Security needs in people begin with what are apparently instinctive reactions to perceived threats. Humans seem to have a survival instinct hardwired into the organism. It is initially visible in the
Security Strategies 䡲 111
form of refl exes and later becomes more sophisticated. An infant reacts to loud noises or jerky motions with alarm. As the child grows and develops more sophisticated perceptions, refl exes are augmented by thinking processes. Reactions to threats include not only simple perception but also analysis of the threat and the choice of an appropriate response.
As sophistication grows even further people become able to develop actions based on an assess- ment of the probability that a threat might exist. Our personal security becomes more proactive and less reactive. A person walking down a dark street in an unfamiliar neighborhood hearing footsteps approaching from the rear is likely to experience an elevated heart rate and other physical signs of psychological arousal. Th ere is no clear and present danger but the person makes an analysis of the facts listed earlier, blends it with past experiences as well as stories heard, and reaches instant conclusions regarding the presence of threat. Th ese conclusions produce the physical feelings with which we are all familiar when danger is sensed. Th e default response for people is to prepare to fl ee or fi ght. It seems that the very design of the organism is toward protection and survival. It is impor- tant to note that refl exive reactions never completely disappear. Th ey have always been necessary for the survival of the organism and are not likely to evolve out of existence any time soon.
A truly interesting thing about this process is that as learning continues, the proactive process can come to appear refl exive as the processing of information regarding familiar stimuli becomes “automated” in the brain. Familiar threats begin to produce what appear to be refl exive reactions, which are actually learned responses that bypass conscious analysis as an unnecessary step in deal- ing with that stimulus. Essentially, a person forms an “association macro” that runs an automatic analysis of the stimulus and then runs a programmed response. Th e person walking down the dark street did not think about the danger. In fact the physical feelings were probably felt before any conscious thought occurred. Th us the foundation for the person’s tendencies throughout life to approach or avoid various stimuli is laid.
In a sense the processes come full circle from refl ex to conscious thought and back to what appears as refl ex again (see Figure 8.1).
Such learned automatic behavior is even called “knee jerk” in popular literature. Th e allusion to what happens when the doctor taps a person’s knee to test refl exes is not without foundation. For all intents and purposes it is the same thing. Th e only meaningful diff erence between the two responses is that the latter, learned response can be altered by conscious cognitive intervention.
As cognitive mechanisms continue to develop automated responses can become incorporated into larger schemes of thought such that the person anticipates discomfort and avoids walking unaccompanied in unfamiliar neighborhoods at night. After all, would not a reasonable person avoid perceived danger? You can probably see how this process proceeding out of control can also produce “unreasonable” patterns of behavior that we might call paranoid or otherwise excessive.
So What?
By now you are probably asking yourself why this discussion of assessing culture began with a walk through Developmental Psych 101. It is important because this “biological inertia” to survive and to use programmed responses is also true for other organic forms in our world, including human organizations, and it fi nds its expression in the patterns that we call organization culture. Th at which is born does not normally want to die and there is a will to live apparent in all viable organizations as well as in viable people. In fact managers in organizations accept their account- ability for the protection of the organization’s continued growth and survival unquestioningly. I have not seen a position description (except at the chief executive offi cer level) that spells out this
CRC_AU6708_Ch008.indd 111
accountability for managers but I doubt that any would deny that it exists. It could be argued that this refl exive will to survive is hardwired into the organization or is at least automated in manage- ment practices (Rousseau, 1995).
Th e problem is that refl exes are not enough and reactions to risk must become thoughtful antici- pation of risk. Rapid discovery of a security breach must be secondary to eff ective reduction of a security risk. Th e design of the process of reducing risk is the point at which all organisms and organizations diff er and that diff erence follows from either personality in the individual or culture in an organization.
So, just as we would need to understand the personality of an individual to understand his or her needs for security, so must we understand the culture of an organization to design an appropriate security program.
Diff erent personalities are likely to perceive personal risk diff erently and diff erent organizational cultures will also diff er in their perceptions of what is most important to their survival. As will be
Stimulus At rest Analysis Response Response effect
Security Strategies 䡲 113
discussed later, culture can trump good common sense when it comes to management and secu- rity practices and this is the compelling driver for including a useful assessment of culture in the development of a security program. After all, eff ective management is doing the right things right, not just doing everything that can be done.