What is Culture?

There is a major question I got asked more often than not: “What is culture?” Most of the time, the asker wonders from the perspective of cyber security and security awareness, even if I also get asked by non-security people. There is no single, clear-cut definition of culture, it all depends on your perspective, background and interest. In my upcoming book “Build a Security Culture”, I define security culture as:

The ideas, customs, and social behavior of a particular people or society that allows them to be free from danger or threats.

This definition is created by combining the definition of security, and adding that to the definition of culture generally used by anthropologists. The definition of security culture I use explains and frames the topic I discuss, and is most commonly the answer I provide when asked “What is Culture?”

You may or may not agree with this definition, and that is fine. Instead, let´s agree that there are many different definitions available, and the one we should use should be best able to describe the topic and framing we aim for. As an example of alternative perspectives of culture, let us consider a few other definitions.

culture: from farming, preparing and using the nature for farming, i.e. cultivating the landscape.

This is the original use of the word, and is a useful backdrop to the definition, as it makes us realize that culture is about changing something into a state that we want — from the wild nature into a form and state we can control.

In sociology, culture have many different definitions and perspectives too — from being the object of studies and explanation (cultural studies, studies of how culture is created, used and impacts us), to cultural sociology where culture itself is used to describe, initiate and explain change. According to the latter, culture is one of a number of objects we may change, thus by definition (again), culture is formable, something we can act upon and use.

In psychology, culture is mainly focused on the differences between groups (regions, countries etc), and used to explain how one group of people may respond to threats differently based on their collective mind being different.

My concern with culture is a practical one: I strive to build and maintain security culture. A definition that helps me frame the topic helps me understand what exactly we are working with, and what is not a part of the work. My needs are to identify the areas we can change, how to change those as efficient as possible, and document both the change itself and the failures. I am a pragmatic in that I focus on creating actual results, more than just describing an interesting (ab)normality.

Using the definition above helps me focus on my tasks and work towards my goal: build and maintain better security culture.

If you are interested in security culture, you may want to check out the Security Culture Framework.