The Impact of Security Culture on Information Security Strategies

In an exclusive interview with Wise TV, Doğan Holding CISO Gökay Düzay emphasized that establishing a corporate strategy requires not only a technical foundation but also a cultural one. Noting that information security is a responsibility that concerns every department, Düzay explained how culture, regulations, and the support of senior management shape this process.

“To define a corporate strategy within a company, a cultural foundation is essential; information security and cybersecurity are not operations that can be left to the sole responsibility of a single department or individual. This is a risk that the entire organization faces collectively. Minimizing it requires all departments and stakeholders to act in unison. Policies, procedures, and behaviors—all of these constitute what we call ‘culture.’ Developing this culture takes time; generations shift, technologies evolve, and leadership changes. Consequently, embedding such a culture is a gradual process. However, we work to expand and strengthen our security framework within the parameters set by regulations. The support of senior management is also crucial to the development of this culture. At the end of the day, we are often perceived as a department that primarily incurs costs. Unlike purchasing a tangible asset—such as a car or a house—the systems and software we implement operate within server rooms or virtual environments, meaning senior management cannot ‘see’ them, nor can they immediately visualize the return on their investment. We strive to foster this culture by demonstrating that, as long as no security incidents occur, it is a clear indication that the right investments have been made.” The Importance of Corporate Strategy and Cultural Infrastructure
Corporate strategy serves as the roadmap a company defines to achieve its long-term goals. However, the successful implementation of this strategy requires a robust cultural infrastructure. Culture shapes an organization’s values, beliefs, and behaviors, making it the cornerstone of any strategy. The significance of culture becomes even more pronounced in critical areas such as information security and cybersecurity.

The Role of Culture in Information Security and Cybersecurity
Information security and cybersecurity should not be the sole responsibility of a single department or individual. These areas represent a collective responsibility for the entire company, requiring collaboration across all departments and among all stakeholders. Such collaboration must be embedded within the company’s overall culture.

The Contribution of Regulations to Culture
Regulations assist companies in establishing security standards, which play a vital role in the development of a security culture. Through these regulations, companies can both broaden and strengthen their security framework.

Support from Senior Management
Support from senior management is a critical factor in shaping culture. Leadership must recognize the importance of investments in information security and provide the necessary resources. This support facilitates the adoption of a security culture throughout the entire organization.