Context

I am managing a small team of consultants, technical architects and developers at a Cyber Security  firm. My team is responsible for incubating high-tech products which could improve cyber risk  posture of enterprises.

In recent years, cybercrime has grown at an unprecedented rate. Attackers are not only motivated  with monetary objectives but are often seeking to achieve Corporate Espionage and geo-political  goals. Since there exists no silver-bullet, organizations are forced to adhere to a multi-tier security  approach, and for that enterprises are required to build multiple competencies, such as:

•  Vulnerability Management   •  Risk analysis and Mitigation plan  •  Intrusion Detection and Prevention Systems (IDS and IPS)   •  Security Information and Event Management (SIEM)    •  Security Operations Centre (SOC) equipped with Cyber Threat Intelligence Capabilities   •  Firewalls and Anti-virus solutions

We are constantly in look-out for new ideas to be developed, prototyped and hopefully  commercialized. But stakeholder buy-in is a must before any substantial resources could be  committed.

Challenge

In our organization, every novel idea on the shelf first needs to be internally approved and then  vetted by the steering committee. Stakeholder buy-in is required at multiple stages and biggest  challenge faced by my team is to sell the idea to the senior leadership, who often have limited time  and technical expertise/inclination.

Recently we came up with an idea of developing a Blockchain enabled Access Management System,  but the challenge was to sell this to the senior leadership, in a meeting timeboxed for 20 mins.  Blockchain still being an emerging technology, we expected to face confusion and misconceptions in  the ballroom. Having learnt the Design Thinking Process, we knew that we were in the second phase  – trying to tackle “what-if”, exploring the possibilities our new idea presented. Now was the time to  communicate the idea to win stakeholder patronage.

Selection

Storytelling, as explained in Week 2 courseware, is a powerful tool to communicate an idea to the  stakeholders. It is an excellent tool to share experience, explain values and interconnections  between actors in a given scenario. More than helping solve a problem, a great story helps look for a  cause. A compelling story has following fundamental attributes:

1. It is created for a specific audience    2. It has a clear sequence of events  3. It has some carefully designed moments of reflections, which build suspense and intrigue  the audience

Nehemiah Thomas, Leadership Development Director at Mars Inc., explains in the 2nd Week class that a  story of transformation begins with a challenge that the organization currently faces and then  gradually introduces the actors impacted by the current situation and tensions that they have  because of the problem, and finally towards the end it provides the solution to the problem.

We selected storytelling tool, since in our situation, where we needed to convey our idea and win  confidence of the leadership, it appeared to be the best solution. Without getting deeper into the  technical details of the proposed solution, we wanted to convey its value and real-world problems it  could potentially solve. Storytelling seemed to be the best possible way of engaging our audience.

Application

We introduced fictitious actors – Mr. Unknown (a cybercriminal), The Alpha Retail (an online retail  store), Sam (an online customer) and David (information security officer). Via visuals and  storyboarding we explained the current challenge -

1. Sam needs to provide his email ID, password, credit card details and address details  (collectively referred to as Personally Identifiable Information - PII) for any transaction at  Alpha Retail. Sam is worried about any possible misuse or leakage of personal data  2. David needs to take every possible security measure to safeguard Sam’s PII stored by Alpha  Retail. It costs money but never promises infallible security.  3. One miss and Mr. Unknown steals away treasured PII – uses it for fraud, extorts Alpha Retail.

After establishing the real-world problem and its strong implications, we explained our proposed  solution where Alpha Retail will not require to store Sam’s PII anymore. Information once captured  will be hashed (strong encryption using SHA-256) and written on an immutable distributed ledger  (Blockchain). At login, Sam’s credentials will only be hashed and matched with the hashed record  available at the ledger, and access will be granted on successful match. Non-storage of PII, will  simply mean no risk of it getting stolen – thus reduced cost in security for Alpha Retail and better  efficiency at David’s end. Sam is happy too, as he knowns that his PII is not stored by Alpha Retail.

Insight

During the process of creating story, the internal team was able to reflect better on the solution. We  got to come at a better understanding and clear consensus about how different actors were  impacted and how our solution promised to solve their individual problems. It enabled us to present  a better case in front of the steering committee. Leaders, to which this story was presented,  engaged with the Idea and were able to appreciate the magnitude of the problem and the impact it  has every year on the retail industry. Storytelling enabled us to explain a complex business problem  and even more complex technological solution to a wide audience quickly and effortlessly.

Approach

In a similar situation, I think we will repeat the same tool, as it meets the constraint of limited time  and executive meeting scenario. However, if we will be allowed to extend the meeting for a longer  time, we would like to engage the audience also in the storyboarding exercise. We would like to  invite the leadership to pick up each actor and associate them with a set of challenges/tensions. This  would not only ascertain a much higher level of engagement, but also help the incubation team  learn from the plethora of industry experience that the leadership team possesses.

