Video clips and cowboy hats can teach digital security; understand

In January 2021, Rachel Tobac had a lighthearted idea to tackle a serious topic: a video with a folk soundtrack (a popular musical style in the US) in which she sang a story about the importance of password security and multi-factor authentication. .

It came complete with a refrain that read: “Soon a criminal may come steal your photos and data and run away.”

Tobac, CEO and co-founder of SocialProof Security, spends a lot of time thinking about how to educate people about the importance of protecting their digital data.

At the time, she said, these kinds of songs were all the rage on TikTok, so the genre seemed appropriate; she tweeted her video thinking it would be fun (and possibly useful) for others.

She soon realized that she had tapped into something bigger: corporate training sessions – whether done in person or via video – are often boring and hard to remember.

And dozens of companies contacted her after her tweet, asking if they could use it as part of their security awareness training.

She said yes, offering it for free, and about half of those who used it later told her the song made it easier for employees to sign up for password managers and enforce the use of multi-factor authentication. Then they asked him to make more songs.

Now, what started out as a fun side project is an actual product that SocialProof Security, which trains corporate employees on information security topics through hacker workshops, training, and demos, is selling to its customers.

The company is making well-packaged video clips with a country song about how to spot a phishing scam.

Tobac posted a trailer showcasing the music videos on Twitter in early August, including a song called “Don’t Get Hacked,” which has an ’80s pop vibe.

In two days, 140 companies have contacted them asking for demonstrations of their company’s video clip approach to information security, and several have already signed up as customers.

Tobac does not name specific companies that have applied for the music video product, but in general SocialProof Security’s customers include a wide range of large companies such as Google, Meta, Lululemon and Prudential, as well as the US Air Force and a few universities.

“I think it really shows that a lot of different companies, not just in technology, are looking for something a lot less boring,” she said.

To make the videos, Tobac created a list of topics to cover — from social media security and password management to malware and ransomware — and gave the songwriters a list of details each song should include, as well as ideas for lyrics.

Watching SocialProof’s video on how to avoid phishing attempts shows the results: it’s corny, with its country music, cowboy-hat-and-boots singer, and choreographed dances in an office. But it’s also fun and occasionally captivating (and yes, it includes some basic facts about how to avoid falling for a phishing).

Johnathan Yerby, an associate professor at Mercer University who studies cybersecurity, thinks it’s a great idea to use music videos to communicate about information security.

He cautioned that it may not be possible to include (or for viewers to absorb) all the relevant information in a single video, particularly if it goes by quickly while people are dancing in line.

The biggest challenge with training employees on this specific topic, he said, is simply getting them to care. He hopes music videos can make him more accessible.

And while many people might find information security music videos fun (or at least more fun than watching a typical corporate training video or listening to a presentation), Tobac knows they’re not for everyone.

She conducted research before creating the videos and found that around 20% of people are not really interested in learning about cybersecurity issues by singing and dancing. For this audience, she has a more sober solution in talking videos that address the same subjects.

Tobac, who in 2019 used his social engineering skills to hack the data of Donie O’Sullivan of CNN said the company has completed the “Don’t Get Hacked” and phishing music videos so far.

He plans to shoot a video for a song about password security (whose audio sounds like an alternative ’90s-style track) and a track about the dangers of over-sharing on social media (a contemporary pop confection) in the coming weeks.

Her company plans to release more songs quarterly, and eventually she hopes to have a collection of 12 videos representing various music genres and information security topics.

“There are so many other topics we can cover,” she said.