1
00:00:00,000 --> 00:00:07,820
Last night I was standing out in the hallway and somebody came up and they asked me to think about a question that they were going to give me.

2
00:00:08,240 --> 00:00:16,760
And it was if there was one moment in my career that adjusted my thinking and helped me to become a better social engineer.

3
00:00:17,420 --> 00:00:23,740
So I gave that some thought for about an hour and then when he came back I said that one event was hiring our next speaker.

4
00:00:23,740 --> 00:00:33,840
That's Michelle Fincher. Hiring her did a lot of things for my business because it added professionalism to us that we didn't have before.

5
00:00:34,080 --> 00:00:40,020
It added the ability to be proud of the work that we put out and the reports that we put out.

6
00:00:40,160 --> 00:00:49,760
And it made me a better social engineer, businessman, writer because she demands perfection and scientific proof of everything I say.

7
00:00:50,420 --> 00:00:53,000
Which I appreciate now. Maybe I didn't at first.

8
00:00:53,160 --> 00:00:53,720
But I did.

9
00:00:53,740 --> 00:00:54,620
But I appreciate it now.

10
00:00:55,080 --> 00:00:58,420
So I know you're going to enjoy this if you haven't heard Michelle speak before.

11
00:00:58,660 --> 00:01:01,480
So just join me in welcoming Michelle Fincher.

12
00:01:07,360 --> 00:01:08,160
Hey y'all.

13
00:01:09,240 --> 00:01:10,120
You like the dress?

14
00:01:12,260 --> 00:01:16,340
Actually my husband picked this out for me and I wanted to segue into my talk a little bit.

15
00:01:16,380 --> 00:01:17,760
I'm going to tell you a story about my husband.

16
00:01:18,900 --> 00:01:20,900
We met in martial arts class.

17
00:01:20,960 --> 00:01:23,180
It is the classic love story.

18
00:01:24,560 --> 00:01:28,280
I was a belt above him so I really thought I was badass.

19
00:01:28,780 --> 00:01:34,240
And at the time what we would do is we would have a sparring session before we broke off into our separate belt levels.

20
00:01:34,740 --> 00:01:37,140
And, you know, we chose each other.

21
00:01:37,220 --> 00:01:40,080
I think there was probably a little preliminary chemistry there.

22
00:01:40,560 --> 00:01:46,040
But, you know, I thought, this is going to be easy because he's a belt below me and I'm just going to humiliate him.

23
00:01:46,240 --> 00:01:48,380
Well, what happened was the sparring match started.

24
00:01:48,620 --> 00:01:50,500
He punched me right in the face.

25
00:01:53,040 --> 00:01:53,720
And I said, you know, I'm not going to do that.

26
00:01:53,720 --> 00:01:55,780
And I said, baby, you're going to marry me.

27
00:01:57,380 --> 00:01:58,800
So let me tell you why though.

28
00:01:58,880 --> 00:02:00,640
It is not because I'm a masochist.

29
00:02:00,660 --> 00:02:01,780
He didn't break my nose.

30
00:02:01,880 --> 00:02:02,840
He didn't give me a black eye.

31
00:02:03,280 --> 00:02:04,380
Here's what he did.

32
00:02:04,900 --> 00:02:07,600
He treated me as a legitimate opponent.

33
00:02:09,120 --> 00:02:11,560
He tested my decision making.

34
00:02:11,720 --> 00:02:17,340
He basically said, you made some decisions about not putting your hands up and I tested that appropriately.

35
00:02:18,680 --> 00:02:23,700
And the reason why I fell in love with that man, that was that moment in time when I saw the measure of the man.

36
00:02:24,820 --> 00:02:27,740
Because he respected me enough to give me a fair test.

37
00:02:27,860 --> 00:02:32,040
And I'll tell you what, I never let my hands down around him ever again.

38
00:02:32,700 --> 00:02:33,100
Okay.

39
00:02:33,280 --> 00:02:39,020
So this is the talk that I want to have with you all about your security programs.

40
00:02:39,180 --> 00:02:42,100
And I think all of us or many of us are involved in InfoSec.

41
00:02:42,360 --> 00:02:44,620
And we like to think that we're doing a good job.

42
00:02:44,740 --> 00:02:53,040
But sometimes I think everyone reaches a point in their security profession where they're saying things are just not working quite the way I thought they would.

43
00:02:53,040 --> 00:02:55,760
And my population isn't listening to me like they should.

44
00:02:55,940 --> 00:02:57,640
And I don't really understand why.

45
00:02:57,760 --> 00:03:06,680
So let's talk about a few things that can be impactful in the decision making that you have in terms of your security program.

46
00:03:06,920 --> 00:03:07,200
All right.

