1
00:00:00,500 --> 00:00:05,940
So we appreciate everyone being here. We have our first speaker, John Nye. He's the Vice

2
00:00:05,940 --> 00:00:10,520
President of Cyber Security Strategy at Synergist Tech and has over ten years of experience in

3
00:00:10,520 --> 00:00:16,680
the security and IT industry. He is or has been an auditor, consultant, hacker, speaker,

4
00:00:16,900 --> 00:00:21,420
father, leader and writer. So we want to give our attention to John Nye's theme is the human

5
00:00:21,420 --> 00:00:24,860
factor. Why are we so bad at security and risk assessment?

6
00:00:32,380 --> 00:00:36,900
We'll see if you still want to clap when I'm done. So as I said, my name is John Nye.

7
00:00:37,060 --> 00:00:41,000
I'll make the introductions brief because they've got a timer over here and I've got a lot to

8
00:00:41,000 --> 00:00:45,700
tell you about. So I already told you this. I do security. I was a pen tester for the last ten

9
00:00:45,700 --> 00:00:50,860
years doing technical stuff and I'm sick of seeing the same stuff over and over again and I think

10
00:00:50,860 --> 00:00:54,780
we need to fix the core, the root of our problem and that's what I'm here to talk about. I

11
00:00:54,780 --> 00:00:59,740
work for a company called Exilio slash Synergistic and we do consulting mostly for

12
00:00:59,740 --> 00:01:29,440
healthcare. All right, so let's get this rolling. Wetware, which is all of you. We, and I mean by we, I mean we, every single human being are all biased. And I mean the most enlightened person you've ever met in your life, they're still biased. They have biases that control. It's an ingrained part of our core selves, of our humanity to have these. And without it, we wouldn't be humans.

13
00:01:29,740 --> 00:01:39,460
I mean we have to have these biases. But we also have to understand them. This is going this way, each and every one of you came into this room today and you had some sort of preconceived idea

14
00:01:40,420 --> 00:01:51,780
about why you came here. You know, maybe you saw my tweets or the blogs I was posting on peer list or somebody dragged you in here or the line was shorter than the other ones.

15
00:01:52,260 --> 00:01:59,720
You know, there's a lot of things. Or you're here to get a seat to see Jason and Michelle talk. Whatever. You know you had to get in here to

16
00:01:59,720 --> 00:02:04,920
here. Or maybe you hope to learn something. Maybe you think I am completely full of shit and you

17
00:02:04,920 --> 00:02:08,280
want to prove that. You know, there's a lot of things you can do. You want to prove me wrong,

18
00:02:08,420 --> 00:02:13,880
that could very well be it. Then you all came in and sat down and you're like, I wonder if this

19
00:02:13,880 --> 00:02:19,420
hour is going to be worth my time. All of you thought about that for a minute. Then the biggest

20
00:02:19,420 --> 00:02:28,360
hurdle for all of our bias is when you saw me. And you're like, okay, this guy is, looks like a

21
00:02:28,360 --> 00:02:34,780
tool. You know, maybe I look like a tool. Or maybe you thought I'm cute. I am single. So that's

22
00:02:34,780 --> 00:02:42,040
awesome. Come talk to me afterwards. Or a million other things. You know, you could say you hate my

23
00:02:42,040 --> 00:02:48,340
jacket. It looks stupid because my sleeves are rolled up like Zack Morris. Right? Or my hair. Or

24
00:02:48,340 --> 00:02:52,520
you like my hair. Or a million things you could say, positive or negative, thinking about me on

25
00:02:52,520 --> 00:02:58,340
first impression. And that absolutely guides how you're going to view what I have to say.

26
00:02:58,360 --> 00:03:06,960
The entirety of how we feel about people, situations, risk, decisions, ourselves, others, all of

27
00:03:06,960 --> 00:03:12,900
that is directly linked to these biases, which, as you will see, are directly controlled by our

28
00:03:12,900 --> 00:03:21,260
emotions. And that, that is a lot of implications. So it appears, as best as scientists can tell, at

29
00:03:21,260 --> 00:03:27,300
least, that this is actually our brain's mechanism to keep us safe. Because if you think about it,

30
00:03:27,320 --> 00:03:28,340
at every given time, there's going to be a lot of things that we're going to have to deal with.

31
00:03:28,360 --> 00:03:31,040
It's more than just a question. It's more than a given second. Every single person in the world is

32
00:03:31,040 --> 00:03:38,140
getting so much data thrown at them. All of your senses, all the stuff you're thinking about.

33
00:03:38,260 --> 00:03:43,520
The emotions you're feeling. And it's more than a person could deal. It's more than you could

34
00:03:43,520 --> 00:03:49,180
handle. More than you can conceive of. More than we can fathom the amount of information that

35
00:03:49,180 --> 00:03:54,940
we're getting at any given second. Because of this, our minds handle the vast majority

36
00:03:55,620 --> 00:03:57,300
independently of our conscious mind.

37
00:03:57,820 --> 00:04:01,040
So we don't even know what's going on.

38
00:04:01,460 --> 00:04:03,700
And that way we're not inundated at all times.

39
00:04:03,860 --> 00:04:09,440
You know, we're happy, oblivious to what's going on around us, the vast majority of what's going on around us.

40
00:04:09,740 --> 00:04:15,200
And it's only possible because our minds have found this mechanism to stay sane.

41
00:04:15,520 --> 00:04:17,840
And that mechanism is not trusting you.

42
00:04:17,980 --> 00:04:21,860
Your brain does not trust you to do stuff, at least not with your conscious brain.

43
00:04:23,220 --> 00:04:25,480
So now you see your brain doesn't trust you.

44
00:04:25,480 --> 00:04:28,000
You need to think about whether you need to keep trusting your brain.

45
00:04:28,280 --> 00:04:29,360
And that's what we'll talk about.

46
00:04:29,580 --> 00:04:33,560
So the main topic, what is the most important note on your network?

47
00:04:33,700 --> 00:04:36,860
We're all hearing about important things on our networks.

48
00:04:37,160 --> 00:04:41,840
Well, I'm going to get you in the right frame of mind before we dive into this.

49
00:04:41,960 --> 00:04:49,840
Think about a disagreement or a situation where you had to convince somebody of something that you had facts behind.

50
00:04:50,600 --> 00:04:53,200
So how many times has this happened in those situations?

51
00:04:53,560 --> 00:04:54,860
You come into this confrontation.

52
00:04:55,480 --> 00:05:01,500
You have significant, strong, irrefutable facts and evidence to show them.

53
00:05:01,660 --> 00:05:10,320
But no amount of logic or reasoning actually gets through to your opponent, to the other person you're talking to.

54
00:05:10,560 --> 00:05:11,940
They've dug in their heels.

55
00:05:12,180 --> 00:05:13,260
They won't budge.

56
00:05:13,420 --> 00:05:14,620
We've all seen it.

57
00:05:15,300 --> 00:05:17,500
And I know it's not unfamiliar to you.

58
00:05:17,520 --> 00:05:18,440
We see it every day at work.

59
00:05:19,220 --> 00:05:20,960
And I'm not just talking about idiots.

60
00:05:21,240 --> 00:05:22,400
These are smart people.

61
00:05:22,600 --> 00:05:25,060
We all know smart people who also believe things.

62
00:05:25,480 --> 00:05:26,360
We can't fathom.

63
00:05:26,400 --> 00:05:27,680
And we can easily refute.

64
00:05:27,800 --> 00:05:28,600
They believe it.

65
00:05:29,100 --> 00:05:31,500
The question on the screen is rhetorical.

66
00:05:31,640 --> 00:05:33,180
I don't want everybody to yell out an answer.

67
00:05:33,360 --> 00:05:35,080
But I hope you've all thought about it.

68
00:05:35,380 --> 00:05:37,780
And in case not, the answer is humans.

69
00:05:38,240 --> 00:05:43,120
The most important note on your entire network is not a technical note.

70
00:05:43,420 --> 00:05:45,080
It's the biology.

71
00:05:45,760 --> 00:05:51,740
So think of the times you watched someone, despite all the evidence and warnings to the contrary, proceed to make a horrible decision.

72
00:05:52,600 --> 00:05:53,720
We've all seen it.

73
00:05:53,860 --> 00:05:55,460
In fact, if you want to hear it, you can.

74
00:05:55,480 --> 00:05:56,700
Use your own 20-20 hindsight.

75
00:05:57,120 --> 00:06:00,160
I am sure each and every one of you has an instance like this.

76
00:06:00,400 --> 00:06:03,260
If you're like me, you've probably been in an instance like this in the last couple days.

77
00:06:04,040 --> 00:06:04,980
And that's fine.

78
00:06:05,080 --> 00:06:05,560
We're in Vegas.

79
00:06:05,760 --> 00:06:07,240
This is a great time to make some bad decisions.

80
00:06:08,400 --> 00:06:15,580
So I'm going to do my best to help you all understand the people that use your networks, including yourself, through this talk.

81
00:06:16,720 --> 00:06:18,860
These are the broad topics we're going to cover.

82
00:06:21,220 --> 00:06:24,520
We're limited on time, so I'm going to bowl through all these things.

83
00:06:24,520 --> 00:06:27,200
But I want to tell you right now, this talk is an introduction.

