The quarterly publication of the International Legal Technology Association
Issue link: https://epubs.iltanet.org/i/411912
WWW.ILTANET.ORG 57 Many anthropologists suggest that storytelling has been around as long as human language. Our ancestors relied on storytelling for many reasons, from explaining scientific phenomena to entertainment. Whether it's about the gods on Olympus, the Tooth Fairy or the latest urban legend about alligators in sewers, everyone loves to hear a compelling story. It engages us. It teaches us. It is a time-honored and essential part of human communication. Storytelling can be a valuable tool within your organization. It can help engage employees and foster their participation in large-scale initiatives, including security awareness. The goal of a successful security awareness program is deceptively simple: to get employees to change their behavior. As with any change management initiative, communication is the key to successfully motivating employees to participate in your security awareness efforts and change their behaviors. However, not all communication is created equal. Today, statistics and factoids are easily available via the Internet. While facts and figures have an important role to play in helping employees understand how widespread security risks and incidents have become, they often fall short in gaining employees' assent to actually changing their behaviors. When we talk with law firms about security awareness efforts, we're often told that even after hearing compelling statistics about data breaches and risk factors, employees aren't committed to changing. Why is this kind of communication unsuccessful? Research in behavioral change has shown that communication that uses facts and figures is effective in helping employees understand the reasons behind the changes we ask them to make, but it doesn't motivate employees to change their behaviors. For that, employees must have an emotional connection to the subject at hand. That's where storytelling comes in. Incorporating storytelling in your security awareness communication efforts is an effective way to engage employees. To have the most impact and to increase your chances of changing their behaviors, tell the right stories. FIND RELEVANT STORIES The first thing to consider when selecting stories to tell is the relevance of the story. Law firm employees, including lawyers, respond most strongly to stories about other law firms and other lawyers. However, finding front-page news stories about law firms is challenging. Does that mean law firms aren't targets of hackers or aren't experiencing data breaches? Not necessarily. It's far more likely that we don't see those stories on the front pages because law firms are doing a good job of keeping these incidents off the radar. How do you find stories that pertain to your law firm audience? The Internet is a great resource. Just because you don't see these stories front and center, doesn't mean they aren't out there; you just have to look a little harder. As more law firms step up their security awareness efforts and engage in conversations on the subject, more stories are surfacing. In addition, peer-to-peer sharing through organizations like ILTA is a great way to find relevant stories to tell. Just be respectful of your peers and sanitize identifying details from their stories before sharing them. MAKE THE STORY RELATABLE The next criterion to examine when evaluating whether a story is good to tell is whether it's relevant to your audience. Could this possibly happen to your listeners, or is it so over-the-top that they are likely to dismiss it with a roll of the eyes and an "I would never do that" response? Stories can help overcome this issue if they incorporate an element of the accidental. After all, who hasn't misplaced a smartphone at some point? Your story must have an element of the possible for your audience to make an emotional connection. I have to empathize with the character in the story to connect to him and for the story to have an impact. BE CAUTIONARY, BUT NOT SCARY The right stories involve loss or consequences … but nothing too dire. Even if you have a great story about a lawyer who lost his smartphone, causing the entire firm to collapse, think twice before sharing it. Research into the personality traits of lawyers tells us that a majority have a strong sense of skepticism. The work of Dr. Larry Richard in analyzing personality traits provides great insight here. For over 20 years, Dr. Richard has studied the personality traits of thousands of lawyers using various tools, such as the Caliper Profile and the Hogan Assessments. His research has found that a majority of lawyers score in the 90th percentile in the trait of skepticism. According to Dr. Richard, those with a About the Author Julia Montgomery, Senior Change Management Consultant at Traveling Coaches, Inc., advises clients on all aspects of change management related to technology projects. She specializes in developing strategic communications. A true user advocate, Julia believes the key to increasing user adoption is to focus on the needs met by a technology solution rather than on the technology itself. Before joining Traveling Coaches, Julia spent more than 15 years as part of in-house legal technology teams. She is a member of ILTA's LegalSEC Council. Contact Julia at jmontgomery@travelingcoaches.com. To have the most impact and to increase your chances of changing their behaviors, tell the right stories.