Storytelling in cybersecurity: The impact of a great story

[00:00:00] CS: Welcome to today's episode of the Cyber Work with Infosec podcast. For 12 days in November, Cyber Work is premiering a new episode every single day. In these dozen episodes we'll discuss security awareness essentials, hiring best practices, career strategies, team development. And in today's episode, you'll hear about the ways that cyber security intersects with the art of storytelling.

Our guest today is Sarah Moffatt, a talent development expert, leader coach and speaker. Her passion in life is working to empower and excite people about the practice of security. Steve jobs once said, “The most powerful person in the world is the storyteller. The storyteller sets the vision, values and agenda of an entire generation that is to come.” But it's not just the C-suite who has the power. Everyone has access to the power of storytelling to enhance security awareness. And if you stick around for this show you'll find out how.

We hope you enjoy this 30-minute presentation with Sarah Moffatt along with host Kristin Zurovitch. If you want to learn cyber security or move up the ladder in your career, we're giving all Cyber Work listeners a free month of access to hundreds of courses and hands-on cyber ranges with Infosec Skills. Infosec Skills is aligned to the work roles, knowledge and skill statements in the NICE workforce framework and can help you out at any stage of your career. Be sure to use the code cyberwork when signing up. More details can be found in the episode description. Catch new episodes of Cyber Work every Monday at 1PM Central Time on our YouTube channel for video or on audio wherever you like to get your podcasts. And now let's start the show.

[00:01:40] SM: I worked at HHS when the news hit about migrant children being detained at the borders. Officials were doing their best to accelerate the legal proceedings, but the logistics and all of those issues were really slowing down the process and the crisis was really getting worse by the day. And that's when my friend Lisa stepped up. Lisa worked in the Cyber Security Operations Center doing communications, and when she heard about the issues they were having at the border she just jumped into action. She came up with a networking strategy. She assembled a team and they literally just flew down to the border. Pretty neat, right?

So she and her team set up an entire set of virtual private networks, encrypted, protected, and what it did was it allowed the children immediate access to attorneys across the country, to judges across the country that could adjudicate their cases to get them reunited with their parents much faster. Lisa's quick work, her innovation, her take charge attitude made a huge difference in the lives of countless children and their parents. I mean, talk about having a monumental impact using the power of cyber security and technology. And this is why we need more women, more creative thinkers, more diversity in the field of cyber security.

When you're telling a story, what you want to think about first is where are people right now? And then you want to think, “Where do i want them to go?” And this is the most basic explanation of how storytelling works in cyber security and in business. My friend Pete always says, “Numbers tell, stories sell.” And why is that? It's because we are hardwired for stories. You and me, we are. Our instinct to listen and tell stories is literally a survival skill that we have had since humanity started. We are narrative beings. It's how we all make sense of the world. So what's important now is to recognize that storytelling isn't just essential survival skill. It's an essential business skill. It's how we brand ourselves in our companies. Stories are literally the foundation of how our companies communicate who they are and what they stand for. And stories are how we can overcome barriers including technology barriers.

Telling a story can be a crucial element of bridging skill gaps, communication gaps, funding gaps, training gaps and human gaps and understanding. So what I do is I call storytelling the soul of technology or the soul of cyber security. How we implement stories can bring fresh air, a sense of connection, a sense of community to every aspect of business. So we can use stories in the C-suite with our boards. We can use stories to talk about technology and help bring more people into the field like I talked about at the beginning of the session. The thing is, is that storytelling is the most ancient gatherer of people.

Millions of years ago, man created fire. And yeah, sure, it allowed us an opportunity to get warm, to cook our food, but what it did was it brought people together and it created communities. And so Now I think of storytelling kind of like in its business renaissance. And I want every single person watching, I want you watching to understand that you can be a storyteller even if you don't think that you're super creative. I want to empower you to find your own stories in your own voice and give you a path forward, whether you're briefing your senior leadership or trying to explain to your daughter what it is that you do for a living.

