Re-thinking The Human Factor with Bruce Hallas

Welcome to the Re-thinking the Human Factor podcast. Hosted by Bruce Hallas, it is a podcast about information security awareness, behaviour and culture for information security professionals. Bruce is the author of “Re-thinking the Human Factor”, and the founder of Marmalade Box a strategic information security consultancy that specialises in security awareness behaviour and culture. He is also the founder of The Analogies Project, an online library of analogies for security professionals to use in communicating the information security story. In this show, Bruce interviews guests from outside the information security industry who specialise in aspects of awareness, behaviour and culture and invites them to share how they have effectively tackled the challenges we face as security professionals. Bruce also invites leading security professionals and CISOs to review the episodes with him so that you can hear what they’re taking away from the podcast. Guests include best selling author Dan Ariely, Gert Hofstede and Rachel Lawes, John Pollack who was Bill Clinton’s former speechwriter, and Greg Michaelidis, the former Director of Communication at Homeland Security for President Obama’s Administration If you’re interested in nudge theory, behavioural economics, storytelling, organisational culture and communication, then you’ll find something of interest.

Lessons from the world of coffee! 08/30/2024

Key performance metrics 08/30/2024

The security function's culture. 04/21/2024

An appointment with the Doctor to discuss culture, behaviour and decision making. 03/17/2024

Insights from advertising for security awareness professionals. 01/22/2024

A Human Resource view on Information Security Awareness and Education 12/04/2023

Embracing Diverse Skills When Building an Effective Education and Awareness Team. 11/20/2023

Embracing Diverse Skills When Building an Effective Education and Awareness Team. When I first got involved in “information security” 20+ years ago, I found myself almost entirely surrounded by industry peers whose training and experience was in technology or technology disciplines. My training in law, marketing and finance, and my experience in business development, marketing, recruitment and even a stint in purchasing and supplies all seemed out of line with the world of IT security as it was called back then. As I came to understand, during my own research in human behaviour and culture, my lack of an education in technology meant I was culturally and even physically wired differently. This meant I looked at things through a different set of lenses. The result, was an approach that we would now call governance, risk and compliance. However, it was these very human disciplines, which led me to fundamentally think differently when it came to kicking off the Re-thinking the Human Factor research programme. Our guest Lana McGill, to me, enshrines the change in direction of an increasing number of forward thinking security professionals looking for a more mature approach to employee awareness, behaviour and culture. Lana believes that by diversifying their search for skills and experience, outside of the traditional industry expectations, you can bring new insights and energy to the challenge of influencing employee behaviour and culture. Her role as a senior information security leader, in the finance sector, and her willingness to embrace other skills and experiences in the search for more effective interventions, gives hope that the industry inertia, when it comes to the human factor, may finally be shifting. ©Copyright Marmalade Box Limited The content of this podcast is the property of Marmalade Box Limited. Any use of the content of the podcast, either in full or partially, will be considered an infringement of Marmalade Box Limited rights as sole owners of this content. Any enquiries about the use of this content should be directed to Marmalade Box Limited. Contact information can be found at . /episode/index/show/rethinkingthehumanfactor/id/28710288

The Science Behind Metrics 11/06/2023

Insights from Educational Psychology for Information Security Professionals 10/23/2023

Understand the forces at play. 11/29/2021

The human factor. A view from Brazil. 11/03/2021

Versace, Burberry and Lacoste. Thoughts from branding. 10/18/2021

An internal communications perspective. 10/05/2021

The human factor in the middle of a major security breach. 09/06/2021

CyberSecurity ABC's 08/09/2021

An ex-regulators view on awareness, behaviour and culture. 07/19/2021

What does it mean to have a people-centric approach to cybersecurity? And, why you should have one?) 07/05/2021

Content is king or so they say! Discover some caveats around the saying as we explore the role of a security influencer. 06/27/2021

What role training materials must play in building security aware-rich organisations? 06/21/2021

What does it take for security teams to win in the cybersecurity fight? 06/14/2021