84
00:06:27,680 --> 00:06:34,100
These are topics and concepts for which there are dozens of books, hundreds of research papers.

85
00:06:35,040 --> 00:06:38,720
I could not even begin to touch on all this if they let me talk all day.

86
00:06:39,000 --> 00:06:40,240
Because there is so much.

87
00:06:40,540 --> 00:06:43,540
So what we need to do is all of us need to dig.

88
00:06:43,680 --> 00:06:45,500
We all need to start looking at this.

89
00:06:45,600 --> 00:06:47,000
There is science out there.

90
00:06:47,040 --> 00:06:48,440
There is information that can help us.

91
00:06:48,860 --> 00:06:54,160
And we'll look at the studies out there right now and decision-making, memory, perception.

92
00:06:54,520 --> 00:07:00,980
Their insights have been applied to all sorts of industries over the years with amazing success.

93
00:07:02,040 --> 00:07:06,900
Financial corporations use it because they know we're irrational.

94
00:07:07,200 --> 00:07:08,420
And it's helped them a lot.

95
00:07:09,200 --> 00:07:14,180
We see it in, anyways, we're going to look at decision-making, memory, and perception.

96
00:07:14,460 --> 00:07:17,280
And you'll better understand what we're getting ready to say here.

97
00:07:17,520 --> 00:07:19,640
So like Soylent Green, wetware is people.

98
00:07:19,800 --> 00:07:23,360
And people are the single most important asset on any network.

99
00:07:23,940 --> 00:07:24,500
Computers are the most important asset on any network.

100
00:07:24,520 --> 00:07:29,600
Computers, let alone the network itself only exist because people use them.

101
00:07:29,840 --> 00:07:35,760
And despite, or perhaps because of their best intentions, people are terrible at decision-making.

102
00:07:36,020 --> 00:07:37,920
And by extension, security.

103
00:07:39,540 --> 00:07:43,960
We're all of our user education efforts, are those pointless.

104
00:07:44,660 --> 00:07:47,560
You know, can we better understand our users.

105
00:07:47,680 --> 00:07:48,280
Is that possible.

106
00:07:48,940 --> 00:07:50,840
These are the kind of things we need to answer.

107
00:07:51,080 --> 00:07:52,540
Knowing what makes people tick.

108
00:07:53,140 --> 00:07:56,640
That's the key to keeping our non-biological systems secure as well.

109
00:07:57,300 --> 00:08:02,600
The best hope we have to move beyond the reactive security model that we're all living in,

110
00:08:02,700 --> 00:08:04,800
as I know it feels like Groundhog's Day to me,

111
00:08:05,660 --> 00:08:09,560
is that we embrace the truths of human component of our networks.

112
00:08:09,800 --> 00:08:13,920
And we have to keep in mind this is a very difficult journey to take.

113
00:08:14,160 --> 00:08:19,040
Our brains are full of these safety mechanisms that make this stuff hard for us to grasp.

114
00:08:19,040 --> 00:08:23,180
And we consciously want to not believe it.

115
00:08:23,320 --> 00:08:25,460
Like, my brain doesn't do that to me.

116
00:08:25,580 --> 00:08:27,180
I make good decisions, etc.

117
00:08:27,780 --> 00:08:30,100
But all of this is applicable to everybody.

118
00:08:30,700 --> 00:08:32,680
Let's get an understanding of what perception is.

119
00:08:33,080 --> 00:08:35,720
So I want to start this section here with an illustrative story.

120
00:08:35,920 --> 00:08:40,580
Set the stage so you can begin to perceive what perception is.

121
00:08:40,880 --> 00:08:43,500
It's a very difficult concept for people to get.

122
00:08:43,620 --> 00:08:48,660
But story is one of the most powerful things you can use to illustrate concepts like this.

123
00:08:49,040 --> 00:08:54,500
So when I was a kid, my uncle, he had collected horses.

124
00:08:54,940 --> 00:08:56,720
Not like pretend horses.

125
00:08:56,880 --> 00:08:59,580
He had real horses, like draft horses and all that stuff.

126
00:09:00,120 --> 00:09:01,260
Well, I was a city kid.

127
00:09:02,340 --> 00:09:04,280
And I didn't know a lot about them.

128
00:09:04,320 --> 00:09:08,820
But he'd tell me about some pony that was growing up and he was going to have to break the horse.

129
00:09:09,280 --> 00:09:10,860
I didn't know what that was.

130
00:09:10,960 --> 00:09:13,480
So I made up what it was in my head.

131
00:09:14,240 --> 00:09:18,600
And to me, what I pictured was like a horse owner, which was, of course,

132
00:09:19,040 --> 00:09:20,980
was like a cowboy rancher looking guy.

133
00:09:21,240 --> 00:09:24,040
He's got leathery skin, a big bushy mustache.

134
00:09:24,400 --> 00:09:30,840
And he's always be like, what you're looking at, you know, yelling at everybody, sitting in a sitting in his big, huge horse.

135
00:09:31,240 --> 00:09:35,900
And he would have to literally break the smaller horse, break it.

136
00:09:36,000 --> 00:09:37,380
That's what I imagined.

137
00:09:37,940 --> 00:09:48,920
So I picture him taking his lasso and lassoing this little horse, diving on it, doing some sort of Hulk Hogan, you know, headlock and literally breaking its back.

138
00:09:49,040 --> 00:09:51,740
And then nursing it back to health so it would be docile.

139
00:09:52,000 --> 00:09:53,020
That's what I pictured.

140
00:09:53,800 --> 00:09:56,460
And now that's not what breaking a horse is.

141
00:09:56,600 --> 00:09:58,100
I know people in here have dealt with it.

142
00:09:58,240 --> 00:10:00,120
Not that I really know much about it.

143
00:10:00,440 --> 00:10:12,020
But for a surprisingly long time, this preconception that was made up out of whole cloth by my six or seven year old mind, it stuck with me.

144
00:10:12,320 --> 00:10:17,440
And still now when I hear it, which is super rare, when I hear about somebody breaking a horse,

145
00:10:17,620 --> 00:10:18,900
the first image I have.

146
00:10:19,040 --> 00:10:20,460
Is somebody breaking a horse's back.

147
00:10:20,840 --> 00:10:30,360
I know that's not what happens, but you could see how my perception of this act of breaking a horse led me to have negative feelings and toward the people that did this.

148
00:10:30,480 --> 00:10:37,060
So I didn't, I had a bias against country music for most of my life because they talked about horses and I was like, I, I like animals.

149
00:10:37,220 --> 00:10:38,280
I don't want people to do that.

150
00:10:39,680 --> 00:10:42,120
So, you know, we all have these biases.

151
00:10:42,380 --> 00:10:47,380
So maybe you're a vegetarian and you think people that eat meat are disgusting secretly.

152
00:10:47,780 --> 00:10:48,480
Maybe not.

153
00:10:48,520 --> 00:10:48,900
So secret.

154
00:10:49,040 --> 00:11:03,040
Or one that I see everywhere is with sports ball, whatever sports team you're into the player for the year rival team who you hate until they come to play for your team and then they're great, you know, and it's, it's total.

155
00:11:03,180 --> 00:11:05,180
It's just the bias in there.

156
00:11:05,280 --> 00:11:18,640
So our perception is one of the most important things for us to understand as humans, we have our own unique perception of the world and the default setting of our perception is to be narrowly focused on our own point of view with no

157
00:11:18,640 --> 00:11:19,020
concern.

158
00:11:19,040 --> 00:11:25,000
So by default, the world does revolve around you by default.

159
00:11:25,140 --> 00:11:27,000
That's how it works again.

160
00:11:27,180 --> 00:11:34,620
Another story about when I was younger, I lived near my grandfather and he was a professor, a professor in sociology and I didn't get to talk to him about that.

161
00:11:34,720 --> 00:11:48,560
I was too young, but he, one day he did a really rare thing and he took me out to lunch, which I think that was maybe the only time he ever did and proceeded to tell my eight year old self a litany of life lessons.

162
00:11:48,560 --> 00:12:01,300
That went in one ear and out the other because I was eight, who the hell remembers that, but he did say one thing to me and he said, John, remember, it's all about perspective and if you understand that, you can understand anything.

163
00:12:02,040 --> 00:12:16,620
Now we're in a room full of hackers and I honestly think that this is something that hackers do well, we excel at this, we're all able, but we need to use it beyond the need to approach systems and software from the perspective of an attacker.

164
00:12:16,860 --> 00:12:18,160
We need to use that skill.

165
00:12:18,160 --> 00:12:20,480
We need to use that skill to see the perspectives of our users.

166
00:12:20,740 --> 00:12:23,940
To see the perspectives of our coworkers.

167
00:12:24,300 --> 00:12:25,780
Of the person that sits next to you.

168
00:12:26,240 --> 00:12:38,220
So rather than beating users, berating them with security requirements and making it harder for them to do their jobs at every turn, maybe we need to work to better understand them and better understand perspective.

169
00:12:38,880 --> 00:12:48,140
So there's a whole lot of special images, videos, and sounds out there that severely affect our perception and make us question what we're actually seeing.

