1
00:00:00,000 --> 00:00:08,320
The next talk, this coming talk that we have right now, is a very, very good segue from Chris's keynote.

2
00:00:09,080 --> 00:00:17,760
But before I introduce you to Catherine and Chris, I want to take a few minutes to give a public service announcement.

3
00:00:19,300 --> 00:00:23,080
And around the second talk, before the beginning of the second talk,

4
00:00:23,080 --> 00:00:29,860
I want to give a public service announcement on a topic which I'm sure some of you may be familiar with, which is sexual harassment.

5
00:00:31,420 --> 00:00:36,800
I want to just let everyone know that it is an absolute no-no.

6
00:00:36,880 --> 00:00:38,160
Just don't do it.

7
00:00:38,480 --> 00:00:46,120
It is giving the security community a black guy, and ultimately the tech community a black guy.

8
00:00:46,460 --> 00:00:47,480
Completely wrong.

9
00:00:47,640 --> 00:00:48,640
Don't do it.

10
00:00:48,660 --> 00:00:49,600
Don't go there.

11
00:00:49,720 --> 00:00:50,960
Don't do anything stupid.

12
00:00:52,100 --> 00:00:53,060
Read the paper.

13
00:00:53,080 --> 00:00:56,280
Read the Code of Ethics and the Code of Conduct here at DEF CON.

14
00:00:56,480 --> 00:00:57,680
Just don't even go there.

15
00:00:57,880 --> 00:00:59,280
I mean, that's all I'm going to say.

16
00:00:59,540 --> 00:01:00,180
Just don't do it.

17
00:01:00,280 --> 00:01:08,480
Just don't give this community and cybersecurity a black guy and a bad name as it already has.

18
00:01:08,860 --> 00:01:10,740
That's all I want to say.

19
00:01:11,160 --> 00:01:18,420
Because, you know, we here, especially the Wall of Sheep and the Packet Hacking Village, I mean, it's absolutely a no-no.

20
00:01:18,560 --> 00:01:19,280
Don't go there.

21
00:01:19,840 --> 00:01:20,280
Okay?

22
00:01:21,020 --> 00:01:22,580
So now it is.

23
00:01:23,080 --> 00:01:26,260
My pleasure to introduce you to the next two speakers.

24
00:01:27,160 --> 00:01:34,900
And these next two speakers, I guess the best thing I will say is they don't need a lot of introduction.

25
00:01:36,760 --> 00:01:45,320
And a lot of what you may have heard about the speakers, especially the gentleman to my right, half of what you heard is not true.

26
00:01:45,860 --> 00:01:51,460
So without much ado, it is my pleasure to introduce you to Catherine Ullman and Chris Roberts.

27
00:01:51,860 --> 00:01:52,460
Chris Roberts.

28
00:01:56,700 --> 00:01:57,700
Thank you.

29
00:01:57,880 --> 00:01:59,380
It's our pleasure to be here.

30
00:02:00,500 --> 00:02:05,440
This is my first time presenting at DEF CON Wall of Sheep.

31
00:02:05,720 --> 00:02:10,220
Chris has done this multiple times in various places.

32
00:02:10,460 --> 00:02:17,020
So he will no doubt be a little more comfortable with this than I am.

33
00:02:17,560 --> 00:02:18,300
Thank you.

34
00:02:18,300 --> 00:02:18,800
Thank you.

35
00:02:19,240 --> 00:02:19,580
Thank you.

36
00:02:20,080 --> 00:02:20,880
Thank you.

37
00:02:23,080 --> 00:02:24,480
And we will see you here today.

38
00:02:24,740 --> 00:02:25,380
Absolutely.

39
00:02:25,940 --> 00:02:29,700
So just a quick bit about where this presentation came from.

40
00:02:31,180 --> 00:02:36,740
Basically I had been sitting in on a bunch of B-Sides conferences and some other conferences.

41
00:02:37,100 --> 00:02:43,840
And in particular a keynote that Chris Nickerson gave, in which he talked about some of our

42
00:02:43,840 --> 00:02:47,300
failings as techs and geeks and hackers.

43
00:02:47,660 --> 00:02:53,060
And I started to think about the top topics of the conversations that had been going on.

44
00:02:53,060 --> 00:02:59,620
in these conferences and realizing that there seemed to be a missing piece and then in following

45
00:02:59,620 --> 00:03:06,040
some of what Chris talks about in his blogs and some of the talks he gives, I started

46
00:03:06,040 --> 00:03:10,800
to put together in my own head an idea of where I could take that topic and then reached

47
00:03:10,800 --> 00:03:15,320
out to Chris and said, would you be a part of this? And he fortunately for me said yes.

48
00:03:15,900 --> 00:03:22,820
So with that, we're going to talk about a situation in which an organization has ultimately

49
00:03:22,820 --> 00:03:28,020
been hit with some sort of horrible ransomware because, you know, we never hear that these

50
00:03:28,020 --> 00:03:44,880
days, right? There's never any cases of ransomware. Oh. Why did that?

51
00:03:57,020 --> 00:04:01,700
All right. So while Catherine's sorting out the geek stuff that we all do a wonderful

52
00:04:01,700 --> 00:04:06,800
job. Can you guys hear me now with this stupid thing? All right. Brilliant. So what Catherine's

53
00:04:06,800 --> 00:04:11,060
failing to say is the fact that, let's face it, if any of you follow me on Twitter or

54
00:04:11,060 --> 00:04:15,580
LinkedIn or anything else like that, there are somewhat regular occasions when I want

55
00:04:15,580 --> 00:04:22,720
to actually taser most levels of users, managers, executives, lawyers. Actually, lawyers are

56
00:04:22,820 --> 00:04:24,900
because we don't want to tase. We just want to take them out in the field and shoot them.

57
00:04:26,180 --> 00:04:31,920
And so I'm occasionally known for that kind of an attitude. So when Catherine actually

58
00:04:31,920 --> 00:04:36,500
came up and said, hey, I want to do a talk on how we communicate with people, especially

59
00:04:36,500 --> 00:04:40,920
when the shit does hit the fan, it was one of those where I had to take that step back

60
00:04:40,920 --> 00:04:46,340
and go, rather than being the somewhat rambunctious, rather annoying person that I can be on a fairly

61
00:04:46,340 --> 00:04:52,220
regular basis, I actually had to go, how do we effectively communicate with the various

62
00:04:52,220 --> 00:04:52,800
different teams?

63
00:04:52,800 --> 00:04:58,680
teams and various different groups that we have. You good? I do like it when we have a

64
00:04:58,680 --> 00:05:06,560
technical audience as well. The six of us are helping. At this point you're going to be

65
00:05:06,560 --> 00:05:18,540
watching it on a small, oh there we go, yay. Just hit up and down. Well done. Where the

66
00:05:18,540 --> 00:05:22,800
hell did he go? There he is. That man needs a shot. Well, yeah, actually we probably can.

