Oct. 13, 2020

Using Netflix-Style Videos to Teach Cyber Security Awareness

Using Netflix-Style Videos to Teach Cyber Security Awareness

In this episode, Ryan interviews Anna Collard, SVP Content Strategy & Evangelist at KnowBe4 Africa, about the current state and future of cyber security education.


Is working from home dulling our cyber security spidey senses? How does cyber security awareness differ around the globe? And what's the most effective way to educate people who aren't tech savvy on cyber threats?

Ryan interviews Anna Collard, SVP Content Strategy & Evangelist at KnowBe4 Africa, to learn the answers to those questions and more in the latest episode of Digital Workspace Works.

Anna founded security content publisher Popcorn Training – a South African company that promotes Cyber Security awareness 

by using innovative, story-based techniques and gamification to make complex content simple to understand and easy to remember.

Anna has been working in the information security field for 18 years assisting corporates across South Africa, Europe and the US in keeping their information assets safe and holds various security certifications such as CISSP, CISA, ISO 27001 lead auditor, CIPP/IT and used to be a Visa/Mastercard PCI DSS QSA.

US-based Cyber Security Awareness Training giant KnowBe4, acquired Popcorn Training in 2018. Anna maintains her role as Managing Director of Popcorn Training/Knowbe4 Africa driving security awareness across the African continent.

Sample family rules for online behaviour
Click here to join the Slack Workspace
Click here for the episode transcript
Follow us on Twitter: @thedwwpodcast 

Email us: podcast@digitalworkspace.works 

Visit us: www.digitalworkspace.works 

Subscribe to the podcast: click here 

Transcript

Ryan Purvis  0:00  
Hello, and welcome to the digital workspace works podcast. I'm Ryan Purvis, your host supported by producer Heather Bicknell. In this series, you'll hear stories and opinions from experts in their field story from the frontlines, the problems they face and how they solve them. The years they're focused on from technology, people and processes to the approaches they took, they will help you to get to the scripts for the digital workspace inner workings.

Anna Collard  0:31  
My name is Anna Collard, and I am the founder of a small company called popcorn training. We're South African security awareness, content publisher. And about two years ago, we were acquired by Navajo. So since the acquisition, we've now rebranded to Naga for Africa. And I was responsible as the managing director for sort of the, you know, the growth of the business into the African region and the continent. But since the September, spread me after a Nero, it's a long American title, but it stands for SVP for content, strategy and evangelist. And basically, what that means in plain English is that I can do the things that I enjoy most doing, which is research and working on the content creation. And yeah, doing a bit of brand awareness into the market, and then leave the operational running of the business to our new Md carbonica joined us a couple of months.

Ryan Purvis  1:26  
I don't know most of it is very cool content. I mean, one of the we will say we became a customer of logo for last year. And I don't know if it was because of you or something like that. But I obviously listen to the hacking humans podcast where your guest. And I was looking at the timer thing. And then when I was heard it was South African based content, as I call it, we didn't have to look at this content. And then we went through and it's a very nice Netflix c experience to watch, you know, information security stuff incubated the sort of old way of many slides with me boring questions. It's nice to watch, you know, having more animated material. And you're doing it today, tell us a bit before we get into the sort of the nuts and bolts of you know, what digital workspace means to you and how it applies in your location.

Anna Collard  2:15  
Yeah, that's really cool that he doesn't have a full customer. And the workspace I actually thought about that, before the meeting. And you know, where we come from, like, you know, working in it, I think we've been working physically or virtually, or in the digital workspace for the last 10 years already. I mean, it's quite the norm to work from home. I mean, I started my business as a complete virtual setup, we didn't have an office, everybody worked from wherever I had developers and Sedgefield animators in South America. And actually, two of them back in South Africa, they moved to Japan. And we always were actually using slack and other sort of integration tools to, to chat and stay in contact. And it's only now since the the number four acquisition that we had to like, set up a proper office and bring people into the real world. And, and now, obviously, with COVID, that sort of curious banana works for everybody. And I think for people that have not had that kind of, you know, it background or upbringing in the IT space, it has been quite a new way of doing things. I mean, if I consider my husband, for example, them in the wine industry, they ran a call center, and he was so surprised that they could trust the call center agents to do the job from home, that he never suspected that would be possible, even though I've been, you know, talking to him for years that he should allow people to work from home more because it's just more practical. And COVID sort of showed it. It proved that it is actually possible to test people and then we have the tools and the technology to make it work and it doesn't matter where you are