170
00:12:48,160 --> 00:12:54,340
seen. These images are here, these either illustrate perception, like in the two cartoons,

171
00:12:54,680 --> 00:12:59,220
that guy is seeing that number from two different angles, a completely different number. Or

172
00:12:59,220 --> 00:13:02,940
they show you something that appears to be something it's not. This thing in the upper left

173
00:13:02,940 --> 00:13:07,300
hand corner, if you took a ruler to it you would see that those lines are parallel, not as

174
00:13:07,300 --> 00:13:13,260
skew as they appear to be. And it's because the pattern of blocks messes with our brains. Or

175
00:13:13,260 --> 00:13:18,740
you have other pictures, like the two on the right hand side, that appear to be more than one

176
00:13:18,740 --> 00:13:26,240
thing at the same time. You know, is that a guy head on or a profile? How many legs does that

177
00:13:26,240 --> 00:13:33,160
elephant have? So all these images illustrate how perception is not consistent. We are not

178
00:13:33,160 --> 00:13:38,260
all seeing exactly the same thing. You don't go home at night to the same family as your

179
00:13:38,260 --> 00:13:43,240
coworker. You don't know what they really believe, their biases, their preferences. You

180
00:13:43,240 --> 00:13:47,560
don't know their prejudices, their passions, all the things that make them who they are. You

181
00:13:47,560 --> 00:13:54,640
don't know that. We can't presume to know that. So how can we presume to know how a user is

182
00:13:54,640 --> 00:13:59,640
going to react to something? Or training is a great one. From the perception of those that

183
00:13:59,640 --> 00:14:05,840
design the training, it appears to make sense. It probably even looks compelling. And probably to

184
00:14:05,840 --> 00:14:11,480
some small percentage of your population, of the population, yeah, it might be that. But not

185
00:14:11,480 --> 00:14:13,220
to everyone. And it's not a good thing. It's not a good thing. It's not a good thing. It's not a

186
00:14:13,240 --> 00:14:17,440
good thing. It's because their perception is different. So why does the cashier in the

187
00:14:17,440 --> 00:14:22,180
cafeteria care about protecting her Outlook account? And she definitely doesn't care if the

188
00:14:22,180 --> 00:14:26,780
organization is hacked. It's not going to affect her. But from her perspective, if she could

189
00:14:26,780 --> 00:14:32,340
avoid to lose the money or lose her bank account access, her credit card could be safer because of

190
00:14:32,340 --> 00:14:37,100
some action, that would matter and that would affect her immediately. And it would begin to

191
00:14:37,100 --> 00:14:43,180
form habits. She can bring back. They follow them unconsciously. Our perception rules us and it

192
00:14:43,240 --> 00:14:49,140
is ours to rule. And this means that we all live in a universe that is well and truly centered

193
00:14:49,140 --> 00:14:55,200
around ourselves. And if we want to reach the rest of the world, we have to reconsider our

194
00:14:55,200 --> 00:15:01,860
message. We have to reconsider our perceptions, our assumptions and how we deliver it. But then

195
00:15:01,860 --> 00:15:08,080
we have to consider how people retain information. So we look at memory. Human memory, while

196
00:15:08,740 --> 00:15:13,220
amazing, is inherently unreliable. And our tendency to try to retain information is to be

197
00:15:13,220 --> 00:15:19,640
distrust is the cause of many of the problems we have in society today. That we trust our

198
00:15:19,640 --> 00:15:26,000
brain, our memories. Fortunately, or hopefully fortunately, we have a long line of really

199
00:15:26,000 --> 00:15:30,940
insightful scientists, academics, who have literally spent their entire lives studying human

200
00:15:30,940 --> 00:15:38,160
memory. Because of this, you would think all the misconceptions and outright falsities would

201
00:15:38,160 --> 00:15:43,000
not be there. But they are. I can tell you with absolute confidence that you can rely

202
00:15:43,220 --> 00:15:49,560
on your computer's memory far beyond your own. And anybody who has worked in defer or incident

203
00:15:49,560 --> 00:15:55,340
response, forensics, knows that that's kind of a scary thought. To have to rely on your computer

204
00:15:55,340 --> 00:16:01,640
more than yourself. So, for example, memories often mischaracterized as an accurate method of

205
00:16:01,640 --> 00:16:08,920
recalling an event. But, like I was just saying, our perception is unique to each of us. So my

206
00:16:08,920 --> 00:16:13,200
memory of an event would be different than anyone else that's there. And that's why we have to

207
00:16:13,200 --> 00:16:18,100
remember what's there. This talk is a great example. To me, I'm on stage, looking at all your

208
00:16:18,100 --> 00:16:23,620
eyes, staring at me. I'm going to remember that. Each of you is going to remember something

209
00:16:23,620 --> 00:16:27,180
different. You might remember this slide. You might remember another slide. You might

210
00:16:27,180 --> 00:16:30,940
remember what you're doing on your phone. Or what's behind your eyelids if you've been up too

211
00:16:30,940 --> 00:16:36,420
late. So, there's a lot, a lot of, it's different for each person. So, yes, we can recall

212
00:16:36,420 --> 00:16:43,180
that event. But is that, is that recollection accurate? Often it's not. So, I'm going to talk a

213
00:16:43,200 --> 00:16:47,460
little bit about it. So, it's something to think about. The turn of the century, this century, so

214
00:16:47,460 --> 00:16:53,620
in like 1999, two cognitive psychologists, Daniel Simmons and Christopher Chabris, they did a

215
00:16:53,620 --> 00:16:58,080
study to prove that when people focus hard enough on one thing, they get what's called

216
00:16:59,100 --> 00:17:06,740
inattentional blindness. Not intentional, inattentional blindness. And this study, the

217
00:17:06,740 --> 00:17:10,820
participants were shown a video of a group of people passing a ball around. Many of you have

218
00:17:10,820 --> 00:17:13,180
probably heard about this. And they were asked to think about what was going on. And they were

219
00:17:13,200 --> 00:17:17,440
asked to count the number of times the ball was passed by one of the teams. And then immediately

220
00:17:17,440 --> 00:17:22,840
after watching, they asked the participants how many passes were made. And universally, they

221
00:17:22,840 --> 00:17:27,640
were right. They were able to count the passes. Good for them. But after that first question,

222
00:17:27,740 --> 00:17:34,140
they then asked, what about the gorilla? Did you see the gorilla that walked in? And none of them

223
00:17:34,140 --> 00:17:40,420
saw the gorilla. All these people completely missed something as obvious as a gorilla walking

224
00:17:40,420 --> 00:17:43,180
into the room. But they were able to, they were able to tell that the ball was passed by one of the

225
00:17:43,180 --> 00:17:48,340
to count the things. So they were accurate. They accurately saw what happened, but they missed

226
00:17:48,340 --> 00:17:54,300
something, something really big. So that has major implications for witnesses and for victims

227
00:17:54,300 --> 00:18:00,040
where there's no other corroborating evidence besides witness testimony. We often remember

228
00:18:00,040 --> 00:18:04,960
even the most unique things we see and we add details. And this study is the epitome of the

229
00:18:04,960 --> 00:18:10,400
counterintuitive nature of our minds. In the polls since then, over 90% of people who've been

230
00:18:10,400 --> 00:18:15,840
asked said that they think they would have seen that gorilla. Now with the knowledge of the

231
00:18:15,840 --> 00:18:22,400
gorilla's existence, they probably would. But in 2010, Simmons decided to revisit this and see

232
00:18:22,400 --> 00:18:29,420
what he could do. So I'm going to play this for you. The audio is unimportant, but this is

233
00:18:29,420 --> 00:18:34,520
the second iteration. Count how many times the players in white pass the ball.

234
00:19:02,460 --> 00:19:09,260
All right. So hopefully you guys 16. We all saw the gorilla because we expected it. But

235
00:19:12,020 --> 00:19:23,240
this is the second iteration. So they say about half people miss it in real situations. Did

236
00:19:23,240 --> 00:19:28,200
anybody notice that? Did you see the curtain change color? Good. A few of you noticed that. Also

237
00:19:28,200 --> 00:19:33,280
one of the people in black walked out of the room. I'll let it play and rewind real quick and you

238
00:19:33,280 --> 00:19:38,360
can see, now you'll see it because you know about it, just like the gorilla. And did you see

239
00:19:38,360 --> 00:19:40,380
that? It went from red to orange. And there's a little bit of black and there's a little bit of

240
00:19:40,400 --> 00:19:45,920
blue and there's only two players in black. It all happens right here. The player in black is

241
00:19:45,920 --> 00:19:53,920
gone. The gorilla is gone. It's orange. So, you know, we all see it. Hopefully it was new to

242
00:19:53,920 --> 00:19:59,620
you. If it wasn't, you could see that our memories being trusted as an agent of the truth is

243
00:19:59,620 --> 00:20:05,460
the biggest misconception about memory that there is. So there's an organization many of you

244
00:20:05,460 --> 00:20:09,980
probably heard of called the Innocence Project. What they're dedicated to doing is helping

245
00:20:09,980 --> 00:20:17,060
people who are innocent be exonerated, who have been convicted of crimes to be exonerated. And up

246
00:20:17,060 --> 00:20:22,520
till now, they've been pretty successful through the use of DNA testing. They have been able to

247
00:20:22,520 --> 00:20:30,700
free more than 350 people who spent time in prison for crimes they did not commit. But because of

