Storytelling in cybersecurity: The impact of a great story (with Sarah Moffatt)

January 4, 2021 by

Patrick Mallory

“It's not people, armies, gold or flags that unites people; it's stories. There's nothing more powerful in the world than a good story.” 

The power of a good story is not something you usually link to the highly technical field of cybersecurity, but Learning & Leadership Development Expert and Cybersecurity Training Manager Sarah Moffat begs to differ.

Should you pay the ransom?

Download The Ransomware Paper for real-world ransomware examples, mistakes and lessons learned.

Download Now

Just as in any other personal or professional environment, a good story has the power to break through and help people imagine what could be. This is exactly the message that Moffat shared with the audience during her “Storytelling in Cybersecurity” session of Infosec Inspire Cyber Skills Summit, tying her concept of storytelling into a story most of us have known since childhood, the fairy tale of Little Red Riding Hood: 

Stories can make cybersecurity personal

Moffat’s session immediately started with an example of the type of powerful cybersecurity message she hoped to guide her audience to do.

“I worked at the U.S. Department of Health & Human Services (DHHS) when the news hit about migrant children being detained at the border. Officials were doing their best to accelerate legal proceedings, but the logistics and all of those issues were really slowing down the process. And the crisis was really getting worse by the day.” 

And that's when Moffat’s colleague stepped up. “Lisa worked with the cybersecurity operations team handling communications and she just jumped into action. She came up with a networking strategy. She assembled a team. And they literally just flew down to the border.” 

Ultimately, the larger DHHS team set up an entire set of virtual private networks that were encrypted and allowed the children immediate access to attorneys and judges across the country so their cases could be adjudicated to get them reunited with their parents much faster.

As Moffat shared, it is this sort of intersection between cybersecurity and storytelling that can allow cybersecurity professionals to better communicate, collaborate and get the resources they need to fulfill their own mission.

The power of a story

Cybersecurity isn't really just about a bunch of ones and zeros. It is actually about using technology to accomplish something — a personal or organizational mission. Therefore, it is about how you can motivate and connect with others, with stories often serving as the best way to do so.

“The important thing to remember is: If you lose sight of your business' story, your team's story or your personal story, you're gonna lose sight of who you are. Stories allow businesses and organizations and individuals to distill complexity.” 

And one can use this power toward building a good cybersecurity culture, helping with recruiting, retainment, training or getting the resources that you need to accomplish your goals. “If you want to tell a great story in the boardroom, if you want to tell a great story to your boss about why you need more money, it all starts with an idea.”

Hear Sarah describe the way she crafts her story down to a single person here:

Just as when Moffat shared the story about her team at DHHS doing their part to help kids at the border, you might forget the names, the time, the place or the agency, but you likely won’t forget the underlying purpose. “You're going to remember the key concepts of innovation, technology and cybersecurity to reunite kids. That's the through line.”

Understanding your audience

Before you map out the story you are going to tell, you want to first think about where your audience is right now in their opinion or stance on the topic. 

“They always say ‘numbers tell, but stories sell.’ Why is that? It's because we are hardwired for stories. Our instinct to listen and tell stories is literally a survival skill that we have had since the beginning of humanity; it's how we all make sense of the world,” notes Moffat. “So what's an essential survival skill is also an essential business skill.” 

People also use stories and experiences to help brand themselves while organizations also use stories as the foundation of how they communicate, connect with customers and what they stand for. According to Moffat, stories are, therefore, also how we can overcome barriers, including technology barriers.

The key qualities of a great storyteller

In order to tell a good story, Moffat shared a series of best practices and strategies that she has learned over her 15 years in the field, including time as a TED Talks speaker. 

• Be specific with the through line you want to build in your audience’s mind. A “great through line should be 15 words or less” to tie the elements of your story together. A through line is a theme or concept that runs throughout your entire story.

• Don’t rush. Moffat notes, “Don’t try to pack things into your story. Don't rush it. Make sure you can explain your story well in the time that you have available.” Instead, really think about why every word you say really matters in helping get your point across. In other words, less is more when it comes to storytelling. If that means cutting back on topics, then those you do share will have greater impact.

• Use examples. Use real-life examples to help make your story come alive and emphasize the points you are trying to leave the audience with.

• Lean on passion. “Ask yourself: ‘Is this a topic that you feel really passionate about?’” If you can’t answer “yes” to that, Moffat suggests, then you should find someone that can. “You want your audience to feel things; you want them to be engaged emotionally,” according to Moffat.

• What is your goal? Is the goal of your story a “gift or an ask?” Being able to answer this question will ensure that you select the right examples, audience and through line for your delivery.

• Use the emotion of a challenge. Every story needs a challenge and a character so make sure you have them. According to Moffat, be able to articulate what is going to be able to overcome that challenge.

Phishing simulations & training

Build the knowledge and skills to stay cyber secure at work and home with 2,000+ security awareness resources. Unlock the right subscription plan for you.

VIEW PRICING

Wrap up

Ultimately, Moffat hopes that something she shared during her Inspire session inspired her audience or helped to shape an idea that they already had for a presentation to be better. If that happened, Moffat had one last recommendation: “Before you go to your next activity, take two minutes and jot it down. Because if you've got an impulse or goal, you have got to act on it right away.” Otherwise, Moffat warns, you just may lose that momentum.

To watch the entire “Storytelling in Cybersecurity” session, check out the recording here.