Ryan Purvis  3:58  
physically. It is a lot of like conspiracy theories around COVID being a manufactured virus and then being sent out sent out to do whatever it's doing, but I think may and maybe this is what a new conspiracy mega conspiracy theory was to gain advantage to the same level of using technology. Because you're right most of you know for years decades, but but it always it was always lifted it person in the family to try and get everyone up to use Skype or Skype was the big thing to call and then you know you as a business have moved on to new things and you have a business then you're not going to do and there's always a disconnect between what you do as a family beside versus what you did in corporate life. And why we thought Scott's terrible you know, we should be using zoom or whatever it is now everyone's using zoom or teams or whatever it is. I think somebody mentioned about trust. And it's quite ironic considering your specific information security background and Nothing has been the biggest problem with a lot of people to work anyway has been, can we trust them to work? specifically around work in a coffee shop potentially with the patient? How's that driven? More? Or how is it changing your content approach? Maybe?

Unknown Speaker  5:18  
when you really look at that,

Anna Collard  5:19  
yeah, I mean, a lot of the content that we create is obviously, you know, it's targeted at end users that are typically in a corporate environment. So you know, because of the basic things, just how to respond to social engineering or phishing attacks, and data protection. And a lot of it is, you know, more than traditional kind of way. And, you know, if you now take people out of the office environment, where they might have somebody sitting next door to them to kind of ask, you know, hey, Is this legit or not, that there is a challenge that, you know, we had to address by making the content more specific around Hey, you not home. And specifically, within the this pandemic face, what also happens is that people, and even the ones that have, you know, worked from home before, and we sort of tap into collective kind of anxiety, and that makes us as humans, unfortunately, more vulnerable to people, hackers or social engineers, because any bs that you know, what happens is if we are stressed or anxious, and we use our urist, ik thinking mode, and that makes us, you know, much more sort of quick and more reactive. So if you get something while you're in the stress mode, and we all even security people we all, you know, relate to them. But if you stressed out if you have your kids screaming in the background, and you may just click on that thing that you wouldn't have clicked, yeah, otherwise, hand out information that he would have thought, you know, with the slow thinking mind, you're sort of critical thinking mind. And that is something that we had to kind of build into the training content more to make people aware of their own psychological vulnerabilities, I guess while they're working from home. Yeah, it's funny you said,

Ryan Purvis  7:03  
I mean, my wife the other day, so we're sitting having dinner, and we live in a little complex, it's not like seven complex, everything's closed off, but like seven houses, yeah, by the road. And, and we're not doing home I'd seen this this woman walking door to door and young girls, you know, student one event and you can't when you when it comes to charity, they carry baggage and a clipboard and all that kind of stuff. So you can sort of validate who they are. And I see them walking, and we were having dinner, Josie go to our section. And while we're having this thunderstorm erupted because we've had a lot of bad weather here. So just you know, the rain coming down. And and the doorbell rang. And I went and open the door and adolescent gaming schpeel. And they're already interested in having dinner on now. I said look, it's really way outside Can you give me some some towel to wipe my head down and walk back to the kitchen and get the towel came back and she wins and then you're secure security guard you let someone stand you do away with the door open with an iPad? for three minutes. Yeah. Okay, sounds like you're so right that you thought about that. Because at home You're so comfortable and so relaxed. That all those things are your spidey senses.

Anna Collard  8:20  
Yeah, exactly. Your spidey senses that that's a good way. And and there's also a lot of profiling that happens, you know, like you look at, and as women, we, you know, and social engineering, you take advantage of that, you know, if you, you put a pillow under your tummy and pretend you're a pregnant woman, and everybody will open the door for you, you know, because that's we polite, you know, and you don't associate a young girl or a pregnant lady was a criminal. But unfortunately, you know, this is very much possible. So

Ryan Purvis  8:51  
as you know, my daughter was born last week. And there's a big thing about going anywhere in the world about obviously child trafficking and, and get in and out of the wards and that sort of stuff. And as they finally my son was born two years ago, they didn't have this in place. And now they do the sensor on a on a band, they put it around the baby's leg, there's a walk out of the baby leaves the premises of locking doors now. But when you get what I mean, when you get in and out of the ward, you obviously the camera system, and you need to go in and the big sign and say no tailgating and all that sort of stuff. And I was curious just to see how many people actually got stopped by a nurse coming in and actually stopped pretty much. It's 80% of them. And to the point where I choose to bother doing it, and I've been I've been there a few days in a row and gotten to know some of the nurses. She looked at me and she said I know who you are, but only unless you press the button, and someone on the other side sees you. And I was like she that's that's really good training, because most people are going oh, I've seen you three days in a row. And I've seen you go into a woman's Ward, you must be a dad, it must be okay. But I had to identify myself and what goes up and I was I was quite impressed with Because that's, you know, losing a child is probably the worst thing you could ever have happened to you last date taken so seriously.

