Culture Is Your Best Defense: What the Nvidia SpyAllegations Remind Us

Nvidia makes some of the most closely guarded technology on the planet. It has security resources most companies can only dream of. Yet recently, the company opened an investigation into its own CEO over a possible national security breach.

According to the Associated Press, U.S. intelligence concluded that a business executive close to Jensen Huang was an agent gathering information for the CCP.

Though the investigation is ongoing, a familiar lesson is emerging.

When the Target Is a Person

This story does not involve a zero-day exploit, a phishing attempt, or a misconfigured firewall. It involves one of the oldest and most effective espionage techniques: an illicit relationship.

If it can happen at the top of one of the world's most valuable companies, it can happen in a five-person machine shop contracting for the DoW.

This is a risk for every organization: your people are your perimeter.

Whether a trusted vendor, a friendly new "partner," a recruiter on LinkedIn, or a potential customer who asks one question too many, each can become a point of access that even the world's best tools cannot protect against.

The Best Defense

As a managed services provider, many of our customers rely on us for the tools we offer: a better SIEM, MFA implementation, or a secure enclave. These configurations matter.

Tools enforce policy, but the best defense is your organization's culture.

Culture determines the type of people you hire, whether people notice when something feels off, and whether they speak up when they do.

Unlike tools, culture is not something you can outsource. Culture is something created and recreated on a daily basis.

A Culture of Vigilance

Companies that are founded on values that are promoted at every stage in the employee lifecycle, and corporately at every opportunity, both internally as well as externally, promote a healthy culture. Building a security-minded culture isn't achieved through a mandatory training video, nor can it be outsourced. Security awareness is embedded in the company culture and built on a set of habits that business leaders model every day.

We've learned:

• Culture is top-down. Executives, whether they realize it or not, set the tone for an organization's culture.
• Shared values vs double standards. Leaders who hold themselves to different standards create double standards and inconsistency. At the edges, these inconsistencies lead to risky behaviors that jeopardize the entire business.
• Safe reporting. People who fear embarrassment or reprisal will conceal mistakes, giving mistakes time to compound and become more serious. Reward a see-something, say-something culture, and you can stop incidents early.
• Teach the social side of threats. Bribes, flattery, and unsolicited partnerships are the tradecraft of our nation's enemies. Train people to recognize the early signs and how to avoid becoming vulnerable in the first place.
• Reinforce the message. Repeat and reiterate your organization's values often to ensure they stick.

The Takeaway

Whatever the Nvidia investigation finds, the risk is the same for every business leader. If someone patient and well-funded wanted access to your company, your people could be the unguarded door to your most sensitive information.