So over the next 20 minutes I'm going to share with you some of the things that I've learned from being in technology for 17 years, from being the daughter of a novelist and also the daughter of a senior systems analyst. And I also went through the TED Master Class Training and I have developed and delivered a TED Talk on the TED stage at TED headquarters in New York City. So I'm bringing all of this to you guys to hopefully inspire and empower you. And to remind you that it's not people, or armies, or gold, or flags that unites people, it's stories. There's nothing more powerful in the world than a good story. And think about that. That's so true. Nothing can stop a good story. Even when you hear a story that's not true, you just want to tell it. And when you find out it's not true, you still kind of tell it anyway. Nothing can defeat a good story. Nothing can top a good story.

So in business, a good story creates breakthroughs and it helps people imagine the future today. It can create like a collective vision for what we're doing and help bridge the gap for our clients, for our customers, for our stakeholders, and help our organization grow. And the important thing to remember is if you lose sight of your story, of your business's story, of your team's story, of your personal story, you're going to lose sight of who you are, because again we are narrative beings. And so stories allow businesses and organizations and individuals to distill complexity through something really compelling so it becomes simplified. It becomes adoptable. It becomes an emotion and it can bring fresh perspective that brings energy to what you're doing.

So when we're thinking about creating narratives, we can create breakthroughs. We can share a vision and it helps us keep sight of who we are. But stories also can allow us to create narratives for how or why something works. And I just want to give you a couple quick examples. You've most likely heard the story of Little Red Riding Hood, right? Red's out for – She's getting ready to go out for a walk. Her mom says, “Stay on the path. Do not leave the path. Go straight to grandma. Don't talk to anybody.” So there goes Red down the path. She runs into the wolf, and she and the wolf have a conversation. And throughout the conversation the wolf learns a couple key pieces of information, because he's asking some pretty good questions. And he learns where grandma lives, because Red gave away her personally identifiable information. He learns that grandma's sick because Red gave away grandma's personal health info.” The wolf is able to use this information that he got through social engineering to get this information from Red. And then he did one more great manipulation trick that we all know. We know it in the real-world, and now we know it in the virtual world now is he said, “Hey, you see that field over there? It has beautiful flowers in it. Don't you think your grandmother would love them?” And even though Red knew she wasn't supposed to go into the field, even though you're not supposed to click the link, she went and did it. And while she was distracted, the wolf hit grandma.

So I'm able to take the story that we all know we've heard a million times and I get to use it to help people understand what social engineering is, right? A good narrative can help create a breakthrough. It can help overcome complexity. When I was a kid – Here's another good one. When I was a kid, I had a secret passphrase with my mom so that if somebody came up to me on the playground at school and said, “Your mother's been in a car accident and I have to take you to the hospital.” Then I would know if they were not a kidnapper, basically. So I would know they were not a kidnapper if they said our secret passphrase, which was, “Hello. My name is Indigo Montoya. Your mother's been in a car accident. Come with me to the hospital.”

I knew about passphrases way before we had a computer. And you knew about passphrases way before you had a computer, because your parents taught you how. And so now I get to use that story to help people understand that we've been using passphrases forever. It's, again, something we know about in the real world that we get to apply to the virtual realm. So that's a cool way that stories can really impact business and really impact the bottom line. But also, stories can create or break trust.

So some of you on the phone are working in talent development and you're probably looking for ways not just to recruit, which you could use the Lisa story for a great recruiting story. But you're also looking for ways to retain your talent, to build the culture. And so it's really important to recognize that stories are integral to how the culture is founded. Stories are how you brand yourself, whether it's your personal brand or your company's brand. And that's why I say you've got to keep sight of what are the stories you hear about the company. What are the stories that you hear about leadership?

