Explore how resilience, culture, and community connection drive cybersecurity in a compelling conversation with Dr. Leanne Ngo at AISA Cyber Con 2024. Discover actionable insights on empowering diverse communities, fostering belief in human potential, and building a secure society through collaboration and education.
Guest: Leanne Ngo, Associate Professor, La Trobe University
On LinkedIn | https://www.linkedin.com/in/leanne-ngo-86979042/
Hosts:
Sean Martin, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining CyberSecurity Podcast [@RedefiningCyber]
On ITSPmagazine | https://www.itspmagazine.com/sean-martin
Marco Ciappelli, Co-Founder at ITSPmagazine [@ITSPmagazine] and Host of Redefining Society Podcast & Audio Signals Podcast
On ITSPmagazine | https://www.itspmagazine.com/itspmagazine-podcast-radio-hosts/marco-ciappelli
____________________________
Episode Notes
During AISA Cyber Con 2024 in Melbourne, Sean Martin and Marco Ciappelli sat down with Dr. Leanne Ngo to discuss cyber resilience, community impact, and the role of culture in cybersecurity. Their conversation explored the intersection of technology, education, and human connection in the pursuit of a safer and more secure society.
Dr. Ngo shared her perspective on resilience, highlighting its evolving definition. While digital tools increase opportunities for connection, she emphasized that face-to-face interaction remains vital, especially for vulnerable communities. Her work in promoting cybersecurity awareness involves building trust and understanding among diverse groups, tailoring approaches to their unique needs and cultural contexts.
The discussion turned to the importance of culture in cybersecurity, with Dr. Ngo describing it as a gradual process of change driven by action and integration into everyday life. She stressed that cyber awareness—often focused on knowledge—must evolve into behavioral transformation, where secure practices become second nature both at work and in personal lives. This requires understanding the subcultures within organizations and communities and adapting strategies to resonate with their specific dynamics.
Sean also brought up the concept of belief as a cornerstone for driving cultural change. Dr. Ngo agreed, emphasizing that confidence and a growth mindset are essential in fostering resilience. Drawing on her experience as a mentor and educator, she described how instilling belief in individuals’ capacity to contribute to a secure society empowers them to take ownership of their role in cybersecurity.
The conversation explored practical ways to bridge the gap between technical solutions and human-centered approaches. Dr. Ngo highlighted her work with the Australian government’s "Stay Safe, Act Now" campaign, which focuses on localizing cybersecurity education. By adapting materials to the values and practices of various communities—such as the South Sudanese and Cambodian populations—her initiatives create relatable and impactful messaging that goes beyond surface-level translations.
Education and workforce development also emerged as key themes. Dr. Ngo underscored the importance of short, targeted training programs, like micro-credentials, in addressing the growing skills gap in cybersecurity. Such programs offer accessible pathways for individuals from all backgrounds to contribute meaningfully to the industry, supporting Australia's ambition to be the most cyber-resilient country by 2030.
Closing the discussion, Dr. Ngo reinforced that cybersecurity is fundamentally about people. By fostering empathy, understanding, and a collaborative spirit, society can build resilience not just through technology but through the collective effort of individuals who care deeply about protecting one another. This belief in human potential left an enduring impression, inspiring attendees to think beyond traditional approaches and embrace the human element at the core of cybersecurity.
____________________________
This Episode’s Sponsors
Threatlocker: https://itspm.ag/threatlocker-r974
____________________________
Resources
Learn more and catch more stories from Australian Cyber Conference 2024 coverage: https://www.itspmagazine.com/australian-cyber-conference-melbourne-2024-cybersecurity-event-coverage-in-australia
Be sure to share and subscribe!
____________________________
Catch all of our event coverage: https://www.itspmagazine.com/technology-cybersecurity-society-humanity-conference-and-event-coverage
To see and hear more Redefining CyberSecurity content on ITSPmagazine, visit: https://www.itspmagazine.com/redefining-cybersecurity-podcast
To see and hear more Redefining Society stories on ITSPmagazine, visit:
https://www.itspmagazine.com/redefining-society-podcast
Want to tell your Brand Story Briefing as part of our event coverage?