67
00:05:23,040 --> 00:05:26,400
We have a, if any of you have seen the Twitter feed this morning, there's an entire small

68
00:05:26,400 --> 00:05:31,200
distillery in the back there. All right, I'm going to hand it over for a second. All right,

69
00:05:31,220 --> 00:05:35,680
so first, even though you know who he is, we'll talk a little bit about me because most of

70
00:05:35,680 --> 00:05:43,740
you probably have no clue who the heck I am. Okay, so who are we? Well, that's me, sort

71
00:05:43,740 --> 00:05:48,520
of, at least. I like to sleep a lot. All right, for those of you who don't know who I am,

72
00:05:48,540 --> 00:05:54,100
you're fine. This is really me. I've been at the University of Buffalo for 17 years.

73
00:05:54,280 --> 00:05:59,380
I've been in security for about 10 of those. I have some certifications and some degrees.

74
00:05:59,680 --> 00:06:05,160
I'm probably way overeducated for what I do. And none of my degrees, by the way, have

75
00:06:05,160 --> 00:06:09,120
anything to do with any of this, really. So, that said.

76
00:06:09,460 --> 00:06:13,140
Yeah, for those of you who don't know me, that's probably the best way you can actually

77
00:06:13,140 --> 00:06:17,760
put me. That is not it. You're going to put me and United in the same line.

78
00:06:26,500 --> 00:06:34,300
All right, so why should we care about this topic? I don't know. So, what are the odds

79
00:06:34,300 --> 00:06:43,820
of being hit with something like ransomware? Well, they're pretty good. In 2016, we had

80
00:06:43,820 --> 00:06:48,520
a small number of these, right? This is the United States. Thousands of ransomware were

81
00:06:48,520 --> 00:06:49,420
1093 breaches

82
00:06:50,520 --> 00:06:56,520
we're already past that at the halfway point of the year and what they're predicting through the end of

83
00:06:56,920 --> 00:06:59,820
2017 is over 1,500 breaches

84
00:07:00,380 --> 00:07:02,220
specifically targeting our

85
00:07:02,220 --> 00:07:02,560
specifically

86
00:07:04,600 --> 00:07:10,400
Involving malware of one variety or another and in many cases ransomware

87
00:07:33,900 --> 00:07:40,180
So, you know many of you have probably seen these quotes, right? There's only a

88
00:07:40,820 --> 00:07:48,440
Couple types of companies out there the ones that have been hacked those that will be and now we're talking about the ones that will be again

89
00:07:48,440 --> 00:07:52,140
Because most of the time it's not just a one and done they get hacked

90
00:07:52,140 --> 00:07:58,520
Somebody pops them and it's not too long even after the cleanup that they'll be hacked again. I can tell you

91
00:07:59,060 --> 00:08:06,400
That there is a hospital in my neck of the woods that got popped and I can tell you that DNS for that particular hospital

92
00:08:06,400 --> 00:08:11,720
Still wide open and this happened months ago. They still haven't addressed some of the basics

93
00:08:14,720 --> 00:08:18,060
So, you know, what do we do out there well in some

94
00:08:18,520 --> 00:08:19,780
Capacity whether we're hacking

95
00:08:20,240 --> 00:08:26,900
For good or for evil in theory. We are some form of infosec professional right and as infosec professionals

96
00:08:26,900 --> 00:08:28,680
We're really good at some things

97
00:08:31,720 --> 00:08:32,880
We're really good at like

98
00:08:33,420 --> 00:08:39,120
Diagnosing and fixing things most of the time right like Rob came up and helped diagnose and fix the problem we were having this morning

99
00:08:39,920 --> 00:08:41,520
So we're pretty good at this

100
00:08:43,940 --> 00:08:48,420
There are some things we're really not good at one of the things were really really not good

101
00:08:48,440 --> 00:08:52,500
At is communication, right? I

102
00:08:52,500 --> 00:08:59,000
Mean I know many of you probably feel this way if you're ever dealing with folks who are less technical and in some cases

103
00:08:59,000 --> 00:09:00,540
Even with those of us who are technical

104
00:09:01,440 --> 00:09:03,940
It's not the computer. No

105
00:09:05,380 --> 00:09:17,560
It's one of those things, over the years, you think, we've been doing this for 25 years. When we first started, we played the user.

106
00:09:18,440 --> 00:09:29,020
Then we played the developer, we played the network guys, the PDA guys. Then because we weren't getting the funds that we needed, we kept going back and saying, if I was broken, we could get another one with 50 or as many as you like.

107
00:09:29,240 --> 00:09:34,280
We started blaming the CFO. Then we blamed the CEO. And then we blamed everybody else.

108
00:09:35,240 --> 00:09:39,760
We have to take a step back and go, what are we doing wrong?

109
00:09:40,420 --> 00:09:44,340
And I think in some cases we're still doing that we're still blaming everybody else

110
00:09:44,340 --> 00:09:46,100
I still want to say to the users

111
00:09:46,100 --> 00:09:47,540
I still want to say to the users

112
00:09:48,440 --> 00:09:54,360
All right, so, you know, we're so not so good at verbal and written communication. We're really not

113
00:09:55,060 --> 00:09:59,140
Another thing we're not particularly good at speaking to that tasering

114
00:10:00,900 --> 00:10:03,540
Patience we don't often have a whole lot of patience

115
00:10:06,700 --> 00:10:13,460
So given the fact that these are the things we're not particularly good at in this community, are there any repercussions?

116
00:10:14,100 --> 00:10:18,100
You think there are repercussions for us not communicating all this information well?

117
00:10:19,080 --> 00:10:20,240
Yeah, quite a few.

118
00:10:22,180 --> 00:10:28,080
You're going to have issues with people are going to lose trust. They're not going to want to come to you when there is a problem.

119
00:10:28,320 --> 00:10:31,080
And they need to be able to come to you when there is a problem.

120
00:10:31,520 --> 00:10:37,600
There are all these processes out there to start to educate folks. All these phishing programs that are out there.

121
00:10:37,820 --> 00:10:44,700
And the problem that I see with most of these programs that are in place these days is that at some level there's negativity.

122
00:10:45,480 --> 00:10:47,080
And if there's negativity...

123
00:10:47,080 --> 00:10:52,140
And I don't mean necessarily that you're even intentionally being negative with the users.

124
00:10:52,280 --> 00:10:57,420
I mean, if you're talking to a fellow co-worker and you're saying something like,

125
00:10:57,540 --> 00:11:00,220
Ugh, Joe Blow fell for that again.

126
00:11:01,520 --> 00:11:03,260
You've got negativity on the brain.

127
00:11:03,480 --> 00:11:10,040
You're not thinking, okay, if this is a person who always falls for this stuff, what controls can we put in place?

128
00:11:10,160 --> 00:11:15,940
Now we know he's part of that, you know, one to five percent that may never learn.

129
00:11:15,940 --> 00:11:18,280
Okay, we can compensate for that.

130
00:11:19,320 --> 00:11:23,140
And I think the other thing is as well, and it's what tends to be at work a lot of the time,

131
00:11:23,200 --> 00:11:30,600
which is part of the reason we're up here talking, is we communicate the same way no matter who the audience is.

132
00:11:31,120 --> 00:11:37,000
That same message goes out. It doesn't matter if it's going out to leadership, management, users, the kids,

133
00:11:37,020 --> 00:11:42,560
perhaps the kids' stuff that we're doing. We haven't yet figured out how to well modify that message.

