Jeremy Cox - Building a Culture of Trust in Information Security

### Overview Jeremy Cox, Director of Technology for Washington County School District, discusses how information security initiatives frequently fail not due to technical flaws, but because of a breakdown in trust and communication between IT/security teams, executive leadership, and general employees. To bridge these divides, Cox outlines communication and cultural strategies that position security professionals as collaborative partners rather than barriers, illustrating how these practices were deployed within his school district over the course of a decade.

### Key Topics - **The Executive Leadership Divide**: Security teams and C-level executives typically share organizational goals but have diverging concerns. Executives prioritize employee productivity, cost versus investment, business goal alignment, and higher risk tolerances. When security teams communicate using dense technical jargon or fail to explain the 'why,' leadership may perceive security as an obstacle and stop listening. - **The Employee Divide & Monitoring Concerns**: Employees frequently experience friction with security measures. Citing workplace statistics, Cox notes that 60% of employees report frustration with IT inflexibility, 43% feel security measures hinder daily tasks, and 56% believe policies hurt productivity. Furthermore, over 80% of organizations conduct employee monitoring, with 59% of remote staff worrying about unconsented spying and 30% feeling uncomfortable, leading to diminished trust. Communication problems compound this: 35% of workers perceive IT communication as condescending or dismissive, whereas 70% report higher satisfaction when IT explains issues in simple terms. - **Healing the Divide**: Overcoming negative stereotypes (such as viewing user errors as 'id10t' or 'PEBKAC' issues) requires remembering that IT and staff are on the same team. Core strategies include: - Seeking first to understand employee workflows by sitting with them. - Simplifying technical terminology and avoiding jargon, using tools like ChatGPT to craft plain explanations. - Using stories and analogies to create emotional connections and intuitive comprehension. - Fostering cross-departmental collaboration and allowing users and executives to co-develop solutions to establish ownership. - Being transparent about constraints and offering positive alternatives instead of outright refusal. - Finding balance and introducing incremental improvements rather than demanding all-or-nothing security overhauls.

### Technical Details & Case Study - **Case Study at Washington County School District**: The district engaged in a multi-year effort to reshape user perception through practical, relatable, and value-driven email communications. Rather than issuing top-down prohibitions, the security team explained the risks and why they personally would avoid specific behaviors. - **Personal Use of Government Email**: When tackling the pervasive issue of employees binding personal accounts (e.g., Apple IDs) to district email addresses (`washk12`), the IT team avoided outright bans. Instead, they transparently educated staff that all government emails are subject to GRAMA (Government Records Access and Management Act) requests, pointing out that any public records request could require third parties to review their personal emails. This explanation motivated staff to voluntarily contact IT to migrate their personal accounts. - **Rolling Out New Security Initiatives**: When launching recent security initiatives, the district selected representative test schools to evaluate workflow impacts, iterated based on direct feedback, and engaged executive leadership with multiple options and analogies so that leadership guided and owned the final rollout decisions.

### Takeaways - Empathetic, simple, and transparent communication is the primary driver of successful security adoption. - Culture shifts cannot happen overnight or within six months; establishing organizational trust is an ongoing effort that takes years. - Security professionals should frame changes around mutual benefits and minimize unnecessary verbiage to ensure instructions are clear and actionable.