Learn More 👉 https://itspm.ag/evtcovbrf
Human Factors in Cyber Security: Cultivating Cybersecurity Culture and Cyber Skills Gap | An Australian Cyber Conference 2024 in Melbourne Conversation with Leanne Ngo | On Location Coverage with Sean Martin and Marco Ciappelli
Please note that this transcript was created using AI technology and may contain inaccuracies or deviations from the original audio file. The transcript is provided for informational purposes only and should not be relied upon as a substitute for the original recording, as errors may exist. At this time, we provide it “as it is,” and we hope it can be helpful for our audience.
_________________________________________
Sean Martin: [00:00:00] Check, check. Perfect.
Marco Ciappelli: We're already recording, may I join? Alright, Thank you so much. Shawn, we are almost at the end. I'm glad you decided to join us. We're talking about society so, I, I feel like culture and culture. I want to definitely be part of this conversation, which is one of the many that we had in this three days here in Melbourne.
Sean Martin: Fantastic. Very, very
Marco Ciappelli: glad that we made it. Yeah. I'm, uh, my brain is tired, but also full of thoughts and knowledge. So
Sean Martin: same for you for the
Leanne Ngo: few days. Oh, absolutely. I mean, I've changed into, um, sneakers. I live on sneakers.
Marco Ciappelli: Yeah, so Leanne, you had a session here, and we want to start with a little bit about who you are, what you do, and what you did talk about here.
Leanne Ngo: Absolutely. So I'm Leanne. [00:01:00] Now, I'm going to tell you a bit about myself. I think it's really important because my passion is on creating, fostering, um, building cyber security culture and awareness, resilience across society.
And looking at the human aspect is really important. And also knowing oneself is important. So I'm going to start off with there. So I think, um, it would be great to get to know who I am. So I'll give you a bit of history. My grandparents were born in China, South Eastern China. Civil war down there, alright.
They migrated down to Cambodia, my parents were born in Cambodia, alright. Civil war again, Khmer Rouge. We were made as refugees, came to Australia, alright, in 1983, couple months old. My parents always instilled safety and freedom, right, and also work ethic and resilience, and obviously they're being resourced.
But safety was the number one key point. They weren't tiger parents, by the [00:02:00] way, but they did, you know, say, education is very important. And my journey at the moment, um, we came to Australia with nothing, right? My dad worked at the farms for 10 a day. My mum had to look after five kids. And she picked up sewing, sewing clothes.
From 7am to 12 o'clock midnight, she had to do that. But she relied on a lot of the women that were working, working at home, looking after their kids, so mentoring with being responsible.
So I went to a state school, right, state school. I wasn't a grade A student, I wasn't a bad student, alright. Um, I did okay in primary school, high school, I did okay in uni. Now, when uni came in, I guess I found my niche, right, found my niche. It was IT, it was computer. Um, a whole heap of people. I guess I did well, right.
I was tapped on the shoulder to go, would you like to research on e commerce security? I said, why not? So I did that. Um, did really well, they gave me a scholarship. I guess I did well, they tapped me on the shoulder [00:03:00] again. Would you like to do a PhD working with companies to look at culture and awareness?
And I thought, okay, why not? Um, they gave me a scholarship. Now, what we found, this was 20 years ago, by the way, 20 years ago. And, um, and during that time when I was doing my PhD, I was also given the opportunity to teach as well at university. My first lecture was horrific. I was not, it was so bad. And I knew in the back of my mind, right, I had to do something about it, you know, because my parents instilled, you know, work ethics.
So, over the years, Alright, I had enhanced, improved on that. Yes, I had the cultural side on, um, cyber security culture on the side. But, um, most recently, building up resilience, um, along the way. Um, won multiple awards in teaching and won a National Australia Award for University Teacher of the Year, etc.
But the culture thing in organisation, years ago. This is 20 years ago. [00:04:00] Um, we were looking at ways rather than have that in person, like, what can we do to change the awareness programme's, culture programs so that it is that can be more scaled up? And back then, it was CD roms, right CD roms. So online education, So education, teaching, combining the two, understanding the people, the stakeholders, what's important.
