The next talk, this coming talk that we have right now, is a very, very good segue from Chris's keynote.
But before I introduce you to Catherine and Chris, I want to take a few minutes to give a public service announcement.
And around the second talk, before the beginning of the second talk,
I want to give a public service announcement on a topic which I'm sure some of you may be familiar with, which is sexual harassment.
I want to just let everyone know that it is an absolute no-no.
Just don't do it.
It is giving the security community a black guy, and ultimately the tech community a black guy.
Completely wrong.
Don't do it.
Don't go there.
Don't do anything stupid.
Read the paper.
Read the Code of Ethics and the Code of Conduct here at DEF CON.
Just don't even go there.
I mean, that's all I'm going to say.
Just don't do it.
Just don't give this community and cybersecurity a black guy and a bad name as it already has.
That's all I want to say.
Because, you know, we here, especially the Wall of Sheep and the Packet Hacking Village, I mean, it's absolutely a no-no.
Don't go there.
Okay?
So now it is.
My pleasure to introduce you to the next two speakers.
And these next two speakers, I guess the best thing I will say is they don't need a lot of introduction.
And a lot of what you may have heard about the speakers, especially the gentleman to my right, half of what you heard is not true.
So without much ado, it is my pleasure to introduce you to Catherine Ullman and Chris Roberts.
Chris Roberts.
Thank you.
It's our pleasure to be here.
This is my first time presenting at DEF CON Wall of Sheep.
Chris has done this multiple times in various places.
So he will no doubt be a little more comfortable with this than I am.
Thank you.
Thank you.
Thank you.
Thank you.
And we will see you here today.
Absolutely.
So just a quick bit about where this presentation came from.
Basically I had been sitting in on a bunch of B-Sides conferences and some other conferences.
And in particular a keynote that Chris Nickerson gave, in which he talked about some of our
failings as techs and geeks and hackers.
And I started to think about the top topics of the conversations that had been going on.
in these conferences and realizing that there seemed to be a missing piece and then in following
some of what Chris talks about in his blogs and some of the talks he gives, I started
to put together in my own head an idea of where I could take that topic and then reached
out to Chris and said, would you be a part of this? And he fortunately for me said yes.
So with that, we're going to talk about a situation in which an organization has ultimately
been hit with some sort of horrible ransomware because, you know, we never hear that these
days, right? There's never any cases of ransomware. Oh. Why did that?
All right. So while Catherine's sorting out the geek stuff that we all do a wonderful
job. Can you guys hear me now with this stupid thing? All right. Brilliant. So what Catherine's
failing to say is the fact that, let's face it, if any of you follow me on Twitter or
LinkedIn or anything else like that, there are somewhat regular occasions when I want
to actually taser most levels of users, managers, executives, lawyers. Actually, lawyers are
because we don't want to tase. We just want to take them out in the field and shoot them.
And so I'm occasionally known for that kind of an attitude. So when Catherine actually
came up and said, hey, I want to do a talk on how we communicate with people, especially
when the shit does hit the fan, it was one of those where I had to take that step back
and go, rather than being the somewhat rambunctious, rather annoying person that I can be on a fairly
regular basis, I actually had to go, how do we effectively communicate with the various
different teams?
teams and various different groups that we have. You good? I do like it when we have a
technical audience as well. The six of us are helping. At this point you're going to be
watching it on a small, oh there we go, yay. Just hit up and down. Well done. Where the
hell did he go? There he is. That man needs a shot. Well, yeah, actually we probably can.
We have a, if any of you have seen the Twitter feed this morning, there's an entire small
distillery in the back there. All right, I'm going to hand it over for a second. All right,
so first, even though you know who he is, we'll talk a little bit about me because most of
you probably have no clue who the heck I am. Okay, so who are we? Well, that's me, sort
of, at least. I like to sleep a lot. All right, for those of you who don't know who I am,
you're fine. This is really me. I've been at the University of Buffalo for 17 years.
I've been in security for about 10 of those. I have some certifications and some degrees.
I'm probably way overeducated for what I do. And none of my degrees, by the way, have
anything to do with any of this, really. So, that said.
