{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/security-culture","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/security-culture/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/security-culture/"},"term":{"en":"Security culture","da":"Sikkerhedskultur"},"aka":{"en":["cybersecurity culture"],"da":["cybersikkerhedskultur"]},"domain":["security"],"cluster":"awareness","layer":"people","status":"current","summary":{"en":"The shared habits and attitudes toward security that shape how people act when nobody is checking.","da":"De fælles vaner og holdninger til sikkerhed, der styrer, hvordan folk handler, når ingen holder øje."},"body":{"formal":{"en":"The unwritten norms, beliefs and everyday routines about security that members of an organisation share, which decide whether the security policy is lived or ignored.","da":"De uskrevne normer, holdninger og hverdagsrutiner omkring sikkerhed, som organisationens medlemmer deler, og som afgør, om sikkerhedspolitikken bliver levet eller ignoreret."},"plain":{"en":"Like the difference between a kitchen where everyone washes their hands because “that's just how we do it” and one where people only do it when the boss is watching.","da":"Som forskellen på et køkken, hvor alle vasker hænder, fordi “sådan gør vi bare”, og et, hvor man kun gør det, når chefen kigger."},"inPractice":{"en":"At a shipping company's head office, colleagues remind each other to lock their screens, and a department head thanks a new starter at a staff meeting for reporting a strange mail.","da":"På et rederis hovedkontor minder kollegerne hinanden om at låse skærmen, og en afdelingsleder takker på et fællesmøde en ny medarbejder for at have meldt en mistænkelig mail."},"whyItMatters":{"en":"Rules and training fade quickly unless the group keeps them alive, so culture decides whether security lasts beyond the last campaign.","da":"Regler og træning bliver hurtigt glemt, medmindre fællesskabet holder dem i live, så kulturen afgør, om sikkerheden holder efter den sidste kampagne."}},"deepDive":{"en":"Most security-culture work borrows Edgar Schein's model of organisational culture, which separates three levels: artefacts (visible structures and behaviour, such as clean desks, badge wearing and a report button), espoused values (what policies and leaders say matters) and basic underlying assumptions (the unspoken beliefs that actually steer decisions, such as \"deadlines beat security\" or \"IT will catch it anyway\"). Interventions aimed at artefacts are easy to see but shallow; lasting change requires shifting the assumptions, which is slow and mostly happens through what leaders reward, tolerate and do themselves. That is why ISO/IEC 27001:2022 clause 5.1 requires top management to demonstrate leadership and commitment, and why NIS2 Art. 20 makes management bodies approve and oversee cybersecurity risk-management measures and follow training themselves.\n\nResearch from usable security explains why culture fails in practice. Beautement, Sasse and Wonham's compliance budget (2008) models each employee as having a finite willingness to absorb security friction; once exceeded, people start bypassing controls, and the bypasses become shared norms. Workarounds such as shared passwords, personal cloud storage and shadow IT are therefore diagnostic signals of friction, not only of misconduct. From safety science comes the idea of a just culture: honest mistakes are reported without punishment, while reckless or malicious behaviour is still sanctioned. Without that distinction, and without psychological safety in Amy Edmondson's sense, near misses go unreported and the organisation loses its best source of early warnings.\n\nMeasuring culture is harder than measuring awareness. Instruments combine surveys of attitudes and perceived norms, interviews and observation, and behavioural indicators such as reporting rates, time from mistake to self-report, the number and age of policy exceptions, and whether security is raised early in projects or only at go-live. NIST SP 800-50 Rev. 1 (§1.4) treats culture as the outcome that a learning programme should support, not as a module in itself, and ENISA's report Cyber Security Culture in Organisations (2018), drawing on organisational science, psychology and law, offers methodological tools and step-by-step guidance for starting or improving a culture programme.