Creating Better Relationships Leads to Better Security | Phin Security | Phishing Training

TL;DR

Security awareness training can sometimes become adversarial due to binary communication and the lack of understanding human behavior.

Transcript

this leads right into kind of the topic for this webinar which was creating better relationships so it seems like this kind of training you know creating a security awareness program can be adversarial from an msp to a client why would reg and why would you wes think that it tends to be adversarial uh as of today well i don't think anyone likes bei... Read More

Key Insights

• 🛰️ Security awareness training can be adversarial due to the discomfort of being told one is not doing well and the tendency to rationalize flaws.
• ❓ Binary communication in the technology and cybersecurity realm doesn't align with human behavior and can hinder progress.
• ❓ Communication should be tailored to the audience, providing value and creating incentives for action.
• ❓ Conversations can become inconsequential when messaging fails to motivate or address customers' individual circumstances.

Questions & Answers

Q: Why does security awareness training often become adversarial?

Security awareness training can be seen as adversarial because people don't want to be told they're not doing well. When flaws are pointed out, individuals may become defensive and rationalize their actions.

Q: How can communication in security awareness programs be improved?

Communication should move away from binary messaging and consider the audience's perspective. It's important to communicate in terms that resonate with the audience, creating value and incentivizing action.

Q: Why do conversations with customers sometimes become inconsequential?

Conversations may become inconsequential when the messaging focused on performance statistics or risks doesn't motivate or move the customers to take action. It's important to recognize that customers are human beings with biases and individual circumstances.

Q: How can security practitioners avoid adversarial conversations?

Level setting with clients is crucial. It's important to convey that the goal is to enable the client's objectives while ensuring security. Communicating that the role is to protect revenue and operational efficiency can help shift the conversation away from an adversarial dynamic.

Key Insights:

• Security awareness training can be adversarial due to the discomfort of being told one is not doing well and the tendency to rationalize flaws.
• Binary communication in the technology and cybersecurity realm doesn't align with human behavior and can hinder progress.
• Communication should be tailored to the audience, providing value and creating incentives for action.
• Conversations can become inconsequential when messaging fails to motivate or address customers' individual circumstances.
• Level setting with clients, emphasizing the role of security professionals in enabling objectives, can help avoid adversarial conversations.

Summary & Key Takeaways

• Training for security awareness programs can often be seen as adversarial because people don't like being told they're not doing well.

• Communication tends to be binary, focusing on either having a problem or not, which doesn't align with human behavior.

• Technology experts should work on improving their communication to create value and incentivize action in their audience.