Security Confidential S11 E6 Bec McKeown

Host: Manoj Tandon
Guest: Bec McKeown

Manoj Tandon: Let me ask a controversial thing here: Is there a role for psychologically testing people before you put them on the front line, if you will, in a high-pressure cybersecurity environment?

Bec McKeown: It depends on what you mean by psychologically testing, because there are a load of tests that you can get people to—

Manoj Tandon: You guys feel something? Personality typing?

Bec McKeown: Yeah, yeah.

Manoj Tandon: I guess, you know what? Again, this is a layperson’s view from just my personal experience. I would want to know: does a person have the ability to simply put a pause or an interrupt statement in their thought cycle before taking action?

Bec McKeown: There are people who think like that, and you can certainly have a look at thinking skills. But something like that, you can train that.

Manoj Tandon: Absolutely. If you could do that, you’d make a million dollars because meetings would actually become useful. Yes, I mean, think about it. When we’re in a meeting, most of the time, people are really just taking turns talking when they should be listening.

Bec McKeown: Yeah, right.

Manoj Tandon: And the fundamental issue is that there isn’t an interrupt. Everybody wants to say something, but that pause function isn’t there that says, “All right, you know what? Just stop. Let’s hear this out.”

Bec McKeown: Yeah. There are three things springing to mind.

One is emotional intelligence, which I’m fairly sure you’ll have heard of: EQ. And that is the ability to understand the perspectives of others. There’s also a thing called CQ, which is cultural intelligence, which I absolutely love, because those two things combined are teaching you exactly that thing. What is the other person thinking? Why? Looking at it from their perspective instead of your own. Why do they think that this particular topic is important, and yet you think it’s so unimportant?

I used to teach cultural specialists in the UK military. Their job was to go to not-very-pleasant places and to build relationships with people that were very much not like them. And I used to find it really difficult to try and explain these concepts to them, because it’s all unconscious.

The story that I want to tell here is we were talking about cultural values. So we had two people in the room, both white males, mid-30s, been in the military for about 15 years. They’d been in the same regiment together; they were almost like twins—”brothers from another mother” or something, I think they called it. So they were very close.

At one point, I showed them a picture of somebody with facial piercings, and I have never seen a reaction like it. They both got angry with each other because they had very opposing views on whether people should have facial piercings or not.

And each of them were so set in their views, they were trying to persuade the other one to their view and to their way of mind. It got to the point where we had throbbing veins on the temples and flushes going up and gritted teeth and folded arms. I just thought, “Oh my gosh, they’re going to have a fight.” You know, I was really quite concerned about this.

Luckily, tea break and biscuits came into the room, so that sort of calmed the situation down a little bit.

Manoj Tandon: That’s a fine British tradition. It is a solvent for every problem.

Bec McKeown: Yes. Apply a biscuit. What is a biscuit over in the US? Is it a cookie? Sorry.

Anyway, afterwards we got them back into the room and explained what was going on there. That friction was about cultural values. When we talk about cultural differences, we tend to think about differences between East and West, or different countries, or different groups, but actually values are for everybody.

The thing that particular incident taught me was that whenever you’ve got friction, there’s going to be something underlying that relates to somebody’s values.

Now, learning that made me apply that to my own life. So now, in a meeting, someone’s talking, I’m just listening and I’m thinking, “Oh, hang on a minute, I don’t agree with that, and it’s making me cross.” So instead of jumping back in to have an argument, I do that thing that you’re talking about now, which is just to hold back a minute, hold that space, and listen.

Because then you’re going to understand why they want to do it their way. And to me, that’s the key to getting more effective meetings and working toward reducing conflict in work situations.

It isn’t easy. It took me years, and it does mess with your head a little bit. I can’t vote anymore because I can now see both sides of the picture from different angles. But yeah, those sort of things, you can train them. This isn’t easy, and it does take time. And you’ve got to have the will, obviously, and the motivation to do so.

Manoj Tandon: So, given potential conflicts and values where these things are stemming from, how do you build resilience then in a team? How do you measure resilience?

Bec McKeown: Yeah. Let’s start with what resilience means, please. It’s a very hot topic. Resilience and psychological safety; I see it all over LinkedIn all the time.