248
00:20:30,700 --> 00:20:37,420
false memories, false witness testimony, they ended up in prison. Or biases. A lot of it is racial

249
00:20:37,420 --> 00:20:39,960
profiling, things along those lines. Biases that are not true. So, you know, we're going to see a lot of

250
00:20:39,960 --> 00:20:40,080
more companies with DNA tests and more cases. And they are trying to support this. They're trying to

251
00:20:40,080 --> 00:20:44,940
These are the types of cases we've all had to deal with. They also said on their website that on

252
00:20:44,940 --> 00:20:54,860
average, those people spent 14 years in prison before they were released. And they can only do

253
00:20:54,860 --> 00:21:03,460
And they can only do this for cases in the U.S. where DNA evidence exists. So, the number of cases

254
00:21:03,460 --> 00:21:09,240
out there where there's not DNA evidence and around the world, there are probably tens of thousands

255
00:21:09,240 --> 00:21:09,940
of people in prison, and there's a lot more than that out there. And, you know, the best thing for

256
00:21:09,940 --> 00:21:12,900
prison because somebody remembered something wrong or

257
00:21:12,900 --> 00:21:16,500
thought they looked suspicious. And we all have to do that. So

258
00:21:16,500 --> 00:21:19,360
according to Dr. Julia Shaw, who I'll tell you more about in a

259
00:21:19,360 --> 00:21:22,040
moment, but she worked with these guys and she said faulty

260
00:21:22,040 --> 00:21:26,280
memory played a role in 75% of those cases through her

261
00:21:26,280 --> 00:21:30,800
research. And that is, again, only in the U.S., only where we

262
00:21:30,800 --> 00:21:36,520
had DNA available. It's pretty scary. Dr. Shaw, who I highly

263
00:21:36,520 --> 00:21:40,260
recommend reading or watching, she's very entertaining, she

264
00:21:40,260 --> 00:21:44,200
wrote a book and released in 2016 called The Memory Illusion.

265
00:21:44,740 --> 00:21:48,500
And it rolls together decades of like academic studies and

266
00:21:48,500 --> 00:21:51,920
research and a bunch of research her and her colleagues have done

267
00:21:51,920 --> 00:21:57,000
that she has specifically spent her career studying false

268
00:21:57,000 --> 00:21:59,920
memories and working to better understand how the phenomenon

269
00:21:59,920 --> 00:22:03,820
works. And after her work with the Innocence Project, she and

270
00:22:03,820 --> 00:22:06,240
some of her colleagues began to research the method by

271
00:22:06,520 --> 00:22:11,340
which false memories are formed and better understand how they

272
00:22:11,340 --> 00:22:15,960
impact our perceptions and reality. In one study they

273
00:22:15,960 --> 00:22:20,660
gathered a group of subjects and they went to their parents. Of

274
00:22:20,660 --> 00:22:24,500
course, this is all college kids. It's research. That's

275
00:22:24,500 --> 00:22:26,840
what they deal with. So the college kids that they got, they

276
00:22:26,840 --> 00:22:30,760
called all of their parents and they said tell us about a couple

277
00:22:30,760 --> 00:22:34,040
of major events that you have a picture for that happened in

278
00:22:34,040 --> 00:22:36,500
their childhood. And they got the opportunity. They found a

279
00:22:36,500 --> 00:22:42,400
a trip to Disney World or going to England, whatever, they'd get a couple of real pictures

280
00:22:42,400 --> 00:22:47,600
of real incidents that happened and ask them questions about this incident. They then doctored

281
00:22:47,600 --> 00:22:53,640
up a third image that showed something virtually impossible. For example, Bugs Bunny in Disney

282
00:22:53,640 --> 00:22:57,720
World hugging them, which if you know anything about Disney, Bugs Bunny ain't never going

283
00:22:57,720 --> 00:23:03,920
to be in a Disney property. Another one was they convinced a guy that he had flown to

284
00:23:03,920 --> 00:23:09,320
England specifically to go have a picnic with the royal family and showed him a picture of him

285
00:23:09,320 --> 00:23:15,000
with the Queen Mother, you know, or with Queen Elizabeth. I'm not British. Sorry if I messed

286
00:23:15,000 --> 00:23:22,080
that up. But regardless, they were able to show, and without fail, all of these people believed

287
00:23:22,080 --> 00:23:27,240
that that thing happened to them and then produced more stories beyond just what was in the

288
00:23:27,240 --> 00:23:33,300
picture about these incidents. Every last one of them. It wasn't hard. It was, it was

289
00:23:33,300 --> 00:23:33,900
tremendous.

290
00:23:33,920 --> 00:23:39,880
It was trivial for them to do it. In the end, they were able to say that they can implant false

291
00:23:39,880 --> 00:23:49,340
memories in anyone trivially. It does not take a master or hypnotism or anything like that.

292
00:23:49,840 --> 00:23:55,140
Another thing she covers in depth in her book, and I'll touch on it briefly in a few minutes, but

293
00:23:55,140 --> 00:24:02,080
she talks about how to get through to subjects, how to make things memorable. And what it comes

294
00:24:02,080 --> 00:24:07,480
down to, the base of it is arousal. And I'm not talking about sexual arousal, that's always the

295
00:24:07,480 --> 00:24:12,820
first thing that comes to mind, but in brain science, arousal is defined, actually it's defined by

296
00:24:12,820 --> 00:24:19,320
the medical dictionary as a state of responsiveness to sensory stimulation or excitability or a

297
00:24:19,320 --> 00:24:25,000
state of behavioral or psychological activation. In other words, your brain is active. You're

298
00:24:25,000 --> 00:24:30,960
paying attention. And it's a very powerful tool we can use to improve others' reactions to

299
00:24:30,960 --> 00:24:32,060
things like training or physical activity. And I think that what

300
00:24:32,080 --> 00:24:36,600
awareness. I know we all love that. And other important things that we need to

301
00:24:36,600 --> 00:24:41,200
deal with, like policies. But we need to look at decision-making real quick

302
00:24:41,200 --> 00:24:46,820
before we can talk about how to fix things. So our brains are evolved from

303
00:24:46,820 --> 00:24:54,620
animal brains and that in the moment the fight-or-flight instincts that we have

304
00:24:54,620 --> 00:25:01,020
inherited from our animal brethren are what take over. And some people are a

305
00:25:01,020 --> 00:25:06,840
little better at recognizing these effects, somewhat offsetting them, but decades of

306
00:25:06,840 --> 00:25:11,980
study, more of this, demonstrate that decisions made by people are as likely to be logical as

307
00:25:11,980 --> 00:25:18,500
the flip of a coin. So that's something to think about. For years the security industry has

308
00:25:18,500 --> 00:25:22,180
been trying to figure out how to mitigate some of the issues that stem from the wetware that

309
00:25:22,180 --> 00:25:28,800
makes IT so insecure. But IT could be considered relatively new. Cyber security is also

310
00:25:28,800 --> 00:25:31,000
relatively new. Like in the grand scheme of things, you can't do anything about it. You

311
00:25:31,000 --> 00:25:36,720
can't do anything about it. But none of these concepts are new. Since as long as people have had

312
00:25:36,720 --> 00:25:41,520
something to be scammed off of them, there's been other people taking advantage of our natural

313
00:25:41,520 --> 00:25:49,080
stupidity, our natural mistakes, our shortcuts that our brains take. And scams in general are

314
00:25:49,080 --> 00:25:53,560
nothing new. And neither is the desire to better understand why we're so terrible at seeing these

315
00:25:53,560 --> 00:25:58,760
dangers, at recognizing them and running from them. Oddly, according to a lot of psychological

316
00:25:58,760 --> 00:26:00,980
experimentation and research, one of the biggest dangers is that we're not able to

317
00:26:01,000 --> 00:26:04,300
identify scams. The biggest reasons we're so terrible at identifying scams is the part of our

318
00:26:04,300 --> 00:26:08,860
brain we share with the animals. The fight or flight part of our brain is the mechanism that

319
00:26:08,860 --> 00:26:14,440
makes us jump to conclusions, make assumptions, see patterns that don't exist, and then we

320
00:26:14,440 --> 00:26:20,640
confidently use this misinformation to make our decisions. Leading to many of the problems we all

321
00:26:20,640 --> 00:26:28,320
face every day. This part of our brain is controlled by our emotions and physiological impulses.

322
00:26:28,580 --> 00:26:30,980
It is not controlled by logic. It is controlled by our emotions. It is controlled by our

323
00:26:30,980 --> 00:26:35,540
emotions. We're not able to use logic at all. We do not work on logic when this mechanism is

324
00:26:35,540 --> 00:26:42,340
activated. We are as likely to pick the logical choice that made sense yesterday than we are to

325
00:26:42,340 --> 00:26:48,620
pick something else. So any amount of planning and logic that we can put into our decision making

326
00:26:48,620 --> 00:26:56,340
process in the actual moment of choice, this takes over. No matter how much analysis you have done,

327
00:26:56,500 --> 00:27:00,960
if you as a person have a stake, it will affect you. We are not able to do that. So we have to

328
00:27:00,980 --> 00:27:05,120
make a decision and if it affects you in any way, that decision, all of that logic is out the window.