Anna Collard  10:08  
That's a great example of good training Exactly. Because they obviously had a lot of awareness campaigns around that and proper hands on training about the procedures, etc. And the same applies in a political cybersecurity world that we can change behavior, you know, if we, if, if we explain to people why it's important, and I know, our natural reaction would be to do the polite thing or not ask questions, you know, the, you know, the British are very polite, but our natural way of being, but you have to actually, and this is where I spoke about that myristic thinking you actually need to like, take a breather, and then not just react naturally, instinctively, but actually think about it. And then there's a lot of these email compromised scams that are making the rounds when the bad guy sort of impersonates authority figures to get you to pay something to fraudulent account. And the again, the same happens, I got natural responses, Oh, my gosh, the CEO is asking me to do something, I've better jump on that straightaway. And so what they just say, and get us to sort of circumvent our critical thinking and, you know, react quickly. And and especially, then we have to tell everybody, you know, if you know, number one thing, and cybersecurity is actually to become more present, and more mindful that take a breath, take a breath, it only takes 10 seconds to get your amygdala to sort of chill out. And then yeah, you know, by your cognitive, you know, your thinking,

Ryan Purvis  11:43  
and especially today, when you're at home all the time, that you've kind of lost your social skills, you're not picking up on those, those subtle body language things you can tell if someone's in the shifting of a shady, practice, founder. How do you be confident? I mean, I can't remember how many countries they are. But I mean, if you say you move to Africa, have you found a different dinapoli ecosystem of different countries culturally? How people handle social engineering?

Anna Collard  12:18  
Yeah. So they have 54 countries, I think, depending on some of them in Canada, some of

Ryan Purvis  12:25  
them today,

Anna Collard  12:27  
listen to another, but I think it's 54. But um, yes, I think that there's a huge difference amongst the cultures. And I mean, it's like Europe, you know, people say that the Europe, Europe is all these different countries that have different maturity levels, completely different cars with the same applies and Africa. And for example, if you go to Mauritius, they actually from a, from a cyber or digital kind of maturity level that that really advanced, they've been rated as I think, the sixth most secure country in terms of what the government has done. Yeah, they have really great regulation in place. And they are under submission to make a call in the smart islands, you know, so they, they obviously, you know, put an investment into education and technology in general. And within, you know, underground was was quite interesting, like, because he went there last year, and also impressed with what I read about Mauritius and other people on the ground. So yeah, I really like that. We've got the paper in place, but the enforcement is a different story. But still, like, you know, it is, you know, compared to South Africa, even Mauritius is far ahead in terms of the regulative frameworks and what they've got in place. Kenya also is actually very mature and a lot of the, you know, sort of data protection, regulation, etc. But then there are other countries that have absolutely nothing in place. And we understandably, you know, you think, okay, they have bigger problems to cry like poverty, unemployment losers. So cyber security is not really high up on the agenda. But that makes it so dangerous, I think, because Africa, and this is something I'm personally quite passionate about is, if we look at, you know, we currently have half a billion people that are online across the continent, and that number is going to double in the next two years. So we have half a billion people coming online. And most of them will be first time users meaning you know, they're not back in the countries where you grow up with computers, and they haven't so they get a smartphone or phone and they connect to the internet. They're not doing financial transaction. I mean, Sub Saharan Africa is the region with the most financial transaction conducted on mobile devices. And that's not the sentence was it though the actual numbers in the world. And then you have that on the one side, you notice, I'm away, often not English speaking, first time users using their mobile devices doing financial transactions. And on the flip side, there's no legislation in place across, you know, the continent. I mean, there's a handful of countries And cybercrime that's sort of shifting the attention towards emerging economies. And they know that Africa is digitizing at a rapid speed. And then, you know, with the sort of mobile kind of malware that's, that's in place that is, that's something I'm scared about. But I'm also passionate about that we can do something about it and pick them. And we're going to organize a panel discussion with a lot of the telcos, you know, MTN vodacom, Intel, because they all have that, you know, they have that opportunity on the one hand side, but they also have a responsibility and a challenge to how to how to protect the consumers. And what's interesting, you know, the challenge that they have is, you now have smartphones that are often secondhand smartphones, that they still use feature phones, and online banking is done through ussd, which is like a 20 year old technology, and how do you protect our phones that they don't even have updates for anymore, you know, like, it really is a challenge. But I guess, you know, listening with is a challenge and a will to solve this opportunity

Ryan Purvis  16:09  
to help you out there, wherever I can. So keep me in the mind that actually, I'm thinking of a friend of mine that you probably would need to chat to, which I will introduce you to after this

Unknown Speaker  16:26  
talk he loves.

