Speaker:culture, which which I I'm hoping is where we're we're headed at some point, but
Speaker:we don't see much research on it, do we? No. And I
Speaker:understand the fear. Right? Because I speak to CSOs a
Speaker:lot, and they're worried. They're they're the ones whose head is
Speaker:on the on the plateau when things go wrong. They're the ones who who have
Speaker:to answer the stories for the board, you know, why did we get hacked?
Speaker:So that fear is then being transmitted, and that's why they get
Speaker:all heavy with the normal average person in the organization.
Speaker:So the whole thing about the blaming and the fear culture is really
Speaker:unhelpful across the board. So I would agree with you, Tom.
Speaker:So your paper is about a religious view on
Speaker:cyber security, and I see that as eminently positive. You know, religion is
Speaker:a positive force in our life. It it speaks
Speaker:to doing good and and being good, and I'm very interested in
Speaker:how you bridge to that particular lens
Speaker:as a way of considering cybersecurity behavior in a new perspective.
Speaker:So I spent some time in Germany a few years ago, and I
Speaker:picked up 2 books before I left to read while I was there. The one
Speaker:was by Scott Atren, which is called talking to the enemy, and
Speaker:the other one was, Jonathan Haight, The Righteous Minds.
Speaker:Nothing to do with cyber. But both of these books really struck me
Speaker:in terms of trying to understand why people do what they
Speaker:do, and both of them spoke about our values.
Speaker:And then I started wondering what were the values that we were
Speaker:trying to get people to adopt in cybersecurity.
Speaker:And then I picked up a book by Alain de Beauforton, which is called religion
Speaker:for atheists. And then I realized, well, hang on. Why don't
Speaker:we learn from the people who do espouse values? Because religions
Speaker:all have values that their adherence espouse. So
Speaker:what what could we take? And but Du Boisoten says, don't
Speaker:throw the baby out with the bathwater. Let's look at religion and take the
Speaker:good parts and learn from it because they're very successful,
Speaker:and and and then don't take the stuff that's not so great. And so that's
Speaker:kind of where this idea came from. And I I zoomed Mark
Speaker:from, from Germany, and he said, yeah. I'm in.
Speaker:So that's that's where the ideas came from. So what did you
Speaker:hope to find in, in applying this new focus on on cybersecurity?
Speaker:Well, I think a lot of it is, you know, like Karen said is, you
Speaker:know, religions have those that have stood the test of time have stood the test
Speaker:of time for for a reason. And and some of them have,
Speaker:you know, a lot of them have stood the test of time, have adapted, evolved,
Speaker:and changed, as times have changed, as our society has
Speaker:changed. And, by doing that, they have,
Speaker:met the needs of of the people they're serving, of of their believers.
Speaker:And, and there's something that could be learned from that. And we
Speaker:think about some of these religions have been around for 1000
Speaker:of years And, you know, in cybersecurity, you
Speaker:know, being around for, you know, 20, 30 years at the
Speaker:most, really. And so what can we do as
Speaker:such a new discipline? What can we take from religion
Speaker:and and try and learn from it? Because, you know, as we said earlier, we're
Speaker:not we're not successful. We're not we're not very successful in what we're doing, and
Speaker:the problems are only getting worse. So let's let's be humble
Speaker:enough. Right? Let's let's show some humility and let's try and learn from
Speaker:these other areas like religion and and see what we
Speaker:can take. And instead of just this compliance and and this
Speaker:punishment of people that are trying just
Speaker:to do their day to day jobs, most of them are not in there to
Speaker:do cybersecurity. They're being tasked with it
Speaker:in often an unfair way when they're there to
Speaker:do pretty much anything but cybersecurity. But what what can we take
Speaker:from other places, other, you know, other disciplines like religion
Speaker:and and learn from it to help us to help us be more successful.
Speaker:And, you know, as Karen said, you know, there there's there's a lot to be
Speaker:learned from. So let's learn a little bit from religion.
Speaker:I wanna dig into just what religion is. So it's one of those things where
Speaker:we all know what it is, but we don't really know kind of what it's
Speaker:made up of. Can you talk to us a little bit about what actually
Speaker:religion does or what its components are? When I I started
Speaker:writing this paper, I thought, well, the first thing to do is define. Right? Whenever
Speaker:you have a new concept in a paper, you have to define it. And it
Speaker:turned out that people are struggle to define religion.