So, um, but I did that, it took a few years with these small, medium sized enterprises, loved it. But when I submitted my thesis, And then at the day, as a PhD student, right, finding a job is really important. Online learning was booming. Cyber security was getting there, but culture was very embryonic back then as well.
I was given a job straight the day after doing my thesis in the online learning, and that was booming at that time. So I'd been in that area for quite a while. Then, um, I took a bit of a break, a one year's break. I turned 40, and I thought, what next, right, what next? Um, I love community [00:05:00] work, um, you know, working with my communities.
And when I was on that break, I wasn't working, before the Medibank and Optus outbreak we had in Australia. I can count up to 50 friends, family, community members who were scammed, had a cyber breach. When those two incidents happened, it grew dramatically, 300, 400, 500, I 000 vulnerable community members.
And I thought, what can I do, you know, with my education, with my connections, my cyber security passion. What What can I do to help? And that's why I'm back in this role, um, in the last couple of years. And the whole focus on human factors and security culture and building cyber security resilience is such a big thing.
And that's for me, that's my value, that's my purpose. Empowering the next generation of learners and building cyber resilience in our communities. So it doesn't matter who I'm affiliated with, that's my aim and that's my purpose.
Sean Martin: I love it. Fantastic story. And I wonder, as you were talking, I was thinking.[00:06:00]
Resilience. Does that word mean something different 20 years ago to now? And I'm thinking, tying culture into this, um, things have changed in society, right? We were just talking about, um, we all live on our devices, we're not, less of a family union, less of a, community in person. Um, does resilience mean something different now because we're so insulated and looking inward towards ourselves versus a broader community?
Leanne Ngo: I think resilience, depending on what it is, look, the COVID 19 outbreak, pandemic outbreak, impacted everybody, right? If I'm talking about vulnerable communities, right? Digital gadgets, etc. Yes, absolutely important. But they still need that face to face interaction, right? Everyone's gone through some form of, [00:07:00] you know, disruption.
They have to fall, pick themselves up, and you know, keep on walking, that kind of approach. But I believe the gadget is there. It actually increases the opportunities for further connections and networking and talking to people, etc. in that space. But I still feel that, that in person nature is really important, because I work a lot with our local vulnerable communities.
So I sit on the board of directors of one of the largest, um, Southeastern Community Services Link. We've got a lot of vulnerable communities there. They still value that face to face connection across there.
Sean Martin: Yeah, and I, I'm wondering, I'll put it even more bluntly, are people selfish now? And less giving, um, because of technology.
And do they only worry about themselves from a security and resilience perspective? And everybody else is up to their own. I don't know. And there may be a regional difference as well. I don't
Leanne Ngo: know. And can I tell you this
Sean Martin: story?
Leanne Ngo: Now, I told you the story that I was on that professional, you know, career break.[00:08:00]
I'm now working at an educational proprietor. I do a lot of community work. One of the key things as part of my education programs, I teach human factors in cyber. When students come in, they're not just doing theory. My main aim, I've got that aim and purpose to build cyber resilience in Australia, because we've got this ambitious aim to be the most secure country by 2030.
We need to, and for me, getting any student, whether you're from corporate doing an undergraduate or masters, you're doing a study, we want to build you holistically to care about cyber resilience. You're, you're asking whether they're more selfish. I don't just teach them the curriculum, the content. I teach them in terms of being holistic individuals, and then they're being ethical.
And the activities, the learning activities, the assessments. I'll tell you the first assessment. It's on cyber security awareness. Choose a vulnerable community. The topic is on deepfakes. Go out there. Get to know them well. Don't just think about yourself, think about others. And I [00:09:00] like to say that. Over the last couple years, whoever I've spoken to about supporting vulnerable communities, they've realized it.
So the session that I had, um, on cultivating culture and building cyber resilience, I had repeat audience members that joined me last year. And they put their hand up and they said, look, I listened to your talk last year and I was inspired. I actually went out to my communities and actually built cyber awareness as well.
So I think when you say selfishness, I think that that's changing as well. And you really need people who are empathetic and who are passionate in that space. And I really do generally believe that as humans, we do care and we do care about ourselves, but we also care about our loved ones in society as well.