134
00:11:43,040 --> 00:11:45,340
Part of the reason we're up here having a conversation about it.

135
00:11:45,940 --> 00:11:46,320
Absolutely.

136
00:11:46,700 --> 00:11:50,340
So, you know, it's also going to cause problems with communications.

137
00:11:50,720 --> 00:11:51,900
There's going to be more conflict.

138
00:11:52,320 --> 00:11:55,180
You know, you're going to have a more difficult time in the future.

139
00:11:55,420 --> 00:11:58,720
So ultimately, this is not ideal.

140
00:11:59,760 --> 00:12:02,520
So what happens when your company gets hit?

141
00:12:03,420 --> 00:12:05,140
Uh-oh, right?

142
00:12:05,920 --> 00:12:07,460
Now the shit's hit the fan.

143
00:12:08,240 --> 00:12:09,860
We now have to deal with it.

144
00:12:10,280 --> 00:12:14,300
And we're so caught up as techs in trying to fix the problem.

145
00:12:14,300 --> 00:12:18,020
And only saying what we absolutely need to so we can get back to fixing the problem,

146
00:12:18,260 --> 00:12:21,000
that we don't realize we're making it worse on ourselves.

147
00:12:23,240 --> 00:12:28,100
So we need to frame the conversation with the audience we're going to have it with.

148
00:12:34,420 --> 00:12:39,600
So it's important to anticipate the questions that each level is going to ask you.

149
00:12:40,420 --> 00:12:44,280
Some of them are going to be the same and some of them are going to be radically, radically different.

150
00:12:45,180 --> 00:12:52,900
And how you respond to them is going to depend in part on framing of the questions that,

151
00:12:52,980 --> 00:12:56,580
or the answers that you're going to give to these questions to that particular level.

152
00:12:57,060 --> 00:12:58,940
So this goes back to what we were saying.

153
00:12:59,140 --> 00:13:03,660
Obviously, a lot of times, we spend a lot of time talking and trying to sort out the end users.

154
00:13:04,040 --> 00:13:07,020
We spent 25 years trying to get them to sort out their topics.

155
00:13:07,260 --> 00:13:12,040
When it's normal practice to see levels so that they're full characters afterwards, we'll deal with that.

156
00:13:12,100 --> 00:13:12,540
Please.

157
00:13:13,600 --> 00:13:14,040
So.

158
00:13:18,160 --> 00:13:18,600
.

159
00:13:31,760 --> 00:13:32,200
Yeah.

160
00:13:33,740 --> 00:13:36,460
And you need to consider how you're going to communicate this.

161
00:13:36,660 --> 00:13:38,620
So what kind of channels are you going to use?

162
00:13:38,840 --> 00:13:41,620
And there's some considerations regarding those channels.

163
00:13:41,860 --> 00:13:42,720
I mean, number one.

164
00:13:42,720 --> 00:13:47,280
Given whatever hit you, you may not have all these channels available to you.

165
00:13:47,480 --> 00:13:51,220
And number two, depending on, you know, what's going on in your particular company,

166
00:13:51,480 --> 00:13:55,240
there may be legal implications, which is in part why we have that final bullet.

167
00:13:56,020 --> 00:13:56,540
.

168
00:13:57,640 --> 00:14:02,420
Because that may be the only way you're allowed to tell people in some instances.

169
00:14:03,180 --> 00:14:03,700
.

170
00:14:07,640 --> 00:14:08,160
.

171
00:14:08,160 --> 00:14:08,440
.

172
00:14:11,720 --> 00:14:12,240
.

173
00:14:12,240 --> 00:14:12,660
.

174
00:14:21,760 --> 00:14:22,100
.

175
00:14:22,100 --> 00:14:22,720
.

176
00:14:31,220 --> 00:14:31,560
.

177
00:14:31,560 --> 00:14:32,040
.

178
00:14:32,040 --> 00:14:32,300
.

179
00:14:32,300 --> 00:14:32,340
.

180
00:14:32,700 --> 00:14:33,040
.

181
00:14:37,140 --> 00:14:37,480
.

182
00:14:37,480 --> 00:14:37,520
.

183
00:14:37,520 --> 00:14:37,600
.

184
00:14:37,600 --> 00:14:37,620
.

185
00:14:37,620 --> 00:14:37,680
.

186
00:14:37,680 --> 00:14:37,700
.

187
00:14:37,700 --> 00:14:37,720
.

188
00:14:40,840 --> 00:14:45,760
And I mean, ideally, if you can do this in person, I really think that's without a doubt

189
00:14:45,760 --> 00:14:54,840
the best way. But if you've got a company of 10,000 people, you may or may not be able

190
00:14:54,840 --> 00:14:59,840
to do that. So let's start talking about the end user and how we're going to communicate

191
00:14:59,840 --> 00:15:06,480
to them. So here's your average end user, right? And honestly, it's okay that they're

192
00:15:06,480 --> 00:15:12,200
at that level. There's nothing wrong with somebody being at this very basic level. And

193
00:15:12,200 --> 00:15:18,120
we need to understand that and make it okay in our own heads. Yes, it can be frustrating.

194
00:15:22,640 --> 00:15:26,880
So what is the end user focused on? Well, they're focused on their day-to-day existence,

195
00:15:27,260 --> 00:15:32,640
right? Getting their jobs done. You're going to use this as an opportunity, a training

196
00:15:32,640 --> 00:15:33,680
opportunity for them.

197
00:15:33,840 --> 00:15:35,860
Whether they were the ones who...

198
00:15:35,860 --> 00:15:36,460
The ones who...

199
00:15:36,460 --> 00:15:40,680
One or one specifically responsible for what happened, which we all know with ransomware,

200
00:15:40,720 --> 00:15:45,900
it's very, very easy to do. But it doesn't really matter whether it was one particular

201
00:15:45,900 --> 00:15:50,740
person or a whole group of people. You're essentially going to use this as a teaching

202
00:15:50,740 --> 00:15:57,060
moment. And don't just teach them about what is... Why it's important at work. Explain

203
00:15:57,060 --> 00:16:02,480
why this is important everywhere, whether it's at home, at work, with their kids. Because

204
00:16:02,480 --> 00:16:06,440
the more you explain to them about how this matters to them as people and not to them

205
00:16:06,440 --> 00:16:11,720
as employees, the faster you will get buy-in and the more they will understand.

206
00:16:12,500 --> 00:16:16,900
I mean, that's a huge point. It's something we've done over the last couple of years.

207
00:16:17,240 --> 00:16:21,340
Obviously with the blending of technology that isn't just in the corporate environment

208
00:16:21,340 --> 00:16:26,280
now, the home, the work, the office, the vehicle, everything that's wearable is blending

209
00:16:26,280 --> 00:16:31,380
that technology. The more you help that person understand that and how it's going to affect

210
00:16:31,380 --> 00:16:35,680
them as a whole, the more effective it's going to be. It's going to take, thank you,

211
00:16:35,680 --> 00:16:40,140
for the help that you're giving us.

212
00:16:51,100 --> 00:16:52,060
Audience member 6

213
00:16:52,060 --> 00:16:57,060
Absolutely. And you need to use effective and efficient communication to do that. And

214
00:16:57,060 --> 00:16:58,760
we're going to talk about what that actually means.