How technology can be a CISO's best friend in changing behaviour. 06/07/2021

Re-thinking the Human Factor: Cyber Security Mini Series 05/31/2021

A conversation with award-winning CISO, Andrew Rose 04/28/2020

A conversation with award-winning CISO, Andrew Rose A conversation with award-winning CISO, Andrew Rose ANDREW ROSE joins us for Series 3, Episode 12 of the Re-Thinking the Human Factor Podcast. Join us for this straight forward discussion with an award winning CISO who transformed security management for three major organisations. With his extensive background, Andrew is a strong relationship manager who is able to develop and lead teams, driving initiatives forward with a style that is facilitative, tenacious and positive. Able to communicate, co-ordinate and influence effectively at all levels and respond to challenges with dedication, enthusiasm and pragmatism. Andrew Rose is strongly focussed on sensible, cost effective security solutions being used to enable a business to innovate and develop. AS YOU LISTEN TO THE EPISODE, IF YOU FIND YOURSELF WANTING TO IMPLEMENT SOME OF THE INSIGHTS YOU’RE GAINING BUT YOU FEEL YOU NEED A LITTLE HELP, PLEASE DO GET IN TOUCH WITH ME AT: JOIN ANDREW ROSE AND BRUCE HALLAS AS THEY DISCUSS: The early days of cyber security and how people almost gave up on the human factor. How the idea of applying the knowledge of human awareness came into play. Challenges today’s cyber security managers face. How can you be safe if you are not secure? The key indicators to a healthy security culture. The influences that help to drive our decision-making and behaviour. Designing cyber security awareness and training with the human in mind. How to win over people to try something new. How hackers think. RESOURCES AND TOPICS FOR FURTHER STUDY MORE ABOUT ANDREW ROSE: Please subscribe to the podcast in , and if you enjoyed this interview, please share with your friends and colleagues and leave a 5 star rating and review. Thanks for listening and sharing. Bruce & The Re-thinking the Human Factor Podcast Team /episode/index/show/rethinkingthehumanfactor/id/14120975

Know your cyber security risks, with Prudence Smith 04/21/2020

Marketing Strategy Applied To Cyber Security with TERRY O’REILLY. 04/14/2020

Why we need to re-think the human factor in security, with Bruce Hallas 04/07/2020

Why we need to re-think the human factor in security, with Bruce Hallas Why we need to re-think the human factor in security, with Bruce Hallas Bruce Hallas sits in the hot seat for a change as Alexia of Marmalade Box grills him, for this: Series 3, Episode 4 of the Re-Thinking the Human Factor Podcast. Having received a lot of emails asking us for more information about Bruce Hallas, the host of this podcast, Alexia agreed to put Bruce through some viewer lead questioning in the hopes of delving deeper into his background and expertise. Having trained in accounting and law, Bruce started his work life in business development, outside the realms of tech, and found himself passionate about security awareness and human behaviour. Via a series of questioning, 7 years ago Bruce was lead to his groundbreaking research that lead to his book ‘Rethinking The Human Factor’. Apart from his work as a researcher and author, he also runs Marmalade Box, a company dedicated to helping organisations cultivate and design a positive security awareness by raising awareness and influencing behaviours. Bruce is an expert in reducing risk and helping companies design security processes that reduce the guesswork from the human factor. We know you will enjoy listening to how and why Bruce is so passionate about his chosen occupation and how you can benefit from his vast understanding. AS YOU LISTEN TO THE EPISODE, IF YOU FIND YOURSELF WANTING TO IMPLEMENT SOME OF THE INSIGHTS YOU’RE GAINING BUT YOU FEEL YOU NEED A LITTLE HELP, PLEASE DO GET IN TOUCH WITH ME AT: JOIN BRUCE HALLAS AND ALEXIA AS THEY DISCUSS: The questions Bruce asked himself when he started his research journey. How understanding the human factor allows for better engagement. Breaking down the entire system within information security to better the process. The Analogies Project and how analogies help in shaping culture and behaviour. Who benefits the most from the Rethinking The Human Factor research? Designing with the human in mind. Does evidence point to the validity of the frame work created from the research done in Rethinking The Human Factor? The importance of establishing a cohesive vision as an anchor. How personal values influence culture. What can my organisation do to benefit from this? RESOURCES AND TOPICS FOR FURTHER STUDY Nudge by Richard H. Thaler The Power Of Analogy by Dieter Wanner MORE ABOUT BRUCE HALLAS: Please subscribe to the podcast in , and if you enjoyed this interview, please share with your friends and colleagues and leave a 5 star rating and review. Thanks for listening and sharing. Bruce & The Re-thinking the Human Factor Podcast Team /episode/index/show/rethinkingthehumanfactor/id/13281038

