but hi um it's gonna be pretty tough to
follow gabe um what i heard of gabe so
it's pretty sick so let's have a go
anyway
um i'd like to start with a question
uh but let's stop i'm not i'd like to
ask you how many of you are completely
up to date on your organization's
mandatory training
so whether that's your fire safety your
hr your manual handling blah blah blah
how many of you are completely up to
date on that training
and please put your question please put
your answers in the chat
so hi my name is oliver bets richards
and you won't remember me from any
other information security conferences
but i'm an information security analyst
at the university of derby
i've dabbled in information security
awareness training for the last couple
of years now
much of that experience has been virtual
to drink covered times and i've done a
couple of in-person sessions as well
the aim of this session is to
give some advice and some practical tips
to help us with both of those settings
it shouldn't really matter whether we're
virtual or in person for this
because most importantly i want you to
join me
in making more impactful
interesting and resonating content
this won't be a self-deprecating talk
but the content is based on lessons that
i've learned and things that i feel i
could have done better
and if you want to find out more about
me
you can find me on the socials at the
foot of the deck i'm on twitter
discord
and linkedin
all that hail nolly
yeah
and if you have kind things to say
please join the conversation on twitter
and use the hashtag beercon3 as you can
see on the deck
and if you have unkind things to say
i'll still like to hear them but please
do dm me on twitter and i'm happy to
talk about anything in this conversation
so you're probably wondering why we're
even having this conversation if i'm
saying that information security
awareness training doesn't work
people are still clicking on phishing
links people are still giving away their
credentials
and verizon are still saying that most
breaches have some form of mysterious
human element to them
so you might think it's about how our
customers understand technology
but i think it's more fundamental than
that most people
don't understand what we're talking
about
most people don't understand our
terminology
and here's the kicker most people
probably don't care either
i know that information security is
important to you and me
it's just otherwise why would we be here
in the first place
it's just a lot less important for just
about everybody else and we need to
empathize with those people
because we see all the time that we're
busy that we're overworked
and reaching burnout but guess what
everybody else is just as busy as we are
and it's our job to inspire them to care
more
about information security as well as
the rest of the cognitive plates that
they're spending on the on the daily
all hope is not lost
i hope that this conversation
can give you some practical steps on to
help you build effective information
security awareness campaigns
and what i want you to take away from
this is that most people don't know
anything about information security
particularly most adult professionals
and they probably carry less and it's
our job to change that
and there's quite a lot of work to do
before we can even get started in our
campaign
and most of it doesn't even involve
information security but please stay
with me
planning an information security
awareness campaign is more than about
information security and how to
communicate with people
you need to have empathy with your
colleagues and you probably heard me say
empathy quite a lot during this talk
so that's one of the most important
things to me here
your colleagues have day jobs to do that
doesn't involve directly carrying out
information security and then most
likely is under resourced as we are and
they're being asked to engage with us on
top of all those things
i can't see the chat right now but i
know from my phone conversations at work
with others i know that a heck of a lot
of people are not up to date on their
mandatory training
so how on earth can we expect people to
engage with us and something that's
important to us
when we don't engage fully with
something that may be important to some
somebody else
oh crap
i've toggled through this fight sorry
sorry i've gone ready wrong here
we also need to remember that it's
horrifically difficult to do this alone
you need to identify who you need to
support you
and i'm very lucky to have supportive
colleagues around me on everything that
i've done on information security
awareness training you need to remember
that your campaign is a project
there's a start a middle and an end to
identify your learning outcomes
identify the narrative of your campaign
and identify what you want your audience
to get from your campaign
you need to
do a heck of a lot more planning than
just our to-do lists
you need to identify the who the what
the what
the why the when and the how
of what you want to say
and that's where a communications plan
comes in
we'll get more on that later
you need to remember that you're not an
educationalist
and that's not an insult i'm just
willing to bet that most people in this
conversation aren't trained educators
i'm not either
you need to remember that marketing is
important as well
you need to get your message out there
and i'm willing to bet that most people
in this conversation
aren't trained marketers either
to document all the skills you need to
put together your campaign and the
people you need to support you
the most important thing for me here is
to empathize with your colleagues and
try and think a bit beyond the
boundaries of information security
it's critical to know the skills you
need
it's also critical that you have some
content
and this is where we you need to think
about what's useful to your organization