47
00:03:07,220 --> 00:03:09,780
So let me see a show of hands here.

48
00:03:09,960 --> 00:03:10,300
All right.

49
00:03:10,300 --> 00:03:13,000
What is the state of your security program?

50
00:03:13,360 --> 00:03:16,020
The greatest of all time.

51
00:03:16,300 --> 00:03:16,980
Come on.

52
00:03:17,000 --> 00:03:17,440
Show of hands.

53
00:03:17,500 --> 00:03:20,520
Who's got the security program that is the greatest of all time?

54
00:03:20,680 --> 00:03:21,680
Come on.

55
00:03:22,820 --> 00:03:23,260
Seriously?

56
00:03:23,480 --> 00:03:24,100
Oh, yes.

57
00:03:24,500 --> 00:03:24,880
Yes.

58
00:03:24,940 --> 00:03:27,400
The man in the back in the social engineering shirt.

59
00:03:27,580 --> 00:03:29,040
The greatest of all time right there.

60
00:03:29,060 --> 00:03:29,800
There's one in the room.

61
00:03:30,020 --> 00:03:30,480
All right.

62
00:03:30,720 --> 00:03:31,560
How about this?

63
00:03:31,760 --> 00:03:36,460
How many of you have security programs that are extremely average?

64
00:03:38,020 --> 00:03:38,460
Okay.

65
00:03:38,540 --> 00:03:39,940
I see a few more.

66
00:03:40,220 --> 00:03:41,820
This is making me a little hopeful.

67
00:03:42,840 --> 00:03:45,100
Third option is still available to you.

68
00:03:45,920 --> 00:03:46,780
Mostly dead.

69
00:03:47,040 --> 00:03:47,920
Show of hands.

70
00:03:48,040 --> 00:03:48,260
Anyone?

71
00:03:48,480 --> 00:03:48,700
Anyone?

72
00:03:49,100 --> 00:03:49,540
Okay.

73
00:03:49,540 --> 00:03:52,340
I don't feel really bad about that.

74
00:03:52,460 --> 00:03:57,000
Although, you know, it would have been nice to have more people than my boss say that

75
00:03:57,000 --> 00:03:59,780
their security program is the greatest of all time.

76
00:03:59,940 --> 00:04:03,120
But we're going to talk about why mostly dead is okay.

77
00:04:03,340 --> 00:04:03,660
Okay.

78
00:04:03,680 --> 00:04:06,980
And most of that has to do with the fact that there's a lot of room for improvement.

79
00:04:08,020 --> 00:04:13,880
But next question I have for you before we get to that is simply this.

80
00:04:14,600 --> 00:04:16,620
How exactly do you know?

81
00:04:16,800 --> 00:04:19,520
How do you know that the state of your security program is the greatest of all time?

82
00:04:19,520 --> 00:04:21,260
Well, the state of your security program is where it is today.

83
00:04:21,420 --> 00:04:22,540
So let's see a show of hands.

84
00:04:23,400 --> 00:04:26,040
Realistic testing, education, and statistics.

85
00:04:26,260 --> 00:04:27,440
Who here does that?

86
00:04:27,580 --> 00:04:28,140
Show of hands.

87
00:04:28,560 --> 00:04:29,040
Ooh.

88
00:04:29,160 --> 00:04:30,460
We get a few.

89
00:04:30,560 --> 00:04:31,680
I like it.

90
00:04:32,240 --> 00:04:32,720
Okay.

91
00:04:32,780 --> 00:04:33,480
Show of hands.

92
00:04:33,680 --> 00:04:35,720
You give your folks CBTs once a year.

93
00:04:37,920 --> 00:04:38,780
No laughter.

94
00:04:39,060 --> 00:04:40,520
No derision here in this room.

95
00:04:40,600 --> 00:04:40,760
Okay.

96
00:04:40,840 --> 00:04:41,500
Got a few there.

97
00:04:42,160 --> 00:04:45,100
We still have a third option for the rest of you.

98
00:04:45,340 --> 00:04:47,120
How about disco pants and haircuts?

99
00:04:47,260 --> 00:04:47,520
Okay.

100
00:04:47,520 --> 00:04:50,860
So, yeah, disco pants and haircuts.

101
00:04:50,920 --> 00:04:57,080
So many of you may feel like your security programs are a little bit chaotic and it needs

102
00:04:57,080 --> 00:04:58,300
a few points of emphasis.

103
00:04:58,400 --> 00:05:04,300
So the good news is, you know, having a security program that is mostly dead means, you know,

104
00:05:04,380 --> 00:05:05,720
it's slightly alive.

105
00:05:06,080 --> 00:05:08,080
There are things that you can still do.

