Lessons in Changing Culture, or Not? Part 2: Culture Shock

Tue, 2006-11-28 12:19

All of this may appear rather obvious to you. Of course, Michigan's government security would come nowhere close to NSA's. Nevertheless, I just had no idea how big the culture shock would be. In the beginning of my state career, I barked out "change those passwords" and "activate your screensaver" orders, like never before. I honestly thought that all that was needed was a few months, or perhaps at most a year or two, of National Security Agency (NSA) indoctrination into the "proper security etiquette" and everything would be set right.

Over time, I realized it was more like trying to teach a Frenchman who lives in Paris how to act like an American who lives in Baltimore. It's not just learning the lingo that's hard, the Frenchman has no desire to live that way. My supposed "enlightened concepts" were returned with puzzled smiles. My boss used to grin and tell James Bond jokes. Others would laugh and say things like: "we're not protecting state secrets now are we." Eventually, I got tired of the strange looks and wisecracks that I received every time I tried to explain "the NSA-way" to do it.

Looking back at the late 90s, I realize that, despite my best efforts, I wasn't changing any hearts or minds or even seriously denting state government culture. The culture was changing me. Even when I became the agency CIO, managing a series of multi-million dollar Y2K contracts and over a hundred staff, I wasn't getting much attention on my security demands.

Sure, we succeeded in adopting a few common-sense measures along the way by bargaining with business managers and adding mandatory tasks to our Y2K compliance project plans. Regardless, security became less and less of a priority. It was a tax, a necessary evil. Later, in order to adapt to the world after Y2K, our division moved on to new challenges like e-government services. Eventually, I left that role to help build Michigan.gov.

So what's the moral of the story? Michigan's state government culture, which goes back decades further than I do, was not "pro security." It's was just not in the organizational DNA. In the same way that Duke University excels at basketball but is "less stellar" in football, Michigan State Government shined in many areas but "lagged" in all things security.

Naturally, September 11, 2001 changed things for all of us. It transformed the nation forever. The tide had turned - I thought. I was back focusing on security, this time as the State's first enterprise-wide CISO in May, 2002. With all the online apps, the new focus on Homeland Security, and serious privacy laws, wouldn't transforming the culture towards becoming security-conscience become easy? I beg to differ.

Yes, the pendulum swung, buildings were guarded, Y2K disaster plans were dusted off. We received millions in federal homeland security dollars to buy generators to protect data centers, filter spam and spyware, add new training, update policies, centralize our security team, etc. We got better, much better. Events like the northeast Blackout in 2003 actually helped to reinforce our efforts. I'd even say we surprised the masses for several years - winning national awards for our security program. Duke had a football team, right?

Not so fast. Pendulums always swing back. Our successes gave other areas of government (and even some IT staff) the view: "done that, my turn, let's move on." Even new headlines around identity theft and stolen laptops have struggled to keep security at the top of the priority list - from the business' viewpoint. While it's true that magazines and many in the IT arena have listed security as a top priority for 2005 and 06, it's starting to lose that shiny, new "hot" appeal. It's now viewed as tough work by system administrators and others who have to keep applying a never-ending assortment of patches and other security fixes.

buy a link »

Reader Feedback

Mon, 2007-06-04 13:24

compare fioricet prices

By Bill

compare fioricet prices
compare fioricet prices
compare fioricet prices
[URL=http://freewebs.com/buy-fioricet-onlineee/fioricet-to-you.html]compare fioricet prices[/URL]
http://freewebs.com/buy-fioricet-onlineee/fioricet-to-you.html

CSO

Blogs

Post new comment

Security Directions: A Virtual Conference

Protecting PII: How to Work with IT to Manage Risk

CSO Corporate Partners

CSO Perspectives