Speaker:So, having read a number of people who said, you know, nobody can
Speaker:agree on it, So, okay, let's go and look at it from a different way.
Speaker:And I found somebody called Durkheim, who's a very well known German academic,
Speaker:who said that religion has 3 dimensions. It's
Speaker:believing, belonging, and doing. And
Speaker:then when I found some other papers that also tried to say, these are
Speaker:the characteristics of religions, I found that they also fell into those three
Speaker:dimensions. And that made it a lot easier to an to kind of
Speaker:start interpreting how what we are doing and what
Speaker:religions do. Can you tell us a little bit about the problem? Part is that,
Speaker:you know, if you go to somebody who's an adherent of a particular religion, they
Speaker:can tell you what they believe in. And they also
Speaker:know what kinds of things they should do. So they may believe in in
Speaker:if it's a Christian, they would believe that they have to be kind to other
Speaker:people and forgive people when things people do bad things to them and that sort
Speaker:of thing. So the believing and the doing is easy to understand. But the
Speaker:belonging was the one that was really came across strongly in all the
Speaker:the religious related literature because people get a
Speaker:sense of belonging to their community. They meet weekly with their
Speaker:community a lot of the time. And that sense that I am a
Speaker:Christian or I am a Muslim or whatever, that was part of became
Speaker:part of their identity. And so those three things were the
Speaker:aspects of religion that people seem to, you know,
Speaker:cohere to. There's also the nature of, I think,
Speaker:the belonging aspect of of of your model to
Speaker:me speaks to what I've always considered to be the important part
Speaker:of cybersecurity, which is belonging to the team that secures
Speaker:the company. Mhmm. And I I see that as a a very useful
Speaker:metaphor taking religious perspective. Yeah. I I I
Speaker:think, you know, the the belonging part
Speaker:is in many respects, the one big area where we're
Speaker:lacking maybe more than the others. Because I mean, we we all can believe,
Speaker:oh, you need to do this. You need to be aware of this. You need
Speaker:to watch out for that. Make sure you do this and and so on. But
Speaker:building that sense of community that, hey, we're all in this together,
Speaker:that, we know mistakes are gonna happen, that we we realize
Speaker:this is tough to do, that we're not all, at at the
Speaker:same level of understanding these different threats and so on. That,
Speaker:I I I believe, is really where we're lacking and we're not doing a good
Speaker:job of. And I think you look at successful religions, you look
Speaker:at people that, want to go to church, and it's not always just
Speaker:to sit there and and listen
Speaker:to a sermon for an hour, but it's oftentimes those other
Speaker:activities. It's gathering for to share a meal together. It's it's
Speaker:it's just being with one another. It's it's that sense of belonging,
Speaker:that community that you have that we just don't
Speaker:see in in cybersecurity. It's
Speaker:it's it's this very this top down approach. It's this punishment approach.
Speaker:And, you know, I I think as we think about the
Speaker:success of religions and and a sense of belonging, we
Speaker:just we are so lacking with respect to that sense of belonging in
Speaker:cybersecurity. Can I take a tangent here? As you were
Speaker:were all talking about this, I was trying to
Speaker:translate in my mind the idea of
Speaker:belonging to something like a church or a religion
Speaker:versus a sense of belonging at work. And so my
Speaker:church and my religion, for a lot of people that are
Speaker:religious, it's very intertwined with their personal lives.
Speaker:So it is part of their life. I grew up in the Baptist
Speaker:church, and it was you know, it could be 3 nights a
Speaker:week going and doing something all day on Sunday.
Speaker:So that was intimate part of who you were. And
Speaker:I don't know if we get there with work. I know work is part of
Speaker:our identity, but I I wonder if it's a problem of
Speaker:intensity or the extent to which it's intertwined
Speaker:in our real lives. You know, we tend to separate
Speaker:work and personal lives, but religion is part of
Speaker:the personal life. That's a really interesting point because it
Speaker:is work and I guess we have our work tribe and we have our home
Speaker:tribes. But I did another piece of research which is under
Speaker:review right now with some other people in Germany. We asked
Speaker:people, if they ever discussed cybersecurity with other
Speaker:people, and they all said no. And then we asked them whether they
Speaker:would like to discuss cyber with other people, and most of them said yes.