Taking risks to reduce risk, with Eric Ravello 03/31/2020

Simplifying Cyber Security, with Neil Frost 03/24/2020

The Accidental Security Specialist, with David Shipley 03/17/2020

The Accidental Security Specialist, with David Shipley The Accidental Security Specialist, with David Shipley. Living up to our promise to bring you fantastic guests, David Shipley joins us for Series 3, Episode 6 of the Re-Thinking the Human Factor Podcast. Time to go phishing so grab your rod. David is a self professed accidental cyber security professional, but has spent time as a soldier, newspaper reporter and marketer. After a cyber hack within his company occurred, David grew increasingly interested in cyber security and was asked to take on this role within his company. Currently based in Canada, David is an award-winning entrepreneur and head of Beauceron Security. Beauceron's holistic approach to measuring and reducing cyber risk brings together threat intelligence, user education and awareness, simulated attacks and real incident data into an easy-to-use and deploy cloud platform that transforms cybersecurity from an IT-centric issue into a pan-organization management opportunity. AS YOU LISTEN TO THE EPISODE, IF YOU FIND YOURSELF WANTING TO IMPLEMENT SOME OF THE INSIGHTS YOU’RE GAINING BUT YOU FEEL YOU NEED A LITTLE HELP, PLEASE DO GET IN TOUCH WITH ME AT: [email protected] IN THIS EPISODE, DAVID SHIPLEY AND BRUCE HALLAS DISCUSS: The sheepdog effect. Turning the cyber victims into defenders. Empowering the person. The importance of driving behavioural reinforcement within a culture to keep positive cyber security behaviour thriving. Getting the metrics correct- Repeat clickers and what we can learn. Taking the time to make sure people really retain new cyber security-related information and behaviours. Phishing fallibility: Is someone’s emotional state a factor to be considered? The 8 emotional scale. Fear response, social hi-jacking and engineering. How time affects people’s behaviour during a 24 hour period. The power of keeping calm. Speed can often be your enemy. The Power Model - what it is and how it can be used to boost cyber-security awareness: People, environment, actions and resources. Creating an easy to use protocol to gauge involvement. Learning from each other. Building a solid support structure. Black box culture - going deeper into more effective cyber security training: Talking about issues without laying blame. The story of the mayor that got phished. Learning from mistakes in proactive ways. Rewarding right behaviour. Scoring people and then helping them improve their performance within the security culture. Compliance: Exceeding compliance via relative, contextual, timely informative videos. Treat your audience like adults. Using Surveying as a tool to generate better metrics around risk and awareness: The importance of your baseline and the importance of a good survey. How does bias affect survey answers and are there ways around it? Using video responses to surveying to offer training in weak spots and offer guidance and support to colleagues. Start a positive feedback loop. Phishing attacks and data strategy. Data gathering from ‘time to click’ data proves to be very fruitful at limiting risk. Huge amounts of data are available to be mined to design cyber security awareness and education pieces that change behaviour. Having a strategy for data gathering is crucial. Learning when people click leads to a defined process towards a positive security culture. Cyber Security Marketing. The same tools that marketing applies can be used when trying to form a new culture of awareness within a business. What is a KPI clash? Where is the cyber security industry failing? Not enough focus on the human factor. Not enough funding for training. Real meaningful change comes with data and planning correctly Data driven decision making around security awareness. The need for sharing resources exists to help strengthen the entire security industry. RESOURCES AND TOPICS FOR FURTHER STUDY MORE ABOUT DAVID SHIPLEY: Please subscribe to the podcast in , and if you enjoyed this interview, please share with your friends and colleagues and leave a 5 star rating and review. Thanks for listening and sharing. Bruce & The Re-thinking the Human Factor Podcast Team /episode/index/show/rethinkingthehumanfactor/id/13568387