So for example, if you hire me and you say, “Sarah, I have an open door policy. I want to hear your ideas. I will always um make sure that you get credit for your work. And let's work together. Let's be innovative.” And then I go back and your team tells me, “No. I gave her my ideas once and she took them to senior leadership and she said they were hers and I never got any credit for it. And now she won't let me talk to senior leadership.” Well, that story just completely undermined all of the other stories I heard about the company. You see how stories can really be the foundation for doing good business, building good culture or recruiting and retaining great talent or teaching people cyber security for great for gaining budget. If you tell a great story in the board room, if you tell a great story to your boss about why you need more money.

So there're things that we can do to share company values, to make or break trust. But it all starts with an idea. And the question at the beginning that I asked you was or the explanation that I gave was a story is basically figuring out where people are where you want them to be. And what you're doing is you're building an idea into their mind. When I think of a story, I imagine it impacting one person. Who's the one person I want to move from here to here? But when I tell the story sometimes about Lisa and HHS, I imagine I'm telling the 20 year old Uber driver that I had in San Antonio. She's 20 year old Latina. She was working in IT. And when I talked about cyber security she said, “I could never do cyber.” I said, “You don't think you could.” And I told her the story. And all of a sudden this girl recognizes that cyber security isn't a bunch of ones and zeros. That she can actually use it in a humanitarian way.

So when I tell the story, I've got that one girl in mind. When I tell the story about Indigo Montoya, I'm telling that story to a protective parent and helping him see how cyber security is founded on real-life stuff that we already knew as kids. And that dad had a passphrase and now he can go and teach his kids about past phrases in a whole different way. So what's the idea you're trying to build in someone's mind? Whose mind is it? Are you trying to help your leadership understand why your department needs to move under a different leader or have a better alignment? Are you trying to share with your staff something that's really going to engage them and help them find greater meaning? So you've got to have an idea, an idea in your mind, and then you've got to let that idea sort of bump into other ideas.

And there's different ways that that can happen. So have you ever had like a small idea in the back of your mind and then you watch a movie or listen to a podcast and all of a sudden, “Oh! That's what I'm going to do.” That's what I mean when I say ideas bumping into each other or ideas colliding or acting on a hunch. So there's kind of three ways. There's recurring patterns where you've got these like slow hunches and they take time to evolve and they're sort of in the background. It's like the thing you're kind of thinking about when you're gardening or in the shower. And then you've got another kind of small idea and then all of a sudden those ideas come together and you've got the aha. Or at the beginning of a meeting, you might be listening to somebody else talk and they might say something and you might say, “You know, I was thinking about something like that.” And the two of you share your ideas, and those ideas collide together and they create a bigger idea. Aand you get that by going out to coffee with your buddies, or joining a mastermind, or talking to your mentor. So letting your ideas collide with others.

I'm just going to pause here for a second and say, “I know many of us are remote.” I mean, we're actually even having this whole conference remote. But remember to take time to connect with other people. If you are hosting a meeting, don't just jump into the meeting. Take a couple seconds to like chill and talk with other people before the meeting starts. That's how innovation happens. That's where ideas come from. So don't let that time go just because we're social distancing. That's really important. It's part of humanity. Allows people to figure out stories and tell stories, just really important.

Okay, finally, you could be watching Harry Potter. This has happened to me more times than I would like to admit and all of a sudden I get a great idea, because Voldemort did something and I think, “Oh! That's what a social engineer would do.” I don't know. But you’d get ideas in funny ways. And once you get those ideas, the next thing that you've got to do is you've got to create a through line. And creating a clear and captivating through line is maybe the most important thing that you can do in developing your story.

So what is the exact precise line idea? Sorry. What is the exact precise idea that you want to build in your listeners’ mind? What's their takeaway? How will you express yourself in a way that's going to draw that person in? You might even think about how someone else is going to tell that story. So when I tell the story about Lisa and HHS and saving the kids at the border, you might retell that story and you might think – You might forget her name. You might forget what agency I work for. But you're going to remember the key concepts of innovation, technology, cyber security, reuniting kids, and that's because of the through line. The through line I pick for that one is minority women solve critical humanitarian issues through technology and tenacity.

