So we appreciate everyone being here. We have our first speaker, John Nye. He's the Vice
President of Cyber Security Strategy at Synergist Tech and has over ten years of experience in
the security and IT industry. He is or has been an auditor, consultant, hacker, speaker,
father, leader and writer. So we want to give our attention to John Nye's theme is the human
factor. Why are we so bad at security and risk assessment?
We'll see if you still want to clap when I'm done. So as I said, my name is John Nye.
I'll make the introductions brief because they've got a timer over here and I've got a lot to
tell you about. So I already told you this. I do security. I was a pen tester for the last ten
years doing technical stuff and I'm sick of seeing the same stuff over and over again and I think
we need to fix the core, the root of our problem and that's what I'm here to talk about. I
work for a company called Exilio slash Synergistic and we do consulting mostly for
healthcare. All right, so let's get this rolling. Wetware, which is all of you. We, and I mean by we, I mean we, every single human being are all biased. And I mean the most enlightened person you've ever met in your life, they're still biased. They have biases that control. It's an ingrained part of our core selves, of our humanity to have these. And without it, we wouldn't be humans.
I mean we have to have these biases. But we also have to understand them. This is going this way, each and every one of you came into this room today and you had some sort of preconceived idea
about why you came here. You know, maybe you saw my tweets or the blogs I was posting on peer list or somebody dragged you in here or the line was shorter than the other ones.
You know, there's a lot of things. Or you're here to get a seat to see Jason and Michelle talk. Whatever. You know you had to get in here to
here. Or maybe you hope to learn something. Maybe you think I am completely full of shit and you
want to prove that. You know, there's a lot of things you can do. You want to prove me wrong,
that could very well be it. Then you all came in and sat down and you're like, I wonder if this
hour is going to be worth my time. All of you thought about that for a minute. Then the biggest
hurdle for all of our bias is when you saw me. And you're like, okay, this guy is, looks like a
tool. You know, maybe I look like a tool. Or maybe you thought I'm cute. I am single. So that's
awesome. Come talk to me afterwards. Or a million other things. You know, you could say you hate my
jacket. It looks stupid because my sleeves are rolled up like Zack Morris. Right? Or my hair. Or
you like my hair. Or a million things you could say, positive or negative, thinking about me on
first impression. And that absolutely guides how you're going to view what I have to say.
The entirety of how we feel about people, situations, risk, decisions, ourselves, others, all of
that is directly linked to these biases, which, as you will see, are directly controlled by our
emotions. And that, that is a lot of implications. So it appears, as best as scientists can tell, at
least, that this is actually our brain's mechanism to keep us safe. Because if you think about it,
at every given time, there's going to be a lot of things that we're going to have to deal with.
It's more than just a question. It's more than a given second. Every single person in the world is
getting so much data thrown at them. All of your senses, all the stuff you're thinking about.
The emotions you're feeling. And it's more than a person could deal. It's more than you could
handle. More than you can conceive of. More than we can fathom the amount of information that
we're getting at any given second. Because of this, our minds handle the vast majority
independently of our conscious mind.
So we don't even know what's going on.
And that way we're not inundated at all times.
You know, we're happy, oblivious to what's going on around us, the vast majority of what's going on around us.
And it's only possible because our minds have found this mechanism to stay sane.
And that mechanism is not trusting you.
Your brain does not trust you to do stuff, at least not with your conscious brain.
So now you see your brain doesn't trust you.
You need to think about whether you need to keep trusting your brain.
And that's what we'll talk about.
So the main topic, what is the most important note on your network?
We're all hearing about important things on our networks.
Well, I'm going to get you in the right frame of mind before we dive into this.
Think about a disagreement or a situation where you had to convince somebody of something that you had facts behind.
So how many times has this happened in those situations?
You come into this confrontation.
You have significant, strong, irrefutable facts and evidence to show them.
But no amount of logic or reasoning actually gets through to your opponent, to the other person you're talking to.
They've dug in their heels.
They won't budge.
We've all seen it.
And I know it's not unfamiliar to you.
We see it every day at work.
And I'm not just talking about idiots.
These are smart people.
We all know smart people who also believe things.
We can't fathom.
And we can easily refute.
They believe it.
The question on the screen is rhetorical.
I don't want everybody to yell out an answer.
But I hope you've all thought about it.
And in case not, the answer is humans.
The most important note on your entire network is not a technical note.
It's the biology.
So think of the times you watched someone, despite all the evidence and warnings to the contrary, proceed to make a horrible decision.