Yeah, for those of you who don't know me, that's probably the best way you can actually
put me. That is not it. You're going to put me and United in the same line.
All right, so why should we care about this topic? I don't know. So, what are the odds
of being hit with something like ransomware? Well, they're pretty good. In 2016, we had
a small number of these, right? This is the United States. Thousands of ransomware were
1093 breaches
we're already past that at the halfway point of the year and what they're predicting through the end of
2017 is over 1,500 breaches
specifically targeting our
specifically
Involving malware of one variety or another and in many cases ransomware
So, you know many of you have probably seen these quotes, right? There's only a
Couple types of companies out there the ones that have been hacked those that will be and now we're talking about the ones that will be again
Because most of the time it's not just a one and done they get hacked
Somebody pops them and it's not too long even after the cleanup that they'll be hacked again. I can tell you
That there is a hospital in my neck of the woods that got popped and I can tell you that DNS for that particular hospital
Still wide open and this happened months ago. They still haven't addressed some of the basics
So, you know, what do we do out there well in some
Capacity whether we're hacking
For good or for evil in theory. We are some form of infosec professional right and as infosec professionals
We're really good at some things
We're really good at like
Diagnosing and fixing things most of the time right like Rob came up and helped diagnose and fix the problem we were having this morning
So we're pretty good at this
There are some things we're really not good at one of the things were really really not good
At is communication, right? I
Mean I know many of you probably feel this way if you're ever dealing with folks who are less technical and in some cases
Even with those of us who are technical
It's not the computer. No
It's one of those things, over the years, you think, we've been doing this for 25 years. When we first started, we played the user.
Then we played the developer, we played the network guys, the PDA guys. Then because we weren't getting the funds that we needed, we kept going back and saying, if I was broken, we could get another one with 50 or as many as you like.
We started blaming the CFO. Then we blamed the CEO. And then we blamed everybody else.
We have to take a step back and go, what are we doing wrong?
And I think in some cases we're still doing that we're still blaming everybody else
I still want to say to the users
I still want to say to the users
All right, so, you know, we're so not so good at verbal and written communication. We're really not
Another thing we're not particularly good at speaking to that tasering
Patience we don't often have a whole lot of patience
So given the fact that these are the things we're not particularly good at in this community, are there any repercussions?
You think there are repercussions for us not communicating all this information well?
Yeah, quite a few.
You're going to have issues with people are going to lose trust. They're not going to want to come to you when there is a problem.
And they need to be able to come to you when there is a problem.
There are all these processes out there to start to educate folks. All these phishing programs that are out there.
And the problem that I see with most of these programs that are in place these days is that at some level there's negativity.
And if there's negativity...
And I don't mean necessarily that you're even intentionally being negative with the users.
I mean, if you're talking to a fellow co-worker and you're saying something like,
Ugh, Joe Blow fell for that again.
You've got negativity on the brain.
You're not thinking, okay, if this is a person who always falls for this stuff, what controls can we put in place?
Now we know he's part of that, you know, one to five percent that may never learn.
Okay, we can compensate for that.
And I think the other thing is as well, and it's what tends to be at work a lot of the time,
which is part of the reason we're up here talking, is we communicate the same way no matter who the audience is.
That same message goes out. It doesn't matter if it's going out to leadership, management, users, the kids,
perhaps the kids' stuff that we're doing. We haven't yet figured out how to well modify that message.
Part of the reason we're up here having a conversation about it.
Absolutely.
So, you know, it's also going to cause problems with communications.
There's going to be more conflict.
You know, you're going to have a more difficult time in the future.
So ultimately, this is not ideal.
So what happens when your company gets hit?
Uh-oh, right?
Now the shit's hit the fan.
We now have to deal with it.
And we're so caught up as techs in trying to fix the problem.
And only saying what we absolutely need to so we can get back to fixing the problem,
that we don't realize we're making it worse on ourselves.
So we need to frame the conversation with the audience we're going to have it with.
So it's important to anticipate the questions that each level is going to ask you.
Some of them are going to be the same and some of them are going to be radically, radically different.
And how you respond to them is going to depend in part on framing of the questions that,
or the answers that you're going to give to these questions to that particular level.
So this goes back to what we were saying.