you need to identify the risks
and challenges facing your organization
you need to remember that every
organization is unique
every organization has its own people
its imperatives its values
its cultures its politics every single
one is different
so there's a little merit therefore in
prioritizing talks about picking up usb
sticks in the parking lot when your
organization
prohibits using them
and similarly i think it's negligent to
avoid talking about securing paper files
if your organization gets through more
paper than the local library
so i need to think so you need to think
about your audience
i need to think about information
security and how it affects them and
their challenges
and that's where your educationalists
are your friends
your audience might not learn the way
you do
so reach out to them to help guide you
towards creating a campaign that will
engage as many people as possible
and document this as well this
information as well
it's critical to have your thoughts in
order
and most importantly
identify what your organization needs
and what your audience need as well
so we've got some great content ideas
you might think now's the time we can
probably start writing
i'm really sorry to say this a little
bit more thinking doing a bit more
exciting work we need to do first
you need a plan
in a plan that's got a bit more detail
on it than oliver plans to talk about
phishing emails today
you need a communications plan and
luckily for you i'm here to tell you
about what that is
this is where your project managers are
your friends as well
what are you gonna say
what kind of content are you gonna put
out
are you gonna put out presentations
articles screen savers digital signage
blah blah blah
what kind of content do you want to get
out there
who are you going to say it to
where are you going to say it how are
you going to say it when are you going
to say it
who is going to say it
it doesn't necessarily have to be you
doing all the talking
i strongly urge you to identify all the
communication channels you have in your
organization and rinse every single one
of them because we need to get our
message out there to as many people as
we possibly can
and this is also where your marketing
friends come in
marketing is much more than about
sales calls
from vendors pitching us the same stuff
over and over and over again
marketing will probably be your biggest
supporters
and they need to know there's a campaign
in the first place
and this way you have to empathize with
them as well because this is not their
day job
they've probably got heaps more
campaigns on the go as well whether
that's fire safety hr new new systems
blah blah blah they've probably got lots
of stuff on there on their plates and we
need to work with them to land your
message amongst the constant stream of
information overload
that your colleagues are experiencing
every day
and support them to get the word out
there and don't expect them to do all
the work
and document document document
the idea here is a working document for
your campaign now it's all going to take
shape
and the key thing i want to get across
here is the identity to rinse every
single
communications
channel that you have available to you
so we're about halfway through and this
is my rookie talks i'll be immensely
grateful for any feedback in the chat
like to know what i'm doing
i'll be very grateful for anything
you've got to say
and that's what halfway through i
thought we'd have a bit of a recap
because we've documented all the skills
that we need and the people we need to
support us and we've planned our content
we've got a communications plan
that maps how the campaign will all come
together
but there's a tiny bit more work to do
before we can get started
because it's one thing to have a great
campaign lined up it's one thing to have
a lot of great content
but unfortunately most people in our
organizations need some sort of
permission to do things
and that's where your awesome
documentation comes in
you need to sell this to your boss i
mean presumably they care about
information security so she'll be after
a good start there
and that needs to be sold to your boss's
boss as well
i mean hopefully they care about
information security so we might even
get a bit more traction there
but crucially
they can use their influence
to get a bit higher and a lot wider
they can help you get out into your
department
so in your iot department as well
because information security awareness
training isn't just for non-it people
they can also help you implement the
most senior people outside of iit
and engage your biggest stakeholder
group and that's your customers
because your senior leaders need to be
engaged and talk about your campaign as
well
because their employees their staff
spending time engaging with your
training takes away from their time to
do their day job and their managers need
to support this
so it's critical to get support for your
campaign and get the most influential
people on board
and this is a big milestone
so we've planned
an awesome campaign we've got some
awesome content lined up
crucially we've got the buy-in to launch
it so now it's time to put the content
together
please
please please lay off the fear the
uncertainty and the doubt because this
is no time for fear mongering
think about how often you've been
motivated to get out of there
and do your fire safety training when
you've seen an
incident on the news
and empathize again with your colleagues
you're fighting for their attention to
think about what they care about and
what you want from them
most people probably care about data
breaches as much as you do and i do
about how our expenses for example are
budgeted
when we go to conferences
never forget that people are giving up
their time
to engage with you
so produce content that most people can
understand
most people most adult professionals are