215
00:17:02,360 --> 00:17:05,000
So it sort of goes to what we've been saying, right?

216
00:17:05,680 --> 00:17:11,180
want to talk to them at their level in a way they're going to understand, be concise. Less

217
00:17:11,180 --> 00:17:18,680
is more. But that doesn't mean that you're going to talk down to them in some way. You

218
00:17:18,680 --> 00:17:23,420
may need to be judicious and leave out specific information because there may be corporate

219
00:17:23,420 --> 00:17:28,300
information that, you know, about whatever's happened that they shouldn't necessarily know.

220
00:17:28,620 --> 00:17:32,400
But that doesn't mean you shouldn't try your best to answer their questions as honestly

221
00:17:32,400 --> 00:17:36,960
as possible. And you've got to be patient. Even if it means afterwards you go and you

222
00:17:36,960 --> 00:17:50,360
bang your head and tear your hair out and taser. So, you know, be patient.

223
00:18:02,400 --> 00:18:08,980
This is something I don't have much of and it has not served me well at times. It is

224
00:18:08,980 --> 00:18:15,600
a huge thing that we are not good at in the industry and we have to get better at. Whether

225
00:18:15,600 --> 00:18:21,540
it's explaining it to the end users, whoever it is explaining it to, you mentally have

226
00:18:21,540 --> 00:18:26,700
to take that step back and go, you can't explain it how I understand it. You have

227
00:18:26,700 --> 00:18:32,140
to explain it in terms that they understand it. If we don't do that, we have failed.

228
00:18:34,820 --> 00:18:42,840
Absolutely. Engagement is going to be your key. You need to engage whoever your audience

229
00:18:42,840 --> 00:18:47,960
is going to be. And as I mentioned, you need to be upfront and honest. If you do this lies

230
00:18:47,960 --> 00:18:51,620
to children thing, I mean, how many people know that when they have little, little kids

231
00:18:51,620 --> 00:18:56,600
and little kids ask a question that's really seems simplistic at an adult level, but you're

232
00:18:56,600 --> 00:19:00,160
like, oh, how do I explain this to a kid? Like, you know, where do babies come from,

233
00:19:00,200 --> 00:19:00,400
right?

234
00:19:01,840 --> 00:19:02,200
So,

235
00:19:02,400 --> 00:19:06,440
how many times you hear a question like that and you think, oh, I don't want to answer

236
00:19:06,440 --> 00:19:10,940
this, so I'm going to give them a stork story or something silly. And, you know, I mean,

237
00:19:10,960 --> 00:19:14,840
this is kind of a bizarre example, but the bottom line is it will come back to bite you

238
00:19:14,840 --> 00:19:20,100
because someone will inevitably tell them the truth in a way that they don't understand

239
00:19:20,100 --> 00:19:25,100
and then frightens them and you've done everybody now a disservice. So, you know, you don't

240
00:19:25,100 --> 00:19:25,600
want to do that.

241
00:19:25,880 --> 00:19:31,000
So, this is also key for executives. Having worked with media leadership,

242
00:19:31,920 --> 00:19:37,620
as much as we want to cause them and trouble them and not bother them, for crying out loud,

243
00:19:37,860 --> 00:19:43,060
we have to, well, it works both ways. We have to get better at explaining it to leadership

244
00:19:43,060 --> 00:19:47,060
and they have to get better at not speaking the message out. It is definitely a two-way

245
00:19:47,060 --> 00:19:51,340
trick, but this whole, I don't want to bother the leader, I don't want to bother the management,

246
00:19:51,780 --> 00:19:56,580
that bullshit's got to stop. We've got to do a much more effective job of this is part

247
00:19:56,580 --> 00:20:00,980
of the whole discussion about how we communicate at that level, but positing them and dealing

248
00:20:00,980 --> 00:20:04,260
with them and taking them away from it isn't going to fix the problems that we have.

249
00:20:05,100 --> 00:20:10,880
No, and you need to reassure them. If there's somebody who is terrified of what's happened,

250
00:20:11,520 --> 00:20:16,540
you know, you don't want to lie to them, but you want to assuage their fears, which

251
00:20:16,540 --> 00:20:20,360
means answering their questions. And if they come to you and they say, oh, my computer

252
00:20:20,360 --> 00:20:25,380
is doing this weird thing. We had recently, at the university, I had an email from a woman

253
00:20:25,780 --> 00:20:30,960
who was very concerned because she'd received an email and somehow thought that by receiving

254
00:20:30,980 --> 00:20:36,640
this email that had no links and no attachments and nothing in it, that it could have infected

255
00:20:36,640 --> 00:20:41,440
her machine because she could tell it was spam, right? So she was very concerned about

256
00:20:41,440 --> 00:20:46,120
this and didn't understand. And I had to explain to her, no, this won't impact your

257
00:20:46,120 --> 00:20:51,000
machine at home. No, you're okay. It didn't impact your online banking. I mean, you know,

258
00:20:51,020 --> 00:20:55,540
we as techs know, if you get a text email that has nothing attached to it, chances are

259
00:20:55,540 --> 00:20:59,420
you're probably okay, right? You just delete it and go on with your life. But these people,

260
00:21:00,040 --> 00:21:05,240
perception is everything. They think it's reality. And we need to take that into account

261
00:21:05,800 --> 00:21:06,780
when we're talking to them.

262
00:21:09,200 --> 00:21:16,740
Male Speaker 419 scams. We got involved with a bunch of stuff years ago. For those of you

263
00:21:16,740 --> 00:21:21,080
who knew the airplane stuff, before the airplane stuff, we hacked Nigeria and got money back

264
00:21:21,080 --> 00:21:26,620
into the U.S. to do a pit stop with a 419 scam, basically taking money out. One of

265
00:21:26,620 --> 00:21:29,400
the biggest ones that we ended up dealing with was this lady that was trying to get

266
00:21:29,420 --> 00:21:32,460
a job at the airport. She thought that the director of the FBI was communicating with

267
00:21:32,460 --> 00:21:38,040
her directly. And she had the email, and she had the headers on it, and she had the

268
00:21:38,040 --> 00:21:42,440
letters from him. Her perception was that the director of the FBI was telling her to

269
00:21:42,440 --> 00:21:49,120
do this. It's our job to help them understanding how language that they can get. That's not

270
00:21:49,120 --> 00:21:49,620
the case.

271
00:21:51,400 --> 00:21:58,320
So let's move on to middle management now. Calm down. It's all good, right? No.

272
00:22:01,100 --> 00:22:04,920
So they're going to be focused on whatever business process they're responsible for. And that

273
00:22:04,920 --> 00:22:09,060
could be radically different at different companies. You could have a couple of middle

274
00:22:09,060 --> 00:22:13,440
managers. You could have a ton. You could have an HR person, an IT person. I mean, you

275
00:22:13,440 --> 00:22:18,900
could have a zillion of these, right? So depending on what particular business process they're

276
00:22:18,900 --> 00:22:24,020
involved in, that's the thing that they're going to be really, really focused on. And once

277
00:22:24,020 --> 00:22:29,400
again, you need to be talking to them at a level that they can understand. And if they're

278
00:22:29,420 --> 00:22:35,000
not, again, we're talking about effective and efficient communications with them. Help

279
00:22:35,000 --> 00:22:38,660
them understand what's going on. Middle management is hard.