We've all seen it.
In fact, if you want to hear it, you can.
Use your own 20-20 hindsight.
I am sure each and every one of you has an instance like this.
If you're like me, you've probably been in an instance like this in the last couple days.
And that's fine.
We're in Vegas.
This is a great time to make some bad decisions.
So I'm going to do my best to help you all understand the people that use your networks, including yourself, through this talk.
These are the broad topics we're going to cover.
We're limited on time, so I'm going to bowl through all these things.
But I want to tell you right now, this talk is an introduction.
These are topics and concepts for which there are dozens of books, hundreds of research papers.
I could not even begin to touch on all this if they let me talk all day.
Because there is so much.
So what we need to do is all of us need to dig.
We all need to start looking at this.
There is science out there.
There is information that can help us.
And we'll look at the studies out there right now and decision-making, memory, perception.
Their insights have been applied to all sorts of industries over the years with amazing success.
Financial corporations use it because they know we're irrational.
And it's helped them a lot.
We see it in, anyways, we're going to look at decision-making, memory, and perception.
And you'll better understand what we're getting ready to say here.
So like Soylent Green, wetware is people.
And people are the single most important asset on any network.
Computers are the most important asset on any network.
Computers, let alone the network itself only exist because people use them.
And despite, or perhaps because of their best intentions, people are terrible at decision-making.
And by extension, security.
We're all of our user education efforts, are those pointless.
You know, can we better understand our users.
Is that possible.
These are the kind of things we need to answer.
Knowing what makes people tick.
That's the key to keeping our non-biological systems secure as well.
The best hope we have to move beyond the reactive security model that we're all living in,
as I know it feels like Groundhog's Day to me,
is that we embrace the truths of human component of our networks.
And we have to keep in mind this is a very difficult journey to take.
Our brains are full of these safety mechanisms that make this stuff hard for us to grasp.
And we consciously want to not believe it.
Like, my brain doesn't do that to me.
I make good decisions, etc.
But all of this is applicable to everybody.
Let's get an understanding of what perception is.
So I want to start this section here with an illustrative story.
Set the stage so you can begin to perceive what perception is.
It's a very difficult concept for people to get.
But story is one of the most powerful things you can use to illustrate concepts like this.
So when I was a kid, my uncle, he had collected horses.
Not like pretend horses.
He had real horses, like draft horses and all that stuff.
Well, I was a city kid.
And I didn't know a lot about them.
But he'd tell me about some pony that was growing up and he was going to have to break the horse.
I didn't know what that was.
So I made up what it was in my head.
And to me, what I pictured was like a horse owner, which was, of course,
was like a cowboy rancher looking guy.
He's got leathery skin, a big bushy mustache.
And he's always be like, what you're looking at, you know, yelling at everybody, sitting in a sitting in his big, huge horse.
And he would have to literally break the smaller horse, break it.
That's what I imagined.
So I picture him taking his lasso and lassoing this little horse, diving on it, doing some sort of Hulk Hogan, you know, headlock and literally breaking its back.
And then nursing it back to health so it would be docile.
That's what I pictured.
And now that's not what breaking a horse is.
I know people in here have dealt with it.
Not that I really know much about it.
But for a surprisingly long time, this preconception that was made up out of whole cloth by my six or seven year old mind, it stuck with me.
And still now when I hear it, which is super rare, when I hear about somebody breaking a horse,
the first image I have.
Is somebody breaking a horse's back.
I know that's not what happens, but you could see how my perception of this act of breaking a horse led me to have negative feelings and toward the people that did this.
So I didn't, I had a bias against country music for most of my life because they talked about horses and I was like, I, I like animals.
I don't want people to do that.
So, you know, we all have these biases.
So maybe you're a vegetarian and you think people that eat meat are disgusting secretly.
Maybe not.
So secret.
Or one that I see everywhere is with sports ball, whatever sports team you're into the player for the year rival team who you hate until they come to play for your team and then they're great, you know, and it's, it's total.
It's just the bias in there.
So our perception is one of the most important things for us to understand as humans, we have our own unique perception of the world and the default setting of our perception is to be narrowly focused on our own point of view with no
concern.
So by default, the world does revolve around you by default.
That's how it works again.
Another story about when I was younger, I lived near my grandfather and he was a professor, a professor in sociology and I didn't get to talk to him about that.
I was too young, but he, one day he did a really rare thing and he took me out to lunch, which I think that was maybe the only time he ever did and proceeded to tell my eight year old self a litany of life lessons.