\n\nCulture should not be confused with its neighbours. Security awareness is what each individual knows and can do; culture is the group-level set of norms that decides whether that knowledge is applied when it is inconvenient. A security policy states the rules; culture determines whether they are lived. The human firewall is one visible expression of a strong culture, and subcultures matter: a development team, a hospital ward and a finance department in the same organisation can have very different security norms and need different interventions.","da":"Det meste arbejde med sikkerhedskultur låner Edgar Scheins model for organisationskultur, der skelner mellem tre niveauer: artefakter (synlige strukturer og adfærd som ryddelige skriveborde, synlige adgangskort og en meldeknap), erklærede værdier (det, politikker og ledere siger er vigtigt) og grundlæggende antagelser (de uudtalte overbevisninger, der reelt styrer beslutningerne, fx \"deadlines slår sikkerhed\" eller \"IT fanger det alligevel\"). Indsatser rettet mod artefakter er lette at se, men overfladiske; varig forandring kræver, at antagelserne flytter sig, og det sker langsomt og mest gennem det, ledere belønner, tolererer og selv gør. Derfor kræver ISO/IEC 27001:2022 pkt. 5.1, at den øverste ledelse udviser lederskab og engagement, og derfor pålægger NIS2 art. 20 ledelsesorganerne at godkende og føre tilsyn med foranstaltningerne til styring af cybersikkerhedsrisici og selv at deltage i træning.\n\nForskning i brugbar sikkerhed forklarer, hvorfor kulturen svigter i praksis. Beautement, Sasse og Wonhams compliance budget (2008) beskriver hver medarbejder som en person med en begrænset vilje til at acceptere friktion fra sikkerhed; når grænsen er nået, begynder folk at gå uden om kontrollerne, og omvejene bliver fælles normer. Workarounds som delte adgangskoder, privat cloudlager og skygge-IT er derfor tegn på friktion og ikke kun på dårlig opførsel. Fra sikkerhedsforskningen i luftfart og sundhed kommer idéen om just culture: Ærlige fejl meldes uden straf, mens hensynsløs eller ondsindet adfærd stadig sanktioneres. Uden det skel, og uden psykologisk tryghed i Amy Edmondsons forstand, bliver nærved-hændelser ikke meldt, og organisationen mister sin bedste kilde til tidlige advarsler.\n\nKultur er sværere at måle end awareness. Metoderne kombinerer spørgeskemaer om holdninger og oplevede normer, interviews og observation samt adfærdsindikatorer som meldeprocent, tiden fra en fejl til selvindrapportering, antallet og alderen af undtagelser fra politikken, og om sikkerhed bringes op tidligt i projekter eller først ved idriftsættelsen. NIST SP 800-50 Rev. 1 (afsnit 1.4) behandler kultur som det resultat, et læringsprogram skal understøtte, ikke som et modul i sig selv, og ENISA's rapport Cyber Security Culture in Organisations (2018), der trækker på organisationsteori, psykologi og jura, giver metodiske værktøjer og trinvis vejledning til at starte eller forbedre et kulturprogram.\n\nKultur må ikke forveksles med naboerne. Awareness er det, den enkelte ved og kan; kultur er gruppens fælles normer, der afgør, om den viden bliver brugt, når det er ubelejligt. En sikkerhedspolitik fastsætter reglerne; kulturen afgør, om de bliver levet. Human firewall er ét synligt udtryk for en stærk kultur, og subkulturer betyder noget: Et udviklingsteam, en hospitalsafdeling og en økonomiafdeling i samme organisation kan have vidt forskellige sikkerhedsnormer og brug for forskellige indsatser."},"edges":[{"type":"requires","to":"security/security-awareness","confidence":"high","strength":"normal"},{"type":"requires","to":"security/security-policy","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/governance","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/shadow-it","why":{"en":"Where asking IT first is the normal thing to do, people are less tempted to use unapproved tools.","da":"Hvor det er normalt at spørge IT først, er folk mindre fristet til at bruge ikke-godkendte værktøjer."},"confidence":"medium","strength":"normal"}],"depth":2,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ENISA - Cyber Security Culture in Organisations","url":"https://www.enisa.europa.eu/publications/cyber-security-culture-in-organisations","tier":"official-doc","publisher":"ENISA"}],"draft":true}