Dysfunctional relationships in security–and how to move beyond them

In 20 years of usable security research, and a parallel body of research on security culture in information security, little attention has been paid to how the relationships between different stakeholders affect security decision-making in organisations. Notable exceptions are the security dialogues work by Ashenden & Lawrence (2016) and the inclusive security approach pioneered by Coles-Kemp and colleagues (e.g. Hall, Heath & Coles-Kemp, 2015). My research has found that security professionals often abuse security as a means of power (Inglesant & Sasse, 2010) and take a non-trusting stance towards non-security colleagues (Kirlappos & Sasse 2015). In a current project, we examine the relationship between business leaders and security professionals. I will present the core misunderstanding that causes those relationships to be dysfunctional, and examine how different stakeholders have to evolve too so that we can build functional relationships.