That went in one ear and out the other because I was eight, who the hell remembers that, but he did say one thing to me and he said, John, remember, it's all about perspective and if you understand that, you can understand anything.
Now we're in a room full of hackers and I honestly think that this is something that hackers do well, we excel at this, we're all able, but we need to use it beyond the need to approach systems and software from the perspective of an attacker.
We need to use that skill.
We need to use that skill to see the perspectives of our users.
To see the perspectives of our coworkers.
Of the person that sits next to you.
So rather than beating users, berating them with security requirements and making it harder for them to do their jobs at every turn, maybe we need to work to better understand them and better understand perspective.
So there's a whole lot of special images, videos, and sounds out there that severely affect our perception and make us question what we're actually seeing.
seen. These images are here, these either illustrate perception, like in the two cartoons,
that guy is seeing that number from two different angles, a completely different number. Or
they show you something that appears to be something it's not. This thing in the upper left
hand corner, if you took a ruler to it you would see that those lines are parallel, not as
skew as they appear to be. And it's because the pattern of blocks messes with our brains. Or
you have other pictures, like the two on the right hand side, that appear to be more than one
thing at the same time. You know, is that a guy head on or a profile? How many legs does that
elephant have? So all these images illustrate how perception is not consistent. We are not
all seeing exactly the same thing. You don't go home at night to the same family as your
coworker. You don't know what they really believe, their biases, their preferences. You
don't know their prejudices, their passions, all the things that make them who they are. You
don't know that. We can't presume to know that. So how can we presume to know how a user is
going to react to something? Or training is a great one. From the perception of those that
design the training, it appears to make sense. It probably even looks compelling. And probably to
some small percentage of your population, of the population, yeah, it might be that. But not
to everyone. And it's not a good thing. It's not a good thing. It's not a good thing. It's not a
good thing. It's because their perception is different. So why does the cashier in the
cafeteria care about protecting her Outlook account? And she definitely doesn't care if the
organization is hacked. It's not going to affect her. But from her perspective, if she could
avoid to lose the money or lose her bank account access, her credit card could be safer because of
some action, that would matter and that would affect her immediately. And it would begin to
form habits. She can bring back. They follow them unconsciously. Our perception rules us and it
is ours to rule. And this means that we all live in a universe that is well and truly centered
around ourselves. And if we want to reach the rest of the world, we have to reconsider our
message. We have to reconsider our perceptions, our assumptions and how we deliver it. But then
we have to consider how people retain information. So we look at memory. Human memory, while
amazing, is inherently unreliable. And our tendency to try to retain information is to be
distrust is the cause of many of the problems we have in society today. That we trust our
brain, our memories. Fortunately, or hopefully fortunately, we have a long line of really
insightful scientists, academics, who have literally spent their entire lives studying human
memory. Because of this, you would think all the misconceptions and outright falsities would
not be there. But they are. I can tell you with absolute confidence that you can rely
on your computer's memory far beyond your own. And anybody who has worked in defer or incident
response, forensics, knows that that's kind of a scary thought. To have to rely on your computer
more than yourself. So, for example, memories often mischaracterized as an accurate method of
recalling an event. But, like I was just saying, our perception is unique to each of us. So my
memory of an event would be different than anyone else that's there. And that's why we have to
remember what's there. This talk is a great example. To me, I'm on stage, looking at all your
eyes, staring at me. I'm going to remember that. Each of you is going to remember something
different. You might remember this slide. You might remember another slide. You might
remember what you're doing on your phone. Or what's behind your eyelids if you've been up too
late. So, there's a lot, a lot of, it's different for each person. So, yes, we can recall
that event. But is that, is that recollection accurate? Often it's not. So, I'm going to talk a
little bit about it. So, it's something to think about. The turn of the century, this century, so
in like 1999, two cognitive psychologists, Daniel Simmons and Christopher Chabris, they did a
study to prove that when people focus hard enough on one thing, they get what's called
inattentional blindness. Not intentional, inattentional blindness. And this study, the
participants were shown a video of a group of people passing a ball around. Many of you have
probably heard about this. And they were asked to think about what was going on. And they were
asked to count the number of times the ball was passed by one of the teams. And then immediately
after watching, they asked the participants how many passes were made. And universally, they
were right. They were able to count the passes. Good for them. But after that first question,
they then asked, what about the gorilla? Did you see the gorilla that walked in? And none of them
saw the gorilla. All these people completely missed something as obvious as a gorilla walking
into the room. But they were able to, they were able to tell that the ball was passed by one of the
to count the things. So they were accurate. They accurately saw what happened, but they missed
something, something really big. So that has major implications for witnesses and for victims
where there's no other corroborating evidence besides witness testimony. We often remember
even the most unique things we see and we add details. And this study is the epitome of the
counterintuitive nature of our minds. In the polls since then, over 90% of people who've been
asked said that they think they would have seen that gorilla. Now with the knowledge of the
gorilla's existence, they probably would. But in 2010, Simmons decided to revisit this and see
what he could do. So I'm going to play this for you. The audio is unimportant, but this is
the second iteration. Count how many times the players in white pass the ball.