Obviously, a lot of times, we spend a lot of time talking and trying to sort out the end users.
We spent 25 years trying to get them to sort out their topics.
When it's normal practice to see levels so that they're full characters afterwards, we'll deal with that.
Please.
So.
.
Yeah.
And you need to consider how you're going to communicate this.
So what kind of channels are you going to use?
And there's some considerations regarding those channels.
I mean, number one.
Given whatever hit you, you may not have all these channels available to you.
And number two, depending on, you know, what's going on in your particular company,
there may be legal implications, which is in part why we have that final bullet.
.
Because that may be the only way you're allowed to tell people in some instances.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
And I mean, ideally, if you can do this in person, I really think that's without a doubt
the best way. But if you've got a company of 10,000 people, you may or may not be able
to do that. So let's start talking about the end user and how we're going to communicate
to them. So here's your average end user, right? And honestly, it's okay that they're
at that level. There's nothing wrong with somebody being at this very basic level. And
we need to understand that and make it okay in our own heads. Yes, it can be frustrating.
So what is the end user focused on? Well, they're focused on their day-to-day existence,
right? Getting their jobs done. You're going to use this as an opportunity, a training
opportunity for them.
Whether they were the ones who...
The ones who...
One or one specifically responsible for what happened, which we all know with ransomware,
it's very, very easy to do. But it doesn't really matter whether it was one particular
person or a whole group of people. You're essentially going to use this as a teaching
moment. And don't just teach them about what is... Why it's important at work. Explain
why this is important everywhere, whether it's at home, at work, with their kids. Because
the more you explain to them about how this matters to them as people and not to them
as employees, the faster you will get buy-in and the more they will understand.
I mean, that's a huge point. It's something we've done over the last couple of years.
Obviously with the blending of technology that isn't just in the corporate environment
now, the home, the work, the office, the vehicle, everything that's wearable is blending
that technology. The more you help that person understand that and how it's going to affect
them as a whole, the more effective it's going to be. It's going to take, thank you,
for the help that you're giving us.
Audience member 6
Absolutely. And you need to use effective and efficient communication to do that. And
we're going to talk about what that actually means.
So it sort of goes to what we've been saying, right?
want to talk to them at their level in a way they're going to understand, be concise. Less
is more. But that doesn't mean that you're going to talk down to them in some way. You
may need to be judicious and leave out specific information because there may be corporate
information that, you know, about whatever's happened that they shouldn't necessarily know.
But that doesn't mean you shouldn't try your best to answer their questions as honestly
as possible. And you've got to be patient. Even if it means afterwards you go and you
bang your head and tear your hair out and taser. So, you know, be patient.
This is something I don't have much of and it has not served me well at times. It is
a huge thing that we are not good at in the industry and we have to get better at. Whether
it's explaining it to the end users, whoever it is explaining it to, you mentally have
to take that step back and go, you can't explain it how I understand it. You have
to explain it in terms that they understand it. If we don't do that, we have failed.
Absolutely. Engagement is going to be your key. You need to engage whoever your audience
is going to be. And as I mentioned, you need to be upfront and honest. If you do this lies
to children thing, I mean, how many people know that when they have little, little kids
and little kids ask a question that's really seems simplistic at an adult level, but you're
like, oh, how do I explain this to a kid? Like, you know, where do babies come from,
right?
So,
how many times you hear a question like that and you think, oh, I don't want to answer
this, so I'm going to give them a stork story or something silly. And, you know, I mean,
this is kind of a bizarre example, but the bottom line is it will come back to bite you
because someone will inevitably tell them the truth in a way that they don't understand
and then frightens them and you've done everybody now a disservice. So, you know, you don't
want to do that.
So, this is also key for executives. Having worked with media leadership,
as much as we want to cause them and trouble them and not bother them, for crying out loud,
we have to, well, it works both ways. We have to get better at explaining it to leadership
and they have to get better at not speaking the message out. It is definitely a two-way
trick, but this whole, I don't want to bother the leader, I don't want to bother the management,
that bullshit's got to stop. We've got to do a much more effective job of this is part
of the whole discussion about how we communicate at that level, but positing them and dealing
with them and taking them away from it isn't going to fix the problems that we have.
