This is a really difficult issue, but if you have the chance to change things, you should give it all you've got.
You can't change a culture overnight. However, there are steps you can take to begin changing the culture for the better.
This is first on my list. I'm in full agreement here that you need to enforce security policies, and discipline those who don't follow them. That includes everyone from top to bottom.
Would you rather endanger the company by letting those who continue to screw up repeatedly... well, continue to screw up repeatedly? Don't expose your company to unnecessary dangers.
People who are dishonest in little things are dishonest in bigger things, and aren't worth the time it takes to discipline them. These folks are at the top of my termination recommendation list. Anyone who is honest about what they did wrong would be suspended at worst, unless they keep making the same mistakes over and over again.
If someone has a disagreement, give them a place to voice their opinion, but don't just roll over for them. Gently explain why... some users need to know why, it's just how they think. Those users almost always ask questions about why they should do something. Be prepared to teach them.
If someone refuses to follow security policies, you need to find employees who will. It's really that simple.
However, ain't nobody got time for a giant list of rules
I'm of the opinion that having too many rules is detrimental to those doing their job. That's why you should have a few specific rules for everyone, and then create role-specific rules.
Bobby in accounting is not customer-facing. I don't need to teach him about buffer overflows, SQL injections, xss, csrf, whatever. Cathy down in Finance doesn't need to know about server hardening techniques.
Buff Markalo in engineering definitely needs to know, though. And he has to understand the policies he's being taught.
Make training easy to digest, and simple to understand
You need to know your audience before even starting, or you're doomed before you start.
Remember, examples are SUPER helpful to make people understand what they're reading. I'm going to list a few super basic topics to help you get started. Feel free to add to them, but don't make it overbearing.
- Make it platform-specific, and give platform-specific examples.
- You can make it short and simple. You can even develop easily-digestible videos that are only around 5 minutes long for each of the OWASP Top 10 vulnerabilities.
- .gitignore, not storing the wrong stuff on GitHub, etc.
- Anything relevant to your environment.
- Customer-facing employees
- No to credit card storage, or you're fired.
- Dos and donts.
- Explanation of phishing / whaling / social engineering, and how they work.
- Anything relevant to their role. Customer-facing? Don't touch cardholder data in any way.
- Don't share your passwords / accounts
- Don't set up unauthorized resources (servers, virtual machines, etc).
- Sys Admins
- Proper hardening procedures
- Urgency of upgrading vulnerable components
- Anything relevant to their environment.
And always update every time you find an issue that didn't exist before. You'll never get everything, but you can get most.
New hire security orientation
This goes without saying. You need to ensure all hires undergo security orientation. If you make a digestible learning package that assumes everyone has a short attention span, you'll have much better success than 2+ hour videos of security with some guy droning on in a serious voice. I don't even want to watch that crap.
You'll need to see if they actually understand what they're learning. Make everyone take a yearly quiz, and don't allow those who fail to continue working unless they pass.
Reinforcement quizzes, and general competency quizzes help too.
Don't forget to know your target audience. If your target audience likes immature humor, use that in the quizzes.
Hunt down security issues, and confront those who cause them
Have a hunter? Have them hunt down the security issues on your own network(s), and explain them in depth to the teams responsible for these holes. Document everything they did wrong, and approach them and tell them it needs to be fixed.
If they refuse to fix or change, see the Policy enforcement above.
Don't believe anything users tell you. Always verify what they're saying. Honest people are the easiest people to work with in the world. Dishonest people create far more problems than they help with.
- Policy Enforcement
- No overbearing rules. Don't prevent people from getting their jobs done.
- Make it easy to digest, and simple to understand. KISS works really good.
- New hire security orientation.
- Quiz them.
- Hunt down security issues and confront those who create them.
Over time, people will change. It's sometimes an uphill battle, but one worth fighting for.