In the real world, there’s often a discrepancy between an organization’s mandated security processes and what actually happens. The social practice of security flourishes in the space between and around formal organizational security processes.
By recognizing the value of risk management as a communication tool, security practitioners can tap opportunities to improve the security dialogue with staff.
(From the journal abstract)
Ashenden, Debi, and Darren Lawrence. 2016. ‘Security Dialogues: Building Better Relationships between Security and Business’. IEEE Security Privacy 14 (3): 82–87. https://www.computer.org/cms/Computer.org/ComputingNow/issues/2016/08/msp2016030082.pdf.