Behaviour-Driven Adaptive Security Design

The security culture programme described throughout this publication has established that awareness training, while necessary, is insufficient on its own to produce the sustained behavioural change that genuine security culture requires. This section addresses the two strategic instruments that move the security culture programme beyond the compliance-driven training model toward the adaptive education and environmental design disciplines that produce the lasting behavioural outcomes that the information security challenge demands.

The distinction between these two instruments reflects a fundamental insight about how human behaviour changes. Adaptive Security Education, Training and Awareness addresses the knowledge, skills, and motivational dimensions of security behaviour, working through the individual’s understanding and commitment to produce better security decisions. Behaviour-Driven Security Design addresses the environmental and systems dimensions of security behaviour, working through the design of the tools, processes, and physical environment to make secure behaviour the natural and effortless choice rather than the deliberate override of the insecure default. Together these instruments address both the person and the environment whose interaction produces the security behaviour that the organisation requires, recognising that neither alone is sufficient and that their combination produces the complementary effect that each instrument’s limitations make the other necessary to provide.

Adaptive Security Education, Training and Awareness #

The SETA framework provides the structured approach through which the ISO governs the security programme’s human knowledge and skills development, encompassing the three distinct but complementary components whose combined deployment produces the comprehensive human capability that the security programme requires.