All right. So hopefully you guys 16. We all saw the gorilla because we expected it. But
this is the second iteration. So they say about half people miss it in real situations. Did
anybody notice that? Did you see the curtain change color? Good. A few of you noticed that. Also
one of the people in black walked out of the room. I'll let it play and rewind real quick and you
can see, now you'll see it because you know about it, just like the gorilla. And did you see
that? It went from red to orange. And there's a little bit of black and there's a little bit of
blue and there's only two players in black. It all happens right here. The player in black is
gone. The gorilla is gone. It's orange. So, you know, we all see it. Hopefully it was new to
you. If it wasn't, you could see that our memories being trusted as an agent of the truth is
the biggest misconception about memory that there is. So there's an organization many of you
probably heard of called the Innocence Project. What they're dedicated to doing is helping
people who are innocent be exonerated, who have been convicted of crimes to be exonerated. And up
till now, they've been pretty successful through the use of DNA testing. They have been able to
free more than 350 people who spent time in prison for crimes they did not commit. But because of
false memories, false witness testimony, they ended up in prison. Or biases. A lot of it is racial
profiling, things along those lines. Biases that are not true. So, you know, we're going to see a lot of
more companies with DNA tests and more cases. And they are trying to support this. They're trying to
These are the types of cases we've all had to deal with. They also said on their website that on
average, those people spent 14 years in prison before they were released. And they can only do
And they can only do this for cases in the U.S. where DNA evidence exists. So, the number of cases
out there where there's not DNA evidence and around the world, there are probably tens of thousands
of people in prison, and there's a lot more than that out there. And, you know, the best thing for
prison because somebody remembered something wrong or
thought they looked suspicious. And we all have to do that. So
according to Dr. Julia Shaw, who I'll tell you more about in a
moment, but she worked with these guys and she said faulty
memory played a role in 75% of those cases through her
research. And that is, again, only in the U.S., only where we
had DNA available. It's pretty scary. Dr. Shaw, who I highly
recommend reading or watching, she's very entertaining, she
wrote a book and released in 2016 called The Memory Illusion.
And it rolls together decades of like academic studies and
research and a bunch of research her and her colleagues have done
that she has specifically spent her career studying false
memories and working to better understand how the phenomenon
works. And after her work with the Innocence Project, she and
some of her colleagues began to research the method by
which false memories are formed and better understand how they
impact our perceptions and reality. In one study they
gathered a group of subjects and they went to their parents. Of
course, this is all college kids. It's research. That's
what they deal with. So the college kids that they got, they
called all of their parents and they said tell us about a couple
of major events that you have a picture for that happened in
their childhood. And they got the opportunity. They found a
a trip to Disney World or going to England, whatever, they'd get a couple of real pictures
of real incidents that happened and ask them questions about this incident. They then doctored
up a third image that showed something virtually impossible. For example, Bugs Bunny in Disney
World hugging them, which if you know anything about Disney, Bugs Bunny ain't never going
to be in a Disney property. Another one was they convinced a guy that he had flown to
England specifically to go have a picnic with the royal family and showed him a picture of him
with the Queen Mother, you know, or with Queen Elizabeth. I'm not British. Sorry if I messed
that up. But regardless, they were able to show, and without fail, all of these people believed
that that thing happened to them and then produced more stories beyond just what was in the
picture about these incidents. Every last one of them. It wasn't hard. It was, it was
tremendous.
It was trivial for them to do it. In the end, they were able to say that they can implant false
memories in anyone trivially. It does not take a master or hypnotism or anything like that.