Speaker:So it's the kind of thing that people don't talk to each other about at
Speaker:all, where people in the same religion would talk about their religion. So
Speaker:it's almost as though people don't feel that that's something they can do.
Speaker:Whereas a if there's 2 Christians, 2 Muslims, any Buddhists,
Speaker:they would talk about this religion of theirs. Right? So it's almost like it's a
Speaker:solo sport right now instead of a team sport at work. That's
Speaker:an apt point. I I've always felt that
Speaker:many organizations were groups of people each traveling their
Speaker:own way and the challenge of the manager is always to harness their activities
Speaker:in concert with each other. When it comes to something so mission critical,
Speaker:it's protecting the company's assets from external access.
Speaker:So so do you think part of the problem is the negativity
Speaker:around cybersecurity? So we don't talk about doing cybersecurity
Speaker:well. It's when there's an incident, when something bad happens. And
Speaker:who wants to talk about that? I wonder if it's all wrapped up in the
Speaker:fear of the virus. And 3 people fall for a fish, but 3
Speaker:1,000 didn't, who are we talking about? We're talking about those 3.
Speaker:And and so, yes, it it's it's a kind of an a mindset that
Speaker:we felt when we were looking at religion really ought to change
Speaker:and this mutually supporting thing. Because when I've studied events
Speaker:where there have been cyber, breaches, the first thing that happens is the
Speaker:person who's responsible, who may be clicked on the fish or something, they're
Speaker:immediately ostracized. They're immediately pushed into the corner and
Speaker:how dare you do this and how could you have been so stupid. That's that's
Speaker:not what a church would do. They would try to help the person do better.
Speaker:Or not the church, but I mean people in the same religion. Or
Speaker:or burn you at the stake. 1 or 2. Never. Not
Speaker:anymore. Not anymore. Sorry. That was a long time ago. Karen makes a point though.
Speaker:Craig and I both come from the Baptist heritage and then and the Baptist
Speaker:creed of faith is everybody's going to hell unless they do their best to be
Speaker:a good person. No. That's that's putting it too strongly. Everybody's inherently
Speaker:a sinner and seeking forgiveness and doing good
Speaker:works is the avenue away from, the outcome.
Speaker:And I I see the parallel with what you what you just put voice to
Speaker:your current. I think too is it's it's
Speaker:almost difficult to wrap our mind around how would we do this with cybersecurity.
Speaker:But, difficult but not impossible. Right? Because I I
Speaker:think about places I worked previously where, you know, maybe
Speaker:a smaller office environment where maybe there's 50
Speaker:to 75 people working there where, you know, we would
Speaker:have potlucks and and different things. We would have, decorate
Speaker:our office for Halloween and these other activities and have fun things and and
Speaker:build that sense of community. Well, you know, like like Karen said, you know, you
Speaker:know, what if there is a a fishing simulation exercise and,
Speaker:yeah, 3 people fall for it, but everyone else does it? Well, what if we
Speaker:have a a pizza party or something, right, some kind of celebration,
Speaker:for all those that didn't fall for? We don't even mention the fact that
Speaker:there's a few that didn't. And and we just, you know, again, build that
Speaker:sense of community. And we we talk about, how successful
Speaker:we were, or or celebrate these things and and come
Speaker:together. And and I think because it sounds so foreign, it seems
Speaker:silly to think about that. But and that may not be the exact approach,
Speaker:but I don't think it's impossible to think about how we can build this
Speaker:sense of belonging in cybersecurity because the fact of the matter
Speaker:is is this isn't a solo sport. We're not in this
Speaker:individually. We're in this together, but we do act like and
Speaker:it's treated like we're in this individually. At the end of
Speaker:the day, you know, the organization will be impacted. We're
Speaker:all impacted directly and indirectly at at some point in
Speaker:time. So we need to kind of start getting creative with how
Speaker:we're gonna create the sense of belonging and community
Speaker:within organizations.
Speaker:That that fits with what Karen said about mindset. That's one of
Speaker:the things I'm hearing here is we need to really have a shift in mindset.
Speaker:To to get at this, you interviewed a number of religious leaders
Speaker:from a variety of different religious traditions.
