In Brief

To Each Nation, Its Own Security Culture

Ken Wheatley, VP of corporate security for Sony, considers cultural differences

By Christopher Koch

May 01, 2005 — CSO — Offshore Outsourcing - As Western companies rush to send work like IT programming or insurance claims processing offshore, they send their own cultural expectations about security with it. They should expect surprises.

Different cultures have different views about the precautions necessary to secure data. The expectations tie directly to local cultural concepts like honor, tradition and peer pressure. (For more about offshore outsourcing security, see "Don't Export Security," Page 32.)

Ken Wheatley, vice president of corporate security for Sony Electronics, recalls encounteringor rather stepping overthese expectations firsthand. While touring a partner's facility in Japan, Wheatley asked to see the security fence that the company had erected around the perimeter. "It was 2 feet high," he recalls. When he questioned its effectiveness, his hosts were incredulous.

"These people have a fairly homogeneous culture, with unspoken beliefs about trust and honor," says Wheatley. "They asked me with complete honesty, Why would anyone step over the fence?" If Wheatley wanted the fence he had expected, he realized it would be considered an extraordinary measure and would jeopardize the relationship. He had to readjust his horizons. "This was an existing business partner we couldn't walk away from, so it was both a risk acceptance issue and sensitivity to cultural differences," says Wheatley. "You have to understand where people are coming from" when you go into negotiations about security.