280
00:22:40,640 --> 00:22:45,780
So here's what an ideal middle manager looks like, right? They have this huge set of skills.

281
00:22:46,960 --> 00:22:50,920
How many of you have ever seen an ideal middle manager who has all these skills? Raise your

282
00:22:50,920 --> 00:22:52,260
hands. Anybody know any of these?

283
00:22:56,940 --> 00:22:58,380
Yeah, because typically...

284
00:22:58,380 --> 00:22:58,540
.

285
00:22:59,420 --> 00:23:03,340
See, they're like this, right? There's not such thing as an ideal middle manager. They

286
00:23:03,340 --> 00:23:06,900
don't have all those qualities. They might have a couple, and that's a good thing. But

287
00:23:06,900 --> 00:23:12,180
typically, they don't have all of them. So how do we talk to real ones? Well, we're not

288
00:23:12,180 --> 00:23:17,840
going to engage with them. It's a tough place being a middle manager. All the people who

289
00:23:17,840 --> 00:23:21,360
are above you want to keep you where you are and all the people who are below you want

290
00:23:21,360 --> 00:23:28,220
to be who you are. And so you're getting pressure from both above and below, and you're trying

291
00:23:28,220 --> 00:23:36,820
trying to do your job. So how do you manage that? Well, as the IT person or the red team

292
00:23:36,820 --> 00:23:42,120
or the blue team, whoever you are in that position, you're there to help them. Help

293
00:23:42,120 --> 00:23:50,800
them look good. Ultimately, that makes everybody's job easier. You need to be empathetic, which

294
00:23:50,800 --> 00:23:54,140
is really hard sometimes when you've never held that job.

295
00:23:54,700 --> 00:24:00,020
So the other thing to think about as well, I come from a somewhat research red team background,

296
00:24:00,780 --> 00:24:05,320
which is great. We walk in, we broke the stuff for the last 25 years, we go, aha, we broke

297
00:24:05,320 --> 00:24:10,540
all of your shit. And then we leave. That's not working. So now we say, take a look at

298
00:24:10,540 --> 00:24:17,260
the middleman's button from a metric standpoint, from a maturity standpoint. I broke all of

299
00:24:17,260 --> 00:24:22,000
your shit because you're here. You, from a fiduciary reason as an organization, need

300
00:24:22,000 --> 00:24:24,120
to be here or you need to be here. You need to be here. You need to be here. You need

301
00:24:24,140 --> 00:24:29,780
to be here. So how do we help you, especially the middle management guys, understand the

302
00:24:29,780 --> 00:24:35,280
metrics that are necessary, understand the controls that are necessary in a language

303
00:24:35,280 --> 00:24:40,460
they can understand and something that they can take up to the leadership and then move

304
00:24:40,460 --> 00:24:44,980
down into the very team. It comes down to us, again, not just saying, hey, you broke

305
00:24:44,980 --> 00:24:49,060
shit, but what are the metrics behind it? What's the maturity behind it? And then,

306
00:24:49,060 --> 00:24:54,120
honestly, what's the next step that we can help them and all of the other people that

307
00:24:54,140 --> 00:24:56,700
work with us together achieve to move that box?

308
00:24:57,140 --> 00:25:01,980
And that means having a full plan, you know, to what Chris was saying, this whole

309
00:25:01,980 --> 00:25:06,660
idea of we walk in, we break stuff, we leave. Well, we don't want to just walk in, break

310
00:25:06,660 --> 00:25:11,780
stuff, and then say, okay, we need to get here. You need to help them figure out how

311
00:25:11,780 --> 00:25:16,660
to take all those steps. And that means a full, complete plan to get there. Not, well,

312
00:25:16,860 --> 00:25:21,980
you need to follow these guidelines and just read them and do what they say. Well, that's

313
00:25:21,980 --> 00:25:24,040
not useful. You need to do more than that.

314
00:25:25,740 --> 00:25:30,340
So, the plan's got to include everything. What happened, what your end goals are, and

315
00:25:30,340 --> 00:25:34,240
the actual specific steps, working with the middle management to figure out how you're

316
00:25:34,240 --> 00:25:34,740
going to get there.

317
00:25:35,400 --> 00:25:39,920
This is something, again, for those of us that run Red Sheets, for those of you guys

318
00:25:39,920 --> 00:25:46,380
who go in and actually help organizations understand where the issues are, if you are

319
00:25:46,380 --> 00:25:51,600
not putting some of the end goals in there, if you are not putting some of the, how do

320
00:25:51,600 --> 00:25:54,120
we get from, you got broken, to, you know, how do we get from, you know, how do we get

321
00:25:54,140 --> 00:25:58,500
through, you can be fixed, or at least you can get off the bottom rung of the ladder.

322
00:25:58,940 --> 00:26:03,000
If those aren't going in there, we're giving a disservice to the very people that we're

323
00:26:03,000 --> 00:26:07,160
going to be supporting. So, we've got to help them understand. And it isn't just a

324
00:26:07,160 --> 00:26:12,060
technical thing. It comes down to the fiduciary. It comes down to the compliance, the legal,

325
00:26:12,120 --> 00:26:18,620
financial. Give the middle management the tools that they need to argue through leadership

326
00:26:19,140 --> 00:26:24,080
as to why this shit is important. It's how we're going to help basically harm them,

327
00:26:24,140 --> 00:26:27,620
to have those nasty ass discussions and take those out of the far and wide.

328
00:26:29,280 --> 00:26:35,180
So, these are just some of the things that you need to keep in mind in your plan. But

329
00:26:35,180 --> 00:26:38,020
management also needs to be responsible for their user's behavior.

330
00:26:42,020 --> 00:26:47,100
Now, what does that mean? Does that mean that, like, you need to take the onus somehow,

331
00:26:47,380 --> 00:26:52,540
or the managers have to say, oh, it's my fault that, you know, Joe Smith didn't bother

332
00:26:52,540 --> 00:26:54,120
to pay attention and he couldn't do it?

333
00:26:54,140 --> 00:26:59,540
No, it means what I was talking about earlier. You're always going to have some portion of

334
00:26:59,540 --> 00:27:04,680
your user base that isn't going to do the right things, no matter how many times you

335
00:27:04,680 --> 00:27:10,240
tell them, no matter what training they go through. So, what this means is you're going

336
00:27:10,240 --> 00:27:15,080
to help middle management understand that they need to figure out who they are. Because

337
00:27:15,080 --> 00:27:18,500
the other people, they can figure out who they are and they can educate them. And those

338
00:27:18,500 --> 00:27:23,140
people that they can't educate and there's no way to get around that, you can have them

339
00:27:23,140 --> 00:27:28,580
put, work with them to put controls in place to deal with that percentage. Because, and

340
00:27:28,580 --> 00:27:34,140
if you, if they and you don't know who they are, then there's absolutely nothing they

341
00:27:34,140 --> 00:27:39,820
can do. So, management has to take that responsibility on. It doesn't mean, necessarily, they have

342
00:27:39,820 --> 00:27:44,200
to go to each and every person and find out they can delegate this. But they need to find

343
00:27:44,200 --> 00:27:48,060
out and it needs to be part of what they're doing and you need to help educate them to

344
00:27:48,060 --> 00:27:48,720
realize that.