i don't think
can give a definition or working
definition of a finishing email let
alone a zero day vulnerability
and keep your content short and sweet
gravity is your friend
and make your content accessible
remember that not everybody who engages
with your content will have the same
abilities
so when you're doing presentations and
articles for example make sure your
images are descriptive alt tags or use
closed captions where you can like i'm
doing on this on this presentation here
now i have the benefit and a privilege
of a great mentor supporting me on this
talk
i also have the benefit and the
privilege of an amazing colleague to
support me
to get somebody to peer review your
content because we can spend hours
crafting the best articles the best
presentations
and we can miss all sorts of horrors
and so fresh eyes will always enhance
the quality of your work
and most importantly empathize empathize
empathize and make the content
accessible
never forget
that people spend the time with our
content it's time they're spending away
from other things they can be doing and
this
having this in the bank is another big
milestone because we've got our content
and we're ready to go
so we've got a great campaign lined up
we've got a lot of buy-in content in the
bank and we're ready to go
so it's time to get the content out
there
now it's time to talk about your content
now it's time to talk to your colleagues
about your content
it's under ask your colleagues to talk
to their their friends about your
content
because people need to know that your
message is out there
because you need to get your material in
front of as many eyes as you can
so get yourself out there and present
present present
people need to hear about information
security in a way that resonates with
them and the way in which they can make
more informed
and more secure decisions about their
personal their personal lives online and
also when they're at work
and you are the key to that
because you are the ones that are
empowering people to make positive
changes to our collective security
postures
and the key from here is to get that
content out there as far and wide as
possible
because we have to make that change we
have to affect that change
and now that's a heck of a lot of work
going out the way and now it's time to
celebrate because this is a huge
milestone we've done a lot of work with
our colleagues and hopefully we've made
a massive impact
so it's really time to give ourselves a
bit of a pat on the back and celebrate a
little bit
so the contents out there
the article has been read the
presentations have been watched
and it feels amazing to share knowledge
doesn't it
but there's only one thing we have to do
it's one thing knowing we've put out
some awesome content but we also need to
know that we're not howling into the
void
you need to know if your audience has
learned anything and you need to know if
your campaign has made an impact
you need to know if it's worth doing in
the first place really
and there are some handy and quite easy
ways we can do this
you can invite comments on your articles
for example
we can encourage people to give feedback
during the presentations
or encourage them to fill out evaluation
forms after them
i've even done quizzes during sessions
just to get a bit of a gauge with how
our messages are getting across
and talk to people i think that's one of
the most important things here to talk
to people
invite all the feedback you can get
it's critical that we get every bit of
it so we know we're not howling into the
void and we're making a positive impact
on all of our collective security court
postures
so what are the key things i want you to
take away from this conversation that
we're having right now
i'm going to read these all from
clockwise from the top left
and that's what most people don't know
anything about information security and
probably care even less
and that that's not designed to be an
insult
it just in my experience most adult
professionals don't and it's our job to
change
that we need to empathize with our
colleagues and think beyond the
boundaries of information security
and the language that we use and the
approaches that we take
you to identify what your organization
needs
and what your audience needs from you
and to use all the channels that you
have available
it's critical to get support for your
campaign
from as far
and as high and as wide as possible
because we are the ones that are
empowering people to make positive
changes to our collective security
postures
and get feedback any way you can
it's important to know you're not
howling into the void and making a
positive impact
and that's been my lessons learned for
this conversation so thank you for
listening i hope you have got something
from the conversation we've had
um i'd like to give some thank yous out
and i'd like to thank stu coulson for
mentoring me through this experience and
giving me so many things to learn
i'm very grateful for all the time he's
given me and make sure you watch his
talk at five o'clock
i want to thank the beer farmers for
putting on this amazing conference and
accepting my presentation in the first
place
i also want to thank ed tucker and tracy
good for all the insights they've shared
with me as i've been developing this
talk
i want to thank my colleague rayna davey
for supporting me to deliver
every bit of information security
awareness content i've done
and
i want to thank my wife for her
encouragement and supporting me and
support for me during this experience i
wouldn't be able to do that without her
either
and most importantly i want to thank you
all for giving me your time it's been a
pleasure talking to you
and it's um and i hope that you've got
something from it
so make sure you stick around to hear
drew jones and he's going to help us
master blind sql injections i'm sure
that'll be great as well