Speaker:So what did you find? When we analyzed, we didn't specifically ask him about belonging,
Speaker:believing, and doing. We just asked him in a bunch of questions, which I think
Speaker:we've included in the paper. And what happened when we
Speaker:analyzed it was, well, unsurprisingly, belonging, believing, and doing
Speaker:kind of filtered up, and we could group them into those 3 stupid
Speaker:themes. And what came across with with the
Speaker:one the final question was, you know, how could cybersecurity learn? And they all
Speaker:said, oh, you know, you need not to be so harsh on people when they
Speaker:make mistakes. Cyber is hard. And we saw a sense of forgiveness coming
Speaker:across, a sense of grace for the imperfect
Speaker:human. And that we kind of had expected that, but it was really
Speaker:gratifying when we heard it from them.
Speaker:But the interesting part was they said the one guy said,
Speaker:well, you know, when did he did cybersecurity training when he was a
Speaker:student at university? It it was just like a checkbox thing. He did
Speaker:it online. He finished it. He answered the questions, and he was done for the
Speaker:next year. But he said at his church, when they get
Speaker:together, they talk about concepts. They talk about the difficulties they're having
Speaker:when they have their community get together. So he said, why don't we do that?
Speaker:That was exactly what I was hoping if somebody was going to tell me.
Speaker:You know, he was he made he made that contrast for me.
Speaker:One one of the issues that I see from an organizational theory perspective
Speaker:is the notion of agency. The organization
Speaker:is formed as an informal and sometimes
Speaker:actually formalized contract between the people who own the company, the
Speaker:principals, and the people they hire to do the work for them, the agents, and
Speaker:the agents are economically rational. They will they
Speaker:will do things they shouldn't do if they feel like they can get away with
Speaker:it and and it's to their benefit. Mhmm. The distinction in the religious
Speaker:view is the principal agent component is not
Speaker:there. There's no economic rationality. There's there's no
Speaker:if you think about it, no pragmatic payoff for being good other than being good
Speaker:for goodness' sake, which is
Speaker:faith, which I find very I find that to be a very compelling aspect of
Speaker:this religious view that you take of cybersecurity. People doing
Speaker:good security for its own sake, rather than because it's
Speaker:their job or because the boss will sanction them. But also maybe
Speaker:learning to do what's right for the community. Right?
Speaker:Rather than just doing what's what I'm scared not to do.
Speaker:I've long felt that the, the criminal justice perspective on
Speaker:cybersecurity, had issues
Speaker:because it it treats people as problems when in fact your
Speaker:solution is isn't it? Yes. So that
Speaker:that leads into something that I thought was perhaps the
Speaker:most interesting part of the paper, and that's the idea
Speaker:of sacred values. Tom, you were kind of alluding to that.
Speaker:You know, be good for goodness sake. It's because that's what you do
Speaker:regardless of everything else. If it costs you money, if it costs
Speaker:you your position, costs you your material wealth,
Speaker:you still do we we talk about doing doing what's right
Speaker:because it's right. That's a sacred value.
Speaker:So what are sacred values and how do they
Speaker:apply in this context? Mark.
Speaker:This this is not a quiz, so Well, I mean, well, what
Speaker:row. I was gonna real quickly, maybe touch
Speaker:on the prior question if that's okay. And I
Speaker:I think it's just some interesting insight from the
Speaker:religious leaders with kind of that sense of
Speaker:belonging where, you know, they they touched on
Speaker:how we are all different, and we have a lot of differences
Speaker:between us, but how we should focus also on what's common
Speaker:between us. And it's kind of that sense of belonging, you know, bringing us together
Speaker:as a community and how we are there to help each other,
Speaker:help us as as people. And by doing that, we can
Speaker:create that sense of trust, between us. You know? And I see
Speaker:that not really being done very well in organizations. It's it's often like,
Speaker:oh, this person doesn't know what they're doing, but they're gonna click on that phishing
Speaker:email. They're gonna hurt us as an organization and and so
Speaker:on. And so, you know, that was some interesting insight with respect to
Speaker:belonging. And then you look at believing, an interesting comment
Speaker:from one of the religious leaders was, you know, go where the people are rather
Speaker:than just expecting the people to come. And, you know, again, I
Speaker:I thought it was just some very interesting insight
Speaker:of, you know, hey. You know, reach out. Don't just
Speaker:wait for something bad to happen, but be proactive. You know, be
Speaker:available to the to these people that, again, are not there
Speaker:to do cybersecurity but are being tasked with it in an often and
Speaker:unfair manner, but be available to them.