If I was telling story in another case, I might say how cyber security can restore separated families. If I'm talking to my boss about needing to do better diversity hiring, I might use that minority women solving critical humanitarian issues, right? So there's different ways that you can tell the story using different through lines. So when I think about how I'm going to tell the story, again, I'm thinking about that one person I'm telling it to. I'm thinking about how that person might retell the story and I'm thinking about what they're going to feel through that story. And so that is what you want to kind of think about through your through line.

So you've got your idea. Know that you want to build it in somebody's mind. You've got a great through line that's going to really kind of get you in there. Your through line should be 15 words or less. You want it really succinct. Here's some other tips when you're getting ready to tell your story, when you're creating a story. Make sure you know your audience. I'm kind of beating this horse a little bit, but you’ve got to know who you're talking to. You just have to know who is that person whose idea you need to have that in their mind. Don't try to pack things into your story. Don't rush. It just jams everything up.

Figure out why what you're saying matters not to you, your audience. A lot of times we want to talk about what matters to us, because we want you to know how we're feeling. But when you're telling a story, it's not about how I'm feeling. How you're feeling. I want to tell you what's going to get you drawn in. So make sure you've got some real examples because that always works the best Cut back on your topics. Cover less for greater impact, right? And then when you think about that, let your through line be the filter. And so you filter out a lot of things that you might otherwise say. And I'll give you an example about that in just a second.

You've got the idea, you've got some tips. Ask yourself is this a topic that you feel really passionate about? And if you don't, don't try to tell the story. I needed more budget dollars for a project that I was working on. I'm not the budget girl. I don't feel passionate about budget. But my friend Helen does. So ask Helen to tell a story, because Helen's going to be really captivating because she understands the money and she's going to be able to tell the good story. Then I kind of tag on at the end. So you might not be the right person to tell every story. Make sure that if you're going to tell a story, you're passionate about it. Make sure your story is inspiring curiosity, right? You want people to feel things. You want them to be engaged emotionally.

So when you're listening to the story about Lisa and the kids at HHS, were you thinking like, “How did she get the VPN network in there? How did the kids get reunited?” There should have been questions that you had in the back of your mind. Inspire your curiosity. Great question to ask yourself as you're creating a story is, is the story a gift or an ask? It's okay to ask for something at the end of your story, but your story should not be taken away from someone. It should be a gift.

As humans, we want to learn new things. We want to have new ideas. So if your story is giving somebody an opportunity to feel something, to get a new idea, to come up with a solution, then your story is a gift. If you're just talking to talk because you finally have some time with your leadership and you feel like you got to make a point, that's an ask. So make sure your story is a gift. Make sure that you can explain your story well in the time that you have available. It's just really important. And you might think, “I only have 10 minutes. I only get to talk to these folks twice a year. I'm going to pack it all in.” Don't do that. You're not going to have the impact you want to have. You're just not.

Think about is your story fresh or is the information already out there? So like Little Red Riding Hood is obviously not a fresh story. We've all heard it a trillion times. But I made it fresh in the way that I told it. And the emphasis that I put in it and the emotion that I used and the cyber security twist. So make sure you're adding some freshness to your story and maybe tweak it a little bit for different audiences. Make sure that you're making it worth your time to come up with the good story and worth your listeners’ time. It's got to be valuable, okay? And then the last question is really important, is are you the credible person to tell this story? If somebody asks questions, can you give more information? Are you the right person to tell the story?