Another thing she covers in depth in her book, and I'll touch on it briefly in a few minutes, but
she talks about how to get through to subjects, how to make things memorable. And what it comes
down to, the base of it is arousal. And I'm not talking about sexual arousal, that's always the
first thing that comes to mind, but in brain science, arousal is defined, actually it's defined by
the medical dictionary as a state of responsiveness to sensory stimulation or excitability or a
state of behavioral or psychological activation. In other words, your brain is active. You're
paying attention. And it's a very powerful tool we can use to improve others' reactions to
things like training or physical activity. And I think that what
awareness. I know we all love that. And other important things that we need to
deal with, like policies. But we need to look at decision-making real quick
before we can talk about how to fix things. So our brains are evolved from
animal brains and that in the moment the fight-or-flight instincts that we have
inherited from our animal brethren are what take over. And some people are a
little better at recognizing these effects, somewhat offsetting them, but decades of
study, more of this, demonstrate that decisions made by people are as likely to be logical as
the flip of a coin. So that's something to think about. For years the security industry has
been trying to figure out how to mitigate some of the issues that stem from the wetware that
makes IT so insecure. But IT could be considered relatively new. Cyber security is also
relatively new. Like in the grand scheme of things, you can't do anything about it. You
can't do anything about it. But none of these concepts are new. Since as long as people have had
something to be scammed off of them, there's been other people taking advantage of our natural
stupidity, our natural mistakes, our shortcuts that our brains take. And scams in general are
nothing new. And neither is the desire to better understand why we're so terrible at seeing these
dangers, at recognizing them and running from them. Oddly, according to a lot of psychological
experimentation and research, one of the biggest dangers is that we're not able to
identify scams. The biggest reasons we're so terrible at identifying scams is the part of our
brain we share with the animals. The fight or flight part of our brain is the mechanism that
makes us jump to conclusions, make assumptions, see patterns that don't exist, and then we
confidently use this misinformation to make our decisions. Leading to many of the problems we all
face every day. This part of our brain is controlled by our emotions and physiological impulses.
It is not controlled by logic. It is controlled by our emotions. It is controlled by our
emotions. We're not able to use logic at all. We do not work on logic when this mechanism is
activated. We are as likely to pick the logical choice that made sense yesterday than we are to
pick something else. So any amount of planning and logic that we can put into our decision making
process in the actual moment of choice, this takes over. No matter how much analysis you have done,
if you as a person have a stake, it will affect you. We are not able to do that. So we have to
make a decision and if it affects you in any way, that decision, all of that logic is out the window.
And it's your fight or flight. And your brain picks the thing that it subconsciously thinks will cause
the least amount of regret. And that is problematic in a lot of ways. None of us are safe. This is a
condition that I believe I'm using this correctly, literally affects every last human. And shine some
light on this. Let's take a look at another discovery. Neuroscientist named Antonio Di Matteo,
or Damasio, sorry. A few years ago, he and his team began studying the part of the brain that
controls our emotions, the emotional center. They went and found study subjects who had had brain
damage to that part of their brain. So these were like medically, they were medically sociopathic.
They had no emotions whatsoever. They could not do that. Then all of these subjects were easily
able to see the logic behind simple decisions. They could come to reasonable conclusions.
They could figure out the optimal option every time, but only in theory, only when they were
talking. In their minds, they could do it. They could discuss it. But in every case, when they
came down to actually making the choice, they just couldn't do it because they had no feeling,
no emotion to drive the actual choice. They were literally not able to make
decisions. They were not able to make decisions. They were not able to make decisions.
And I'm not talking about whether to buy a house or a car. I mean like should I eat type decisions,
the very basic stuff. And that illustrates that despite our logic, all our careful metrics, our
measurements, our analysis, our emotional system takes over and delivers a choice that it feels is
going to result in the least amount of regret when it boils down to the actual point of decision
making. And our emotions are not going to be the same. They're not going to be the same. They're not
going to be the same. They're not going to be the same. And so these are in control of us. This movie was
surprisingly accurate. I love watching it with my littles. So much of the foundational research for
this was done by a psychologist named Daniel Kahneman and his colleague Amos Tversky. Kahneman won
the Nobel Prize in economics despite the fact that he is a psychologist. And specifically he won it
for his research into the psychology of decision making. And when you look at the results, it's amazing.
It was really simple for people to equate this and understand how this could apply to the field of
economics. And really it's tied into a plethora of industries over the years, everything from
entertainment to everything we do, they think about these kind of things. But we're here to
talk about how it relates to our field, to security as a whole. And you've got to remember
that security exists exclusively because of the people that use the networks and systems that we
have to protect. If a system is designed to interact with another system in a certain way,
it's going to just do that. It doesn't try and change its way. People are the ones that attack
networks and systems. People are the ones, are the reason the tasks are successful. And even in
cases where it's like a bug in software, a hardware issue, still somewhere down the line a
person screwed up. It was human error.