Speaker:So, you know, that it's just some other things that I wanted to to
Speaker:share. One of the things that somebody said was be humble.
Speaker:The people who are asking other folks to do cybersecurity actions
Speaker:should be humble and not act like they know everything. And that that
Speaker:was interesting as well. I'm intrigued by the notion of
Speaker:morality. I always have been. And morality is
Speaker:deeply seated in the concept of religion. I I wonder if maybe
Speaker:it it it transfers over to your research perspective
Speaker:because my sense of organizations is companies
Speaker:have no religion. They are the inherently amoral
Speaker:entities. They do what is legal. And sometimes as I tell
Speaker:my students, amorality is doing what is not
Speaker:prescribed by law or what you think you might not be caught at.
Speaker:And you know it's not right, but you don't think you're gonna get caught. Organizations
Speaker:are not moral, centers,
Speaker:if you will. And then that I think that has to change
Speaker:because cybersecurity requires everybody caring for the good of the all as
Speaker:opposed to everybody looking out for themselves. Don't you think? Yes. Can I just
Speaker:get back to the sacred values that, Craig asked about? When
Speaker:I when I read Scott Atron's book, he said that,
Speaker:people, you know, you could challenge other values they
Speaker:had. But when you went near their sacred values, they it was not
Speaker:negotiable. Right? And so what I kept thinking was we
Speaker:don't even try to incalculate the values into people in
Speaker:cyber. We give them a list of do's and don'ts. We don't actually
Speaker:try to make that part of them that becomes nonnegotiable.
Speaker:And and you were talking about integrity. I've done a study into whistleblowers,
Speaker:and they also said, we saw this and we had to
Speaker:speak because it was our integrity that was a
Speaker:question. So for them, that integrity was their kind of
Speaker:sacred value. But we that it seems to be a completely alien
Speaker:concept in cyber at the moment that we we try to find
Speaker:the values that people should endorse and
Speaker:embrace. Let me see if I can tie this back to what what
Speaker:Tom was talking about. So morality
Speaker:isn't a static, universal thing. I mean, we have
Speaker:some things that we view as largely universal, but
Speaker:you brought up a really important point in your paper that ties into all of
Speaker:this. So the idea is if we can get
Speaker:employees to tie into the security sacred values,
Speaker:then they'll do anything to avoid violating those values.
Speaker:But then you brought up a really important point and I'm literally gonna read it.
Speaker:While cybersecurity professionals could easily commit to these values, talking
Speaker:about the cybersecurity sacred values, we
Speaker:do not know the extent to which individual employees will be able to commit
Speaker:to these relatively broad categories and or convert them
Speaker:into action, nor do we know whether they are effective
Speaker:candidates to serve as the higher values foundation
Speaker:grounding our vision. Yeah. I think that's the rub.
Speaker:That the sacred values for the employees getting some and
Speaker:Tom, you kind of talked about this idea of alignment in in
Speaker:management. I think that's gonna be the neat trick, and if we can
Speaker:figure out how to do that, a lot of other things may fall into place.
Speaker:So what do you all think about that idea? I think that's a big part
Speaker:of the challenge is it's creating that culture that is
Speaker:going to work from, you know, from
Speaker:the bottom to the top and vice versa. And that's that's
Speaker:a really big challenge. It goes to these sacred values
Speaker:that were espoused by the religious leaders, you know, working
Speaker:together to support others. And it's not easy. Everyone is
Speaker:there trying to, for the most part, do their job, make make
Speaker:their money, go home, and and, you know, deal with their lives outside
Speaker:of work. And when things are complicated
Speaker:and, you know, you probably see eye rolls and you see other things
Speaker:I have a couple kids, so I see that plenty. But then, you know, you
Speaker:you're tasking them with other things that complicate matters. It can be
Speaker:difficult to get that buy in. But if you
Speaker:are successful and if you can do that, you can really see
Speaker:some amazing things happen. And and it is possible. You know, you
Speaker:see things that have been done. You look
Speaker:at at Demian and what was done with Toyota in the 19
Speaker:fifties. This humongous shift. These humongous shifts in
Speaker:culture can happen, and they do happen, and they are effective.