Designing Learning Experiences That Stick, with Megan Sumeracki 03/10/2020

Designing Learning Experiences That Stick, with Megan Sumeracki DESIGNING LEARNING EXPERIENCES THAT STICK, WITH MEGAN SUMERACKI Megan Sumeracki joins us for Series 3, Episode 5 of the Re-Thinking the Human Factor Podcast. Megan Sumeracki is an Assistant Professor at Rhode Island College. She co-founded the in January 2016 with Yana Weinstein. Megan received her Master’s in Experimental Psychology at Washington University in St. Louis and her PhD in Cognitive Psychology from Purdue University. Her area of expertise is in human learning and memory, and applying the science of learning in educational contexts. WHAT'S THIS EPISODE ABOUT? As cyber security practitioners, we often ask ourselves the question of how we get people to remember to do the things we tell them to do. How do we get them to retain what we teach them in our trainings? Well, you’re in luck. This conversation is full of treasures to do with how our brains work when learning and strategies (based on scientific evidence) that can help you create training situations where the information will be more likely to stick. Side Note -- We touch a lot on something called Retrieval Practice. Retrieval practice is simply a strategy in which bringing information to mind enhances and boosts learning. It’s about deliberately pulling what we’ve learned back out of our heads to examine it. Megan addresses empirical questions such as: What retrieval practice formats promote student learning? What retrieval practice activities work well for different types of learners? And, why does retrieval increase learning? AS YOU LISTEN TO THE EPISODE, IF YOU FIND YOURSELF WANTING TO IMPLEMENT SOME OF THE INSIGHTS YOU’RE GAINING BUT YOU FEEL YOU NEED A LITTLE HELP, PLEASE DO GET IN TOUCH WITH ME AT: BELOW IS A MORE DETAILED OUTLINE OF WHAT MEGAN AND I DISCUSSED: Understanding how we learn information and how we apply and remember it. The goal of education is to teach students how to learn and retain information so they can use it in the future. The key words: Learn, memory, retain, apply. Even though a student needs to pass exams and get grades, it is more useful to retain information and are able to apply it in the future. Standardised testing could be improved as education needs to create a new behaviour rather then just stored information. Creating tests that mimic the real world can help people retain and then use new information. Data driven approach. Just because we enjoy certain methods of learning does it mean it will help me retain any new information? Challenging the way we learn can push us towards more durable learning processes. Instinct and intuition do not answer the question of education necessarily. Building effective strategies. Why cramming does not relate to long term memory of a topic. Understand what it is that helps people learn and retain information over a longer period of time. Retrieval practice bringing things to mind, spacing practice, spreading learning over a period of time. It is difficult to predict an individual way of learning rather then a larger group on average. Confirmation bias can muddy research waters. Expecting to see something can create patterns. Finding ways to remove bias such as breaking a theory down to disprove it. Results free of bias lead to stronger data. Spacing and retrieval. Spacing and retrieval have been around since the 1800s and used repeatedly. How the true value of all knowledge and understanding is application. The art of communication. Student driven research into learning through accessibility. What other misunderstandings do people have around learning? Designing with the human in mind. The cognitive process. Getting the information in is only one step, you have to be able to get the information back out and apply it. Retrieval cues and how they help. The importance of finding ways to bring back to mind recently learned information to help it stick. Bridging the gap from study to new awareness and understanding. Situational awareness building can help develop new behaviours. Encoding information does not necessarily lead to retrieval. Storytelling as a way to help retrieve new information. Holding interest to hold attention. Does interest really govern retention? If a person likes engaging they will likely engage more with a topic or action. Attention span can often be affected by external influence like eating breakfast and rest. Bite sized learning spread out over a longer period can aid retention. Sometimes ’seductive details’ can be distracting even if entertaining. RESOURCES AND TOPICS FOR FURTHER STUDY FIND MEGAN SUMERACKI ONLINE: Please subscribe to the podcast in , and if you enjoyed this interview, please share with your friends and colleagues and leave a 5 star rating and review. Thanks for listening and sharing. Bruce & The Re-thinking the Human Factor Podcast Team /episode/index/show/rethinkingthehumanfactor/id/13425500