American View: Is Your Security Training So Boring People Would Go Anywhere Else to Escape It?

Management

Let’s talk about “tuning out” of boring training. It’s something that we’re all guilty of. When content, delivery, or both fail to engage us, our minds drift to something – anything! – else that’s more interesting. Turning out is as natural and unconscious as breathing. Attempting to sit silently and motionless in a hot, stuffy classroom while a stranger drones on about a topic you couldn’t care less about is a real challenge no matter how “mature” you think you are. Same goes for clicking one’s way through a boring online training module.

If you’re expecting me to reveal a “secret method” for mitigating this, I’m sorry ‘cause that ain’t gonna happen. I’ve tried every “trick” I known over the years. None of them worked. The only technique that keeps users awake and attentive during a boring class is a high-energy instructor. That said, talent and enthusiasm can only make a dull topic tolerable for a while. There’s only one technique that can get users to engage, and it’s nothing that students can do for themselves.

As an example, when I was in the Air Force, I’d bring new technology classes to our base for my entire team. It was important to me that everyone in the unit understand and learn the tasks that only one of our eight shops might be responsible for. This cross-training helped people support their mates. It also built empathy for other shops and helped everyone understand how to plan and manage complex projects. To their credit, most of my senior techs were on board.

The first years of our all-hands training program went well. Even the videographers took to our “LAN Troubleshooting” class like ducks to water. Everyone devoured the “Supporting Windows XP” course before that OS was approved for military use. Most topics we taught had a little something for everyone. That meant our live, instructor-led classes had a party-like atmosphere; they were team building exercises as much as they were sources of professional education.

There were some snoozers, unfortunately. When my network managers asked for training on Microsoft Systems Management Server so they could set up automatic patching, I was happy to provide . We had money in the training budget and a light week on the schedule that would support another class. Everyone entered the session high-spirited. Our sysadmins were giddy. Everyone listened politely, participated in the hands-on exercises, and tried to keep the mood positive. The boss, however, was immediately bored to tears.

Hi. I was the boss. Too subtle?

Maybe it was because of the instructor’s low-key delivery. Maybe because I was forbidden by policy to apply any of the skills we were being taught. Maybe it was the oppressive summer heat leaking in from outside.

Maybe I was drained from all the office drama I’d been grappling with. Maybe it was aliens. I had no idea at the time why I’d bounced off the topic so hard. All I could say with confidence was that I was ready to nod off at 8 a.m. and the classes ran until 5 p.m. I fought to engage with the content and consistently failed.

I couldn’t just leave; I had to set the example. Everyone participated. I couldn’t be caught napping through the lectures. So, in desperation, I mentally and emotionally disengaged from the lecture and started dreaming up adventures for my kids and jotting them down in my notebook.

For reference, I was teaching my kids to play table-top role-playing games at the time. I’d recently introduced them to GDW’s near-future horror RPG Dark Conspiracy – a monster hunting game set in a dystopian, pre-cyberpunk world. Think The X-Files, but set in the Max Headroom universe and you’ll be in the right headspace. [1]

The more I shut out the “blah-blah-blah SMS” lecture and noodled the more my creativity sparked. Within an hour I’d written an entire script for a one-session “episode” where Our Heroes got hired by a pet shop manager to capture and return an expensive sparrow hawk that had escaped its cage. The adventure began with the heroes breaking into a shopping mall after closing, sneaking past the rent-a-cops, finding the fugitive bird, unsuccessfully chasing it through the mall, and eventually stumbling onto a pack of cultists attempting to summon an eldritch horror in the food court (it was a horror game, after all). Desperate fighting ensued.

The bird was a MacGuffin; an object necessary to the plot that motivated the main characters but was completely irrelevant to the larger story. It was something to be chased but never caught. Hence, the name of the adventure was “The Mall-Tease Falcon.” [2]

I WILL NEVER APOLOGIZE FOR THAT HORRIBLE JOKE!

The entire adventure had unfolded in one fell swoop – so to speak (see also [2]) – from the opening pun. As I struggled to keep from falling asleep in the SMS class, I took wrote the entire script out in an hour. I felt exhilarated when I was finished. I was wide awake and energized, so I tried re-focusing on the SMS lecture … and immediately started to nod off again.

Suffice it to say that by the time the class ended that Friday, I’d written sixteen adventure scripts – all based on terrible puns – and couldn’t tell you anything about how to employ SMS to deploy patches. I passed the end-of-course exam but couldn’t claim to have “learned” anything. That said, I still considered the week as a success. My sysadmins were thrilled with the content and used what they’d learned learned to build, test, and deploy our first SMS server. So … yea?

There are three reasons why I chose this anecdote: First, I wanted to encourage everyone to be honest about the classes they’ve “bounced off” of. None of us are immune. We can’t fix a problem until we understand why it happens. Since this problem is embarrassing, I can see it being uncomfortable enough that people might pretend it doesn’t exist. For them, at least.

Second, I wanted to make it clear that an enthusiastic instructor can make nearly any subject engaging if their delivery resonates with their students. There’s a darned good reason why high-charisma people compel participation, whether in a classroom, from a stage, or in a sales pitch. Good delivery is important, especially when the material is dry.

That said, I contend that intellectual and/or emotional disengagement with training isn’t always an issue of fatigue, environment, or skill deficiencies. Most of the time, I suggest, disengagement comes from a student’s inability to answer the essential question “… and Why Do I care?” When a student can’t understand how the topic direct affects their daily life, they bounce off it. This isn’t a personal failing. It doesn’t matter how experienced, mature, or intellectually curious a student is … when a topic seems irrelevant, the student’s brain can’t be persuaded to “waste” time on it. I suspect it’s an atavistic energy-saving technique that first manifested in Cro-Magnon staff meetings.

Is it just me, or does this 5,000-year-old cave painting from Thailand satisfy all the requirements to be a fully-acceptable Jira story?

I believe that accepting this truth is crucial for everyone involved in the human risk career field. Just telling our users that they need to learn security hygiene skills isn’t likely to resonate with a significant percentage of them. Sure, there are those rare people who can engage with and memorize anything you present. They mustn’t be the standard we build our courseware for. We need to reach everyone. That means we must create and hone our courseware to engage the worker who’s tired, distracted, under too much pressure, and who doesn’t have the cycles to spare for yet-another mandatory box-checking class. We need to reach everyone where they are.

Remember, those of us in the training business are competing for more than just ears and eyeballs; we’re fighting for scant processing time and retention. To get past users’ natural resistance, we must make clear why our stories are important to them first. Think of it as unlocking access to a restricted space. Until you’re allowed in to make your case, no one hears what you’re saying.

That’s why I think it’s our responsibility to clearly communicate how, when, and why our security topics directly affect the individual student up front. Just being entertaining in how we deliver our content isn’t sufficiently motivating for most folks; we need to “hook” them emotionally before we attempt to present our ideas and instructions. Once we clearly communicate why a topic matters, they’ll agree to listen to us and not nod off … or mentally relocate to a more welcoming and stimulating dystopian hellscape where their decisions and actions matter.

[1] Double internet points for you if my comparison brought to mind Chris Carter’s follow-on projects Millennium and Harsh Realm.

[2] BWAH HAH HAH HAH!

Improving Business Performance