Building Modern Security Awareness with Experiences
Experiences and events, the way that I define them, are segments of time in which a learner is more actively engaging in an element of your program. At their best, “experiences” should be well, experiential, requiring active participation rather than passively watching or paging through a Computer Based Training module.
But, that’s not necessary to be considered an experience. I generally consider anything like a meeting, a webinar, a lunch-and-learn, a team activity, or even an everyday interaction with a piece of technology, as an event-based experience. The key is that these are situations that people step into and out of. And, each of these can be leveraged to create a learning opportunity.
How do we apply this? Let’s look at some examples:
Meetings, Presentations, and Lunch-and-Learns
The best thing about each of these is that they are personal. There is generally not a screen separating the presenter from the participants. The formats are more open and interactive, allowing a greater sense of emotion and shared empathy to exist within the event room.
Yes, you can share great content, but you also have the benefit of directly interacting with your audience. This can help foster a bond of trust between your organization’s employees and the security team. These are great forums for storytelling, “ask me anything” sessions, sharing about seasonal/topical issues, and more.
Special meetings with compelling speakers are always good, but not always necessary. An executive from your organization can also share how security is critical to the organization’s success. You can conduct briefings about security incidents that succeeded or were thwarted. The most important thing is to engage your people. Don’t set up these meetings to talk at them. Talk with them.
You can (and should) also find ways to integrate security messaging and values into regularly occurring meetings throughout the organization that you may not actually be able to participate in. For instance, there is great benefit in sending security talking points to all managers to cover in their team meetings. One benefit of doing this is that the employees hear security messaging from their primary point of motivation (their manager).
Tabletop Exercises
I’m a big fan of tabletop exercises (TTXs). What I like about them is that they are extremely flexible. You can easily create tabletop exercises that last anywhere from a couple minutes (so you can slip them into a team meeting) up to a full day or more. In essence, these are thought exercises structured around a “what if” scenario.
One of the best benefits of a TTX is that it allows your people to mentally rehearse their reactions to scenarios at a time when the stakes aren’t high. Their reactions and answers can be studied, and you can decide how best to augment your training, messaging, and playbooks based on what you are seeing and hearing.
With just a few minutes on Google, you’ll see that there are a lot of good resources out there on how to create tabletop exercises. And, what you’ll notice is that many of them come from the emergency preparedness field because that field is always having to develop plans and processes for how to deal with the next big “what if?” Everything from hurricanes, to pandemics, to bombings, and more. You can use these resources as a model for creating your own cybersecurity and physical security scenarios.
Rituals
Since rituals exist to embody and sustain the organization’s cultures, it can be beneficial for you to see if you can incorporate some of your security-related messaging or activities into preestablished company rituals. If you have an “all-hands” meeting each morning, then see if you can incorporate security updates. Rituals also serve the purpose of codifying organizational values, such as service. Can you incorporate security messaging into service rituals that already exist? Or perhaps even create new rituals that are modeled after popular rituals within your organization?
Games
Security-themed games are good for helping your people consider security topics through a different lens. The fun, challenge, and variable rewards associated with games make them effective Trojan Horses for embedding messages and habits. Games can be computer-based or physical games like Jeopardy, puzzle solving, card decks with scenarios, carnival-type games, and so on. Above all else, make your games fun, out of the ordinary, and rewarding.
These are only a handful of examples of how to leverage experiences as a way to influence your security culture. Think about your own organization’s culture and then find ways to create immersive, engaging experiences that will resonate with your people.
About the author: Perry Carpenter is the Chief Evangelist and Strategy Officer for KnowBe4, the provider of the world’s most popular integrated new school security awareness training and simulated phishing platform.
Comments
Post a Comment