英文原文
Empathy over ego: why we're angry at the wrong people in cybersecurity — Cyber Empathy - podcast and more
Whenever someone says humans are the weakest link in cybersecurity, besides educating through fear, they are crafting a narrative, creating a reality in people's heads, and making them feel helpless against cyber criminals.
My guest, Lianne Potter, feels utterly differently about how to educate people on cybersecurity. Instead of fear, she advocates for empowering them through trust, autonomy, and, above all things, reciprocity.
Lianne is a Cyber Anthropologist, Head of Security Operations at Asda, a published author, host of the Compromising Positions podcast, keynote speaker, and multi-award-winning cybersecurity specialist. She recently won Computing.com's Security Specialist of the Year award, and, in 2021, she was named one of the Security Leaders of the Year and Woman of the Year in the Enterprise category.
This conversation is yet another opportunity to discover the dedication, kindness, and thoughtfulness that brought Lianne all these well-deserved achievements.
Throughout our conversation, she brought her brilliant and unique vision of cybersecurity. We discussed cybersecurity's own microculture in the tech space, its rituals and habits, and how cybersecurity specialists can transform how they educate the people they serve.
Lianne proposed brilliant ideas like ritualizing protection, empowering people through trust and autonomy instead of micromanaging and fear, cultivating the hero mentality, and more.
Listen to the podcast on Episode highlights * The moment Lianne fell in love with cybersecurity (6:40), * What makes cybersecurity's micro-culture so attractive (10:20), * The 3 main traits of cybersecurity (14:30), * Why reciprocity is crucial in cybersecurity (17:20), * Why trust and autonomy are the biggest gifts cybersecurity can offer (20:00), * Lianne’s experience with joining her first cybersecurity team (26:30), * The importance of how we communicate things (37:10), * Why educating through fear never works (42:00),
Meet the guest Lianne Potter As the Head of SecOps for the largest greenfield technology transformation project in Europe, Lianne is building a leading edge security team from scratch to meet the needs of a modern retail organisation while empowering her team to think innovatively to create new standards in best practices.
Lianne has delivered talks across the globe to share her vision for a new type of security function. Drawing upon her expertise as a cyber-anthropologist (through her consultancy, The Anthrosecurist), her practical experience as a security-focused software developer and as a security practitioner; Lianne combines the human and the technical aspects of security to evangelise a cultural security transformation.
She is on the advisory board for two community enterprises aimed at encouraging diversity in tech, is a published author, podcast regular, and recently won Computing.com’s Security Specialist of the Year for her work on human-centric approaches to security. In 2021 she won two other awards for Security Leaders of the Year 2021 and Woman of the Year in the Enterprise category.
Resources * Lianne on LinkedIn, * Lianne on Twitter / X, * The Compromising Positions podcast, * Lianne on Tom Eston’s Shared Security Podcast, * What is a Cyber Anthropologist? Lianne Potter on The Brainy Business Podcast, * Wearables, Shareables, Unbearables - The IoT and AI Tech Nobody Asked For but Cybercriminals Love!,
Transcript [00:56] Andra Zaharia: Today, we're exploring a new angle from which to look at cybersecurity, and that is anthropology. Lianne Potter, today's guest, takes us on a fascinating dive into the culture of cybersecurity: the habits, the rituals, and the traits that make it a culture or a micro-culture in the world of tech. Anthropology gives us this incredible ability to zoom in and out of the tiny behaviors that make up the big cultural norms and identities, and, of course, our relationships to them, our perception of them, and how they influence everything from how we speak to what we choose, in terms of decisions, to how we relate to other people. So, Lianne's experience, besides being a cyber anthropologist, is that of a person who's very hands-on, who went through these experiences, who made the most out of them, and who is effecting change in the teams that she's part of. I loved her perspective on the many examples that she shared about the blockers that are keeping cybersecurity from becoming a source of innovation and an even more powerful source of positive change. So, we talked about behavior, habits, and rituals, and also about vocabulary and expectations, and a lot of common experiences that we have in other parts of our lives that resemble what we experience in cybersecurity. Sometimes, we fail to recognize that we already know the situation, and we already know how to handle it and how to treat others and ourselves in that particular context. I'd like you to keep an open mind and an open heart in this episode because it has so much to offer. Lianne has so many great examples to share. One thing that I think you'd be intrigued to discover in this episode is that we're actually mad at the wrong people; we're angry at the wrong people in cybersecurity, and you're going to see exactly what I mean by this towards the end of this episode. So, enjoy, and I can't wait for you to meet Leanne and her experience. I hope you check out her podcast and her work because she's doing really great things. So, thanks for listening, and leave a review if you want to, and enjoy. See you soon.
