Eliciting Intrinsic Motivation and Reframing Problems, with Rachel Lawes
Re-thinking The Human Factor with Bruce HallasShow Notes
Eliciting Intrinsic Motivation and Reframing Problems, with Rachel Lawes
Rachel Lawes joins us for Episode 22 of the Re-Thinking the Human Factor Podcast. Rachel gave a fantastic interview back in Series one of the podcast, and if you haven't had a chance to listen yet, please check it out here when you're able. We've received feedback from a few people recently about how they were really blown away by what Rachel had to say about semiotics as well as how she spoke more broadly about branding, behaviour, and the role of semiotics in behaviour and culture.
Rachel is the author of some of the earliest published papers in semiotics and she's proud to have been involved at a time when it was first emerging in the UK. She uses it, and her academic background in social science, to rejuvenate brands, innovate products and services and steer comms. She conducts research projects using semiotics, ethnography and discourse analysis. She delivers training for client side and agency users, and she supplies consultancy to ad agencies and large branding agencies. She also works with universities because she loves to teach.
"People are shocked at what they fall for when they think they're actually defending themselves…"
JOIN RACHEL LAWES AND BRUCE HALLAS AS THEY DISCUSS: Some clever and engaging videos created by airlines as well as one created by Burger King that featured Snoop Dog, the difference between having an engaging comms piece vs. one that actually elicits behavioural change, and budget issues many cyber security awareness professionals are up against when it comes to the creation of engaging awareness materials. Thinking of Security as a product, almost from a branding or marketing sense. The fact that humans get used to information they see over and over, so it is important to consistently apply innovation to crafting awareness and training materials. Film, audio, visual approach to creating awareness and training campaigns and whether or not there's a better way to accomplish the same goal.
The use of incentives within awareness and training campaigns - do they work? If not, what's a better way to elicit engagement and behaviour change from campaigns? Extrinsic vs. intrinsic motivation, and which is more effective in catalyzing behaviour change. How science has shown that intrinsic motivation is more long-lasting than extrinsic motivation, but for many organizations, a good portion of their awareness budget is spent on incentives, which are extrinsic in nature. With budgets being an issue, would it not be better to spend the money on something that would have an intrinsically motivating effect? It's possible that incentives have their place to accomplish short-term, tactical awareness measures. However, heads of organizations must be communicated with regarding the short-term nature of the incentives program for which they they are approving money, and they also need to know to be prepared for the need for longer-term, intrinsic measures to be funded. The fact that some operate on the model that use of fear, uncertainty, and doubt as scare tactics are going to get people's attention (a practice based on a study of Maslow's "Hierarchy of Needs" concept). Rachel has a different take on this, though, and health campaigns geared towards getting folks to stop smoking stand as a shining example of what she has to say. Bruce also posits that instead of fear, cyber security professionals should create policies that are easier to accomplish than those that were enacted previously. Alleviating friction, alleviating the heaviness (fear / uncertainty) of a policy actually increases the likeliness of compliance.
The environment in which people are making decisions about whether or not to comply with a policy will have triggers. Those triggers, when they are triggered, are going to increase the likelihood that people aren't going to choose to comply. So, understanding the environment first, and understanding that we make
More from Re-thinking The Human Factor with Bruce Hallas
In this episode we re-visit an earlier theme explored in this series. The theme of mesurement and metrics. The question of how to measure awareness, behaviour or culture is something we consistently come across here at Re-thinking the Human Factor when exploring opportunities to work with clients. There's an palpable feeling, across industry chatter, that there's a real lack of maturity when it comes to how we demonstrate the effectiveness of our effrots to influence employee awareness, behaviour and culture. However, there is hope. In this episode I talk with Bernie Smith. Bernie has a focus on KPI's, not just your standard range but also he brings ideas about how you might create new metrics as well. We discuss his view on the development of metrics and how metrics can help not just measure performance but ultimately influence behaviour and shape culture.
In this episode we take a peek at the role of the security teams' own culture and its impact on the broader organisational culture. This, is an important perspective, because whilst many commentators focus on influencing organisational culture they haven't considered the role that the value and behaviours of the security team has in influencing positive security outcomes across the business. To help us explore this perspective, on cultural forces at play, we have a guest who knows a thing or two about how cultures are formed and influenced. Lianne Potter studied in social anthropology, then geeked out on technology before combining the two to shape an industry career which has achieved numerous accolades for her thought leadership in not just the human factor but also information security generally. Lianne, for me, illustrates a small, but growing force within the industry that recognises that the human factor needs to be repositioned not as an after thought once all the work of designing security controls has been done, but as a critical and key part of the process of understanding and managing information security risk. ©Copyright Marmalade Box Limited The content of this podcast is the property of Marmalade Box Limited. Any use of the content of the podcast, either in full or partially, will be considered an infringement of Marmalade Box Limited rights as sole owners of this content. Any enquiries about the use of this content should be directed to Marmalade Box Limited. Contact information can be found at www.marmaladebox.com .
If you're a regular listener then you will have already met today's guest Dr. Char Sample. Char is a force at work deep within the information security community. Char is a rarity, combining a deep knowledge of both the technical and human aspects of the challenges security professionals face when managing cyber security risks. Char and I go back a long way, to a horrible conference lunch in London, where her riveting conversation meant I didn't have to eat what was on the plate in front of me. I have been forever grateful. That riveting conversation was all about our shared understanding of how culture influences everyone's day to day behaviours and how everyday behaviours make up culture. That shared interest has led to many conversations and shared ideas about how the information security industry could step up a level by seeing the potential for improving how we assess and manage human factor risks. In this episode we capture one of those conversations. We talk about heuristics and biases, what they are and what role they might have in artificial intelligence. Why what makes us human often makes us behave in seemingly irrational ways even when presented with all the data we need and assumptions we frequently make when developing and designing systems and processes and how this is undermining the management of business risks. Be warned, there's a lot of laughter in this episode.
In this episode we are joined by a guest who has committed their career to the world of advertising agency work. Influencing target audiences awareness of products and stacking the odds in their clients favour, that the target audience will choose their product over their competitors. The challanges our guest has faced, over the years, are in many ways similar to those that education and awareness managers, for information security and data protection, now face.