329
00:27:05,520 --> 00:27:10,380
And it's your fight or flight. And your brain picks the thing that it subconsciously thinks will cause

330
00:27:10,380 --> 00:27:17,820
the least amount of regret. And that is problematic in a lot of ways. None of us are safe. This is a

331
00:27:17,820 --> 00:27:25,860
condition that I believe I'm using this correctly, literally affects every last human. And shine some

332
00:27:25,860 --> 00:27:30,960
light on this. Let's take a look at another discovery. Neuroscientist named Antonio Di Matteo,

333
00:27:30,960 --> 00:27:37,700
or Damasio, sorry. A few years ago, he and his team began studying the part of the brain that

334
00:27:37,700 --> 00:27:46,340
controls our emotions, the emotional center. They went and found study subjects who had had brain

335
00:27:46,340 --> 00:27:54,440
damage to that part of their brain. So these were like medically, they were medically sociopathic.

336
00:27:54,460 --> 00:28:00,060
They had no emotions whatsoever. They could not do that. Then all of these subjects were easily

337
00:28:00,060 --> 00:28:04,400
able to see the logic behind simple decisions. They could come to reasonable conclusions.

338
00:28:05,140 --> 00:28:12,220
They could figure out the optimal option every time, but only in theory, only when they were

339
00:28:12,220 --> 00:28:17,680
talking. In their minds, they could do it. They could discuss it. But in every case, when they

340
00:28:17,680 --> 00:28:23,820
came down to actually making the choice, they just couldn't do it because they had no feeling,

341
00:28:23,860 --> 00:28:29,740
no emotion to drive the actual choice. They were literally not able to make

342
00:28:29,740 --> 00:28:30,040
decisions. They were not able to make decisions. They were not able to make decisions.

343
00:28:30,060 --> 00:28:36,720
And I'm not talking about whether to buy a house or a car. I mean like should I eat type decisions,

344
00:28:37,020 --> 00:28:43,020
the very basic stuff. And that illustrates that despite our logic, all our careful metrics, our

345
00:28:43,020 --> 00:28:50,640
measurements, our analysis, our emotional system takes over and delivers a choice that it feels is

346
00:28:50,640 --> 00:28:56,480
going to result in the least amount of regret when it boils down to the actual point of decision

347
00:28:56,480 --> 00:29:00,040
making. And our emotions are not going to be the same. They're not going to be the same. They're not

348
00:29:00,040 --> 00:29:01,980
going to be the same. They're not going to be the same. And so these are in control of us. This movie was

349
00:29:01,980 --> 00:29:07,680
surprisingly accurate. I love watching it with my littles. So much of the foundational research for

350
00:29:07,680 --> 00:29:16,000
this was done by a psychologist named Daniel Kahneman and his colleague Amos Tversky. Kahneman won

351
00:29:16,000 --> 00:29:24,040
the Nobel Prize in economics despite the fact that he is a psychologist. And specifically he won it

352
00:29:24,040 --> 00:29:30,020
for his research into the psychology of decision making. And when you look at the results, it's amazing.

353
00:29:30,040 --> 00:29:36,240
It was really simple for people to equate this and understand how this could apply to the field of

354
00:29:36,240 --> 00:29:42,820
economics. And really it's tied into a plethora of industries over the years, everything from

355
00:29:42,820 --> 00:29:48,880
entertainment to everything we do, they think about these kind of things. But we're here to

356
00:29:48,880 --> 00:29:54,760
talk about how it relates to our field, to security as a whole. And you've got to remember

357
00:29:54,760 --> 00:30:01,040
that security exists exclusively because of the people that use the networks and systems that we

358
00:30:01,040 --> 00:30:06,060
have to protect. If a system is designed to interact with another system in a certain way,

359
00:30:06,140 --> 00:30:11,420
it's going to just do that. It doesn't try and change its way. People are the ones that attack

360
00:30:11,420 --> 00:30:18,260
networks and systems. People are the ones, are the reason the tasks are successful. And even in

361
00:30:18,260 --> 00:30:22,540
cases where it's like a bug in software, a hardware issue, still somewhere down the line a

362
00:30:22,540 --> 00:30:24,520
person screwed up. It was human error.

363
00:30:24,760 --> 00:30:31,360
That led to that and people attacking it. Kahneman and Taberski's insights were a major wake up

364
00:30:31,360 --> 00:30:37,780
call to the world of economics. When they first started publishing their findings, the world of

365
00:30:37,780 --> 00:30:44,260
economics was literally a completely different field. Before this, economists based all of their

366
00:30:44,260 --> 00:30:53,080
predictions on the belief or the assumption that people make rational choices. They do not. And

367
00:30:53,080 --> 00:30:54,740
they were able to embrace this decision. And they were able to embrace this decision. And they

368
00:30:54,740 --> 00:30:55,940
were able to embrace this decision. And they were able to embrace this decision theory that Kahneman and

369
00:30:55,940 --> 00:31:01,280
Taberski developed and then they were able to completely change their models. The entire world.

370
00:31:01,420 --> 00:31:06,480
If you talked to somebody who retired in the 60s from economics, they would have no damn clue what

371
00:31:06,480 --> 00:31:13,820
a current economist is talking about. Because it is that much different. And there's, so their

372
00:31:13,820 --> 00:31:20,120
models account for the fact that common sense, as it were, is nothing more than a fallacy. And it

373
00:31:20,120 --> 00:31:24,720
has nothing to do with the reality of our irrational minds. Common sense, it is not a law. It is a

374
00:31:24,720 --> 00:31:27,300
is about as real as rational decisions are.

375
00:31:27,860 --> 00:31:29,040
So Annette Simmons,

376
00:31:29,560 --> 00:31:31,920
who's the author of a book called The Story Factor,

377
00:31:32,080 --> 00:31:33,700
a book I highly recommend

378
00:31:33,700 --> 00:31:36,280
if you want to reach other people in some way.

379
00:31:36,420 --> 00:31:38,240
Story is the most powerful thing you can do.

380
00:31:38,580 --> 00:31:40,380
She said, people are unconscious

381
00:31:40,380 --> 00:31:42,580
of most of their behavioral choices.

382
00:31:43,080 --> 00:31:45,720
If you ask someone why they did something,

383
00:31:46,040 --> 00:31:47,680
they're going to give you a good reason,

384
00:31:47,800 --> 00:31:50,320
a very rational sounding reason.

385
00:31:50,720 --> 00:31:52,680
And it has nothing to do with the real reason.

386
00:31:52,680 --> 00:31:59,660
As a rule, we humans aren't being aware of making choices,

387
00:31:59,820 --> 00:32:02,200
much less why we make the choices we make.

388
00:32:02,340 --> 00:32:05,540
We do it that way because somebody told us to do it that way.

389
00:32:05,620 --> 00:32:06,640
It feels right.

390
00:32:07,260 --> 00:32:08,920
This is how people work.

391
00:32:09,060 --> 00:32:11,580
So there is no such thing as common sense.

392
00:32:11,880 --> 00:32:13,660
So just stop saying it.

393
00:32:13,760 --> 00:32:15,460
Stop expecting it.

394
00:32:15,620 --> 00:32:17,440
Stop thinking about it.

395
00:32:17,540 --> 00:32:19,320
Every single person is different.

396
00:32:19,460 --> 00:32:21,280
Their brains don't work the same as yours.

397
00:32:21,620 --> 00:32:22,660
You don't know.

398
00:32:22,680 --> 00:32:22,800
You don't know them.

399
00:32:23,160 --> 00:32:24,140
Not the real them.

400
00:32:24,760 --> 00:32:26,600
Common sense to each person is different.

401
00:32:26,780 --> 00:32:28,700
So we have got to stop that.

402
00:32:29,100 --> 00:32:31,280
That's like, that just makes me angry.

403
00:32:31,700 --> 00:32:32,160
Yes.

404
00:32:32,740 --> 00:32:34,720
So these revelations, among others,

405
00:32:34,880 --> 00:32:36,360
that these two came up with,

406
00:32:36,500 --> 00:32:38,340
that we just don't have time to go into,

407
00:32:38,500 --> 00:32:40,300
but I highly recommend reading into this.

408
00:32:41,660 --> 00:32:43,220
Kahneman has several books out.

409
00:32:43,360 --> 00:32:44,600
He's done TED Talks.

410
00:32:45,000 --> 00:32:46,620
Watch it, read it, learn it.

411
00:32:48,060 --> 00:32:50,500
Anyways, this is the reason for the renaissance of economics,

412
00:32:50,740 --> 00:32:52,660
a paradigm shift in the world,

413
00:32:52,680 --> 00:32:54,000
in the art of negotiation.

414
00:32:54,720 --> 00:32:56,860
It changed how policies were written.

415
00:32:57,360 --> 00:32:59,740
It's affected every industry.

416
00:32:59,960 --> 00:33:03,960
And while it's relatively simple to see how it was applied to those verticals,

417
00:33:04,680 --> 00:33:05,900
why does it apply to InfoSec?

418
00:33:06,420 --> 00:33:07,460
Why do we care?

419
00:33:08,380 --> 00:33:12,240
Well, there is an overwhelming and pervasive misunderstanding

420
00:33:12,820 --> 00:33:15,300
of human nature in the world of IT.