Ryan Purvis  16:30  
He's a great SME in the mobile space. So all those vendors he knows people that you know, he traveled. I mean, he showed me his profile the other day, I think, the first 250 events across Africa, in the mobile space. So he's been around those those people, you know, perfect for what you want to do. And you probably ski with

Anna Collard  16:51  
Yeah, that would be amazing.

Ryan Purvis  16:54  
But yeah, I think just Well, there we go to issue. Oh, six to go back to, to the education piece. And the first. Yeah, there's those first users that aren't English speakers that I mean, what are you thinking? How are you? And also how you dumbing it down? But, you know, technology is like, is like magic people that don't understand it. Until about an educated person has, you know, been through? They've worked with laptops, Lycos. I've never been someone who's never seen an ad on TV, if you're lucky. And how are you feeling? The way introduced?

Anna Collard  17:29  
Yeah, we have to just keep it simple. I simplify just most essential basic kind of message. And often that's actually about the behavior, you know, not so much necessarily, but the technology or how these threads operate as well. What can I do in my day to day law? You know, what are the do's and don'ts of not using jailbroken or rooted devices, you know, to do that whole? And let me think before I click kind of thing over behavior message. And that can be, you know, and that's also challenging on its own, you know, that people I mean, change their behaviors. I mean, we only have one or two habits that be able to change it. Yeah. But but this is really where I feel that collaboration between the governments and the industries need to assess to start with the kind of education and grassroots levels that really in the schools already, and universities. And, you know, something that was quite interesting, like, now before have acquired a company called culture from Norway, so probably about two years ago, and they run like a culture survey across, I think, 24 countries. And the recent one was just released about two weeks ago, it's quite an interesting read, I'll send you the link. And in Yeah, and they they sort of, you know, what they do is they measure what does security culture mean, in terms of different dimensions. So there are seven dimensions that the sociologists have been measured, you know, have been measuring for 30 years. And they applied that to security. And that allows them to sort of compare different industries, countries against each other in terms of the maturity level. And what was quite concerning is that the education sector, by far across all countries, scored the lowest in terms of security culture. And that means that, you know, part of the dimensions is cognition, which means the level of understanding and awareness was pretty low, but also attitude. So the attitudes of the people in the education sector towards cyber security was the lowest across all of them. You know, norms are sort of the behavior that that's not written down. It's just what we do, and everybody does, but it's not in a policy or something. So they score pretty, you know, terribly across all of these dimensions. And I think that's concerning because, you know, a place of learning should be the first place that we sort of expose our children and the students too. And I think being digitally savvy or service security away is like a second life skill. It's no longer something that is a nice to have, I mean, especially if Now talking about digital workspace and all of us working from home doing online schooling. And it's something that we have to embrace more. And we sort of have a positive attitude towards now.

Ryan Purvis  20:12  
As you say, I'm seeing more and more about kids going to school and the amount of social media, I think Tick Tock is probably the most popular one at the moment. And people not realizing that I think is really on Netflix. Now. That's what I saw link to about the social media creation. And yesterday, yeah, I heard it, it's really good. And this whole thing, and then Kevin, Katie said, originally, and if you're not, you're not paying for the product. And that's not just your data, but that's, you know, access into systems or, you know, real, real social engineering exercises. It's a scary place, if people that are there. Yeah, exactly.

Anna Collard  20:55  
Yeah, and I mean, is that notion that even though youngsters, then know that that information is being, you know, that they're paying with information, and that it's being used as like a commodity, and it's being traded, and then they don't really mind because it's just the way the way things are. But you know, that oversharing kind of thing. But there are other aspects to it that people really, I think are not aware of yet at macro mezcal, maybe we need to do more. I mean, look, I think that in the UK, they have fantastic resources is the chocolate site that provides content to parents, kids, parents, teachers, educators, and Australia has also done a fantastic job in sort of providing pre and really good content to, you know, individuals, parents, as well as small SMB businesses and bigger organizations. And there's a lot of work to be done in South Africa and Africa in particular, I mean, you saw that there was a, an article just over the weekend about I don't know who it was some researcher who tried to contact the South African cyber security hub, which is all search government search. Hmm. And the email just went into like, Nowhere Land, like there was no, there was no response. It just shows like that that's something we have to assist the government with in order to focus capacity and provide that support to the consumers and the people. Because it's meant to be there that if you have an incident or problem that you can reach out to them and get in support. But seems to not even be meant, you know, there's nobody behind that.

