How narrative-based learning can improve your awareness strategy?

Photo by Hulki Okan Tabak on Unsplash

Introduction

If the last couple of years taught us anything, it was that things change, unexpected things happen. Any security practitioner will tell you that security threats are always evolving. It’s clear that efforts to make end users aware of threats, to protect themselves and their organisations, must keep up.

We need to keep people up to date, but also to seize upon teachable moments when available.

What is narrative-based learning?

“Narrative[-based] learning is more than learning through stories. It’s also a way of conceptualizing the learning process. When we are learning something new, we’re trying to make sense of it, to figure out its internal logic and how it’s related to what we already know”
Clark, M. Carolyn and Rossiter, Marsha (2008). "Narrative Learning in the Adult Classroom," Adult Education Research Conference. https://newprairiepress.org/aerc/2008/papers/13

People love a good story. In fact, narrative-based learning is increasingly seen as being highly effective at increasing comprehension. And opportunities to draw on real life situations and stories are rife – offering the potential to highlight security threats in a relatable way. Also, using reported phishing emails, you can highlight specific threats to your organisation; through to highlighting security incidents reported in the media and elsewhere.

Simply reviewing the NCSC’s threat reports for the last few months provides stories on things like:

• • Malware masquerading as legitimate Google Play Store  
  • Twitch confirms large scale data breach
  • Data breach hits millions of customers
  • Ransomware attacks against hospitals have real-life consequences
  • Data of 106 million visitors to Thailand breached

   

These stories represent great opportunities to engage people with topical content, relevant to both work and personal security. But, as a security awareness or security practitioner, how can you best make use of this?

How to deliver the narrative?

To deliver a great story you need to choose the correct channel. We have investigated a few of the more common learning platforms and here’s our findings:

We’ve asserted before that Security Awareness needs to adapt. Gone are the days when an annual awareness course will cut it. Traditional channels struggle as mechanisms to deliver the sort of timely content that is needed. Which would seem to be a real missed opportunity unless we can….

…Find a new channel

The challenge here is to be able to adapt quickly, minimise impact on staff (giving them short snippets of information and a choice over when to engage), win the competition for attention, yet still pass on those key pieces of actionable advice.

And it is possible. We’ve seen engagement levels of greater than 90% with content that:

• Is pushed directly to users, although still allows them to choose when to engage.
• Can be updated in near real-time.
• Interleaves interesting, intriguing, personally relevant and topical security content, with more corporate focused content.

Security Awareness need not always be a rigid compliance-based syllabus. A key part of the battle is to engage users and get them thinking about security and secure behaviours in any (and all) aspects of their lives.

Topical and relatable content offers the potential to do this. And a new channel, such as that provided by Redflags™, offers the ability to deliver that content. Right content, right time, right way.