So what actually is resilience? To me as a psychologist, it’s the ability to bounce back after a crisis. So there are a thousand and one different tools to measure resilience, and they all have a slightly different take on it.

There is a model called the Robertson Cooper model, and it has four components. I kind of like that because it’s fairly simple to understand. It’s made up of confidence—so if you believe that you have the skills and the ability to deal with the problem, you’re more confident about it. That makes you more resilient because you’re not afraid of what’s coming towards you. “Self-efficacy” is the technical term.

Then we have adaptability, and this was the thing I was talking about earlier about spotting underlying patterns in the way that you think. It’s the ability to sort of switch between different modes of thought. Do we stick to the playbook, or do we have to take a step back and be more creative and come up with a new solution because it’s a new type of threat that’s attacking us?

The example I usually use for this is Captain Sullenberger and landing his airplane on the Hudson River.

Manoj Tandon: Yeah.

Bec McKeown: A perfect example of adaptability and adaptive expertise. He’s a pilot; he knew that he needed to land his aircraft somewhere flat, somewhere wide, and not on top of the most substantially populated city on the planet. He didn’t have enough fuel to go back, so he took all of those things and he looked at the river. Well, it looked like a big runway. Down you go.

If he had stuck to the playbook, something else would have happened. But that to me is a really good example of adaptive expertise: taking that knowledge and applying it in a completely different way in a new situation.

He’d learned those underlying patterns about how to land a plane that said it needed to be flat, it needed to be wide, etc. etc. So that makes you more resilient.

Also, social support: so relationships. And this is what I’ve been talking about regarding building trust with those teams. Don’t test those relationships when you’re under pressure; get it all out of the way beforehand. Then people can have conversations in a calm way in a difficult environment.

That builds resilience because you’re not on your own dealing with the problem.

And then also, it’s this sort of self-awareness and the ability to adapt afterwards: the metacognition thing I mentioned earlier. What did we learn from that experience as individuals, as a team? How can we grow from that and take a positive? I think there’s a saying, “Every cloud has a silver lining.” Even when bad things happen, there’s something you can learn from it.

So all of those things help an individual build resilience.

Manoj Tandon: However, that confidence, adaptability, the ability to adapt to a situation, you know, metacognition…

Bec McKeown: Right, yeah.

Manoj Tandon: And you mentioned one more item.

Bec McKeown: Yeah, the social support.

Manoj Tandon: Social support. So those four factors… Social support is something that we can inspire and train into a true team environment. Confidence and adaptability are individualistic traits.

They’re really smart, but they’re not confident. Yeah, you know, I’ve seen this, believe it or not, with physicians. So, I come from a family of physicians, and you see it where people know the subject matter, but anytime it comes to decision time, it’s like, “No, let’s not make a decision.” That’s the best decision: I just won’t make one, and therefore I’ll never be wrong.

And so it seems like there’s a lack of confidence. And then adaptability, again, seems like an individual trait. So, should we test for that before you put somebody into a pressure cooker environment?

I guess I know it’s not practical, especially in our industry where we have a huge workforce shortage, to be able to implement those kinds of filters on a practical basis, because you may not have much of a team left.

But when queuing back to the military model, I think if you’re applying for a Special Forces application, they do see if you have the mental toughness to actually get engaged with a program like that.

Bec McKeown: I don’t know that it’s really that different because—

Manoj Tandon: You look at the case—I think you’re wrong.

Bec McKeown: Yeah, I don’t think you can—

Manoj Tandon: You can also train it. That’s my—

Bec McKeown: You can train it.

Manoj Tandon: You can train it? Okay. And how do you train them?

Bec McKeown: Again, this all goes back to the training things: the cognitive agility, the lots of little labels. In training, you start to spot the underlying patterns. Somebody who’s not very confident will grow in confidence the more times they’re put into that situation and they have to make that decision, but they’re not doing it under pressure because you’re doing those little nibbles of training all the way through.

So it’s a gradual skill and confidence-building thing rather than chucking them into the fire and then going, “Oh, he didn’t cope.”

You know, get him prepared, get his fireman suit on, metaphorically speaking, before you put him into the burning building. And even if—so I mean, there’s going to be times where that’s just not possible. Something happens two weeks after somebody starts in the job.