Unknown Speaker  22:41  
It

Ryan Purvis  22:43  
doesn't surprise me being you know, it's one of those things in Korea, unfortunately, the corruption that exists is probably that money was spent elsewhere or taken elsewhere. But at the same token, I had an issue here many years ago, where we'd gone back to South Africa and holiday come back and add a few letters in the doorway. I bought five cars, and someone had stolen my identity and managed to go try and buy these cars. And when I spoke to the first person he said oh yeah, well we you know, there's a process they went through they couldn't prove that they were us. So obviously we obviously loved it as a thing on their side and I try to get hold of the UK cyber police armed with a Call now and yeah, that phone that phone will never go out either. So either this in so many cases that those people can't get to it or it's this other department that doesn't have the teeth to fix people just an African problem is decided that way. Yeah, yeah, it's

Unknown Speaker  23:47  
so

Anna Collard  23:47  
I mean, it didn't wasn't all resolved like did you get

Ryan Purvis  23:51  
so you already buy cars they bought they try to get credit credit card, they try to get closing accounts done. So I had to go through a whole rigmarole with Equifax Equifax, Equifax Yeah, go challenge all the transactions and I had to put a passcode on my credit profile which which still exists today. And that was fine. And so it took a while sorted out but it got sorted out, but they never got caught. So it's one of those things where it current and more pain and frustration and irritation for me than actually solving the problem again, you guys and we've kind of figured it out that what they did is we had cleaning service come in. And maybe the usual pinos six, that's another game for that day and they must have grabbed the payslip off my desk or something like that. And then, because we weren't, we weren't in there in the house, every time they were cleaning. They're somehow arranged to have my driver's license reissued. And in addition to the new driver's license, and then we actually had the one car dealership actually had them communicating with them at times, and that's why I tried to police involved and he was asking him to keep providing More documentation, more proof of income and like other stuff. And you can see that they've taken a bank statement. But then the transactions were incorrect, but my bank details with everything else is correct. So it was good. It was quite carefully done. But because we were aware that it was illegal, that we're getting anyway. And then we said all those keep them busy until they get to they give up. And because the cops aren't getting involved, and then yeah, so So the solution you can call the CFS, di Fs, which are armorstands, basically, it's a, you put a note that you you've been impersonated. And then anytime you get to be creative, they won't get you anywhere, you have to go to the phone call process, but then also having the passcode or credit profile. Anytime I try. Like when I bought a new car two years ago, the dealer said you've been declined. So no, I haven't been declined. But you need to get your credit card and phone, the Bureau, the bureau if I mean, he asked me when I say yes. And then number three. And that's because I stole my identity. So you know, that's that is like you say, Alaska. That's law school. And I mean, mine, you know, my kids are very young. How are your kids out there? But I'm looking at my nephews and that I mean, that's on the on the device at the same time I see them. But they're not really? How are you still worried about any information they're sharing on there? Or, you know, they've never mentioned that, oh, you need to have a passcode on my tablet, because it's secure that they don't have that sort of worry. And they really should they should value their data. And I think that's the underlying problem is.

Anna Collard  26:42  
Yeah. But that's the that's also the challenge for the parents and my friends. My kids are still relatively young, so they don't, you don't allow them. It was hairy six, is asking for one, but as long as possible, like them, a lot of my friends who have other kids that they also tell me Look, no, I have no idea. But how do you set up parental controls? I'd like to find out more about it. But it's so complicated. So how do we you know, I mean, they are concerned about it, but I think that they're just overwhelmed, especially moms or dads that are that don't have any technical technical background, that might even be aware of it. But they just then they let that second step to Okay. What What is that he can actually do? And isn't that one could do. And again, I think the opportunity is there to provide content and make it really simple and easy to understand. I mean, my actually my mom in law, she said, Yeah, I just wanted on like a on my phone already. So when I need it, and I know where to go, you know, if I need a parental control for my grandchildren, and then on YouTube, I know, I don't have to know Google ads, even though it's easy, but for the granny, she just wanted one click. And then he did you know,

Ryan Purvis  28:00  
with a few techie guys, and one of them has said that he set her up on his recess. And so that's where it happened. And it's about you know, no phones in the bedroom, no TVs in the bedroom, you know, when you go to bed at night, your phone charges downstairs, there's some content because these applications don't really have a content level sensitivity. So don't worry about what you're saying on there. But you can limit the amount of time they spend on you. And that's probably the way to teach your kids as opposed to how the technology solves the problem.

Anna Collard  28:33  
We actually have a few years ago, I worked with sanlam. And we did like a, you know, a sort of cipher line at home page for the for the employees, but obviously, you know, for them to use it with their children. And I think we created the one soccer like a family agreement and sort of a policy that the parent can then talk the kids through and obviously number one was you know, don't ever meet anybody in real life that you haven't verified you know, see that's the number one thing but then also talk about things exactly like he said, how much screen time when and where and then all the safety and security precautions but in a very simple it's just a one pager that can vary simple plain English and parents can sit down with the kids and

Unknown Speaker  29:19  
poke it through

Unknown Speaker  29:21  
that's that was quite successful.