No, and you need to reassure them. If there's somebody who is terrified of what's happened,
you know, you don't want to lie to them, but you want to assuage their fears, which
means answering their questions. And if they come to you and they say, oh, my computer
is doing this weird thing. We had recently, at the university, I had an email from a woman
who was very concerned because she'd received an email and somehow thought that by receiving
this email that had no links and no attachments and nothing in it, that it could have infected
her machine because she could tell it was spam, right? So she was very concerned about
this and didn't understand. And I had to explain to her, no, this won't impact your
machine at home. No, you're okay. It didn't impact your online banking. I mean, you know,
we as techs know, if you get a text email that has nothing attached to it, chances are
you're probably okay, right? You just delete it and go on with your life. But these people,
perception is everything. They think it's reality. And we need to take that into account
when we're talking to them.
Male Speaker 419 scams. We got involved with a bunch of stuff years ago. For those of you
who knew the airplane stuff, before the airplane stuff, we hacked Nigeria and got money back
into the U.S. to do a pit stop with a 419 scam, basically taking money out. One of
the biggest ones that we ended up dealing with was this lady that was trying to get
a job at the airport. She thought that the director of the FBI was communicating with
her directly. And she had the email, and she had the headers on it, and she had the
letters from him. Her perception was that the director of the FBI was telling her to
do this. It's our job to help them understanding how language that they can get. That's not
the case.
So let's move on to middle management now. Calm down. It's all good, right? No.
So they're going to be focused on whatever business process they're responsible for. And that
could be radically different at different companies. You could have a couple of middle
managers. You could have a ton. You could have an HR person, an IT person. I mean, you
could have a zillion of these, right? So depending on what particular business process they're
involved in, that's the thing that they're going to be really, really focused on. And once
again, you need to be talking to them at a level that they can understand. And if they're
not, again, we're talking about effective and efficient communications with them. Help
them understand what's going on. Middle management is hard.
So here's what an ideal middle manager looks like, right? They have this huge set of skills.
How many of you have ever seen an ideal middle manager who has all these skills? Raise your
hands. Anybody know any of these?
Yeah, because typically...
.
See, they're like this, right? There's not such thing as an ideal middle manager. They
don't have all those qualities. They might have a couple, and that's a good thing. But
typically, they don't have all of them. So how do we talk to real ones? Well, we're not
going to engage with them. It's a tough place being a middle manager. All the people who
are above you want to keep you where you are and all the people who are below you want
to be who you are. And so you're getting pressure from both above and below, and you're trying
trying to do your job. So how do you manage that? Well, as the IT person or the red team
or the blue team, whoever you are in that position, you're there to help them. Help
them look good. Ultimately, that makes everybody's job easier. You need to be empathetic, which
is really hard sometimes when you've never held that job.
So the other thing to think about as well, I come from a somewhat research red team background,
which is great. We walk in, we broke the stuff for the last 25 years, we go, aha, we broke
all of your shit. And then we leave. That's not working. So now we say, take a look at
the middleman's button from a metric standpoint, from a maturity standpoint. I broke all of
your shit because you're here. You, from a fiduciary reason as an organization, need
to be here or you need to be here. You need to be here. You need to be here. You need
to be here. So how do we help you, especially the middle management guys, understand the
metrics that are necessary, understand the controls that are necessary in a language
they can understand and something that they can take up to the leadership and then move
down into the very team. It comes down to us, again, not just saying, hey, you broke
shit, but what are the metrics behind it? What's the maturity behind it? And then,
honestly, what's the next step that we can help them and all of the other people that
work with us together achieve to move that box?
And that means having a full plan, you know, to what Chris was saying, this whole
idea of we walk in, we break stuff, we leave. Well, we don't want to just walk in, break
stuff, and then say, okay, we need to get here. You need to help them figure out how
to take all those steps. And that means a full, complete plan to get there. Not, well,
you need to follow these guidelines and just read them and do what they say. Well, that's
not useful. You need to do more than that.
So, the plan's got to include everything. What happened, what your end goals are, and
the actual specific steps, working with the middle management to figure out how you're
going to get there.