Okay. Solid through line. You've got the idea. You've got it all written out. You know it's a gift. You know it's fresh. You know that you're going to kill it when you tell it. Okay. The key to killing it when you tell your story is to practice, practice, practice. When I was getting ready to do my TED Talk, I practiced it on dozens of people. But I would only practice it with people that I could see. So I would only do it in person or I would only do it on the camera, because I knew there were places where I wanted them to react. And so I would only do it if I could see the reaction. And if they weren't reacting the way that I wanted them to in a certain spot, then I could tweak it a little bit. So practice where you can see people's reaction.

Plan your story again for an audience of one. If you can find somebody to practice with that is similar to that audience, that's perfect. Perfect. If you're delivering your story as part of a presentation or request to a board or if – Oh my gosh! If you're delivering it to kids, for sure, make sure you practice with a camera. So record yourself. It's painful sometimes, because we don't like to watch ourselves. You need to do it. So practice. Watch your facial expressions. So when I did my TED Talk, my TED Talk was modern mentoring. How to develop your roundtable as legendary as King Arthur's? And I'm telling the story of King Arthur before he's the king. He's got to pull the sword. That’s all I can say. And Arthur walked up to the sword and he pulled the sword from the stone. I could see my face. I could probably see her face if i tell it that way. Or I can say he looked around, and knowing that he was the strongest guy there, knowing that he was probably the least likely person, this 15-year-old boy to pull the sword from the stone. I mean, can you imagine what kind of brain waves he had to have going on in his mind to even try to pull the sword from the stone?

So there goes the scrawny kid up to the sword and he puts his hands to it, pulls this sword from the stone. When I can watch myself on the camera, I can see what I look like. I can see what my facial expressions are going to look like. Remember, people mirror your facial expressions. So if I'm smiling, you're probably smiling. If I'm going like this, you're probably like, “Oh! That's a weird face to make during a keynote speech.”

Anyway. So make sure that you're like watching yourself. And then finally, look for ways to cut back. My original TED Talk was 22 minutes. They asked me to cut it back four minutes. And I was like, “Oh God! This hurts so bad.” So I cut it back. Two days before the TED talk they asked me to cut it back four more minutes. The one that I ended up delivering was 14 minutes long. And what I had to do was I had to go back to my through line and then go to my script. And I scripted it, but I rehearsed it a bunch of times so that I had it down. And I went back to my script and I started to take out stuff that didn't tie directly to my message, and it helped a lot.

Okay. So this is from this book called Unleash the Power of Storytelling, this little graphic I've got here on the screen that you can see. So you've got your idea. You know your audience. You know the idea you want to share with them. Make sure you've got a challenge in your story. Every story needs a challenge. And make sure you've got a character that's going to overcome that challenge. That's super important. And then finally you've got to make sure there's resolution. Don't leave people hanging y'all. Don't leave people hanging.

A kind of cool thing that you could do though so you could tell part of the story, you could tell all about Arthur and he walks up to the sword. And I could pause there and I can say, “What must have been going for this?” And I can say, “Hey, have you ever been in a business meeting where you've got something that you know you want to say and your heart is pounding out of your chest and you're afraid to speak up and know you have to just like Arthur? So you can kind of leave them hanging for a minute, but you've got to make sure that you resolve it.

Okay. So I'm wrapping up to the end here. And I want to show you how a good story can be persuasive and influential. Stories are like a primer that nudge people in the direction that you want them to go into. Remember, you're planting an idea in their mind. So I could start off saying we only have this many percentage of minority women in the workplace. But that's not going to persuade you into action, because numbers don't persuade. Reasons don't persuade. Emotions do. And if I get straight to my point, it can come across as abrupt or abrasive. So instead what you want to do is you want to find a story that can kind of nudge people to start feeling a certain way and you want to you want to say things so that they can put themselves in the shoes of the character and let them feel some emotions. Remember, our brains want new ideas. So we make sure that we're giving a gift. So here's the way that I do this. And I learned this from a guy named Brendon Burchard. Affirm, aspire, affect. Three critical parts to your story.

