What is Behavioral Cybersecurity?

What is behavioral cybersecurity, do I need it, and how do I get it?

Cybersecurity arises from attitudes, behaviors, and shared understanding of what creates a secure environment. These attitudes, behaviors, and shared understandings are found in every business unit of every organization. 

Sometimes, especially when the leaders of a business unit are used to dealing with technology, it's not hard to get people to understand the basics -- e.g., never stick a thumb drive into a mainframe. But then someone sticks a thumb drive into a mainframe (see the James Bond movie "Skyfall"). But basics don't create cybersecurity, they are building blocks for cybersecurity. Also, because most managers are not promoted out of technologist or IT roles, they do not have a good understanding of how different systems interconnect and reinforce each other to create an integral network.

You need behavioral cybersecurity because systems are increasingly interconnected; because more peripherals become connected to your network; and because sometimes people engage in counterproductive behavior either due to lack of paying attention, because it suits their needs, or because they receive reward for doing so. Cybersecurity is not the property of IT anymore, it's now everyone's business.

You get behavioral cybersecurity by creating performance standards in the business unit and reinforcing standards that incorporate cybersecure behaviors. That may sound simplistic but again most managers are not selected or reinforced for creating a culture of cybersecurity. Getting cybersecurity requires changing yourself as a leader -- understanding cybersecurity basics, talking about why it's important, discussing it with clients and peers. It also means creating a culture where there is a balance between feeling free to bring up problems while still accomplishing the mission.

Our white paper on assessing readiness for cybersecurity, Behavioral Assessment of Readiness for Cybersecurity (BARC), is available for further review of these topics. You can also watch our video discussion about how we use Behavioral Science on our YouTube channel. We also have an introductory video.