This is something, again, for those of us that run Red Sheets, for those of you guys
who go in and actually help organizations understand where the issues are, if you are
not putting some of the end goals in there, if you are not putting some of the, how do
we get from, you got broken, to, you know, how do we get from, you know, how do we get
through, you can be fixed, or at least you can get off the bottom rung of the ladder.
If those aren't going in there, we're giving a disservice to the very people that we're
going to be supporting. So, we've got to help them understand. And it isn't just a
technical thing. It comes down to the fiduciary. It comes down to the compliance, the legal,
financial. Give the middle management the tools that they need to argue through leadership
as to why this shit is important. It's how we're going to help basically harm them,
to have those nasty ass discussions and take those out of the far and wide.
So, these are just some of the things that you need to keep in mind in your plan. But
management also needs to be responsible for their user's behavior.
Now, what does that mean? Does that mean that, like, you need to take the onus somehow,
or the managers have to say, oh, it's my fault that, you know, Joe Smith didn't bother
to pay attention and he couldn't do it?
No, it means what I was talking about earlier. You're always going to have some portion of
your user base that isn't going to do the right things, no matter how many times you
tell them, no matter what training they go through. So, what this means is you're going
to help middle management understand that they need to figure out who they are. Because
the other people, they can figure out who they are and they can educate them. And those
people that they can't educate and there's no way to get around that, you can have them
put, work with them to put controls in place to deal with that percentage. Because, and
if you, if they and you don't know who they are, then there's absolutely nothing they
can do. So, management has to take that responsibility on. It doesn't mean, necessarily, they have
to go to each and every person and find out they can delegate this. But they need to find
out and it needs to be part of what they're doing and you need to help educate them to
realize that.
And these are just some of the areas in terms of engaging with middle management that you
need to consider which direction they need to go. You're going to coach and encourage
some form of collaboration, but, you know, do they need to manage stuff? Do they really
need to control stuff? Is it stuff they can delegate? There are all these different factors.
I think the other thing in here as well, and it's something we all think about, is
as we look at the news, and we help, and we ask you what, and not many organizations
put their hands up and go, sorry, we lost all your tips, we fucked up. We need to help
the middle management go, hey, you made a mistake and it's okay to admit making that
mistake. You're not going to get fired for it, but it's okay to admit that you made a
mistake as long as you can go, hey, I made it, I learned from it, and here's what we're
going to do differently. It's not here's what I did, it's here's what you did. It's
what we are going to do differently. Very, very informal middle management.
And this kind of goes back to some of the questions that you need to make sure there
are answers for. If we're talking about some form of ransomware, there's always the question
of do we pay? And, you know, ideally, as InfoSec people were going to tell you, that's
probably not a good idea. But maybe there's a situation where the company decides that's
in their best interest for some reason. They need to know this answer long before this
happens. And if they don't already know this answer before it happens, they better have
this answer ready for upper management before that upper management comes calling.
So let's talk about the C-suite. So they're going to focus on the big picture stuff, right?
You need to think when you're walking in there.
It's going to be like as if you've got 30 seconds in an elevator to have that conversation.
So now you even need to be more concise with what you're talking about.
Very, very, very specific details. And yet, they need to be very broad in nature.
Because what that C-level is focused on is going to be an overview of the company at
various levels.
The executives, executives, board of directors, i.e., the decision makers, the heavyweight
decision makers. You know, take some time and practice this one. I don't care if you
talk to other people, talk to yourself, talk in front of a frickin' miracle or like that.
But get to a level where you can help a leadership organization understand literally in that
30 seconds why this is important. Talking to the big level, the 27,000 people in this room
will understand, isn't going to do it.
But understanding the fiduciary reasons, the fiduciary leadership and what they have to do
and why it's important for the overall organization, why it's important for whatever the different
reasons, for the digital side of it, the future of the company, where the organization's
going, the market sector, the industry itself. These are things that you guys are going to
have to understand because it's all of our responsibility to educate you at the entire
level. These guys are the best ones.
So here are the, kind of, the things that you guys are going to have to understand.
Here are the bullet points. You're going to describe very generally what happened.
You're not going to talk in technical terms. Even if they understand technical terms,
that's not where their brains are. That's not what they're thinking about.
