What are the most effective cybersecurity methods to engage stakeholders?

In the goal of "reading a room" I ensure to talk about cybersecurity in a way that's relevant to the group. I'm not afraid to use humor--because that's my style, and let's face it, sometimes cybersecurity is not the most exciting thing if you're not a cybersecurity expert. And let's not forget the most important thing--don't forget to tell them why they care! We can talk about technical issues until we are blue in the face, but if we need to clarify why they should care, we have not done our job as good articulators and storytellers.

Utilizing stories and scenarios to illustrate the importance of cybersecurity is an effective strategy. In my role as an ISO 27001 auditor, a crucial standard in the digital era, I've observed how these narratives facilitate understanding of complex concepts and raise awareness about the need to protect information. The standard not only establishes guidelines but also provides specific recommendations to address cyber risks, which is essential for safeguarding the interests of stakeholders. The pandemic has further emphasized the relevance of digital security, and ISO 27001 offers a robust framework to tackle these challenges.

Storytelling is like poetry; What's the delivered message behind the words connecting emotion with logic. Highly successful presenters practice the delivery of a message in privacy to an anonymous audience comprised of people we know, it creates a comfortable setting and allows us to hone our words. The result is a clear message with impactful delivery regardless if you're in a formal setting or conversational environment. Use practical and comparative analogies to outline a simplistic example, followed by

It is imperative to get your point across without using too many acronyms or jargon that an average person cannot understand. Often this means the speaker is not cognizant of the world outside of their respective area or at worst, doesn’t actually know what they’re talking about and are attempting to baffle the audience. Better to use stories anal analogies to describe the methods, techniques, and outcomes in ways the average person can understand.

Use T.E.D. in the reverse order. The TED method of conversation (Tell me about, Explain, Describe) is primarily used for helping to gain a better understanding of a situation, organization, problem set, challenge, etc. Using T.E.D. in the reverse order is equally effective when offering feedback and recognition. In this case it translates to 'Tell the Stakeholder how their input shapes everyones activities and why clear understanding is important, Explain the value of individual Stakeholder contributions and lastly Describe (recognize) how Stakeholders feedback compliments each other. Then use storytelling to bring it together.

In my experience, providing feedback and recognition to stakeholders is essential to strengthen the security culture. Continuous feedback allows monitoring their involvement, identifying areas for improvement, and offering appropriate guidance. Moreover, recognition, whether through certificates, badges, or gamification elements, acts as a key motivator to reinforce positive behaviors. In the context of ISO standards, managing the needs and expectations of relevant stakeholders becomes a comprehensive process to establish effective security guidelines and achieve continuous improvement.

Una buena estrategia además de la retroalimentación y reconocimiento, es invitar a los equipos de trabajo a reportar las posibles paginas en la red de la que se tengan sospechas en materia de seguridad. Publicidad enga?osa o repetitiva, correos o los mismos mensajes de texto con números telefónicos no certificados, podrían evaluarse en los reportes y ganar puntos por reportes de sospechas.

In my opinion, tailoring cybersecurity content to stakeholders is crucial for effective risk management. As an ISO 27001 auditor, communication should be adapted to stakeholders' needs, promoting awareness to manage and mitigate cybersecurity risks. Customizing content to different groups, considering individual characteristics such as learning styles or language preferences, enhances understanding and engagement. This adaptability is particularly essential in the ever-changing landscape of cybersecurity, ensuring a proactive approach to address emerging risks.

Speak at a level that the stakeholders understand. Using technical jargon or fear, uncertainty, and doubt (FUD) will do little to garner support from the stakeholders. Tell the stakeholders how it is in terms they understand, which may be risk and finance. Once you get the information to them in such a way that they understand, they become empowered to make proper decisions.

In my experience, inviting stakeholders to the table increases engagement, adoption and adaption rate of your cybersecurity program. I would normally give them a role as a cybersecurity ambassador of their particular area, and they attend my monthly team meetings.

In my opinion, involving and empowering stakeholders is a key strategy in cybersecurity. As an auditor, I consider it essential to educate stakeholders to promote awareness of security, their responsibilities, and the necessary actions to mitigate risks and achieve desired objectives. Active participation through champions, committees, or security networks, coupled with empowerment through responsibilities and adequate resources, fosters innovation and autonomy. This not only strengthens the security posture but also creates a cybersecurity culture rooted in collaboration and commitment.

Educated people feel empowered armed with knowledge to make better decisions. Education is an investment in communications and productivity, it's also continuous, people can only absorb so much at once. Be patient.

Es muy poco lo que se ve en este aspecto. Las empresas no estan formando y entrenando a las partes intersadas en ciberseguridad. Solo estan enfocandose en la seguridad física. Primero hay que hacer una evaluación de la ciberseguridad de la compa?ia, y allí si trabajar en las acciones para mejorarlas. Luego, la educación puntual frente a los hallazgos, y que esta sea de manera tan sencilla, que invite a las personas de manera automática a su interiorización. Puede ser en los entrenamientos de contratación de nuevos talentos, etc.

In my perspective, inspiring and influencing stakeholders is crucial to foster cybersecurity awareness. This achievement is realized by sharing compelling narratives that resonate with stakeholders' emotions, beliefs, and values. Influence is exerted by leveraging relationships, networks, and social proof to shape attitudes, opinions, and behaviors. Highlighting success stories supported by role models or influential leaders in cybersecurity is essential. This approach, based on my experience as an auditor, strengthens understanding and commitment to policies and procedures, ensuring the effective implementation of corrections and corrective actions in response to any findings.

Effective cybersecurity engagement involves regular communication, education, and collaboration with stakeholders. Implementing clear policies, conducting training sessions, and fostering a culture of vigilance can enhance awareness. Regular updates on threats, transparent communication about incidents, and involving stakeholders in decision-making contribute to a robust cybersecurity framework.

Yo considero que si hay políticas de seguridad cibernéticas en la organización y tenemos un equipo de trabajo sólido, con claridad en la forma de trabajar, con educación en el área de ciberseguridad, de seguro podemos conseguir una cultura de confianza en la red. Seguimientos constantes y verificación de amenazas oportunamente y periódicas.