Ryan Purvis  29:23  
You don't have to have a copy of that anyway that you could share it but I think that'd be useful to share out.

Anna Collard  29:27  
Yes, I'm sure so fine. And it might be a little bit dated now but I think the principles are still the same.

Ryan Purvis  29:33  
I'll share it with you. Yeah, I'd like to say because that is to say you know a bunch of techies and I think that is the the transmission thing you need technical tools just everyone Yeah. And a six year old men that may not be rational To be honest, you rationalize it, but at least they know that they are discussing something with you to get what they want, but through you know a structure

Unknown Speaker  29:59  
Yeah. Cool.

Anna Collard  30:01  
Yeah, I mean, I think that there's so much opportunity now like we had a plastic we did brown tech roundtable discussion about the government and the challenges to digital size in South Africa, and there were quite a few, you know, like other tech companies represented amongst others Gattaca from captured Ramesh aware of what they've done is actually going on all day. So they during the actually before the pandemic, already, they created this communication channel, by which, you know, citizens can communicate with the government. And instead of developing something CF, they just sort of said, Well, what are people using their phones already, and everybody's on WhatsApp. So they hooked into WhatsApp. And then during the coven pandemic, they use that to allow people to apply for grants, and verify the identity and all of it sort of without having to go anyway. And they grew massively. I mean, they had to within a few days, I think scowl, I don't know how many millions of messages they got in, but you can imagine, you know, when people apply for grants, and that's such a beautiful success story, when technology really helps the government to sort of, you know, jump ahead. And so the discussion we had last week was then about what are the other What else could be done? And obviously, the government, we can't expect the government to have an answer. So but I just I kind of said, Well, we should, as an industry, just come together and sponsor hackathon and and sort of reach into the youth and the talent to find ways to, you know, innovate. And then you're a you're doing a couple of things, you, you assisting the youth to think in the right direction and building capacity when it's needed. And one of the solutions that we brainstorm was we need a search like somebody who ments the email address that nobody responds to. And so we have to build up some security skills, which obviously, we don't have enough, worldwide, but especially not in Africa, and maybe come up with a way to like the grafted guys have done to automate a lot of the process that you can, I don't know possibly report something by WhatsApp and you get like a part response back initially, like just doing a bit whatever that might be. But idea is to really and you know, trend microphysics and other company know who we also think cool, we happy to sponsor it. And the U WC guys have been a bunch of students quotes, the digital innovation labs sponsored by Samson take him to like, you know, provide the students and hook into bits University and say, you know, what, there might be something cool happening. And I don't know, it's still very much in the infancy, infancy. But whenever you have challenges like that, yeah, starting there, I think there's so much opportunity out there really is and to do good and helpless job creation, and, and have the government, you know, build a better, more secure

Unknown Speaker  32:59  
way of

Ryan Purvis  33:00  
doing things. I figured out early, it's up to the government to solve a problem. And I think that's a mentality problem in culture organization, that people expect to fix everything. And, and that's why the government isn't getting anywhere, because it's trying to fix too many things. And it's almost the Marshalls approach. We go do something. And the next week, the partners embolism, and shoot the same thing.

Anna Collard  33:26  
Yeah, not sure. And I mean, that they don't have the skills, either. I mean, if we, as an industry already can't find the skills, how can government organization, you know,

just have to collaborate together?

Ryan Purvis  33:41  
Now, I'm looking forward to see where that goes. I mean, when you when you think about the future, I mean, what do you see that being for information security training, or getting people educated?