You're going to provide this best case, this worst case, and the most likely scenario.
Because that's, again, what they're thinking about. The overall big picture.
What is the possibility of this being, you know, a complete catastrophe?
And not only that, you want to try to tell them, if you know something about underlying
causes of what happened in ransomware case, you know, it's probably somebody clicking
on something they shouldn't have. And what are the consequences going to be
for that organization, you know, if they can't get their data back, and you've talked
to the other IT people, and maybe their backups haven't worked in the last year?
I'm going in there and having a conversation like, oh, we don't have enough money
for this, and CSO is an asshole, and we need to choose a developer. That's not going to do it.
Having a conversation like, hey, I understand that you have to go to the board of directors
next week and explain what the hell we just happened. Let me give you some insight onto
where the future of the company is going. How does this relationship with maybe our
vendors, our suppliers, need to be leveraged more effectively to provide the security?
Maybe help understand with you guys, hey, it comes from the top down. We can have your
useful message more effectively throughout the organization. You can have your useful
message more effectively. And remember, of course, they're people, too. I mean, sometimes
I know it's really hard to remember, but at the end of the day, most of them go home,
some of them to families, and, you know, they're trying to have lives, too. And it's really,
really hard on them to have this hanging over their heads.
So, again, be empathetic with them. So, metrics. Metrics are going to be something
really important at this level. But not just any metrics. You want metrics that are really
meaningful. Something that is meaningful and measurable is going to be far more useful.
And I can give you an example from my own institution. So one of the things that we
put in place is that...
For emails that come in with links that go out to websites that have done some sort of
a screen scrape and look just like our shibboleth login page, we put in a redirection. And
that redirection goes to an educational page. You know, you've clicked on...you've arrived
here because you clicked on a bad thing and, you know, just so you know, right? The tool
that we use to put that in place actually gives me click metrics. I can say, by doing
this, we prevented...
We've prevented X number of people, because I can even sort by IP address, from going
to this space. And what that tells our folks is, hey, this tool we bought, it's giving
us some value for that in a context that is important to our management.
I think the other thing to look at as well on this one is a meaningful, measurable
metric. We have a ton of resources out there. We've looked at the last report. We've looked
at all our love and hate for Cisco and Microsoft and all those other ones for companies.
They each put out reports every six months, every year, variety of reports. All of these
reports and metrics, they break down the industry that we're looking after and we have
responsibility to, and say, who's getting their ass handed to them? How often? How
much? These are the metrics we can go to the CFO and say, hey, here's where we are.
Here's where the industry is. Here's where we should be. Here's where we need to be.
Here's what we need.
Here's what's coming down the line from a business standpoint. And why do we need to
be paying more attention to IoT or whatever the heck the latest one of the day is going
to be. This is the stuff that we need. Use those outside resources to help strengthen
the message to these folks.
And, you know, your CFO often knows those fiduciary legal requirements for their
company. So let that person teach you and turn around and help them understand what
the requirements and the regulations within IT that correspond to that. Work together
on that in the CFO land.
In the COO land, there are a couple different kinds. I'll let Chris talk a little more
about this.
So these are the guys, again, so from a team operating officer, you have the guy
who's there to make sure the damn company stays running. Pretty much they'll come
head or high water. So he doesn't want to turn things off. He doesn't want to take down
DLT. I apologize. DLT doesn't want to take things down. You have to help them understand
how to be more successful in the world. You talk about ransomware. It's going to impact
and how do we mitigate that. Help them understand the mitigation. Help them understand
also from the COO to the CTO to the COO. Where are they going and how can you help
them understand more effectively, not just their position, but how they can influence
change inside that organization.
And maybe you can do that.
How they can be more effective. You know, we all take a look at the logging, the monitoring,
the management. Well, nobody has enough teams and enough staff. So as security professionals,
it is our role to say, hey, these tools that we can bring in could help you become more
effective, could help you detect the ransomware, the malware. Instead of buying the next
$20,000 firewall, why don't we look up more inventive measures? Why don't we educate
the users more effectively? Our role is to help these guys understand strategically how
these things work.