421
00:33:15,520 --> 00:33:17,380
Not just security, IT period.

422
00:33:17,920 --> 00:33:21,440
And I'm not trying to say this is a dig to the industry that I love

423
00:33:21,440 --> 00:33:22,660
and that I am happy with.

424
00:33:22,660 --> 00:33:23,500
I'm happy to be part of.

425
00:33:23,860 --> 00:33:25,740
I'm trying to say that we can do better.

426
00:33:25,880 --> 00:33:28,740
If we seriously want to move the industry forward,

427
00:33:28,900 --> 00:33:32,340
we have to begin to accept a few facts of life

428
00:33:32,340 --> 00:33:37,180
and work in sync with those instead of against them like we are now.

429
00:33:37,880 --> 00:33:40,960
But first, we need to break security down, or at least part of it.

430
00:33:41,020 --> 00:33:41,640
What is it really?

431
00:33:41,800 --> 00:33:45,380
It's a way to protect people, their property, and their livelihoods

432
00:33:45,380 --> 00:33:48,500
from entities that may cause them harm or distress.

433
00:33:49,180 --> 00:33:50,720
And we all see where this is going.

434
00:33:50,840 --> 00:33:51,600
It's back to people.

435
00:33:51,600 --> 00:33:56,600
I really want to reiterate, I am not telling you guys something new here.

436
00:33:56,880 --> 00:34:00,000
I am not a prophet from the future.

437
00:34:00,220 --> 00:34:01,460
This is old stuff.

438
00:34:01,780 --> 00:34:05,800
I'm trying to show you how we could use this to change our focus,

439
00:34:06,640 --> 00:34:08,480
humanize IT and security.

440
00:34:09,440 --> 00:34:14,160
People are the core component of all aspects that there are in security.

441
00:34:14,900 --> 00:34:18,440
Even the most analytical ones, like big data, threat analytics,

442
00:34:18,760 --> 00:34:20,500
they're all driven by people.

443
00:34:20,660 --> 00:34:21,580
People have power.

444
00:34:21,600 --> 00:34:22,960
Someone had to make the algorithms.

445
00:34:23,220 --> 00:34:24,500
Somebody wrote the software.

446
00:34:24,780 --> 00:34:26,000
Somebody manages the databases.

447
00:34:26,240 --> 00:34:27,180
They handle the reporting.

448
00:34:27,380 --> 00:34:31,220
Ultimately, a person has to confirm the analysis isn't just crazy.

449
00:34:31,620 --> 00:34:33,800
So people have to look at it all along the way.

450
00:34:33,960 --> 00:34:37,360
They're driving every component from the users we're securing

451
00:34:37,360 --> 00:34:38,980
to us doing the securing.

452
00:34:39,480 --> 00:34:43,100
And if we don't figure out a better method of influencing our users

453
00:34:43,100 --> 00:34:46,180
and even our peers, all the people we work with,

454
00:34:46,400 --> 00:34:49,400
then we can expect an endless loop like this GIF.

455
00:34:49,440 --> 00:34:50,980
Or GIF if you prefer.

456
00:34:52,120 --> 00:34:54,160
And as we all know quite well,

457
00:34:54,280 --> 00:34:56,420
the vast majority of attacks start from the inside.

458
00:34:56,860 --> 00:35:00,920
And that is done with social engineering in most cases.

459
00:35:01,240 --> 00:35:05,580
Basically every single type of social engineering attack uses these tactics

460
00:35:06,260 --> 00:35:11,680
to take advantage of human emotions and our natural tendencies to take shortcuts.

461
00:35:12,720 --> 00:35:17,980
So, you know, Chris Hadnagy and Jason Street,

462
00:35:18,160 --> 00:35:20,540
these guys are all talking about this stuff all the time.

463
00:35:20,540 --> 00:35:22,840
There are people out there preaching about it.

464
00:35:24,340 --> 00:35:27,640
But we need to figure out how we can better adapt,

465
00:35:27,920 --> 00:35:31,160
how we can make this, how we can actually make the right change.

466
00:35:31,740 --> 00:35:33,500
Technology is not new, but it could be,

467
00:35:33,600 --> 00:35:36,300
and it could actually be said to have started with the invention of the wheel.

468
00:35:37,280 --> 00:35:41,860
For all of human history, we have been striving to make our lives better with technology.

469
00:35:42,240 --> 00:35:48,060
It began with the wheel or maybe fire, paper, printing presses, plumbing, electricity.

470
00:35:48,400 --> 00:35:50,100
All of these are old technologies.

471
00:35:50,540 --> 00:35:52,540
And they are all ingrained in our lives.

472
00:35:52,680 --> 00:35:53,720
We deal with them every day.

473
00:35:53,920 --> 00:35:55,340
We couldn't live without them.

474
00:35:55,480 --> 00:35:57,100
God, I wouldn't want to not have electricity here.

475
00:35:57,700 --> 00:36:01,500
You know, none of these, they didn't have any friction in becoming that way.

476
00:36:01,660 --> 00:36:02,880
They are irreplaceable.

477
00:36:02,980 --> 00:36:04,580
There was no problems.

478
00:36:04,820 --> 00:36:06,760
They have no problems sticking around in our lives.

479
00:36:06,820 --> 00:36:07,660
They're not going anywhere.

480
00:36:08,340 --> 00:36:10,820
All these technologies have one thing in common.

481
00:36:11,220 --> 00:36:19,260
Each and every one of them was invented specifically to deal with a problem that all people face.

482
00:36:19,260 --> 00:36:21,400
Like going to the bathroom.

483
00:36:21,700 --> 00:36:23,120
Or turning on the lights.

484
00:36:23,340 --> 00:36:28,260
So these are technologies that interjected in our lives to fix a problem we already had.

485
00:36:28,900 --> 00:36:33,580
Computers were invented to solve a problem, but not a problem that most people face.

486
00:36:33,880 --> 00:36:35,420
Which was cracking codes.

487
00:36:35,900 --> 00:36:39,760
And I know that my mom doesn't crack codes or know what that would mean.

488
00:36:39,920 --> 00:36:40,860
But she uses a computer.

489
00:36:41,380 --> 00:36:49,180
We've done a really good job of interjecting computers, IT, and all of its myriad iterations into our daily lives.

490
00:36:49,180 --> 00:36:51,680
And it's certainly irreplaceable.

491
00:36:51,800 --> 00:36:52,960
I couldn't live without the internet.

492
00:36:53,660 --> 00:36:57,300
But I'm of the opinion that there's been too little focus on the human element.

493
00:36:57,640 --> 00:37:01,020
We made a keyboard, a mouse, a monitor, and we were like, we're good.

494
00:37:01,180 --> 00:37:02,120
People can use it.

495
00:37:02,160 --> 00:37:02,920
They can interact.

496
00:37:03,120 --> 00:37:04,800
Now this is not entirely true.

497
00:37:05,020 --> 00:37:06,860
We build interfaces.

498
00:37:07,560 --> 00:37:10,700
There's operating systems that are foolproof-ish.

499
00:37:12,300 --> 00:37:14,140
User experience gets plenty of buzz.

500
00:37:14,240 --> 00:37:15,380
I know I hear that word all the time.

501
00:37:15,680 --> 00:37:18,880
So, I mean, they talk about it, but it's not happening.

502
00:37:18,980 --> 00:37:19,160
It affects people.

503
00:37:19,180 --> 00:37:19,800
It affects all of us.

504
00:37:19,880 --> 00:37:29,960
The networks we're charged with securing and certainly the users, which includes our friends, our families, our loved ones, not just the girl that works in the cafeteria.

505
00:37:30,900 --> 00:37:37,140
Con artists have been using all these flaws of the human for as long as there's been people.

506
00:37:37,340 --> 00:37:38,600
As long as there's been a society.

507
00:37:39,260 --> 00:37:44,980
And what they're really good at is fooling people into thinking that something is their own idea.

508
00:37:45,260 --> 00:37:46,760
Which is the same thing our brains do.

509
00:37:48,220 --> 00:37:57,880
So it's either they either convince them that the idea is their own or that the con is something that is more advantageous to the mark than it is to anybody else.

510
00:37:58,160 --> 00:38:00,200
And they have to believe this.

511
00:38:00,820 --> 00:38:05,440
And we all know that this body of knowledge has been incorporated into social engineering.

512
00:38:05,600 --> 00:38:11,060
And it's almost indistinguishable now from the old tricks that worked for centuries.

513
00:38:11,320 --> 00:38:12,500
It's similar things.

514
00:38:12,740 --> 00:38:16,140
The primary key to the success of these methods is to convince the mark.

515
00:38:16,140 --> 00:38:24,140
That whatever plan they're being swindled into is either somehow their own idea or that the idea is so much more beneficial to them than anybody else, including the instigator.

516
00:38:24,780 --> 00:38:27,460
And these are basic psychology.

517
00:38:27,820 --> 00:38:29,800
They don't require technology to work.

518
00:38:30,100 --> 00:38:35,880
But technology, especially at its current form, has made the perfect vehicle.

519
00:38:36,320 --> 00:38:38,400
Hence the popularity of this village.

520
00:38:38,920 --> 00:38:44,600
And talks like mine and Jason's and Michelle who's talking after me.