[03:42] Andra Zaharia: So excited to talk to you today, Lianne. Welcome to the Cyber Empathy podcast. Thank you for the chance to talk to you about your work and about the beautiful marriage that you've officiated between anthropology and cybersecurity, and so many other things.
[04:02] Lianne Potter: Well, thank you for having such an amazing podcast title. What a great idea to base a whole podcast around the idea of cyber empathy because it is severely lacking. I'm sure that we will get into that as our discussion develops. But cyber anthropology? I do think that anthropology and cybersecurity, and anthropology and tech, in general, make excellent bedfellows, but it wasn't always like that. When I first became an anthropologist, people were like, "Why do you focus on digital anthropology?" because that was my specialism. "Shouldn't you be going off into a far-flung country or an exotic place and learning all about different cultures that way?" I was like, "I could feel what I was studying—digital anthropology—something interesting was happening in the digital space." So, my study was around looking at how communities were built through the virtual sphere. We don't tend to use the word "virtual" much anymore because we have gotten very used to the idea that our lives are an amalgamation of being in the real world and our online personas. But I studied looking at things like Second Life—I'm aging myself dramatically there—which was a platform in which people could build avatars, build houses, have commerce, and things like that. I wanted to understand this: Do we replicate those same behaviors of society in those environments? And we do; we love to just revert back to Marx's capitalism straight away and the understanding of different types of labor models and how communities are developed and grow. But at the time, people were like, “But it's ephemeral, isn't it? It's not real connections; it's not real relationships.” But they were. There was a big debate in the anthropology sector thinking about "Should we be recording all this online information? One, it's quite vast; there's a lot of stuff going on. But also, is it worth saving?" And there's a whole debate around, "How do we now, knowing that it's so important to save all this information?" So, you've got the Internet Archive, for example. "How do we keep all that information prolonging?" Because I can get a papyrus from ancient Egypt and still have access to it. If I have maybe a CD-ROM with a load of content on it, I am going to really struggle right now to find where I can actually play that and if it will still even play. The ephemeralness, I think, is not the ephemeral of, "Are these relationships, are these cultures real?" They are very much real. The ephemeralness is that we're losing all this information. So, you need anthropologists to come in and record this information.
[06:43] Andra Zaharia: Record it, and also help us make sense of it. When you mentioned that people expected you to go to a far-off country and practice your craft, I thought that for many people, cybersecurity is still a far-off realm of myth, legend, obscurity, and all of the symbolism that it carries with it. It plays such an interesting part in our society and how we relate to these concepts because how we relate to each of these concepts says something about us, our own preconceptions, and our own cultures. This is why I find anthropology fascinating. It was one of my favorite things to study at the university. It opened my world in such a wonderful way of zooming in and out of cultures and cultural trends, understanding people, connecting their habits to the bigger picture and how they shaped society, and understanding of key concepts like childhood, marriage, love, and so many other things. Now, we're seeing this cultural evolution in the making around cybersecurity, what that means, and what role it plays in society. So, I was wondering, what was the pivotal moment that made you look at cybersecurity particularly and say,