I've been reading a lot lately about generative culture at the suggestion of my boss. Apparently this topic has been popping up and circulating with frequency through DevOps circles in recent months, and seeing as I'm currently charged with doing "stuff" related to security and DevOps, it seemed like a good thing to research.
For those unfamiliar with generative culture, I recommend reading up on it. I found these pieces to be of particular value:
- "The Future of Generative Organizations"
- "What Makes a Culture Generative?"
- "Building Generative Cultures"
- "Safety Culture - Theory and Practice"
- "Creating a Generative Culture & Overcoming Barriers to Change"
What's most interesting about generative culture is that it really fits well with the current problems facing organizations today with respect to security. That is, infosec spend is still continuously viewed as overhead cost, infosec people are still viewed as obstacles (even when trying to play nicely with DevOps teams), and infosec tools continue to be undermined by the human element, which often sees security as an externality to their specific duties (even when it really oughtn't be).