But if you’ve got that social support and those relationships, you’ve got a team of people doing this thing. So if one person is struggling, it’s not all on them; it’s on the team. And that is—I guess it’s just like football, really, isn’t it?

Manoj Tandon: Yeah, they work together as a team to drive forward.

Analogy: if you look at the sports world, you look at the number of times you hear the broadcasters or the commentators, or even the publications, focus in on a player or two. Right? And it’s not about the team.

In many cases, there are a lot more people than just one or two players on that team that actually make it effective. But it seems like there’s a lot of focus on individuals—specific rockstars, if you will.

Bec McKeown: Right. Yeah, right. But you need the whole team to be a rockstar.

Manoj Tandon: Yeah. And I guess that leads to the next question: when you don’t have that, or let me rephrase it—why do teams who have even gone through this kind of a program, and we’ve trained in resilience and we’ve drilled in exercises, why do they still fall apart under pressure? Have you seen that happen?

Bec McKeown: Yeah. It goes back to that amygdala hijack that I talked about right at the beginning of our conversations.

I had one person I was talking to who was a crisis response expert, a global crisis response expert who had been doing this for several years. She was very confident, and she went in and her exact words were, “I know what I’m supposed to do, but I kind of didn’t know what to do.”

And that was that amygdala hijack response. It was a particularly nasty thing that was going on. It was going to have an immediate effect on the way the business was running, which was going to have a global impact, and everybody was going to know about it. So that immense pressure meant that even she, in that moment, just didn’t… she just froze. She couldn’t do anything about it.

What she found was that having an explanation of why that happened helped rebuild her confidence, because she lost a lot of confidence at that particular point in time. But because she then came and learned what it is that causes that, she realized that, actually, that was just a reaction thing in that particular situation. It doesn’t mean that I can’t do my job; it doesn’t mean that I’ve lost my nerve or anything like that. And she became more accepting of it.

And again, the whole team piece: because everybody felt like that in the team in that one particular moment, it was a bonded team.

Actually, even though they sort of fell apart under pressure in spite of all of their training and experience, by sharing that experience and talking about it afterwards in an after-action review, it properly bonded that team together and rebuilt the confidence afterwards to go back and carry on the good fight.

Manoj Tandon: So what would you say to the executive—and there’s a bunch of them—who would say back, “You know, we don’t like to talk about the negative; let’s just focus on the positive and move on.”

So then that kind of a review really never takes place in that kind of thing.

Bec McKeown: Yeah, yeah. And I know it’s done: “Let’s move on and move forward to the next thing.” We don’t like talking about the negative, but as adults, the way we learn is we learn by making mistakes. So by ignoring the negative, you’re not learning.

I did a really interesting piece of work looking at this after-action review with the UK military, but I also did it with the US military and the Canadian military. So it was interesting to see how three different countries did the same approach. They all do the after-action review, and it’s a case of: we know it’s going to take time; we might not feel like it; we might not want to actually acknowledge what’s gone on; but we’re going to do it. Because if we do it and learn from it, we pass it on to the next people that are going through training, ready to go out on operations.

And that’s called “double-loop learning.” You’ve learned by your mistakes, and you’ve made sure that you’ve passed that on in training so it doesn’t happen again.

And it’s about a mindset and an organizational culture. Are you a learning organization? Do you want to be a learning organization? Do you want to pick up from those errors?

Interestingly, the aviation industry has got this absolutely nailed. They have what’s called a “just culture.” A just culture is a culture whereby it’s okay to make mistakes as long as we talk about it, we learn from it, and we put it right. And there’s no consequences—job losses or anything like that—for people who make honest mistakes.

And we learn from it as a team. There are insider threats—people who are not making honest mistakes; they’re doing deliberate sabotage. That is always dealt with appropriately and off you go.

So it’s about the understanding that by looking at mistakes and understanding how it happened in a no-blame situation, in a very factual way, we can learn from that and put it right.

I’ve seen quite a lot of things, people talking about cybersecurity culture, and that to me is where aviation absolutely got it right. It would be useful to move towards that sort of culture. She said it like it’s the easiest thing on the planet—which it isn’t, I know.