521
00:38:44,600 --> 00:38:50,160
All these insights can be applied to other aspects of InfoSec.

522
00:38:50,360 --> 00:38:55,120
And even the most exciting part, social engineering, in case you didn't guess.

523
00:38:55,620 --> 00:38:58,100
But to do that, we need remedies.

524
00:38:58,340 --> 00:39:00,700
Now, I do not have the answers.

525
00:39:00,920 --> 00:39:03,140
This is something that we all need to figure out.

526
00:39:03,540 --> 00:39:04,720
But I have some ideas.

527
00:39:05,900 --> 00:39:11,380
We've been building our security solutions on false assumptions from the beginning.

528
00:39:12,080 --> 00:39:14,120
How can we expect to secure something?

529
00:39:14,120 --> 00:39:15,760
Something as irrational as humans are?

530
00:39:16,260 --> 00:39:18,620
The answer is relatively easy.

531
00:39:18,800 --> 00:39:23,980
We do what the world of economics did more than 40 years ago when Kahneman and Tversky shared their findings.

532
00:39:24,300 --> 00:39:26,040
We change our assumptions.

533
00:39:26,420 --> 00:39:33,700
We no longer build our models, our software, and whatever on the assumption that users are going to make rational choices.

534
00:39:34,480 --> 00:39:36,300
This doesn't leave us in the lurch.

535
00:39:36,440 --> 00:39:37,980
We are not completely screwed.

536
00:39:39,160 --> 00:39:41,120
Rather, if you think about it,

537
00:39:41,120 --> 00:39:45,140
this kind of assuages that itch that we're all feeling.

538
00:39:45,340 --> 00:39:49,400
That internal, that inkling that something's just not right,

539
00:39:49,600 --> 00:39:52,700
which has been driving me crazy for 10 years of pen testing.

540
00:39:52,980 --> 00:39:54,920
Something doesn't seem right.

541
00:39:55,100 --> 00:39:56,660
Something isn't right.

542
00:39:56,900 --> 00:39:58,680
And we have to try and change that.

543
00:39:58,920 --> 00:40:04,640
It seems to me that the latest tactic I see to deal with the human aspect of security

544
00:40:04,640 --> 00:40:09,700
for most organizations, and I work at a consulting firm, so I deal with a lot of different organizations,

545
00:40:09,700 --> 00:40:11,860
is to do one of two things.

546
00:40:12,020 --> 00:40:13,520
One is put their head in the sand.

547
00:40:13,720 --> 00:40:17,420
Which is the, oh no, no SE on this engagement.

548
00:40:17,580 --> 00:40:18,620
We know we're going to fail.

549
00:40:18,880 --> 00:40:21,800
We aren't going to do a phishing because we know we're going to fail.

550
00:40:22,220 --> 00:40:24,900
That is putting your head in the sand and ignoring the problem.

551
00:40:25,160 --> 00:40:26,320
And that's not going to help.

552
00:40:26,540 --> 00:40:29,420
And I know we've all heard that crap all the time.

553
00:40:29,660 --> 00:40:33,360
Or alternatively, they throw more tech at the problem.

554
00:40:33,900 --> 00:40:37,780
Which we all know is, you know, we start taking capabilities from users.

555
00:40:38,080 --> 00:40:39,680
We make their lives, their jobs better.

556
00:40:39,700 --> 00:40:40,200
We make their jobs more difficult.

557
00:40:40,520 --> 00:40:44,580
You know, like the temporary VM session that loses everything in the end.

558
00:40:44,700 --> 00:40:46,740
You know, or other extreme examples out there.

559
00:40:46,980 --> 00:40:49,880
What we need to do is change our baseline assumptions.

560
00:40:50,460 --> 00:40:55,640
We have to accept that people, all of them, including us, are fallible.

561
00:40:56,600 --> 00:40:59,500
And they're probably not paying that much attention.

562
00:40:59,960 --> 00:41:00,880
Not in reality.

563
00:41:01,440 --> 00:41:04,800
So we need to approach the problems that we're facing from a different angle.

564
00:41:05,440 --> 00:41:09,440
The most obvious area that these concepts are applicable,

565
00:41:09,700 --> 00:41:12,420
is of course, user awareness training.

566
00:41:13,100 --> 00:41:14,560
And I know we all hate that.

567
00:41:15,200 --> 00:41:17,800
Every organization I've worked with, or for,

568
00:41:17,960 --> 00:41:22,000
the users and the security people cringe when they hear that term.

569
00:41:22,200 --> 00:41:23,880
As most of you probably just did.

570
00:41:24,260 --> 00:41:25,680
We all cringe when we hear that.

571
00:41:26,040 --> 00:41:28,580
No one likes the awareness training we're subjected to.

572
00:41:28,780 --> 00:41:31,000
It's like a PowerPoint deck once a year,

573
00:41:31,100 --> 00:41:33,840
and we all cheat on the multiple choice answers in the end.

574
00:41:34,020 --> 00:41:36,560
I know the users do. I know I do. I don't care.

575
00:41:36,800 --> 00:41:38,660
I mean, it's not helpful.

576
00:41:38,660 --> 00:41:41,660
At best, it's marginally helpful, at best.

577
00:41:42,040 --> 00:41:45,660
So instead, maybe we should take a cue from how humans actually think.

578
00:41:45,900 --> 00:41:48,120
We can't make people do things.

579
00:41:48,360 --> 00:41:51,760
And if we're honest, people are really just worried about themselves.

580
00:41:52,960 --> 00:41:55,460
So, of course, they love the company.

581
00:41:55,620 --> 00:41:59,340
And they know that inherently the enterprise of security is tied to their personal happiness.

582
00:42:00,300 --> 00:42:01,500
That is sarcasm.

583
00:42:01,680 --> 00:42:02,840
They do not know that.

584
00:42:03,000 --> 00:42:04,840
I don't care how much they love the company.

585
00:42:05,040 --> 00:42:06,200
They do not believe that.

586
00:42:07,080 --> 00:42:09,460
Sure, logic can tie them to this.

587
00:42:09,520 --> 00:42:11,660
You can tie their happiness to the employer's success.

588
00:42:11,980 --> 00:42:13,640
You know, their livelihood relies on it.

589
00:42:13,920 --> 00:42:17,440
But really, outside the C-suite, who sees the fruits of that?

590
00:42:17,640 --> 00:42:19,480
You know, not that much.

591
00:42:19,740 --> 00:42:21,720
And again, really, people are not rational.

592
00:42:21,940 --> 00:42:24,140
So we can't expect this.

593
00:42:24,520 --> 00:42:26,840
Assumptions, as we've been saying, don't make those.

594
00:42:27,080 --> 00:42:27,840
They're bad.

595
00:42:28,160 --> 00:42:31,120
Instead of teaching users how to protect company assets,

596
00:42:31,760 --> 00:42:34,740
what if we taught them about how to protect their own information,

597
00:42:34,740 --> 00:42:37,360
their data, their devices?

598
00:42:37,800 --> 00:42:39,460
Let security start at home.

599
00:42:39,940 --> 00:42:44,220
Teach them why rather than demand that they do something.

600
00:42:44,600 --> 00:42:45,800
Tell stories.

601
00:42:46,440 --> 00:42:47,620
Make it interesting.

602
00:42:48,280 --> 00:42:50,260
Show them how to protect their home Wi-Fi.

603
00:42:50,480 --> 00:42:53,320
That helps the organization anyways because you know you're going to make them work at home.

604
00:42:53,760 --> 00:42:57,940
So there's even a way to sell it to your executives.

605
00:42:58,560 --> 00:43:03,780
Now, I'm sure there are dozens more ways or hundreds more ways that we can apply this

606
00:43:03,780 --> 00:43:05,020
that I've never thought of.

607
00:43:05,140 --> 00:43:07,920
I'm not the smartest person in this room, I am sure.

608
00:43:08,400 --> 00:43:10,000
And I would never claim to be.

609
00:43:10,180 --> 00:43:11,560
And I don't know the answers.

610
00:43:12,000 --> 00:43:14,060
It's going to take all of us to think about this.

611
00:43:14,480 --> 00:43:18,600
And I'm going to keep digging because I'm down the rabbit hole.

612
00:43:18,860 --> 00:43:21,300
But hopefully some other people will jump in with me.

613
00:43:21,760 --> 00:43:26,200
Besides training and user education, maybe we should take a look at people and processes.

614
00:43:27,060 --> 00:43:29,140
What about processes and workflows?

615
00:43:30,020 --> 00:43:33,200
I think it may be possible to change our approach

616
00:43:33,200 --> 00:43:37,420
to the plethora of processes that organizations collectively rely on

617
00:43:37,420 --> 00:43:42,420
to ensure the business continues effectively and efficiently and safely.

618
00:43:42,800 --> 00:43:47,240
But instead of simply making a detailed list of steps that must be followed,

619
00:43:47,520 --> 00:43:52,820
maybe there's a way to design these processes in a way that the user can learn

620
00:43:52,820 --> 00:43:58,000
that leads them to the most appropriate solution

621
00:43:58,000 --> 00:44:01,040
without like browbeating them into doing it,

622
00:44:01,080 --> 00:44:02,300
yelling at them.