Because I'll set the moment. Yeah. Yes, we, for those who are in their professional roles, but we have different identities. We're part of different communities. We have loved ones. We have families. We have members. We have different communities as well. So, I believe in that, um, in terms of being selfish. [00:10:00] No, I don't think so.
I think that, that's changing. Um, and we just heard our, uh, Lieutenant General talk about building cultural change. The first thing you need to do is build cyber awareness, because people don't know what the threats are, what the knowledge is. You've got to build their knowledge first. The next step is learning.
Okay. So, um, we're going to be looking at
Marco Ciappelli: behavioral change and cultural change at the end. Well, I, I, I agree with you and, and I'm glad that this is our last conversation of this conference and we get to talk about this with you because we did touch on this topic in many different conversation we had from, uh, The corporate training to just to podcast before these fishing, fishing training and the human element and how I like to say that we still have a prehistoric brain and a really extensive technology that goes into the future.
And many times we do not understand it completely. So, when you go and [00:11:00] talk about breaking it down and try not to use the technology language, the cyber security language, and really be one on one with elderly, with the young kids, and find a formula that explains that technology has become part of our society.
As we close the door, open the door, or do things in the street, we also do it online. And I think that's when you really break. But, where I want to go with you is the idea of changing the culture. Many people say, Ah, we're going to change the culture of this company. They think they're just going to switch it, give you a book, here's the new culture, learn it.
Right, that's all I have to say. Culture takes time, right? You're What culture come from your grandparents and parents from China and I come from Italy, right? And I carry with me that even if I've been living in the U. S. for 24 years. So how do we accelerate? Maybe, because [00:12:00] technology goes fast, and culture goes slower.
Leanne Ngo: Look, absolutely agree with you. You are singing my language as well. A lot of the focus, um, over the last few years, and what I'm still seeing as well I'm hearing, is on cyber awareness. Cyber awareness is about knowledge, right?
Marco Ciappelli: Yep.
Leanne Ngo: Culture happens when you actually take action. Action at the end as well, when you're able to actually change the behavior of the thoughts and making sure it's normalized within their everyday work as well.
And also society, not just in work, but what they're doing in society at the same time. Now I've got a background in. Education and learning as well. Every single individual are all different. It doesn't mean they're culturally different. There's so many subcultures as well. You may have, you may be an extrovert, you may be an introvert, you may have mental health issues, you may have family problems, you may have, you know.
Um, a type of disability or you might be neurodiverse, there are [00:13:00] so many different nuances, so many different areas that you can apply to this. And with learning, everyone has different learning styles. Everyone has different cognitive abilities as well. So for me, when I talk about culture and cultural change.
You really need to get to know the stakeholder individual really well. When you go into an organization, you have different sizes of the organization, different industries, but at the same time, depending on the organization, there might be an overall culture, um, you know, like enterprise wide, but then departments will have their own set of cultures.
And then within the departments, you have stakeholders. Subgroups. They all have this type of cultures as well. And typically this is set from, you know, top down. We know that already as well.
Sean Martin: Can I pause you, because I think one of the, part of the title of your session is No One Left Behind. Yeah. Um, because I can see a culture that fits most, but then there's some of these subgroups that, that just don't quite fit in, right?[00:14:00]
Leanne Ngo: So, absolutely, so to give you an example, so our Australian government, they're very keen to build cyber resilience and culture across society. They've got this campaign called Stay Safe Act Now, right, it's a, it's a common language around, you know, digital safety and cyber security, alright, and they're looking at translating that into multiple languages, alright, but how do you go about delivering that and really, you know, implementing that, embedding You can't have that and have that hosted on a website.
That won't work. Yes, we've got the resources. But, for example, I'm taking that, I'm, I'm working with the Sudanese, South Sudanese community, the Cambodian community, um, women, just, um, and recent refugees and asylum seekers, etc. We're taking that. But we're also giving resources. Going to these communities.
I've built long lasting relationships with them as well. We need to know who they are, their working styles, their [00:15:00] lifestyle as well. We take the um, content, adapt it to suit it to their style as well. And we are looking at training, you know, training the trainer, getting them to empower them as well. It's what suits them.