Manoj Tandon: Do you have any data, even anecdotally, on people who are implementing this kind of a review mechanism—an after-action report, quote-unquote—and then they faced the same situation again? What’s the percentage increase in effectivity that’s taken place?

Bec McKeown: That’s a really difficult question. I wouldn’t want to put numbers on it. I’ve seen it happen lots of different ways, but I’ve also seen it go badly wrong.

I think one of the examples we used to use with our human factors students when I was working in the industry was looking at aircraft accidents. Look at NASA and things that happened with major accidents there. 20 years later, something happens again. You’re never going to get rid of all of that, because as humans, we’re not very good at remembering things.

You think, after 20 or 30 years, people move on, there’s a new generation that comes up, and they have to make the same mistakes again. So I think it’s about being realistic about what you can achieve, but at least do your organization the favor of trying your best to put it right rather than just ignoring it and moving on.

Manoj Tandon: And that’s an interesting—yeah.

Bec McKeown: Well, I am kind of practical, but I think it’s something that I know it so well and I’ve seen it so much over years that I find it difficult to understand why people don’t get it.

Manoj Tandon: So, explain the “wicked problem” to us. I came across that term when we were researching some of your work. What exactly is it, its implications, and how do you prep for this thing?

Bec McKeown: A “wicked problem” is exactly that: wicked because it’s not easy to deal with.

In a normal problem space, you can identify the different factors that are part of the problem, you can look at evidence, you can attribute cause to it and all of that sort of thing, and work out a way forward.

A wicked problem—and this is so typical of cybersecurity, I feel—is fast-paced. So everything is happening really, really quickly. You’ve got a whole bunch of information coming at you from different directions. Some of that information is of quality; some of it is not.

The situation’s changing very, very rapidly. There isn’t an immediate solution; you can’t just press a button, tick a box, and everything goes away. It might be something that you don’t necessarily have experience with.

But for me, the wickedest part of it, if you like, is the fact it’s a zero-sum game. So whatever you do that is right in one area might well cause a problem in another area. Therefore, there isn’t always that obvious path to take because something bad’s going to happen regardless.

And it’s very much a case of having to find the least damaging compromise at each step and understand—

Manoj Tandon: A cyberattack would be the perfect example.

Bec McKeown: You take a series of steps and you have to manage the situation each day as it comes, because you can’t just solve it straight away. So that is a wicked problem.

Manoj Tandon: That brings us to what you just described there, where you have potentially outcomes that are going to be damaging regardless of whatever action you take. The question is, which of the lesser evils do I pick here?

That brings in the chain of command issue. And again, this is my personal opinion. When we look at cybersecurity teams, they’re usually composed of a bunch of technocrats, whether from the CIO or CISO on down to the analysts, threat hunters, and the entire team.

Those folks are not empowered or designed to make those competing decisions. Okay, an example would be, “Well, if I take this server offline, it’s going to kill our credit card transactions for an hour.” That has all kinds of financial implications. Or, “If I take this server offline, the last 15 minutes of orders or the last 15 minutes of shipments are completely lost.”

Okay. They don’t have the authority or, as they say, the pay grade to actually make those decisions. But the people who do often are not part of a cybersecurity team, or are not included, or don’t even understand the risk.

What do we do here? I mean, how do we address this? Because these people need to be brought in, and I want a real psychologist to tell us about this.

Bec McKeown: Two things are springing into my mind as you’re talking there.

First is: why aren’t those people from other areas of the business brought in to work with and train with the incident response team? Because then you’re listening to those issues as you go along. They’re there. They begin to appreciate each other’s roles.

I think I’ve talked about this several times throughout. So why aren’t they training with them? It doesn’t mean that they have to take three days out of the office to do some massive tabletop exercise and all the rest of it. It can be like little scenarios every now and then, and then you have those conversations in that safe space.

Understand why business development or business operations want to do one thing and the IT people want to do a different thing. Have those conversations. Where are we locking heads? Where are the clashes?

Manoj Tandon: May I interrupt for just—

Bec McKeown: Yeah, sure.

Manoj Tandon: It appears that you presented something brilliant there. You know, “Why are they locking heads?” They come from two different social cultures.

They have two different value sets, and as often as I’ve heard in the halls, “Never the two shall meet.” You have people who understand the business: they understand what they’re selling, they understand their customers, the market, and how to operationalize that and gain access to the market.

