Security's Social Problem
summary
Security failures stem more from ineffective risk programs and culture than broken tech, with DBIR showing 74% of breaches include a human element. The proposed fix uses restorative circles, restorative questions and nonviolent communication to process shame (compass of shame), apply fair process, and run compassionate witnessing after breaches. Academic findings note policies and rewards don’t drive voluntary security behaviors; collaborative practices (policy-as-code, developer-security circles) increase trust and produced higher-performing teams in State of DevOps research, and restorative programs correlate with reduced misconduct and better engagement.
AI-written summary · about
chapters (21)
- 0:00Security's Social Problem intro
- 1:05Why tech-only security fails
- 2:12Human element in breaches
- 3:56How humans decide security
- 5:45Fear appeals in security
- 7:51Voluntary behaviors and policy
- 9:59Bystander theory and culture
- 11:06Org culture and generative teams
- 13:12Generative culture with restorative practices
- 15:46Restorative justice foundations
- 19:02Shame management in security
- 21:10Relationship window for security
- 23:16Restorative justice principles
- 26:06Effective statements and NVC
- 29:58Restorative questions and circles
- 31:22Power of circles in security
- 33:58Evidence restorative practices work
- 35:48Security stress tests and postmortems
- 37:20Starting restorative practices
- 43:21Q&A on restorative practices
- 49:04Final thoughts
related talks
40mCulture Matters—Put People at the Heart of Security
20mBuilding security culture on infrastructure teams
48mHow to build a security mindset
11mPeople-Powered Security: The Role of Soft Skills
51mThinking Differently About Security
37mSecurity Culture Hacking: Disrupting the Security Status Quo
24mConcrete Steps to Create a Security Culture
27mSecurity: The Thing That Everyone...