Security Culture
Definition
Security culture is the set of habits, norms, and shared expectations a group develops to protect its members, its operations, and its information from surveillance, infiltration, and accidental disclosure.
It is the practitioner consolidation of older movement-security traditions (the closed-circle, the need-to-know, the operational security checklist) into an explicit group-shared practice — every member of the group knows the norms, knows why the norms exist, and can gently hold other members to them.
The canonical practitioner reference is Tactical Tech and Front Line Defenders’ Holistic Security curriculum, which embeds security culture in the broader protective practice of the group rather than treating it as a separate technical skill — a good security culture is one that runs in the background of the meeting, not as an agenda item.
Full page: [[security-culture]]. [source: security-culture] [source: holistic-security-tactical-tech]
FAQ
What is security culture?
Security culture is the set of habits, norms, and shared expectations a group develops to protect its members, its operations, and its information from surveillance, infiltration, and accidental disclosure. The full-page version of this definition lives on [[security-culture]]. It sits between the operational discipline captured in digital-security and the broader organising culture a movement needs to sustain its work under pressure.
What is the historical lineage of security culture?
It is the practitioner consolidation of older movement-security traditions (the closed-circle, the need-to-know, the operational security checklist) into an explicit group-shared practice — every member of the group knows the norms, knows why the norms exist, and can gently hold other members to them. The consolidation brings the older security traditions under one explicit discipline rather than leaving them as scattered habits.
What is the canonical practitioner reference?
The canonical practitioner reference is Tactical Tech and Front Line Defenders’ Holistic Security curriculum, which embeds security culture in the broader protective practice of the group rather than treating it as a separate technical skill — a good security culture is one that runs in the background of the meeting, not as an agenda item [source: holistic-security-tactical-tech].
What does it mean for security culture to run in the background of the meeting?
Running in the background of the meeting means the security norms operate without being named at every step — the room is swept, the screen is not visible to passers-by, the conversation does not name a sensitive detail. A security culture that requires an agenda item at every meeting is one that has failed to be absorbed into the group’s habits; the test is whether the meeting is safe without anyone naming the security practice.