Anna Collard  33:52  
Yeah, I mean, I hope that, you know, we'll see much more collaboration, you know, that's something that I'm kind of driving nine, my new role, I actually have the luckily I have like, the scope for that, you know, was before I just you have ideas, but you don't have the time for it. And that's sort of part of my role she work with different organizations. So I'm very, I guess, very lucky to have put us in position now. So I'm hoping that now we also collaborate with a Nigerian organization and they also offering like free security training to the SMB. SMB is in Nigeria, and we provide a social engineering training, you know, so so just obviously, we have like our, our product that we sell into the corporate environment and the businesses but with that comes a lot of, there's like a research arm and sort of freebies that we love to sort of share that will help and more social entrepreneurial organization to get off the ground. And and I think Long in the long run, I would love to see the communications ministers or departments to make that a security part of a curriculum and at school level already, not just at university, I think at a school level, and both for teachers as well as the as well as students to improve that at that level already. And another thing that I'm involved with, which I also think is very, very interesting is we've ran a survey across predominantly Kenya and South Africa. But they were also quite a few responses from North Africa and West Africa, we had 450 teachers responding and the question that we wanted to find out is how do we get more particularly girls attracted into the tech and the cybersecurity space. And the responses were really interesting, because some of the stuff that they said was a quarter of the students actually don't have internet at home. So whatever we do needs to be available in the classroom or to the teachers to then somehow share with the students. And one of the things that they're looking for is, you know, success stories, that's really other women, particularly African women, who've made a success of themselves in the tech sector in the security space. And then, you know, have them share their stories, and then was sort of guidance on how you can enter into that space. And and then again, I think it's actually something that's very easily doable, because you just asked, Can you just reach out to these women and ask them to record themselves for a few days, professionally edited, and you know, and then share that with the teachers who can then in turn, share it with the students and hopefully, inspire more girls to not just go this, the boys went? You know, obviously, that's one area we've been identified, and we don't have enough women in industry, and particularly in Africa, we don't have enough security skill. So that's something again, that could be a cool thing, and of capacity building by tapping into the use. Um, so yeah, that's, that's, yeah.

Ryan Purvis  37:07  
I think there's a sexist reviewer, but I don't think there's enough confidence or confidence that a young girl could go into cyber, and a lot of male dominant, dominated roles. And the main ones a friend of mine on Friday game, fair enough, he's a guy, but he's coming from a marketing background. And he's like, he wants to do a change. And he wants to go into cyber and he keeps saying, you know, how can I go into cyber have a marketing person but the technical skill not? In fairness, most your market skills are probably more, more attuned to cyber then your technical skills, because lots of there's lots of technical guys, but but most information security breaches are based on humans doing things that they should have done.

Anna Collard  37:51  
Exactly. And we need communications people. Yeah. Marketing Communications background, so he's actually hired the moms, you know, like, every, all of our customers need to make what we call them campaign managers or security awareness managers, you know, and they would much prefer somebody with a communications change management marketing background than a technical person. Yeah. Yeah, that is, you can stay in theory, if you

Ryan Purvis  38:20  
anyway, yeah. Cuz, I mean, I think that's the thing is, it's one of those industries that's young enough that the mood of his background his abilities are versus say, banking, we've done the same way for champions. Change.

Unknown Speaker  38:35  
Yeah.

Anna Collard  38:37  
And I think that's also the feedback that some of the teachers gave us did make it cool, you know, and, I mean, look, I mean, we've been working security for many years, we think it's cool. I thought it was super cool back in the day, but I think that the maybe for the mainstream, it's not cool enough. So we have to find a way of making it really attractive to young girls.

Ryan Purvis  39:00  
Bed hacking movies, where they see something on a screen and all of a sudden they're inside a bank, and it says, you know,

Unknown Speaker  39:08  
yeah, and we'll be pretty cool.

Ryan Purvis  39:15  
Yeah, so I mean, what are your so we didn't you Robin started September. You know, what, what are your sort of plans for that for them in the future? That's still being figured out.

Anna Collard  39:25  
Yeah, and we know, this is still very new. And but So like I mentioned at the beginning, I love research. So, um, you know, we'd have the culture company from no way Do they really do fantastic work and they have like a professor called Franco Petrus. I think it is and he's, you know, he's like a, like the guru of assessments and things, social studies. So it's really amazing to tap into that and work with them and collaborate across other industries to see Know what kind of research can be conducted together to, you know, make, make, create the right content make the right decisions in terms of not just a slogan for the product, but for the market, you know, it's like this thing we do now with the teachers is it's not really productive, and it's more vital, the bigger kind of story. And so I'm really looking forward to those kind of projects, and then I'm heavily involved in content side. So really going back to how I started, you know, started with reading content. And that's just something I love, you know, I just put my earphones on and credit, painting concerts, you know. So that's sort of what I'm looking at in terms of new products, what is really interesting or fascinating that we're working on is to find a way to provide, you know, suggestions of content on an individual level based on the security culture that they are at. So if somebody has a low attitude, for example, what kind of content could be provided will help better that, you know, and then within sort of AI engine in the background, that will then automatically suggests the right kind of content? So that is, I think, from a strategy along the long road, we'll be going, and I think that's a really fascinating, dude.

Ryan Purvis  41:25  
Yeah. And that goes back to the Netflix analogy. I want you want to give us a maybe maybe an insight to how you started, because I mean, your your background is very similar to the Dimension Data, because I was there as well. And, and you're an auditor, which I've definitely been in order to live in orange, and many times for information security stuff to get into to starting your own business and then getting more money.