That led to that and people attacking it. Kahneman and Taberski's insights were a major wake up
call to the world of economics. When they first started publishing their findings, the world of
economics was literally a completely different field. Before this, economists based all of their
predictions on the belief or the assumption that people make rational choices. They do not. And
they were able to embrace this decision. And they were able to embrace this decision. And they
were able to embrace this decision. And they were able to embrace this decision theory that Kahneman and
Taberski developed and then they were able to completely change their models. The entire world.
If you talked to somebody who retired in the 60s from economics, they would have no damn clue what
a current economist is talking about. Because it is that much different. And there's, so their
models account for the fact that common sense, as it were, is nothing more than a fallacy. And it
has nothing to do with the reality of our irrational minds. Common sense, it is not a law. It is a
is about as real as rational decisions are.
So Annette Simmons,
who's the author of a book called The Story Factor,
a book I highly recommend
if you want to reach other people in some way.
Story is the most powerful thing you can do.
She said, people are unconscious
of most of their behavioral choices.
If you ask someone why they did something,
they're going to give you a good reason,
a very rational sounding reason.
And it has nothing to do with the real reason.
As a rule, we humans aren't being aware of making choices,
much less why we make the choices we make.
We do it that way because somebody told us to do it that way.
It feels right.
This is how people work.
So there is no such thing as common sense.
So just stop saying it.
Stop expecting it.
Stop thinking about it.
Every single person is different.
Their brains don't work the same as yours.
You don't know.
You don't know them.
Not the real them.
Common sense to each person is different.
So we have got to stop that.
That's like, that just makes me angry.
Yes.
So these revelations, among others,
that these two came up with,
that we just don't have time to go into,
but I highly recommend reading into this.
Kahneman has several books out.
He's done TED Talks.
Watch it, read it, learn it.
Anyways, this is the reason for the renaissance of economics,
a paradigm shift in the world,
in the art of negotiation.
It changed how policies were written.
It's affected every industry.
And while it's relatively simple to see how it was applied to those verticals,
why does it apply to InfoSec?
Why do we care?
Well, there is an overwhelming and pervasive misunderstanding
of human nature in the world of IT.
Not just security, IT period.
And I'm not trying to say this is a dig to the industry that I love
and that I am happy with.
I'm happy to be part of.
I'm trying to say that we can do better.
If we seriously want to move the industry forward,
we have to begin to accept a few facts of life
and work in sync with those instead of against them like we are now.
But first, we need to break security down, or at least part of it.
What is it really?
It's a way to protect people, their property, and their livelihoods
from entities that may cause them harm or distress.
And we all see where this is going.
It's back to people.
I really want to reiterate, I am not telling you guys something new here.
I am not a prophet from the future.
This is old stuff.
I'm trying to show you how we could use this to change our focus,
humanize IT and security.
People are the core component of all aspects that there are in security.
Even the most analytical ones, like big data, threat analytics,
they're all driven by people.
People have power.
Someone had to make the algorithms.
Somebody wrote the software.
Somebody manages the databases.
They handle the reporting.
Ultimately, a person has to confirm the analysis isn't just crazy.
So people have to look at it all along the way.
They're driving every component from the users we're securing
to us doing the securing.
And if we don't figure out a better method of influencing our users
and even our peers, all the people we work with,
then we can expect an endless loop like this GIF.
Or GIF if you prefer.
And as we all know quite well,
the vast majority of attacks start from the inside.
And that is done with social engineering in most cases.
Basically every single type of social engineering attack uses these tactics
to take advantage of human emotions and our natural tendencies to take shortcuts.
So, you know, Chris Hadnagy and Jason Street,
these guys are all talking about this stuff all the time.
There are people out there preaching about it.
But we need to figure out how we can better adapt,
how we can make this, how we can actually make the right change.
Technology is not new, but it could be,
and it could actually be said to have started with the invention of the wheel.
For all of human history, we have been striving to make our lives better with technology.
It began with the wheel or maybe fire, paper, printing presses, plumbing, electricity.
All of these are old technologies.
And they are all ingrained in our lives.
We deal with them every day.
We couldn't live without them.
God, I wouldn't want to not have electricity here.
You know, none of these, they didn't have any friction in becoming that way.
They are irreplaceable.
There was no problems.
They have no problems sticking around in our lives.
They're not going anywhere.
