Building a Culture of Cybersecurity: A Case Study Approach to Enhancing Risk Management

The talk opens with the perception gap between security practitioners and non-technical staff. Through audience polls, the speaker rates risk in two departments, human resources and marketing. HR handles sensitive payroll and personal records, often through PDFs, resumes and SaaS systems on endpoints that may not be fully controlled. Marketing staff meet outside contacts, which can bring unsolicited emails, odd attachments and invitations to meet off campus.

The middle of the talk follows a single lunch meeting that escalates step by step. Security staff hear alarm bells at each stage, while the marketer sees routine networking. The speaker argues that labels like high, medium and low mean different things to different departments, so teams should agree on definitions tied to what the organization depends on to make money. Suggested mitigations include access controls, verifying contacts, using official communication channels, and inviting non-technical staff into the discussion, including naming cyber champions within departments.

The closing point is that culture should be inviting rather than punitive. A fear-driven "no police" approach may get short-term compliance but little lasting engagement. In the Q&A, the speaker repeated that risk definitions should be set per organization and that relationship management helps bridge the gap. The takeaway is that security teams should empower staff to ask questions and understand their daily work.