And you need to know, and if you look at that from an organizational perspective, you're not gonna go in and take something off the shelf and go ahead, right. You need to. Get to know the organization, all the various departments, subgroups, and the people that are there, the champions that are there. And whatever you're communicating, and that's where the learning comes in, understanding the learning styles.
And yes, there's a marketing element, and yes, you need to know psychology and across all of that, but you really need to get to know the individuals and what actually works for them, right? And I do believe that, um, Um, psychological safety is a big thing. Being able, because back a few years ago, everyone was so scared about, you know, accident and clicking on a link and, you know, um, you know, in fear of, you know, being reprimanded in an organization.
I can see that slowly changing over time. [00:16:00] And it comes with leadership and, fingers crossed, there is a person who is leading in culture and awareness. within the organization that's there as a support. And they're not just there sitting in their ivory tower, but they're in there embedded across the organization.
All right? But the key thing is you get, you need to know the individuals, contextualize it really well.
Marco Ciappelli: Yeah. I think it's a, it's a dynamic. education. It applies to school, the school system as well. So I had conversation in, in, in the way that education now can use technology to be more uh, adoptive, right?
And then I look back at the time that I was in school and, you know, probably in most school nowadays, this is the lesson. It's for everybody. Somebody's going to be really bad. Somebody's going to be really good. But I also then I see the progress that you explain about yourself where I was like, you know, like mid school high school.
I was like, [00:17:00] yeah, I'm going by. Then when I went to college, then I found my niche and I excel at that because I really loved it and I could do it my way. It wasn't this solution serves everybody when ultimately it doesn't. It may serve the majority, but it will leave people behind.
Leanne Ngo: Look, and absolutely. And, you know, at the moment, I mean, you know, the education space, you know, we do have our traditional families.
three year bachelor's degree, master's degree, but the concept of short courses and micro credentials are gaining momentum. So, you know, back a couple of years ago, we're saying we need 38, 000, um, individuals in cyber security to fill that cyber skills gap in Australia by 2030. Our minister, um, Like we've been in Australia just a couple of days ago, just reported back that now we need, I think it was 80 plus K to fill the cyber skills gap.
So that's like a 60 percent increase, right? So we have these micro [00:18:00] credentials that are two weeks, four weeks to help upskill and reskill anyone and everyone into this space. So there are so many different ways. So you're talking about how are we going to do this more broadly and upskill. I believe online learning, But it's adaptive learning, immersive learning, different ways to engage with different learners.
Like for example, we have cyber escape challenges for those to gamify, you know, learning as well. There's so many different types and I think that's the key, having that learning element to it as well. Um, And making sure that the content that's there that's being delivered, it needs to be authentic. You can't just deliver generic content.
It's got to evoke emotions and feelings across that as well. Because you can talk the talk, but if you've evoked some emotion, they will listen, they will, you know, remember it.
Marco Ciappelli: I like the, I like the micro, like quick, because at least you learn something and then you can build on top of that. Years ago, we were always making fun of Fund.
Same thing in the United States. You know, we, we [00:19:00] need to fill the gap, but in order for you to be in an entry level, you need 10 years of experience. No. How is that going to happen? Right. But with the micro element and the niche I think that's, that's, that's a really good
Sean Martin: approach. Something that's been burning in my mind since the beginning of your story is belief.
You used to use the word emotion and evoking a feeling. And there's, to your point, in the early part of school you kind of got by. You did what you needed to, to get the exit to go on and do the next thing. Because
Marco Ciappelli: I didn't care about everything.
Sean Martin: Right. And then And then you found something you cared about and you invested in that.
So I'm wondering how much of a culture is built on a belief, a common belief. And we, we talked about, uh, in the last podcast, that series of, um, [00:20:00] societal contract where everybody feels safe because of the way that the society works. So they believe in that and they all adhere. I don't want to say adhere, but subscribe to the same belief system that this is what works for us.
How important is that for culture, like we're talking about here, not just learning something, but believing in the outcome as a whole in society, and how important is finding the emotion that feeds on that to then
Leanne Ngo: achieve the outcome. It is extremely, extremely important. I'm a big believer of positive growth mindset, and as I told you my story about my family, war torn country, coming to Australia, freedom, safety, and I believe cyber security at the moment.