There’s a whole bunch of people on the technical side that don’t know the first thing about that, but understand how the signals go across the wire that enable that transaction to take place. Right, but they don’t know what happens if that signal doesn’t make it. They don’t know how upset customers get if they don’t get their orders.

That’s something that’s completely out of their paradigm, and so they don’t have a common language that actually brings them together, although they’re working for the same cause.

Bec McKeown: I mean, that’s a massive problem. It’s also quite well researched. I came across some research—it was the Norwegian military, and the situation they described there is they call it “working across the hybrid space,” because you’ve got tactical, operational, online, and real life, and you’ve got to have somebody who can, as they say, navigate that space.

I came across one of the UK banks that actually solved the problem by putting somebody into the team whose job it was to translate technical language into business and vice versa so people understood it. But that’s quite a mature crisis response team.

Manoj Tandon: Wow. I haven’t seen too many of those.

Bec McKeown: It’s rare that someone’s doing it.

Manoj Tandon: Yeah.

Bec McKeown: That’s what I’ve come across. But what the Norwegian research showed was that, actually, it’s about having those conversations. The business person comes in and explains, “Well, actually, if you do that operationally, it means that the customers won’t be able to do this, the suppliers won’t be able to…” It actually spells it out to the tech people.

Then the tech people also listen to those stories—you know, give their own stories: “Well, actually, this is what we need to do and this is why we want to do that.”

When they have that discussion and they begin to understand why each one has its different point, you start to find that people can generally then start to look at where the compromise is. Where is the midpoint for this?

There is a professor in Australia, Professor Debbie Ashenden—she’s proper cybersecurity, Adelaide—and she’s done a bunch of research into this. She’s written a wonderful paper on design thinking. It’s about bringing those teams together right at the start and getting them to design systems and processes, but design them as a joint team instead of separate ones and chucking something over the fence.

What she found in her research was that because they were designing the system or the reaction—the playbook—together, it led to an increased understanding. So, again, there are things you can do, but it’s about being creative and looking at doing things differently within the organization. Not everybody likes change.

Manoj Tandon: Nobody.

Bec McKeown: Yeah, and if nothing changes, nothing changes.

Manoj Tandon: Yeah.

Bec McKeown: If we keep doing what we’ve always done, we keep getting what we’ve always got. I don’t know who said that, but it’s very apt.

Manoj Tandon: I think it’s easy—I know at the executive level, if you are not at all familiar with or are uncomfortable with technical things, or you perceive you’re uncomfortable, or you don’t want to… it’s like, “Well, I don’t do that stuff.”

Then it’s very easy to be very dismissive.

Bec McKeown: Yes, absolutely right.

Manoj Tandon: And when you’re dismissive, I think you’re doing your organization an injustice. Because what you’re asking to have happen is almost impossible unless the command-and-control structure acknowledges that, “Yeah, really bad things can happen; we’d better be a part of this.”

Bec McKeown: Yeah, and that’s a bit like security awareness training.

I will put my hands up and admit that years ago, when I got my security awareness training when I was working at the university—mandatory training… You put “mandatory” in front of anything, and I immediately switch off because I know it’s probably going to have nothing to do with me.

I would go through that, my fire extinguisher identification training, my manual handling training—I had to do it, otherwise I’d get told off. They sent me emails badgering me every couple of weeks because I hadn’t done it. I’d log on to the e-learning system and get to it as quickly as I can and see if I can still score 100%, because that’s the challenge I’m finding in it.

That is not learning. That is ticking a box, and I think that’s boring.

If you look at most cybersecurity awareness training or the trainings you’re talking about, it’s definitely PowerPoint and it’s boring, and I don’t get it. Why does it apply to me? I mean, at the time I was an academic, so I’m doing research, I’m lecturing; why is cybersecurity… we’ve got an IT department, they do all that, don’t they?

That was my attitude towards it. Obviously, I then started working in cybersecurity and was embarrassed into realizing, “You can’t behave like that anymore.” Because actually, you now know why it’s really important.

The thing that I found is that if people understand how it applies to them in their role, they become a little bit more interested.