So I'm going to tell the Lisa story again, blah-blah-blah-blah. She saved the children at the end. And I'm going to affirm what you're thinking talking to my leadership, okay? Listen, I know we have a terrific staff here. We've got really engaged workers. We've got some real problem solvers here, and I know that we have kind of a finite amount of money and resources for recruiting. I've affirmed where you are. I'm going to ask you to aspire. But wouldn't it be amazing if we could take just a little bit of that money and start to really – I want to just do maybe one or two recruiting events at historically black colleges or all women colleges, because can you imagine what our already great team would look like if we just infused them with positive energy from younger graduates back from socioeconomically diverse backgrounds, from ethnic backgrounds? I mean, can you imagine the problem solving power that we would have with that much diversity. If you hear how I'm talking about this, I'm using affect. I'm using emotion. I have affirmed where you are. I'm asking you to aspire to greater. I'm giving you a gift and letting you emote.

And what is happening here is that I am influencing you. I am teaching you how to think about yourself, others and the world around you, thinking about yourself, your company. We are already in a great place. This is how I'm affirming you. Now I'm asking you to think about others. Can you imagine what it would do for our team if we could bring on some great new innovative talents and diverse thinking? What that would do to the world around us? Can you imagine how our stakeholders would take that? Oh my gosh! The new products we could come with this really impact the bottom lane. We could serve our consumers so much better. That's what a story of influence does. It helps you affirm where people are. It gives them this idea. It allows the idea to grow into an aspiration. It teaches them how to think about themselves and the world around you. A good story is going to let someone see themselves inside the story and uncover need that they have help them translate that need into an action. If you can share your vision like this through a story in a natural way, get on board. It creates connection. It creates – That's what we want to do.

So I'm at the end of my session today. It flew by. I'm so grateful to Infosec for inviting me. And listen, I know you guys have another session to go to, but do me one small favor before you go. Something I said inspired you. Something I said gave you an idea. One of your ideas bumped into one of my ideas. So before you go to your next session, have a piece of paper or something and just jot it down. Just like take two minutes to jot down, because if you've got an impulse or a goal, you got to act on it right away. Do something physical right away so your brain doesn't kill your idea, right? So just get that idea down. Spend two minutes before you go to your next session and just start something really quick.

All right. So thank you so, so, so much for having me here. It's been a real honor. I want to invite all of you watching to email me any questions you have. My email address is right there, it’s sarah@leadingladies.co. Not .com. Co. I also would love for you especially if you are a woman to follow me on Instagram, LeadingLadiesCo is the Instagram handle. I am all about building community, all about inspiring and empowering women through a multitude of different ways. And then I also invite everybody to connect with me on Linkedin, linkedin.com/in/saraccmoffatt.

Thank you all so much. This has been just a divine opportunity. I hope that I inspired you. I hope that you'll go tell a great story. And I hope that you felt all of these ideas and it is inspiring you with a couple of your own.

[00:31:35] CS: Thanks for checking out storytelling in cyber security, the impact of a great story with Sarah Moffatt. Join us again tomorrow for our next episode; Why We Need to Rethink the Human Factor, featuring security awareness writer, consultant and podcaster Bruce Hallas, who you might have previously heard right here on Cyber Work. Bruce will crystallize and solidify some of the concepts we talked about and explain the importance of moving cyber security away from a have-to mindset, i.e, “I have to do this because my IT.t department said so,” and moving it towards a want-to mindset.

Cyber Work with Infosec is produced weekly by Infosec. The show is for cyber security professionals and those who wish to enter the cyber security field. New episodes of Cyber Work are released every Monday on our YouTube channel and at all the places where you like to get podcasts. To claim one free month of our Infosec Skills platform, please visit infosecinstitute.com/skills and enter the promo code cyberwork for a free month of security courses, hands-on cyber ranges, skills assessments and certification practice exams for you to try.

Thanks for listening, and I'll see you back here tomorrow for more Cyber Work. Bye for now.