623
00:44:03,200 --> 00:44:04,460
People want to feel empowered.

624
00:44:04,620 --> 00:44:05,680
All people do.

625
00:44:05,980 --> 00:44:08,660
And they want to feel that they've made a contribution.

626
00:44:09,320 --> 00:44:11,020
And that is absolutely true.

627
00:44:12,740 --> 00:44:16,860
Unfortunately, I don't have time in this venue to take this part of the discussion

628
00:44:16,860 --> 00:44:19,480
to like another level because we only have so much time.

629
00:44:19,620 --> 00:44:21,080
But we need to take this online.

630
00:44:21,280 --> 00:44:21,880
We need to brainstorm.

631
00:44:22,380 --> 00:44:25,520
This is one I don't know for sure how we can fix.

632
00:44:26,500 --> 00:44:29,740
But I do think part of the answer to this problem

633
00:44:29,740 --> 00:44:31,980
is going to be a better focus on the human element

634
00:44:31,980 --> 00:44:33,440
and the use of story.

635
00:44:34,340 --> 00:44:38,140
And so I'm compelled to put up yet another quote from Annette Simmons,

636
00:44:38,460 --> 00:44:39,820
who is the author of that book I mentioned,

637
00:44:39,940 --> 00:44:40,800
The Story Factor.

638
00:44:41,020 --> 00:44:43,100
It's like eight bucks on Amazon.

639
00:44:43,320 --> 00:44:44,100
Just buy it.

640
00:44:44,180 --> 00:44:45,160
You will learn a lot.

641
00:44:45,280 --> 00:44:46,880
Anyways, I don't work for her.

642
00:44:47,720 --> 00:44:49,860
Most policy statements, she says this,

643
00:44:49,900 --> 00:44:51,360
most policy statements concern me.

644
00:44:51,540 --> 00:44:53,460
If you want to do the thinking for someone,

645
00:44:53,660 --> 00:44:57,920
and that is all any policy statement is designed to do,

646
00:44:58,080 --> 00:44:59,340
that is really important.

647
00:44:59,820 --> 00:45:01,960
At least story invites to hear

648
00:45:01,980 --> 00:45:03,920
what kind of human being you wish to influence

649
00:45:03,920 --> 00:45:06,020
to participate in that thinking process.

650
00:45:06,760 --> 00:45:08,920
Mandatory rules don't allow participation

651
00:45:08,920 --> 00:45:12,980
and they tend to influence people to either mindless obedience

652
00:45:12,980 --> 00:45:15,280
or gleeful malicious obedience.

653
00:45:15,700 --> 00:45:16,840
And we've all seen that.

654
00:45:16,960 --> 00:45:18,500
That can only make things worse.

655
00:45:18,660 --> 00:45:20,600
And that is like, I'll follow that policy.

656
00:45:20,840 --> 00:45:21,300
Okay.

657
00:45:21,980 --> 00:45:23,920
And you know it's a stupid policy

658
00:45:23,920 --> 00:45:26,180
or it's leading to a bad place.

659
00:45:26,520 --> 00:45:29,500
We all know that this is true.

660
00:45:29,500 --> 00:45:32,480
And how can we fix it?

661
00:45:32,720 --> 00:45:35,400
I think it's going to take some more time to figure this out.

662
00:45:36,460 --> 00:45:38,940
We're only going to face opposition,

663
00:45:39,780 --> 00:45:41,780
especially with policy.

664
00:45:42,020 --> 00:45:43,260
It's critical to the enterprise.

665
00:45:43,780 --> 00:45:45,500
They rely on it.

666
00:45:45,540 --> 00:45:46,620
It keeps them in compliance.

667
00:45:46,800 --> 00:45:49,940
This is going to be a really hard area to approach.

668
00:45:52,820 --> 00:45:55,020
So, in the arena of human interaction,

669
00:45:55,380 --> 00:45:56,880
we are all equals.

670
00:45:56,980 --> 00:45:59,400
Users, admins, non-users,

671
00:45:59,400 --> 00:46:01,880
babies, old people, everyone.

672
00:46:02,400 --> 00:46:04,640
It is the ultimate in inclusion.

673
00:46:05,100 --> 00:46:08,860
Our humanity is the one thing that levels the playing field.

674
00:46:09,140 --> 00:46:11,100
We are not better than that user

675
00:46:11,100 --> 00:46:13,380
who downloaded a macro virus last week.

676
00:46:13,540 --> 00:46:16,060
And we are all in this together.

677
00:46:16,260 --> 00:46:17,440
Whether we like it or not,

678
00:46:17,540 --> 00:46:20,480
the only way we can actually get the elusive users

679
00:46:20,480 --> 00:46:24,260
to be more secure is going to start with humanizing them,

680
00:46:24,460 --> 00:46:25,920
telling them stories,

681
00:46:26,320 --> 00:46:28,680
making the habits you need for them to form,

682
00:46:28,780 --> 00:46:29,140
you know,

683
00:46:29,400 --> 00:46:30,060
good security hygiene,

684
00:46:30,660 --> 00:46:33,940
directly and exclusively applicable to them

685
00:46:33,940 --> 00:46:35,740
and their sphere of influence,

686
00:46:36,060 --> 00:46:36,880
their loved ones,

687
00:46:37,080 --> 00:46:37,800
their family,

688
00:46:37,940 --> 00:46:38,420
their kids.

689
00:46:38,560 --> 00:46:39,620
That's what makes a difference.

690
00:46:40,100 --> 00:46:41,400
They will make changes.

691
00:46:41,700 --> 00:46:42,600
They'll keep themselves,

692
00:46:42,980 --> 00:46:43,420
their loved ones,

693
00:46:43,460 --> 00:46:43,900
their family,

694
00:46:43,980 --> 00:46:44,900
anyone they care about,

695
00:46:44,960 --> 00:46:45,320
safer,

696
00:46:45,500 --> 00:46:47,240
and they'll form good security habits.

697
00:46:47,400 --> 00:46:49,540
Those habits will follow them

698
00:46:49,540 --> 00:46:50,900
because people don't break habits.

699
00:46:51,120 --> 00:46:52,420
They will follow them.

700
00:46:52,460 --> 00:46:53,580
They'll carry over to work

701
00:46:53,580 --> 00:46:55,120
and they'll have it with them.

702
00:46:55,260 --> 00:46:57,180
And then they make the enterprise more secure.

703
00:46:57,840 --> 00:47:00,340
Now all we got to do now is figure out a way

704
00:47:00,340 --> 00:47:02,580
to do that consistently and effectively.

705
00:47:02,940 --> 00:47:04,560
So I hope somebody out there knows.

706
00:47:05,520 --> 00:47:07,340
None of this is news as I said.

707
00:47:07,520 --> 00:47:08,880
And although we don't,

708
00:47:08,880 --> 00:47:09,580
as a collective,

709
00:47:09,720 --> 00:47:12,280
consider this consciously nearly enough,

710
00:47:12,540 --> 00:47:14,240
we are all fallible.

711
00:47:14,900 --> 00:47:16,280
No particular group,

712
00:47:16,340 --> 00:47:16,920
all of us.

713
00:47:17,000 --> 00:47:18,420
And that tendency to err

714
00:47:18,420 --> 00:47:20,960
is what allows us to keep our jobs in security.

715
00:47:21,520 --> 00:47:24,560
It is definitely the cause of the greatest beauty

716
00:47:24,560 --> 00:47:25,380
in the world.

717
00:47:25,440 --> 00:47:25,780
Art

718
00:47:25,780 --> 00:47:27,660
is created because of this.

719
00:47:27,740 --> 00:47:29,200
It's also the root cause

720
00:47:29,200 --> 00:47:31,860
of the most colossal screw-ups in history.

721
00:47:32,600 --> 00:47:33,980
It's the same things.

722
00:47:34,520 --> 00:47:35,660
All of this.

723
00:47:35,720 --> 00:47:39,200
I say it all not to paint an ugly picture of people

724
00:47:39,200 --> 00:47:40,440
or of anything.

725
00:47:40,940 --> 00:47:44,140
I think this topic needs to be brought to the forefront

726
00:47:44,140 --> 00:47:45,860
of our collective consciousness.

727
00:47:46,500 --> 00:47:47,600
As a group,

728
00:47:47,620 --> 00:47:50,020
and now I'm talking about security people,

729
00:47:50,240 --> 00:47:51,400
the people who are here,

730
00:47:52,060 --> 00:47:55,640
we have some of the greatest problem-solving minds

731
00:47:55,640 --> 00:47:58,960
the greatest creative thinkers in the world

732
00:47:58,960 --> 00:47:59,760
in this community.

733
00:48:00,260 --> 00:48:00,860
So,

734
00:48:01,560 --> 00:48:04,000
if we can build on the knowledge

735
00:48:04,000 --> 00:48:05,460
that is already out there,

736
00:48:05,580 --> 00:48:07,440
that's been built on by other industries,

737
00:48:07,660 --> 00:48:09,920
to drastically improve

738
00:48:10,560 --> 00:48:12,160
the world for everyone.

739
00:48:12,320 --> 00:48:14,180
We can actually make the world safer.

740
00:48:14,820 --> 00:48:15,420
So,

741
00:48:15,520 --> 00:48:16,280
let's get to work.