Speaker:Why can't this happen with cybersecurity in organizational settings?
Speaker:It can. You know? We just need to figure it out. And I think this
Speaker:is a starting place for some discussions of what this might look
Speaker:like. You know, how this can be effectuated? You know, we still have some
Speaker:work to do to figure that out and to try it out, but it it
Speaker:is possible. It is. You're in my wheelhouse now
Speaker:when you bring up Deming because Deming was issued by all the major
Speaker:US automakers as being irrelevant. So he went to Toyota
Speaker:out of desperation to sell his idea, and he he
Speaker:landed in a culture which espouses
Speaker:collectivism, which means the good of all as opposed to the good of the one,
Speaker:whereas the companies who turned him down are strictly into economic
Speaker:outcomes for the 1, maximized personal outcome, which is really, I think,
Speaker:the the issue in the a moral approach to business. I I I don't
Speaker:know. I'm I'm on a soapbox now, so I'll stop. But I I wanted to,
Speaker:to ask you whether you think that the notion in the title of your
Speaker:paper, shame, has an irrelevance or if that's just
Speaker:something that we try to avoid by doing good. And if I
Speaker:could just interject, that's that's another paper that's in this kind of
Speaker:overall we need to do security differently theme. And
Speaker:assuming that Mark and Karen are willing, we're going to have
Speaker:them back to talk about that paper because it was just too much for one
Speaker:episode. So I just want wanted to to kind of give the backstory
Speaker:here. And that's one that we followed the fear one with because it felt as
Speaker:if people were being shamed when they did make a mistake,
Speaker:and that was my sense. And then when Mark gathered
Speaker:all our bunch of data, it actually happened to loads of people where
Speaker:they where they done something silly, clicked on a message or whatever.
Speaker:And there was then the organization would people would yell at
Speaker:them, and they would they would get, you know, ostracized
Speaker:by their by their because now everyone had to go for the training
Speaker:again, and everyone couldn't work that day while the folks, IT folks,
Speaker:had to sort the computers out and everything. And the what the people
Speaker:went through was awful. You know? And and what we
Speaker:discovered was, interestingly, there's a difference between shame and guilt.
Speaker:Guilt says, you did this silly thing. Here's what you can do to
Speaker:make up for it. Shame says, you are the stupid
Speaker:person. It's an attack on you as a as a human. So then
Speaker:what you get is a self defense response. And what we also
Speaker:discovered is that what you do when you shame people is create an insider
Speaker:threat. It's very, very counterproductive.
Speaker:The organization does not end up ahead like maybe they think they're gonna
Speaker:end up ahead. So it's it's very counterproductive. So
Speaker:we're we're gonna leave that as foreshadowing for our later
Speaker:episode. We're starting to run up against our time
Speaker:limit, so could you
Speaker:give us kind of the 3 or 4 messages
Speaker:that you want our practitioner listeners, our
Speaker:cybersecurity professionals, to take away from what you found in
Speaker:your work. I'm gonna punt that to Mark. I've I've spoken a
Speaker:lot. Sorry. One thing I will say, and
Speaker:maybe this isn't a direct answer to your question, but maybe one thing I'll say
Speaker:just as a follow-up to the same question is is one thing we sought
Speaker:out to do here was to learn
Speaker:from world religions what we could apply to
Speaker:cybersecurity and make cybersecurity better. One thing that
Speaker:we did not seek to do was to porch portray
Speaker:that world religions were without any issues
Speaker:or faults of their own, that there weren't any problems or challenges. And I mentioned
Speaker:that because, obviously, plenty of religions
Speaker:use shame. They use fear. They use other things that we do
Speaker:not think should be used in cybersecurity. So I did I did want to
Speaker:mention that that we're trying to say, you know, what does make world religion
Speaker:successful? How can we take that and apply that to cybersecurity?