345
00:27:51,180 --> 00:27:57,260
And these are just some of the areas in terms of engaging with middle management that you

346
00:27:57,260 --> 00:28:03,460
need to consider which direction they need to go. You're going to coach and encourage

347
00:28:03,460 --> 00:28:09,040
some form of collaboration, but, you know, do they need to manage stuff? Do they really

348
00:28:09,040 --> 00:28:14,600
need to control stuff? Is it stuff they can delegate? There are all these different factors.

349
00:28:15,140 --> 00:28:18,700
I think the other thing in here as well, and it's something we all think about, is

350
00:28:18,720 --> 00:28:23,880
as we look at the news, and we help, and we ask you what, and not many organizations

351
00:28:24,520 --> 00:28:31,360
put their hands up and go, sorry, we lost all your tips, we fucked up. We need to help

352
00:28:31,360 --> 00:28:37,880
the middle management go, hey, you made a mistake and it's okay to admit making that

353
00:28:37,880 --> 00:28:41,760
mistake. You're not going to get fired for it, but it's okay to admit that you made a

354
00:28:41,760 --> 00:28:46,200
mistake as long as you can go, hey, I made it, I learned from it, and here's what we're

355
00:28:46,200 --> 00:28:48,700
going to do differently. It's not here's what I did, it's here's what you did. It's

356
00:28:48,700 --> 00:28:52,820
what we are going to do differently. Very, very informal middle management.

357
00:28:53,400 --> 00:29:02,060
And this kind of goes back to some of the questions that you need to make sure there

358
00:29:02,060 --> 00:29:06,720
are answers for. If we're talking about some form of ransomware, there's always the question

359
00:29:06,720 --> 00:29:13,000
of do we pay? And, you know, ideally, as InfoSec people were going to tell you, that's

360
00:29:13,000 --> 00:29:18,140
probably not a good idea. But maybe there's a situation where the company decides that's

361
00:29:18,140 --> 00:29:24,580
in their best interest for some reason. They need to know this answer long before this

362
00:29:24,580 --> 00:29:28,660
happens. And if they don't already know this answer before it happens, they better have

363
00:29:28,660 --> 00:29:34,060
this answer ready for upper management before that upper management comes calling.

364
00:29:37,900 --> 00:29:44,460
So let's talk about the C-suite. So they're going to focus on the big picture stuff, right?

365
00:29:45,140 --> 00:29:47,320
You need to think when you're walking in there.

366
00:29:48,140 --> 00:29:51,700
It's going to be like as if you've got 30 seconds in an elevator to have that conversation.

367
00:29:52,640 --> 00:29:55,800
So now you even need to be more concise with what you're talking about.

368
00:29:56,560 --> 00:30:01,640
Very, very, very specific details. And yet, they need to be very broad in nature.

369
00:30:01,820 --> 00:30:08,920
Because what that C-level is focused on is going to be an overview of the company at

370
00:30:08,920 --> 00:30:09,760
various levels.

371
00:30:18,140 --> 00:30:23,140
The executives, executives, board of directors, i.e., the decision makers, the heavyweight

372
00:30:23,140 --> 00:30:27,640
decision makers. You know, take some time and practice this one. I don't care if you

373
00:30:27,640 --> 00:30:31,980
talk to other people, talk to yourself, talk in front of a frickin' miracle or like that.

374
00:30:32,340 --> 00:30:38,040
But get to a level where you can help a leadership organization understand literally in that

375
00:30:38,040 --> 00:30:45,080
30 seconds why this is important. Talking to the big level, the 27,000 people in this room

376
00:30:45,080 --> 00:30:47,660
will understand, isn't going to do it.

377
00:30:48,140 --> 00:30:53,920
But understanding the fiduciary reasons, the fiduciary leadership and what they have to do

378
00:30:53,920 --> 00:30:59,380
and why it's important for the overall organization, why it's important for whatever the different

379
00:30:59,380 --> 00:31:03,300
reasons, for the digital side of it, the future of the company, where the organization's

380
00:31:03,300 --> 00:31:08,860
going, the market sector, the industry itself. These are things that you guys are going to

381
00:31:08,860 --> 00:31:13,020
have to understand because it's all of our responsibility to educate you at the entire

382
00:31:13,020 --> 00:31:15,380
level. These guys are the best ones.

383
00:31:16,600 --> 00:31:18,120
So here are the, kind of, the things that you guys are going to have to understand.

384
00:31:18,140 --> 00:31:21,820
Here are the bullet points. You're going to describe very generally what happened.

385
00:31:22,020 --> 00:31:26,580
You're not going to talk in technical terms. Even if they understand technical terms,

386
00:31:26,820 --> 00:31:29,640
that's not where their brains are. That's not what they're thinking about.

387
00:31:30,260 --> 00:31:33,840
You're going to provide this best case, this worst case, and the most likely scenario.

388
00:31:34,280 --> 00:31:37,600
Because that's, again, what they're thinking about. The overall big picture.

389
00:31:37,920 --> 00:31:41,620
What is the possibility of this being, you know, a complete catastrophe?

390
00:31:42,500 --> 00:31:47,500
And not only that, you want to try to tell them, if you know something about underlying

391
00:31:47,500 --> 00:31:53,620
causes of what happened in ransomware case, you know, it's probably somebody clicking

392
00:31:53,620 --> 00:31:57,520
on something they shouldn't have. And what are the consequences going to be

393
00:31:57,520 --> 00:32:01,300
for that organization, you know, if they can't get their data back, and you've talked

394
00:32:01,300 --> 00:32:05,440
to the other IT people, and maybe their backups haven't worked in the last year?

395
00:32:05,860 --> 00:32:09,940
I'm going in there and having a conversation like, oh, we don't have enough money

396
00:32:09,940 --> 00:32:15,220
for this, and CSO is an asshole, and we need to choose a developer. That's not going to do it.

397
00:32:15,220 --> 00:32:20,140
Having a conversation like, hey, I understand that you have to go to the board of directors

398
00:32:20,140 --> 00:32:24,720
next week and explain what the hell we just happened. Let me give you some insight onto

399
00:32:24,720 --> 00:32:29,280
where the future of the company is going. How does this relationship with maybe our

400
00:32:29,280 --> 00:32:34,340
vendors, our suppliers, need to be leveraged more effectively to provide the security?

401
00:32:34,800 --> 00:32:40,460
Maybe help understand with you guys, hey, it comes from the top down. We can have your

402
00:32:40,460 --> 00:32:45,200
useful message more effectively throughout the organization. You can have your useful

403
00:32:45,220 --> 00:33:01,660
message more effectively. And remember, of course, they're people, too. I mean, sometimes

404
00:33:01,660 --> 00:33:05,680
I know it's really hard to remember, but at the end of the day, most of them go home,

405
00:33:05,760 --> 00:33:11,280
some of them to families, and, you know, they're trying to have lives, too. And it's really,

406
00:33:11,320 --> 00:33:14,540
really hard on them to have this hanging over their heads.