Anna Collard  41:50  
Yeah, I mean, I started as I mentioned, data as a security, sort of the link between the engineering team and the sales team or product manager initially at Internet solutions, actually, and then moved more into security, consulting and architecture, and also auditing. Over the years, and then I think, pretty early on, I realized that a lot of our customers didn't do enough, who they users would have had back a post up somewhere, pretty late one, you know that that was it. And then then, as a child, that was I was always drawn into drawing cartoons like that was like my thing. And when we went to honeymoon, I did like a whole as drew a whole storyboard of these characters called poly scumbag and rather than a data that I came up with a ton of schemes and steal, information, etc. And I saw the storyboard T of mutual at the time was based on side who has a fun kind of thing. And they just, they liked it, they said I you should do this. And by the way, you should not do six modules. And you have to create a learning management system, which I had no idea at the time, it was literally just a, hey, look, here's a few drawings and an idea. And then Luckily, it was really a contracted dimension. So whatever I did, was sort of my intellectual property. And that's how it started. So it was literally of mutual, guiding me into what they wanted or needed. And then from the group, you know, then I went to sand lamb, and they liked it. And that's sort of the company that dealt with. And that idea became the business probably, but two years later, I'm still working for dimensioned data, and just doing this on the side. And then 2014 explained my son was born, and then a

mobile only son only have my first job.

Full time I just did the popcorn.

Unknown Speaker  43:56  
That's a great story. And then how did the connection comes with it?

Anna Collard  44:02  
Yeah, that was quite a coincidence, or I don't know, like, we managed to somehow make it onto Gartner Magic Quadrant, you know, they I think they liked the approach that I took a very simplified story based approach. And I really wanted to bring beauty across in a simple way that non techie people can understand it and make it memorable as well by using stories. And we then also got through local customers, so they kind of said, Oh, they can't use cartoons, you have to use live action video and through got into the whole production side of things, and that put us on a map. So partner, you know, like that everyone and Gartner Magic Quadrant. And obviously, in order for you know, being a much bigger American company, they enter time that the Gartner analyst actually moved from Gartner to know before he knew us and, you know, our continent to that connection. You know, they reached out and said, Look can we work together? And then just drop the bomb that can be quite universal? Wow, he's 17. And yeah,

Ryan Purvis  45:08  
we'd love to hear some African success story. So that's great to hear. Yeah, thanks,

Anna Collard  45:13  
Ryan. Yeah, that's been, you know, I wouldn't wish for a better acquisition partner gets, you know, they really they've grown from strength to strength, and they have such an amazing leadership and strategic outlook. And credible people, you know, working with Terry and the research team, and no way and you know, it's really such an honor. So that's awesome. Be in that field right now,

Ryan Purvis  45:38  
for the testing and testing. time anyway, it's close enough. So is there anything else you want to cover? Or? No, no,

Anna Collard  45:45  
it's fine. Like, I think my kind of main message is always about, you know, Africa and finding a way to collaborate between the telco industry and the government as well as the rest of the industry to have the consumers because any that it also has a sort of maybe the closing kind of thought to find ways to work together in solving the challenge.

Ryan Purvis  46:08  
Great, thank you. What's the best way to get hold of you or follow you on Twitter or LinkedIn? to do that?

Anna Collard  46:16  
Yeah. LinkedIn, as well as

on post platforms. And I'm not great at twitter. So I'm actually better on LinkedIn.

Ryan Purvis  46:33  
Yeah, I think we have time today. It's been great conversation.

Anna Collard  46:38  
Yeah, I think you right now. It's been awesome.

Ryan Purvis  46:42  
Thank you for listening. Today's episode, and the big news, producer, editor. Thank you for your hard work for this episode. Please subscribe to the series and rate us on iTunes or the Google Play Store. Follow us on Twitter at the DW w podcast. The show notes and transcripts will be available on the website, www digital workspace that works. Please also visit our website www dot digital workspace that works and subscribe to our newsletter. And lastly, if you found this episode useful, please share with your friends or colleagues.

Transcribed by https://otter.ai

Anna Collard

SVP Content Strategy & Evangelist KnowBe4 Africa

Anna Collard founded security content publisher Popcorn Training–
a South African company that promotes Cyber Security awareness
by using innovative, story-based techniques and gamification
to make complex content simple to understand and easy to
remember.
Anna has been working in the information security field for 18years
assisting corporates across South Africa, Europe and the US
keeping their information assets safe and holds various security
certifications such as CISSP, CISA, ISO 27001 lead auditor, CIPP/IT
and used to be a Visa/Mastercard PCI DSS QSA.
US-based Cyber Security Awareness Training giant KnowBe4,
acquired Popcorn Training in 2018. Anna maintains her role
as Managing Director of Popcorn Training/Knowbe4 Africa driving
security awareness across the African continent.