All these technologies have one thing in common.
Each and every one of them was invented specifically to deal with a problem that all people face.
Like going to the bathroom.
Or turning on the lights.
So these are technologies that interjected in our lives to fix a problem we already had.
Computers were invented to solve a problem, but not a problem that most people face.
Which was cracking codes.
And I know that my mom doesn't crack codes or know what that would mean.
But she uses a computer.
We've done a really good job of interjecting computers, IT, and all of its myriad iterations into our daily lives.
And it's certainly irreplaceable.
I couldn't live without the internet.
But I'm of the opinion that there's been too little focus on the human element.
We made a keyboard, a mouse, a monitor, and we were like, we're good.
People can use it.
They can interact.
Now this is not entirely true.
We build interfaces.
There's operating systems that are foolproof-ish.
User experience gets plenty of buzz.
I know I hear that word all the time.
So, I mean, they talk about it, but it's not happening.
It affects people.
It affects all of us.
The networks we're charged with securing and certainly the users, which includes our friends, our families, our loved ones, not just the girl that works in the cafeteria.
Con artists have been using all these flaws of the human for as long as there's been people.
As long as there's been a society.
And what they're really good at is fooling people into thinking that something is their own idea.
Which is the same thing our brains do.
So it's either they either convince them that the idea is their own or that the con is something that is more advantageous to the mark than it is to anybody else.
And they have to believe this.
And we all know that this body of knowledge has been incorporated into social engineering.
And it's almost indistinguishable now from the old tricks that worked for centuries.
It's similar things.
The primary key to the success of these methods is to convince the mark.
That whatever plan they're being swindled into is either somehow their own idea or that the idea is so much more beneficial to them than anybody else, including the instigator.
And these are basic psychology.
They don't require technology to work.
But technology, especially at its current form, has made the perfect vehicle.
Hence the popularity of this village.
And talks like mine and Jason's and Michelle who's talking after me.
All these insights can be applied to other aspects of InfoSec.
And even the most exciting part, social engineering, in case you didn't guess.
But to do that, we need remedies.
Now, I do not have the answers.
This is something that we all need to figure out.
But I have some ideas.
We've been building our security solutions on false assumptions from the beginning.
How can we expect to secure something?
Something as irrational as humans are?
The answer is relatively easy.
We do what the world of economics did more than 40 years ago when Kahneman and Tversky shared their findings.
We change our assumptions.
We no longer build our models, our software, and whatever on the assumption that users are going to make rational choices.
This doesn't leave us in the lurch.
We are not completely screwed.
Rather, if you think about it,
this kind of assuages that itch that we're all feeling.
That internal, that inkling that something's just not right,
which has been driving me crazy for 10 years of pen testing.
Something doesn't seem right.
Something isn't right.
And we have to try and change that.
It seems to me that the latest tactic I see to deal with the human aspect of security
for most organizations, and I work at a consulting firm, so I deal with a lot of different organizations,
is to do one of two things.
One is put their head in the sand.
Which is the, oh no, no SE on this engagement.
We know we're going to fail.
We aren't going to do a phishing because we know we're going to fail.
That is putting your head in the sand and ignoring the problem.
And that's not going to help.
And I know we've all heard that crap all the time.
Or alternatively, they throw more tech at the problem.
Which we all know is, you know, we start taking capabilities from users.
We make their lives, their jobs better.
We make their jobs more difficult.
You know, like the temporary VM session that loses everything in the end.
You know, or other extreme examples out there.
What we need to do is change our baseline assumptions.
We have to accept that people, all of them, including us, are fallible.
And they're probably not paying that much attention.
Not in reality.
So we need to approach the problems that we're facing from a different angle.
The most obvious area that these concepts are applicable,
is of course, user awareness training.
And I know we all hate that.
Every organization I've worked with, or for,
the users and the security people cringe when they hear that term.
As most of you probably just did.
We all cringe when we hear that.
No one likes the awareness training we're subjected to.
It's like a PowerPoint deck once a year,
and we all cheat on the multiple choice answers in the end.
I know the users do. I know I do. I don't care.
I mean, it's not helpful.
At best, it's marginally helpful, at best.
So instead, maybe we should take a cue from how humans actually think.
We can't make people do things.
And if we're honest, people are really just worried about themselves.
So, of course, they love the company.
And they know that inherently the enterprise of security is tied to their personal happiness.
That is sarcasm.
They do not know that.
I don't care how much they love the company.
They do not believe that.
Sure, logic can tie them to this.
