It's no secret that I'm not book-smart. I am life smart. This means I can navigate through life using my experiences and mistakes. Sure, I've read stuff through my eyes, but when it was time for my brain to retain it, it chose not to, instead thinking about something more pressing, like, did I lock the front door? I guess this goes back to learning styles, and bookish learning doesn't do it for me. I lack the focus to take stuff in like this. I've also recently discovered that some (most) of you can visualise when you learn in this way. I can not. I can't picture what's going on in a story or a book, so when I read, I skip to the quotes or the pictures. Do you remember the old Thomas the Tank Engine books in the early 90s? They had the full story on the right-hand page and an image with a summary on the left (which just now dawned on me was the equivalent of alt text). I could never read all the words; they wouldn't go in, so I'd opt for the summary and finish the book in the same amount of time as someone reading the whole story. Before you ask, I've never been statemented as having trouble digesting information.
I think those of us who learn in this way become really good at hiding that we aren't "mainstream" to fit in with conventional teaching or education. You could say we are situationally aware.
Now mainstream teaching or education relies on our brains retaining information posed to us in a mainstream way, with little in the way of deviation from the textbook methods. I don't want to besmirch the character of teachers. Still, if some random percentage of the cohort can retain this mainstream info, then it's good enough to meet the targets set by some suited geezer who has never taught a day in his life. Students who can retain knowledge are encouraged into further education in some academic form, such as A-levels. In contrast, those who can't get shunted off to a vocational studies world, which suits them down to the ground. But there is a stigma behind these vocational courses. The assumption is that you weren't smart enough to do 'real' education; instead, you did colouring in, make-up, hairdressing, and woodwork. This isn't my opinion; look at a few job adverts out there; they are asking for degrees, affiliate memberships, and professional qualifications which assess knowledge retention, and they are not asking for a certificate in practical colour theory. Why does the world value the assessment of knowledge retention over demonstrable and practical skills?
The assessment of knowledge retained doesn't stop when we leave education; when we head out into the world of work, we are required to perform some mandatory training, where we must digest some information and answer some questions, with a passing score of 80% or higher. This experience is even worse for those who don't learn in a mainstream way because, at this moment, you have the knowledge that you have x amount of tries and time to complete the quiz. It is a requirement to pass your probation, i.e. if you get to keep your new job, which you're already nervous enough about.
Driving tests are not a perfect example of how things should be done but come on the journey with me for a few moments. In the UK, when you take your driving test, you must pass a theoretical test, which assesses your ability to retain knowledge to pass. Let's be honest, who remembers the nonsense they ask you once you've got your driving licence? Immediately following the theory test, and before you get your score, you sit a hazard perception test, where you observe footage of a driver's view of journeys. You must click a mouse when you notice a potential hazard, when the potential risk escalates, and when the horse is sitting on your bonnet (it's been a while, the horse might not do this). After you have completed these two assessments, you are eligible to book your practical driving test, which lasts 40 minutes or so. In this test (they keep changing it, so I'll do my best to describe it), you are asked to point out where your screen wash and brake fluid receptacles are and explain how you would check and fill them. You are asked various questions about the workings of the car you are in. I think this part is called show me, tell me. When you're ready to set off, the examiner will ask you to complete everyday driving things, like pulling in and out safely, following their directions, emergency stops, parking, and following the directions on a sat nav. At the end of this test, you will be told if you've passed or failed and handed a green piece of paper where they have marked down any faults you've made during the assessment period and how severe they are. While this isn't a perfect example of tailoring learning to an individual because you can only move on to the next stage once you've successfully passed the last, this test doesn't just look at knowledge retained. It looks at your situational awareness, cognitive ability and common sense, all of which are more valuable than the pass mark for the "which road sign is this" section of the test.
So, where am I going with this? You can drive a car by following theoretical knowledge. You can fix some things by reading a manual. The rise of YouTube DIY videos showing you how to wallpaper, build something, fix something, etc., indicates, sometimes, to be proficient, you need a practical example to fix a practical challenge. And some people learn by doing, by creating lasting memories from an experience that used more than one sense, from the pain of hitting your thumb with the hammer, from the satisfaction of completing a practical task, and not by reading about it. Traditional education has shown us we can game the system, class, and test so we can get the hell out of there and move on to something we find more valuable, like locking the front door. Standard eLearning isn't a reliable training programme; it teaches us the road signs for as long as we need to know them and how to game our way through the process. It only teaches us the practicalities of the world if we have a brain which can imagine the practicalities through written words.
Situational awareness is a far more valuable skill to ensure we can demonstrate the mandatory learning topics. Yet, we aren't assessed in this way. The suit that decides what the target is doesn't care if you get it. They care if you can pass the test with as little deviation from the norm as possible in the cheapest and fastest way. Not caring leads to higher costs in the long run… fixing fire damage, recovering from a network compromise, the harassment law suite, aka disaster recovery.
Individual learning plans (ILP) are hard to put together and are costly to deliver. They also assume enough analysis and knowledge of your particular needs has been carried out to produce a plan that works for you as an individual. I know this because many, many moons ago, I taught life skills to adults with learning difficulties. I did this for 4 years; my class size was around 6-8 people, and ILPs were created for each. Each of these learners had a completely different comprehension of the world and wildly differing needs to carry out the required learning to get to the desired outcome. An example is teaching someone how to type their name when they know their name starts with an uppercase letter followed by lowercase letters, yet a keyboard only features uppercase letters. No matter how much you plan a learning session, there will always be a wildcard you still need to consider.
On mass, ILPs are nearly impossible to produce; this is why Culture Gem have created courses to allow staff members to learn and retain the relevant information. We looked at the barriers to standard learning, such as visual stress, overstimulation, and under-stimulation. We try to deliver the theoretical training to people in a way that meets the learner's needs and ticks the box of the suit. To provide true situational awareness, your mandatory training must include more than just eLearning knowledge assessed courseware. You must supplement the knowledge retention with practical exercises that can be measured, audited and evaluated, but compliance doesn't require it, so who is wrong here? Regulation? Compliance? Knowledge retention methods? Laziness? Budgets?
As I said here, one of the most important parts of cyber sec is a non-blame culture where every member of the workforce is aware of how to keep information safe and where they know what to report and to whom, and that can only come from situational awareness.