407
00:33:14,540 --> 00:33:24,420
So, again, be empathetic with them. So, metrics. Metrics are going to be something

408
00:33:24,420 --> 00:33:32,480
really important at this level. But not just any metrics. You want metrics that are really

409
00:33:32,480 --> 00:33:38,080
meaningful. Something that is meaningful and measurable is going to be far more useful.

410
00:33:38,400 --> 00:33:42,320
And I can give you an example from my own institution. So one of the things that we

411
00:33:42,320 --> 00:33:44,520
put in place is that...

412
00:33:44,540 --> 00:33:50,960
For emails that come in with links that go out to websites that have done some sort of

413
00:33:50,960 --> 00:33:56,760
a screen scrape and look just like our shibboleth login page, we put in a redirection. And

414
00:33:56,760 --> 00:34:00,920
that redirection goes to an educational page. You know, you've clicked on...you've arrived

415
00:34:00,920 --> 00:34:05,940
here because you clicked on a bad thing and, you know, just so you know, right? The tool

416
00:34:05,940 --> 00:34:11,800
that we use to put that in place actually gives me click metrics. I can say, by doing

417
00:34:11,800 --> 00:34:13,700
this, we prevented...

418
00:34:13,700 --> 00:34:20,240
We've prevented X number of people, because I can even sort by IP address, from going

419
00:34:20,240 --> 00:34:27,920
to this space. And what that tells our folks is, hey, this tool we bought, it's giving

420
00:34:27,920 --> 00:34:32,820
us some value for that in a context that is important to our management.

421
00:34:33,840 --> 00:34:38,000
I think the other thing to look at as well on this one is a meaningful, measurable

422
00:34:38,000 --> 00:34:43,680
metric. We have a ton of resources out there. We've looked at the last report. We've looked

423
00:34:43,700 --> 00:34:48,420
at all our love and hate for Cisco and Microsoft and all those other ones for companies.

424
00:34:48,760 --> 00:34:54,800
They each put out reports every six months, every year, variety of reports. All of these

425
00:34:54,800 --> 00:34:58,900
reports and metrics, they break down the industry that we're looking after and we have

426
00:34:58,900 --> 00:35:03,780
responsibility to, and say, who's getting their ass handed to them? How often? How

427
00:35:03,780 --> 00:35:08,260
much? These are the metrics we can go to the CFO and say, hey, here's where we are.

428
00:35:08,460 --> 00:35:12,840
Here's where the industry is. Here's where we should be. Here's where we need to be.

429
00:35:13,000 --> 00:35:13,680
Here's what we need.

430
00:35:13,700 --> 00:35:17,700
Here's what's coming down the line from a business standpoint. And why do we need to

431
00:35:17,700 --> 00:35:22,760
be paying more attention to IoT or whatever the heck the latest one of the day is going

432
00:35:22,760 --> 00:35:28,040
to be. This is the stuff that we need. Use those outside resources to help strengthen

433
00:35:28,040 --> 00:35:29,200
the message to these folks.

434
00:35:30,660 --> 00:35:37,300
And, you know, your CFO often knows those fiduciary legal requirements for their

435
00:35:37,300 --> 00:35:43,680
company. So let that person teach you and turn around and help them understand what

436
00:35:43,680 --> 00:35:48,980
the requirements and the regulations within IT that correspond to that. Work together

437
00:35:48,980 --> 00:35:50,900
on that in the CFO land.

438
00:35:52,320 --> 00:35:56,960
In the COO land, there are a couple different kinds. I'll let Chris talk a little more

439
00:35:56,960 --> 00:35:57,380
about this.

440
00:35:59,080 --> 00:36:03,660
So these are the guys, again, so from a team operating officer, you have the guy

441
00:36:03,660 --> 00:36:08,680
who's there to make sure the damn company stays running. Pretty much they'll come

442
00:36:08,680 --> 00:36:13,400
head or high water. So he doesn't want to turn things off. He doesn't want to take down

443
00:36:13,400 --> 00:36:19,100
DLT. I apologize. DLT doesn't want to take things down. You have to help them understand

444
00:36:19,780 --> 00:36:24,820
how to be more successful in the world. You talk about ransomware. It's going to impact

445
00:36:24,820 --> 00:36:29,680
and how do we mitigate that. Help them understand the mitigation. Help them understand

446
00:36:29,680 --> 00:36:35,000
also from the COO to the CTO to the COO. Where are they going and how can you help

447
00:36:35,000 --> 00:36:39,820
them understand more effectively, not just their position, but how they can influence

448
00:36:39,820 --> 00:36:42,260
change inside that organization.

449
00:36:42,660 --> 00:36:43,380
And maybe you can do that.

450
00:36:43,400 --> 00:36:47,640
How they can be more effective. You know, we all take a look at the logging, the monitoring,

451
00:36:47,700 --> 00:36:53,140
the management. Well, nobody has enough teams and enough staff. So as security professionals,

452
00:36:53,580 --> 00:36:58,740
it is our role to say, hey, these tools that we can bring in could help you become more

453
00:36:58,740 --> 00:37:03,140
effective, could help you detect the ransomware, the malware. Instead of buying the next

454
00:37:03,140 --> 00:37:07,860
$20,000 firewall, why don't we look up more inventive measures? Why don't we educate

455
00:37:07,860 --> 00:37:13,380
the users more effectively? Our role is to help these guys understand strategically how

456
00:37:13,380 --> 00:37:14,320
these things work.

457
00:37:17,320 --> 00:37:21,700
And there may be some very basic things that a company hasn't even done. I mean,

458
00:37:22,300 --> 00:37:31,820
speaking of boxes with blinkies, right? So if you have a company that hasn't made executables

459
00:37:33,200 --> 00:37:37,800
unavailable in email, does it really matter what shiny, blinky box you put in front of

460
00:37:37,800 --> 00:37:37,940
it?

461
00:37:38,920 --> 00:37:39,960
Probably not.

462
00:37:40,880 --> 00:37:41,400
.

463
00:37:42,420 --> 00:37:42,940
.

464
00:37:49,960 --> 00:37:56,340
Right. So ultimately, the question then becomes, was the message received? You've

465
00:37:56,340 --> 00:38:01,360
now had these conversations with these different levels. So how do you know if that message

466
00:38:01,360 --> 00:38:05,080
was received? Well, one of the things you're going to do is you're going to pay attention

467
00:38:05,080 --> 00:38:11,120
to body language. Right? So we're going to talk a little bit about that. This is our

468
00:38:11,120 --> 00:38:11,720
last topic.

469
00:38:12,940 --> 00:38:13,140
.

470
00:38:20,500 --> 00:38:24,040
And we're going to talk about this in a little bit.

471
00:38:24,040 --> 00:38:24,360
.

472
00:38:24,360 --> 00:38:31,060
All right. So, let's go over here.

473
00:38:31,060 --> 00:38:32,540
So, this is a little bit more of an example of what we're going to talk about.

474
00:38:36,360 --> 00:38:36,540
.