You can tie their happiness to the employer's success.
You know, their livelihood relies on it.
But really, outside the C-suite, who sees the fruits of that?
You know, not that much.
And again, really, people are not rational.
So we can't expect this.
Assumptions, as we've been saying, don't make those.
They're bad.
Instead of teaching users how to protect company assets,
what if we taught them about how to protect their own information,
their data, their devices?
Let security start at home.
Teach them why rather than demand that they do something.
Tell stories.
Make it interesting.
Show them how to protect their home Wi-Fi.
That helps the organization anyways because you know you're going to make them work at home.
So there's even a way to sell it to your executives.
Now, I'm sure there are dozens more ways or hundreds more ways that we can apply this
that I've never thought of.
I'm not the smartest person in this room, I am sure.
And I would never claim to be.
And I don't know the answers.
It's going to take all of us to think about this.
And I'm going to keep digging because I'm down the rabbit hole.
But hopefully some other people will jump in with me.
Besides training and user education, maybe we should take a look at people and processes.
What about processes and workflows?
I think it may be possible to change our approach
to the plethora of processes that organizations collectively rely on
to ensure the business continues effectively and efficiently and safely.
But instead of simply making a detailed list of steps that must be followed,
maybe there's a way to design these processes in a way that the user can learn
that leads them to the most appropriate solution
without like browbeating them into doing it,
yelling at them.
People want to feel empowered.
All people do.
And they want to feel that they've made a contribution.
And that is absolutely true.
Unfortunately, I don't have time in this venue to take this part of the discussion
to like another level because we only have so much time.
But we need to take this online.
We need to brainstorm.
This is one I don't know for sure how we can fix.
But I do think part of the answer to this problem
is going to be a better focus on the human element
and the use of story.
And so I'm compelled to put up yet another quote from Annette Simmons,
who is the author of that book I mentioned,
The Story Factor.
It's like eight bucks on Amazon.
Just buy it.
You will learn a lot.
Anyways, I don't work for her.
Most policy statements, she says this,
most policy statements concern me.
If you want to do the thinking for someone,
and that is all any policy statement is designed to do,
that is really important.
At least story invites to hear
what kind of human being you wish to influence
to participate in that thinking process.
Mandatory rules don't allow participation
and they tend to influence people to either mindless obedience
or gleeful malicious obedience.
And we've all seen that.
That can only make things worse.
And that is like, I'll follow that policy.
Okay.
And you know it's a stupid policy
or it's leading to a bad place.
We all know that this is true.
And how can we fix it?
I think it's going to take some more time to figure this out.
We're only going to face opposition,
especially with policy.
It's critical to the enterprise.
They rely on it.
It keeps them in compliance.
This is going to be a really hard area to approach.
So, in the arena of human interaction,
we are all equals.
Users, admins, non-users,
babies, old people, everyone.
It is the ultimate in inclusion.
Our humanity is the one thing that levels the playing field.
We are not better than that user
who downloaded a macro virus last week.
And we are all in this together.
Whether we like it or not,
the only way we can actually get the elusive users
to be more secure is going to start with humanizing them,
telling them stories,
making the habits you need for them to form,
you know,
good security hygiene,
directly and exclusively applicable to them
and their sphere of influence,
their loved ones,
their family,
their kids.
That's what makes a difference.
They will make changes.
They'll keep themselves,
their loved ones,
their family,
anyone they care about,
safer,
and they'll form good security habits.
Those habits will follow them
because people don't break habits.
They will follow them.
They'll carry over to work
and they'll have it with them.
And then they make the enterprise more secure.
Now all we got to do now is figure out a way
to do that consistently and effectively.
So I hope somebody out there knows.
None of this is news as I said.
And although we don't,
as a collective,
consider this consciously nearly enough,
we are all fallible.
No particular group,
all of us.
And that tendency to err
is what allows us to keep our jobs in security.
It is definitely the cause of the greatest beauty
in the world.
Art
is created because of this.
It's also the root cause
of the most colossal screw-ups in history.
It's the same things.
All of this.
I say it all not to paint an ugly picture of people
or of anything.
I think this topic needs to be brought to the forefront
of our collective consciousness.
As a group,
and now I'm talking about security people,
the people who are here,
we have some of the greatest problem-solving minds
the greatest creative thinkers in the world
in this community.
So,
if we can build on the knowledge
that is already out there,
that's been built on by other industries,
to drastically improve
the world for everyone.
We can actually make the world safer.
So,
let's get to work.