And there’s also that thought of—one thing I’ve heard quite a lot recently is explaining it in terms of the Internet of Things. We’ve all got Alexa in our house now; we’ve got our Ring doorbells and all of that sort of thing. If you start explaining cybersecurity in a way that means something bad is going to happen in my house, and they’re going to nick the money out of my bank account, then all of a sudden it comes to a bit higher on my agenda of interest.

So it’s about finding creative ways of engaging people. Gamification—that’s an ideal way for those who like games. For people like me, who don’t give a toss about a leaderboard, it’s not going to engage me anymore. But I might care that my mum might get conned in some way out of her life savings.

So it’s about lots of different ways of just trying to attract people and get their attention. To me, the biggest thing is: why does it affect me and my job? Tell me what it does for me in my role and the part I play, and maybe I’ll find it interesting. Or at least open my mind to it.

Manoj Tandon: What you just said is awesome, because we’ve often said this about people who are in the business of making cybersecurity policy. In a lot of organizations, the cybersecurity teams are looked at as the “people of no”—everything is “no.”

Bec McKeown: Yeah.

Manoj Tandon: But they’ve done themselves a disservice by getting labeled that way.

Bec McKeown: Yep.

Manoj Tandon: And it’s exactly because they’re not explaining the “why” behind these walls in tangible terms.

Because when you tell someone you can’t connect to free Wi-Fi at Starbucks, they’re going to be ticked off, like, “What the heck do you mean? I go out for lunch and that’s when I get caught up on season seven of my favorite TV show, right? And I’m not doing that over my data plan; I’m going to connect to the free Wi-Fi.”

Bec McKeown: Yeah.

Manoj Tandon: But if you explain it to them—”Okay, if you do that, and you use your phone for work, well, now you’ve just created an open channel into your job function, and your job function can have dramatic consequences on your employment, which means it affects your employment, which means it affects your money”—

Bec McKeown: Yeah. But then, even then, it’s not always going to work. Think about how many times… Why do some people smoke? Why do I eat so much chocolate when I know it’s bad for my heart and my arteries? Why don’t I exercise as much as I should do?

Manoj Tandon: Yeah.

Bec McKeown: Why don’t people listen to the safety instructions on an aircraft?

Manoj Tandon: They’re boring.

Bec McKeown: Exactly. You know, it wouldn’t be boring if a plane is heading down and you’ve got to put the life jacket on and get out the door. You’ll be less bored then, but it’s too late.

I think there’s also some reality here: not everybody’s going to comply. You’re never going to get 100% compliance. People speed; people do bad things to other people; people steal. It’s human nature; it’s a rich melting pot.

But you can only do the best you can do. Again, if at least you understand why people aren’t interested and what possibly the hook could be to get them even a little bit interested, then that’s got to be better than nothing. So I think you have to be a little bit realistic.

Peer pressure is a wonderful way to make people do things.

Manoj Tandon: Yes. Now, that’s a very cool concept. Bec, we are actually a little bit over the hour.

Bec McKeown: I’m so sorry!

Manoj Tandon: No, no, no, no. We need to have you back; I want to continue this conversation. There’s just so much here we’re scratching the surface of. We’re just scratching the surface of things, but I want to give you an opportunity to let the audience know anything that you’d like.

If you have any books, publications, appearances—whatever you’d like to plug, you have the floor for the next two minutes. Whatever you’d like to tell them, please go right ahead.

Bec McKeown: I haven’t written any books; I’m too busy doing it! My business, MindScience, is all about the things I’ve talked about today. I run workshops in those things and help people try and put it into their daily lives—understand why they do what they do, and then help them develop those skills to become more adaptable.

When you see it in action, it’s just fabulous. So, look for me on LinkedIn. Put “MindScience” into the search bar, you’ll find me, and I’ll quite happily talk psychology to you and how you can make it work for your business.

Manoj Tandon: Fantastic. Bec, we really appreciate you being here. You’ve been awesome, and we’re looking forward to having you back, if you would consider it.

Bec McKeown: Oh, absolutely. I find it an utterly fascinating subject, and like you say, we haven’t even scratched the surface, really. So, yeah, anytime. I’d be delighted.

Manoj Tandon: That would be wonderful. Thank you.

Bec McKeown: Thank you so much.