Cybersecurity: Familiar, Controlled, and Successful

By Cathy Quon, Chris Harper, Kim Lewis and Sapna McCarthy

Kim Lewis – Emerson Client Director If you want to change behavior, including cyber safety behavior, you have to make familiar, controlled, and successful.

Cathy Quon – Emerson Vice President Well, familiar, you have to liken it something that people have experienced before. You have to provide them with context because naturally, people are going to think about comparisons.

If something is familiar, we decide it’s safe and we do it. Consider what you can make cyber safe behaviors feel like. Then create those comparisons.

Sapna McCarthy – Emerson Consulting Manager Think about the last time you tried a new food. You’re more likely to try it if it reminds you of something that you’ve had before and that you liked.

Kim Lewis – Emerson Client Director People are naturally going to compare the change and what you want to things they already know.

In construction, employees are used to wearing hard hats. It keeps everyone safe. So, if you’re in the construction industry, tell employees checking an email sender or hyperlink is like waring a hard hat. It keeps everyone safe.

Cathy Quon – Emerson Vice President What you want to do is exercise these behaviors in such a way that over time, they become habit. Repeating the cycle over and over again, it’s in their DNA, they really don’t think about it anymore.

Chris Harper – Emerson Associate Director We all work in an environment that changes and shifts often and when we talk about control, we talk about adding structure and predictability to the situation.

Cathy Quon – Emerson Vice President When they need to it is actually the situation that triggers the particular behavior. What is it that they need to do is actually the behavior itself. And how will they know that they’re actually successful?

It’s like planning an IT deployment. Think of this as a “behavior deployment. Tell people what they will experience and the steps to deal with it, so they feel in control.

Sapna McCarthy – Emerson Consulting Manager Tell people what they will experience in a cyber threat and how to handle it.

Chris Harper – Emerson Associate Director Recently I had to work with a major food manufacturer and obviously food quality and cleanliness is really important to them. So every time, whether it’s a leader or someone that works on the floor, steps out onto the production floor, the first thing they do is wash their hands. And the very last thing they do as they step off the floor is wash their hands again.

Cathy Quon – Emerson Vice President People need to know what to expect and what to do.

Kim Lewis – Emerson Client Director So make it the default, not the option for people that cyber safe behaviors are something they should do, want to do, and that it’s something they must do. Research shows that in order to adapt new behaviors, they need to feel successful.

Chris Harper – Emerson Associate Director But you can’t just hope for success. You actually have to engineer it.

Engineer Success: • Use your early adopters. • Get them to try new behaviors. • Have them share their success stories.

Kim Lewis – Emerson Client Director Do things where people can begin to create a habit in small and successful ways.

Cathy Quon – Emerson Vice President And those successes may be as simple as when they do something correctly online, they get a little popup message. Or you might want to have an all hands meeting where you recognize people who have accomplished specific behaviors.

Kim Lewis – Emerson Client Director If you want to change behavior, including cyber safety behavior, you have to make it familiar, controlled – man I was on it that time!