And there may be some very basic things that a company hasn't even done. I mean,
speaking of boxes with blinkies, right? So if you have a company that hasn't made executables
unavailable in email, does it really matter what shiny, blinky box you put in front of
it?
Probably not.
.
.
Right. So ultimately, the question then becomes, was the message received? You've
now had these conversations with these different levels. So how do you know if that message
was received? Well, one of the things you're going to do is you're going to pay attention
to body language. Right? So we're going to talk a little bit about that. This is our
last topic.
.
And we're going to talk about this in a little bit.
.
All right. So, let's go over here.
So, this is a little bit more of an example of what we're going to talk about.
.
All right. So, let's go over here and see if we can get this one.
.
.
communication. You know, what do you think's going on there, right? You're going to look
at your body posture, your facial movements, your gestures, handshakes. Somebody's breathing,
right? But the problem with looking at these verbal cues is are they always going to tell
you the same thing?
So typically, it's law enforcement, military stuff, but it helps you see, basically, de-escalate
an issue. And when you're dealing, especially in a high-risk situation, hey, guess what?
We've got ransomware. It all sits on the element handbasket, and the CEO's about to
bring your net. It really helps you de-escalate that situation and helps move the message
through. And part of this visual mode, verbal cues, you can get from, like, the FBI manual
or the CIA manual, but part of it is very much the verbal language as to how we're
going to deal with these things, and you on your own are going to fail.
So if you look at these examples, what they all have in common is that they could be interpreted
in multiple ways. So any one particular clue that you're getting may not be, because you
can read all kinds of things about this stuff. And, in fact, when I was putting this together,
I found a whole bunch of websites that said things like, you know, oh, if you have this
kind of movement, it means this. Well, any one of these by itself,
can be very misleading. So you have to consider, you've got to ultimately synthesize
these nonverbal cues together. If you put them together, that's ultimately how you should be
arriving at whatever you think is going on. So if you have, as these give an example,
raised eyebrows and fleeting eye movement, as well as, you know, they're grabbing hard at
something, they're probably very uncomfortable. But, you know,
if they're just grabbing a hold of something, that may not have anything to do with discomfort.
It may be that they're just thinking about something else at home that's making them stressed out.
Yeah.
Or whatever their beverage choice might be. Get to know them, right?
Or having the message, getting the message right. Because the delivery and the receptiveness
of that message is key. I mean, you can adjust the message according to the audience.
It's huge skill. I mean, this is under the theme of Chris Hadley and the guys at SBCT.
They are monsters of this skill. Please, look, there's something that we need to do
much more effectively as a hearing professional to get the message across.
Ultimately, it's our job to educate,
not adjudicate. When you are talking to these folks, this is not a judgment.
Don't taser them. Sorry.
It should be essentially a judgment-free zone. Whatever they tell you, whether it's your
end user, your mid-level manager, or your C-level folk, you know, teach them.
Don't judge them for their beliefs or their thoughts or, you know, whatever they're communicating
to you. Help them understand what they're talking about.
Learn what they know and trade knowledge with them.
I think that's a good one. Trade knowledge is huge. We are very good in our own areas.
I had an amazing double conversation yesterday with somebody who deals in signal-frequency
modulation. I know that works. And he did this thing. So we trade with knowledge.
You can do the very same thing with your end user, your middle manager, your leadership
guy. And if you trade knowledge, it opens up the way.
And as many times as I hear, oh my God, there are these jerks who are in security, because
there certainly are, right?
Be the change.
If there are all these jerks and you want to see fewer jerks, be one of those folks
who isn't a jerk.
And teach your friends to not be jerks.
We can't affect change without changing ourselves.
So be the change you want to see out there.
Be those of us in the room.
It's those of us that we look after.
It's those of us that rely on us to deliver a system of people in a safe, secure, I don't
care if it's civilian or military, government, whatever.
It's our role to help basically be that security plan for those people.
And help educate them the best that we can.
And with that, we just have some thank yous.
I wanted to thank my university for sending me here, Chris's company for allowing him
to be here.
And of course,
I want to thank my university for sending me here.
Wall of Sheep for having us.
We can't thank you enough.
Yes, thank you so much for coming.
If you have questions, you know, we're happy to take some questions.