475
00:38:36,540 --> 00:38:42,080
All right. So, let's go over here and see if we can get this one.

476
00:38:42,400 --> 00:38:42,500
.

477
00:38:42,500 --> 00:38:42,720
.

478
00:38:42,720 --> 00:38:48,060
communication. You know, what do you think's going on there, right? You're going to look

479
00:38:48,060 --> 00:38:57,040
at your body posture, your facial movements, your gestures, handshakes. Somebody's breathing,

480
00:38:57,220 --> 00:39:04,420
right? But the problem with looking at these verbal cues is are they always going to tell

481
00:39:04,420 --> 00:39:05,480
you the same thing?

482
00:39:34,420 --> 00:39:40,080
So typically, it's law enforcement, military stuff, but it helps you see, basically, de-escalate

483
00:39:40,080 --> 00:39:44,380
an issue. And when you're dealing, especially in a high-risk situation, hey, guess what?

484
00:39:44,460 --> 00:39:48,460
We've got ransomware. It all sits on the element handbasket, and the CEO's about to

485
00:39:48,460 --> 00:39:54,400
bring your net. It really helps you de-escalate that situation and helps move the message

486
00:39:54,400 --> 00:39:59,540
through. And part of this visual mode, verbal cues, you can get from, like, the FBI manual

487
00:39:59,540 --> 00:40:04,400
or the CIA manual, but part of it is very much the verbal language as to how we're

488
00:40:04,400 --> 00:40:07,300
going to deal with these things, and you on your own are going to fail.

489
00:40:08,300 --> 00:40:13,960
So if you look at these examples, what they all have in common is that they could be interpreted

490
00:40:13,960 --> 00:40:20,560
in multiple ways. So any one particular clue that you're getting may not be, because you

491
00:40:20,560 --> 00:40:25,680
can read all kinds of things about this stuff. And, in fact, when I was putting this together,

492
00:40:25,820 --> 00:40:29,900
I found a whole bunch of websites that said things like, you know, oh, if you have this

493
00:40:29,900 --> 00:40:34,080
kind of movement, it means this. Well, any one of these by itself,

494
00:40:34,400 --> 00:40:40,600
can be very misleading. So you have to consider, you've got to ultimately synthesize

495
00:40:42,220 --> 00:40:48,700
these nonverbal cues together. If you put them together, that's ultimately how you should be

496
00:40:48,700 --> 00:40:54,380
arriving at whatever you think is going on. So if you have, as these give an example,

497
00:40:54,680 --> 00:40:59,580
raised eyebrows and fleeting eye movement, as well as, you know, they're grabbing hard at

498
00:40:59,580 --> 00:41:04,260
something, they're probably very uncomfortable. But, you know,

499
00:41:04,400 --> 00:41:09,020
if they're just grabbing a hold of something, that may not have anything to do with discomfort.

500
00:41:09,280 --> 00:41:13,480
It may be that they're just thinking about something else at home that's making them stressed out.

501
00:41:14,780 --> 00:41:15,220
Yeah.

502
00:41:21,440 --> 00:41:25,560
Or whatever their beverage choice might be. Get to know them, right?

503
00:41:34,400 --> 00:41:39,680
Or having the message, getting the message right. Because the delivery and the receptiveness

504
00:41:39,680 --> 00:41:44,100
of that message is key. I mean, you can adjust the message according to the audience.

505
00:41:44,800 --> 00:41:49,740
It's huge skill. I mean, this is under the theme of Chris Hadley and the guys at SBCT.

506
00:41:50,000 --> 00:41:55,880
They are monsters of this skill. Please, look, there's something that we need to do

507
00:41:55,880 --> 00:41:59,880
much more effectively as a hearing professional to get the message across.

508
00:42:01,960 --> 00:42:03,860
Ultimately, it's our job to educate,

509
00:42:03,860 --> 00:42:08,800
not adjudicate. When you are talking to these folks, this is not a judgment.

510
00:42:09,280 --> 00:42:13,040
Don't taser them. Sorry.

511
00:42:13,780 --> 00:42:19,420
It should be essentially a judgment-free zone. Whatever they tell you, whether it's your

512
00:42:19,420 --> 00:42:25,700
end user, your mid-level manager, or your C-level folk, you know, teach them.

513
00:42:26,460 --> 00:42:31,840
Don't judge them for their beliefs or their thoughts or, you know, whatever they're communicating

514
00:42:31,840 --> 00:42:33,840
to you. Help them understand what they're talking about.

515
00:42:33,840 --> 00:42:37,820
Learn what they know and trade knowledge with them.

516
00:42:38,000 --> 00:42:44,440
I think that's a good one. Trade knowledge is huge. We are very good in our own areas.

517
00:42:45,160 --> 00:42:50,580
I had an amazing double conversation yesterday with somebody who deals in signal-frequency

518
00:42:50,580 --> 00:42:55,960
modulation. I know that works. And he did this thing. So we trade with knowledge.

519
00:42:56,340 --> 00:43:00,900
You can do the very same thing with your end user, your middle manager, your leadership

520
00:43:00,900 --> 00:43:03,820
guy. And if you trade knowledge, it opens up the way.

521
00:43:16,500 --> 00:43:22,940
And as many times as I hear, oh my God, there are these jerks who are in security, because

522
00:43:22,940 --> 00:43:24,220
there certainly are, right?

523
00:43:25,740 --> 00:43:26,920
Be the change.

524
00:43:27,380 --> 00:43:30,980
If there are all these jerks and you want to see fewer jerks, be one of those folks

525
00:43:30,980 --> 00:43:31,720
who isn't a jerk.

526
00:43:31,720 --> 00:43:36,000
And teach your friends to not be jerks.

527
00:43:37,020 --> 00:43:39,640
We can't affect change without changing ourselves.

528
00:43:40,600 --> 00:43:43,920
So be the change you want to see out there.

529
00:44:01,720 --> 00:44:02,980
Be those of us in the room.

530
00:44:03,240 --> 00:44:05,380
It's those of us that we look after.

531
00:44:05,420 --> 00:44:10,960
It's those of us that rely on us to deliver a system of people in a safe, secure, I don't

532
00:44:10,960 --> 00:44:13,720
care if it's civilian or military, government, whatever.

533
00:44:14,140 --> 00:44:18,780
It's our role to help basically be that security plan for those people.

534
00:44:19,080 --> 00:44:21,200
And help educate them the best that we can.

535
00:44:22,060 --> 00:44:25,280
And with that, we just have some thank yous.

536
00:44:25,360 --> 00:44:30,160
I wanted to thank my university for sending me here, Chris's company for allowing him

537
00:44:30,160 --> 00:44:30,620
to be here.

538
00:44:30,700 --> 00:44:31,220
And of course,

539
00:44:31,220 --> 00:44:31,700
I want to thank my university for sending me here.

540
00:44:31,700 --> 00:44:33,720
Wall of Sheep for having us.

541
00:44:33,800 --> 00:44:34,980
We can't thank you enough.

542
00:44:36,820 --> 00:44:38,820
Yes, thank you so much for coming.

543
00:44:39,560 --> 00:44:43,420
If you have questions, you know, we're happy to take some questions.