On the one hand, I have argued before that we need to hold people accountable because, without a stick, our people will not have as much of a reason to care in the first place. On the other hand, a couple of the stats from the report that Doug pulled out tell me something different:
It’s from Australia, but the part that I have looked at so far could be useful for everyone trying to figure out how to build and maintain a workplace that supports mental health. (Check your local laws, though, as the legal references are obviously related to Australian workplace safety rules)
This is the one thing I’ve talked about before when it comes to where we might fall short on our cybersecurity training, we don’t really hold anyone accountable.
Make cybersecurity part of formal employee evaluation. Give people a reason to care. Much like I talked a couple of weeks ago about creating a training culture, provide a way for people to learn more and to learn from others. Give them space and time to talk about security. Recommend they read some security blogs, meet to share stories about the latest phishing information out there, etc.
What they argue for instead is a decentralization of our work. That rather than being the center of our lives and our time, work is simply a transaction. We give you output, you pay us. That’s it. It’s all there is.
That’s the revolution they are looking for. It might seem like a simple change, but it’s actually quite a different way to look at the world of work. Go read more and listen to the episode. It’s interesting to consider.
You cannot claim to care about the people who work for you, and not even check in on their well-being. Those two things do not go together at all. We have to get to that very minimum level before we can do more, and if we can’t even be bothered to get there, I see no reason why anyone with a choice would want to continue working for you.
I mean, it seems so simple, and yet so genius. But also so very unethical:
“In a program called ‘Communicate with Care,’ Google trains and directs employees to add an attorney, a privileged label, and a generic ‘request’ for counsel’s advice to shield sensitive business communications, regardless of whether any legal advice is actually needed or sought. Often, knowing the game, the in-house counsel included in these Communicate-with-Care emails does not respond at all,” the DOJ told the court. The fact that attorneys often don’t reply to the emails “underscor[es] that these communications are not genuine requests for legal advice but rather an effort to hide potential evidence,” the DOJ said.”