Speaker:And so, you know, with that in mind, I think some of the things
Speaker:that some of the major takeaways with respect
Speaker:to these higher values and thinking about, you know, the idea of
Speaker:for me, one of the big ones is a sense of belonging and
Speaker:and building that community, caring for others, wanting
Speaker:others to be successful, to succeed. And
Speaker:that can only be accomplished if, you know, instead
Speaker:of just punishing and looking at other people and saying, hey. You did this
Speaker:wrong. Instead being like, hey. You know,
Speaker:this this types of things happen. We know it's challenging. Let's figure out
Speaker:how we can make this make everyone more successful. Let's you know, what
Speaker:are we doing on our end that, we could do better?
Speaker:You know? So it's not just the employee, but what is the organizational
Speaker:what is the organization doing that, is making it more
Speaker:difficult? You know, what could what can the organization be doing better? And
Speaker:and, you know, just working together to support others, to share this knowledge,
Speaker:to care for each other in in a real meaningful way. And so I
Speaker:I think that that sense of belonging for me is is a really big
Speaker:one that I think religions,
Speaker:maybe in an often ideally idealized,
Speaker:can do very successfully. With cyber, we seem to be stuck in a bit
Speaker:of a a rut where we this is the way we do cybersecurity,
Speaker:and things like generational AI has come have
Speaker:come along, and we have to be able to adapt. But
Speaker:because of the fear based approach, people are almost frozen in the way they're
Speaker:doing stuff and that they're too scared to adapt. So it's really
Speaker:about taking the good parts. I agree with Mark there absolutely.
Speaker:The the religion does belonging pretty well. Let's try and figure that out.
Speaker:Also, the the sacred values were the thing we've put in as our
Speaker:as our this needs to be done because we didn't actually arrive at those.
Speaker:We didn't have the bandwidth to do that with this study, but that's definitely
Speaker:something we want to work on next. So when we
Speaker:were talking about it, Shane earlier, Craig mentioned that it seems a
Speaker:likely topic of your next paper, even though it's it's partially
Speaker:covered here. Tell us about what the next step is in your research because this
Speaker:is fascinating. We need an alternative to, pardon the metaphor, the
Speaker:hellfire and brimstone of a criminal justice perspective in current cybersecurity
Speaker:practice. So Mark and I are looking at this whole issue of
Speaker:sacred values with a another friend, at one of the London
Speaker:universities, and we're really hoping to arrive at a set of values
Speaker:that we could offer to the cybersecurity community to
Speaker:say, these are the things that we think that people could possibly
Speaker:espouse in order to help them. For for secure cyber
Speaker:security to become something that they don't even question that they just do, and
Speaker:you wouldn't have to have the compliance stick to beat them with. We
Speaker:also did a paper on regret, which is can be negative, but
Speaker:it turned out it can also be a positive thing. So if you make a
Speaker:mistake once, you can learn from it. I want to
Speaker:be understood. Organizational theory, Leon Festinger. Everybody
Speaker:knows him for cognitive dissonance, but attribution theory Uh-huh. Was his
Speaker:big thing, organizationally. And then the notion is
Speaker:people hate to fail, and they're more motivated by figuring out what
Speaker:they did wrong and keeping that from happening again than they are
Speaker:figuring out what went right. Because they expect to do well, but they don't expect
Speaker:to fail and they wanna avoid failure. But I was actually what
Speaker:triggered this, Craig, was we managed to put the name of a song in the
Speaker:title. So the title is
Speaker:from Edith Piaf. Nice. I've been wanting to
Speaker:do that for years. So we've we've been talking
Speaker:with doctor Karen LeNo and Mark Dupuy, today about their
Speaker:fascinating perspective on cybersecurity and doing our part to
Speaker:spread the faith of doing good in the workplace. This
Speaker:is cyber ways, a production of Louisiana Tech University College
Speaker:of Business supported by Dean Chris Martin's just business grant.
Speaker:You can download it wherever podcasts are found, and we dearly love if you tell
Speaker:your friends about us. See you next time. And it is important to say that
Speaker:the Cyberways podcast is funded through the just business grant program
Speaker:of Louisiana Tech College of Business, and, we're
Speaker:grateful for that. So join us next time on the Cyberways podcast, which is
Speaker:available on all major podcast platforms. We want you to
Speaker:subscribe or follow or whatever button your favorite
Speaker:podcast app has. Thank you very much.
