Strategic Alliance Magazine Q1 2018 - 25

THE C HAN GIN G FACE OF DATA

to bring more tech and digitization to these offers."
Recently incorporated collaboration tools at Schneider
are Skype for Business and Box-a competitor to Dropbox that is used for storage. Both can extend to the
partner community. "When you think about ... Box as a
cloud-based security system and the information I have
stored there-such as marketing, personally identifiable
information, and payroll-Internet security should be inherent in any application, any collaborative, any kind of
framework, and it should be designed in at the beginning," he reflects. "Security officials should be brought in
from day one. You need to build digital platforms with
security inherently designed into the platform. I know
what they could do if brought in on day one versus day
one hundred. It's much easier and much more cost effective if I have them available at day one rather than having
them doing a vulnerability assessment later, when you
may not be able to fix all of the vulnerability issues."
The new technologies presented a learning curve at
times, DeSpirito admits. "When adopting Box, it took me
time to get used to and [adjust to] allowing a partner to
access it," he says. "You fear change; you like things the
way they are. It's not so much the complexity of digital
transformation that's challenging; it's the cultural changes
required and the pace at which you need to change," he
adds. "I work in the West Kingston, Rhode Island branch,
and there is a culture in this building that's part of a bigger culture of Schneider North America, which is part of
Schneider Global. Those cultures win on a daily basis, no
matter the strategy. You can't discount cultural headwinds, uplift, or tail winds if people resist change," which
means digital transformation needs to be pursued wisely,
he says.
Changing people's behavior is really hard, Blau concurs.
"People tend to stick with whatever the status quo is,
which ends up looking like people ignoring or bypassing
the ... policies that an organization has put in place. One
way that organizations can help make the transition a bit
easier is to time the transition better," he says, citing research on fresh start effects at the University of
Pennsylvania by Katherine Milkman. "The idea is that
people are more likely to follow through with goals and
take action on 'fresh start' days, like the first of the year, or
the beginning of the week, following a holiday, and even
on birthdays. But what this implies is that organizations

might be better off timing the rollout of their new policies
on these 'fresh start' days, and getting their teams ready
well in advance."
Another important and underleveraged time is when a
company is transitioning to new systems or people are
being on-boarded. "There's a huge opportunity to instill a
security mindset as part of the new identity that they are
forming, ... but rarely do security teams take advantage
of these moments," he notes.
He then discusses what he calls last-mile problems, those
additional issues even if you follow all of his recommendations: "As a behavioral scientist, what I generally try to
understand is how the context in which people are acting
can shape their behavior. While education can play a part
in that, we often do things we know we shouldn't do, so
education isn't really a foolproof investment," he advises.
He provides the example of software updates, what security experts always say is one of the most important things
people can do to keep themselves and their company safe.
Yet security experts will acknowledge that updating is an
inconsistent behavior: "We can understand why if we
look at how updates are generally delivered. I bet most
people have experienced getting an update prompt in the
middle of a work day-a time when doing the update is
inconvenient. The update prompt generally gives you two
options, 'update now' or 'update later.' This simple design
decision is likely what leads to people clicking the 'update
later' button for days, weeks, or even months on end,
when they should really just update the thing," he explains. "Make a small change, and ask people to decide
when they would like to update. A simple commitment
intervention could help alleviate this procrastination
process. But the bigger point is that if you have these lastmile problems, you often have to dig into the details to
see what features of the workplace or interface environment are driving the behavior you ultimately want to
change, and make small tweaks to more effectively guide
better behaviors." n
Cynthia B. Hanson is a contributing editor to
the "2017 Verizon Payment Security Report" and the
Jones & Bartlett Learning Information Systems Security
& Assurance Series books Legal Issues in Information
Security and Fundamentals of Communication and
Networking, first and second editions.
25
Q1 * 2018 | STRATEGIC ALLIANCE MAGAZINE

Table of Contents for the Digital Edition of Strategic Alliance Magazine Q1 2018