behavior change wave to create security surfing the motivation · 2019-12-18 · 1 elevatesecurity...
TRANSCRIPT
![Page 1: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/1.jpg)
1ELEVATESecurity
Surfing the motivation wave to create security behavior change
Masha Sedova
Elevate Security
![Page 2: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/2.jpg)
2ELEVATESecurity
Built and ran
Salesforce trust
engagement team
Passionate about
transforming security
behaviors from “have to”
to “want to”
Co-Founder of
security behavior
change company
About Me
Computer security
meets behavioral
science
![Page 3: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/3.jpg)
3ELEVATESecurity
This presentation will explore:
■ Myths about influencing security habits
■ The behavioral elements of human beings
that can get to us to security behavior
change
■ Focus on motivation as a key element
“I want my employees to be better at security”
![Page 4: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/4.jpg)
4ELEVATESecurity
Myth #1Training will change behavior
![Page 5: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/5.jpg)
5ELEVATESecurity
Historically, the industry
solution has been to insist on
terrible “check the box”
trainings as an employee’s only
defense.
Training Doesn’t Work
15%Retention
95%of breaches are
caused by human factors.
![Page 6: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/6.jpg)
6ELEVATESecurity
Rethinking Communications
36.5 million adults in the United States currently smoke cigarettes
The problem must be in the method of delivering this information - right?!
We’ve been creative about ways to get information in front of people:
■ Videos■ Posters■ Newsletters■ Websites■ Talks■ Lavatories
![Page 7: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/7.jpg)
7ELEVATESecurity
Knowing Isn’t
Enough
![Page 8: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/8.jpg)
8ELEVATESecurity
Behavior Change Components▪ Motivation
▪ Ability
▪ Triggers
![Page 9: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/9.jpg)
9ELEVATESecurity
Behavior Change Model
By Dr. Bj Fogg
![Page 10: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/10.jpg)
10ELEVATESecurity
Myth #2People have to care about security,
all the time
![Page 11: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/11.jpg)
11ELEVATESecurity
Unrealistic Expectations
![Page 12: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/12.jpg)
12ELEVATESecurity
Behavior Change Model
By Dr. Bj Fogg
![Page 13: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/13.jpg)
13ELEVATESecurity
Security Action Can Be Simplified
Having secure passwords for all sites
Reporting suspicious activity
Stop tailgating
Remember 20 unique characters across 40+ sites
Install a password manager
Look up correct email, reporting guidelines &
send
Install a “Report” button
Social Accountability
Install a man-trap or in/out badging
HARD
EASY
![Page 14: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/14.jpg)
14ELEVATESecurity
What about things that are hard to do?
By Dr. Bj Fogg
![Page 15: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/15.jpg)
15ELEVATESecurity
When Does Motivation Occur?
Hard things require high motivation.
![Page 16: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/16.jpg)
16ELEVATESecurity
Naturally Occurring Motivation
MOTIVATION
TIME
EVENT
MOTIVATION
TIME
EVENT
Predictable Events Unpredictable Events
▪ Audits▪ Red Team exercises
▪ Breaches▪ Incidents▪ News events
![Page 17: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/17.jpg)
17ELEVATESecurity
Good leaders seizes crises to
remake organizational
habits. Charles Duhigg,
The Power Of Habit
![Page 18: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/18.jpg)
18ELEVATESecurity
Myth #3Money is a good motivator
![Page 19: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/19.jpg)
19ELEVATESecurity
Market NormsAssigning a monetary value to an exchange
Social NormsThe actions among friends that are not
based on money.
Dan Ariely, PhD Predictably Irrational
![Page 20: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/20.jpg)
20ELEVATESecurity
“Generating” Motivation
▪ Connect security to the things people
already care about.
▪ People are motivated by:Hope/FearSocial Acceptance/RejectionPleasure/Pain
People will do something because they matter, they are interesting, part of something more important.
Daniel Pink, Drive
PrideInterest
AchievementCuriosity
PraisePunishment
Money
![Page 21: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/21.jpg)
21ELEVATESecurity
Myth #4Shame/blame for bad behaviors is a good tactic
![Page 22: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/22.jpg)
22ELEVATESecurity
5:1Positive to Negative
exchanges
20%Of security teams have
positive recognition programs
Positive vs
Negative Motivation
![Page 23: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/23.jpg)
23ELEVATESecurity
Competition
Capture the Flag
Bug Bounties
How to Create Positive Motivation
Altruism
Feedback on their impact
Champion Programs
Access
Awarded points
Access to exclusive swag
Achievement
Recognition emails
Company-wide shoutouts
Status
Leaderboards
Top performer award
![Page 24: behavior change wave to create security Surfing the motivation · 2019-12-18 · 1 ELEVATESecurity Surfing the motivation wave to create security behavior change Masha Sedova Masha@ElevateSecurity.com](https://reader036.vdocuments.us/reader036/viewer/2022070621/5e3691bb2b584654cf7c01e1/html5/thumbnails/24.jpg)
24ELEVATESecurity
Takeaways
■ Motivation is required when something is hard to do.
■ First- make it easy. Second- rely on motivation.
■ Leverage naturally occurring events for motivation.
■ Connect intrinsic motivations to security motivation.
■ Negative feedback should be balanced with positive motivation.