We are in, um, in a world at the moment that we are just, there's so many threats coming left, right, and [00:21:00] center, at home, at work, globally, everywhere, at the moment, and I think hope is real. And I, I, and like I said, growth positive mindset, I would love to hope and believe that we are here in it together supporting each other along the way.
Um, and I think if you think negatively and fear, yes, there's a bit of fear, but then we won't go forward, you know, we'll stay backward and we need to be looking forward as well. And I do believe that there are people around you, you know, in privileged positions with access to education, um, that genuinely do care.
care about protecting society and each other along the way. So I do believe that that's something that's really important and I think, um, everyone that I've spoken to about, you know, let's work together, partner up, collaborate and build a more secure society. At the end of the conversation, they're like, Yes, how can we help?
Because they want to support each other. They know people, personally, that has been impacted. [00:22:00] Everyone. I mean, before I used to say, you know, it's around 80 percent who's been, you know, impacted by a scam or security breach. It's 100%. Everyone. I'm sure you have clicked on a link or something, you know, in the past that you've impacted, you know, you've been impacted by it.
It's everyone's issue, at the day. And, you know, and the belief, it's, it's there. It's something that we have. to be more secure, um, across our society in that. And I think with that belief and that hope, um, and not just thinking about yourself but about others in society, we will get there.
Marco Ciappelli: And then we'll do it.
I agree and I, and I like the idea of you can do a decision. Yeah. And at the same time, use technology to do it at a global level, but also go deep into the local community and adopt the way that you share your knowledge and teach them in the way that they'll be more, they will be more receptive because you talk their language.
It's not just the translation you were mentioning that, right? Translating the language doesn't mean that [00:23:00] you get the message through. You're not translating the culture. You need to build the message according to the value that, that
Leanne Ngo: culture has. No, no, absolutely. And the other thing I'll say to that is, and this connects with your question about belief, is building confidence in people that they can do it.
Yeah. And that's where my mentoring and coaching side to this. I'm a, I've been mentoring and coaching for the last 25 years. Um, across students, women, all abilities to cyber and tech professionals. And the common theme in there is about confidence and realizing their potential at the end of the day. And I think that's really important.
Mm hmm. I think Australia. Organizations to the community groups to families individuals It's realizing that confidence and that potential and that belief that we can actually Get there and be the most secure country by 2030 to secure each other. We've got The right infrastructure. We've got the resources.
We've got organizations We've got [00:24:00] people ready to go and I think it's that collaboration in that partnership. How do we do that? How do we collectively work together and cyber security is a industry? It's a field where you don't work alone It's like a group mentality. It's collective. People want to help each other.
It's quite
Marco Ciappelli: collegial,
Leanne Ngo: you know, in that space. So we're very lucky and very fortunate that we don't really have to convince people to come on board. It's there. People just want to volunteer their time to help.
Marco Ciappelli: And also, I'm going to add to that as an end to it, passion, because you're very passionate about this.
I can tell. I know that probably 95 percent of the people at this event, or if it's RSA conference or Black Hat, DEF CON, I mean, talking about passion there, everybody's passionate, and I think everybody, most of the people is not here just for the money, but is here because they do have passion. to make a better society.
Sean Martin: So, you know, it's not passionate, but technology. And that's why I love this [00:25:00] conversation. It started with the person and ends with the people.
Marco Ciappelli: Yeah.
Sean Martin: Ends with the people. It's always about the human. We have to have an active role, active role in this. Yeah. And driven by a belief and passion and great people like you.
Marco Ciappelli: And that's a great way to close our. Yeah. coverage here pretty much Of three days here in melbourne and leanne I'm glad that you made it and share your your thoughts with us and for everybody listening We hope uh, we'll we'll cover again next year and we'll definitely cover other events. So this is a goodbye and see you soon
Sean Martin: Two humans passionate about what we do A great, great way to have amazing people on to tell their story and inspire and, and, uh, hopefully share a passion with the rest of you.
So thanks everybody. Thank you, Leanne.
Marco Ciappelli: Thank you.