{"id":21624,"date":"2021-10-26T09:30:16","date_gmt":"2021-10-26T08:30:16","guid":{"rendered":"\/gb\/en\/blog\/?p=21624"},"modified":"2021-10-26T08:52:39","modified_gmt":"2021-10-26T07:52:39","slug":"cybersecurity-awareness-storytelling","status":"publish","type":"post","link":"\/gb\/en\/blog\/cybersecurity-awareness-storytelling\/","title":{"rendered":"Why Storytelling is Crucial to Raising Cybersecurity Awareness"},"content":{"rendered":"

The power of storytelling isn\u2019t something you\u2019d normally pair with the highly technical field of cybersecurity awareness, but RingCentral\u2019s CISO Heather Hinton believes the opposite.\u00a0<\/span><\/p>\n

Cybersecurity<\/a> is more than ones and zeros. In Heather’s words, this field is all about passion and problem-solving. As children, we learnt morals and social skills through fables and tales, and as adults, we’re no different. Stories are the best way to distil complexity and motivate people to solve problems together.\u00a0<\/span><\/p>\n

Hinton explains how businesses can tap into storytelling to engage employees and raise cybersecurity awareness in this interview.<\/p>\n

How can organisations make cybersecurity accessible?\u00a0<\/b><\/h2>\n

When we talk about the evidence that shows people aren\u2019t embracing cybersecurity best practices, that\u2019s because we (security leaders) aren\u2019t creating content that people immediately relate to. <\/span><\/p>\n

It\u2019s about switching from a technology point of view and putting scenarios into a context that people understand \u2013 telling the story of what <\/span>could<\/span><\/i> happen.<\/span><\/p><\/blockquote>\n

For example, this month we\u2019re running a competition. My team created funny videos that depict typical cybersecurity best practices. Some of them are seriously funny. We have videos on password reuse, USB sharing, compromised email and many more. Part of the reason we’re doing this is so when people see a similar situation, they’ve got a story they remember. We\u2019re sharing the videos virtually across RingCentral\u2019s internal groups and getting people to vote for their favourite with the chance of winning a prize.\u00a0<\/span><\/p>\n

Is there any other advice that you would give to business leaders?\u00a0<\/b><\/h2>\n

In a variation on storytelling, I believe in doing fire drills. You do fire drills when you’re at school, and everybody learns how to leave the building. You have to be very, very careful how you do it. Internal fire drills beyond the Incident Response Team are a great way to get people involved. Again, you have to be careful how you do it because it could be messaged incorrectly.<\/p>\n

One of the things with cybersecurity is that everybody loves to tell accounts of when they were involved in an incident. When cybersecurity people get together, it becomes this contest on who resolved the most \u2018exciting\u2019 incident. Everybody compares notes on what is the scariest thing that happened to them and all that. More people should share how they helped, what they saw and what they learned in the public domain. Again, it\u2019s about bringing the story to more people.\u00a0<\/span><\/p>\n

A lot of security leaders do this with their companies through activities like social engineering<\/a> exercises.\u00a0<\/span><\/p>\n

What are social engineering exercises?<\/h2>\n

There\u2019s a show called White Collar. It’s very loosely<\/em> based on a famous conman who got caught by the FBI and put into jail. The FBI eventually makes him a consultant to catch similar criminals. His role serves a similar purpose to what we see in ethical hackers<\/a> today. It\u2019s all about finding vulnerabilities. In White Collar, the ex-conman achieves this through social engineering. In one episode, the main character goes into a bank, steals the identity badge off of an employee so that he can use the related proximity part to move through the building. That’s social engineering for you.<\/span><\/p>\n

That’s one way to get people to think about risk in real terms because it’s always when you let your guard down that things happen. <\/span><\/p>\n

The problem with cybersecurity is we have to be right 100% of the time. Our attackers have to be right only once. The odds are in their favour, not mine.\u00a0<\/span><\/p><\/blockquote>\n

From a cybersecurity point of view, that\u2019s why we don’t say, \u201cIf we are attacked,\u201d we say, \u201cWhen we are attacked,\u201d how quickly can we respond and shut the threat down?\u00a0<\/span><\/p>\n

Where do you get ideas from to increase awareness of cybersecurity?<\/b><\/h2>\n

I like the content that GCHQ shares – to me, it’s the gold standard because they are approachable. For example, they’ve had a great series on cybersecurity for the farming community for the last month. Its Twitter, web pages and programmes are so different and engaging. The CISA in the US is the other place I look. Both organisations have super smart people dedicated to raising awareness of this space, and they see all sorts of stuff that I don’t see.<\/p>\n

Are there any plans for cybersecurity education at RingCentral beyond this month?<\/b><\/h2>\n

We will have our cybersecurity newsletter coming out in a couple of weeks with a lot of resources for RingCentral employees. I’m kicking around a couple of other ideas that others in my field have suggested (a book club is one of them). Watch this space.<\/span><\/p>\n\t\t