106
00:05:08,220 --> 00:05:12,680
And because I have the background that I do, we're going to talk about three major points.

107
00:05:12,740 --> 00:05:16,780
It's going to sound like I'm shoving a lot of information in your general direction.

108
00:05:16,780 --> 00:05:20,600
But I promise you, it comes down to really three things.

109
00:05:20,740 --> 00:05:25,640
Understanding how your population thinks, understanding how they feel, and understanding

110
00:05:25,640 --> 00:05:27,200
the decisions that they make.

111
00:05:27,360 --> 00:05:27,720
Okay?

112
00:05:27,760 --> 00:05:32,260
So let's go to the first point here.

113
00:05:32,560 --> 00:05:35,520
Understanding how your population thinks.

114
00:05:37,080 --> 00:05:43,140
The previous speaker, oh, my gosh, John, had a lot of really good points about cognitive

115
00:05:43,140 --> 00:05:45,720
bias and the mistakes that people make.

116
00:05:45,720 --> 00:05:47,640
Now, let's talk about a couple of these.

117
00:05:48,340 --> 00:05:49,300
Overconfidence effect.

118
00:05:49,480 --> 00:05:55,260
Now, this is the tendency to overestimate your ability or knowledge in specific areas.

119
00:05:56,080 --> 00:05:58,440
We all have a tendency to do this.

120
00:05:58,540 --> 00:06:04,360
But if you had to guess, between men and women, who suffers the most from overconfidence?

121
00:06:06,480 --> 00:06:07,520
Yeah, guys.

122
00:06:08,700 --> 00:06:14,080
Men, generally speaking, tend to rely a little bit more on overconfidence.

123
00:06:14,100 --> 00:06:15,700
We'll talk about why that can be.

124
00:06:15,720 --> 00:06:16,040
It can be an issue.

125
00:06:17,020 --> 00:06:18,980
Because the next one is one of my favorites.

126
00:06:19,440 --> 00:06:20,240
Dunning-Kruger.

127
00:06:20,440 --> 00:06:22,440
Does anyone know what Dunning-Kruger effect is?

128
00:06:22,680 --> 00:06:22,980
Okay.

129
00:06:23,240 --> 00:06:28,100
So Dunning-Kruger is the interesting effect that when you learn something a little, you

130
00:06:28,100 --> 00:06:33,420
know, you learn about this much about a particular area, you suddenly feel like the heavens have

131
00:06:33,420 --> 00:06:34,620
opened, and you are now an expert.

132
00:06:34,840 --> 00:06:39,420
That's why if anybody says that they're an expert in something, you know, have caution

133
00:06:39,420 --> 00:06:40,040
with that.

134
00:06:40,240 --> 00:06:45,700
I remember in my martial arts class, the philosophy was that if you're an expert in something,

135
00:06:45,700 --> 00:06:50,200
if you got to first black, that's when you actually had the door open to you.

136
00:06:50,280 --> 00:06:52,580
That's when you were a legitimate student of the art.

137
00:06:52,840 --> 00:06:56,900
But what we had were a bunch of white and yellow belts running around saying, I know

138
00:06:56,900 --> 00:07:01,000
all there is to know about kung fu, and I'm going to prove it to you in this sparring

139
00:07:01,000 --> 00:07:01,260
match.

140
00:07:01,620 --> 00:07:07,560
So Dunning-Kruger is interesting because there's a point in time where a novice has

141
00:07:07,560 --> 00:07:10,480
just enough information to be deadly.

142
00:07:10,880 --> 00:07:11,280
Okay?

143
00:07:11,560 --> 00:07:15,680
And there is a point as you go in terms of knowledge in the martial arts world where

144
00:07:15,680 --> 00:07:19,120
there's a lot of information in the field, and you actually realize that you don't

145
00:07:19,120 --> 00:07:23,840
know as much as you should, or the field is much more complex, or there's way more stuff

146
00:07:23,840 --> 00:07:27,080
to know here, and your confidence actually takes a dip.

147
00:07:27,820 --> 00:07:31,920
Finally, there's a point in time where you feel like you've spent enough time, enough

148
00:07:31,920 --> 00:07:33,960
research, and understand your topic.

149
00:07:34,200 --> 00:07:35,040
Hey, Mike.

150
00:07:35,580 --> 00:07:36,400
White rhino.

151
00:07:37,400 --> 00:07:43,020
And understand your topic so that you can feel relatively confident about your choices.

152
00:07:43,020 --> 00:07:50,140
In terms of overconfidence and Dunning-Kruger, UTSA did a really interesting study where

153
00:07:50,140 --> 00:07:54,860
they found that most people think they're much better at detecting phishing emails than

154
00:07:54,860 --> 00:07:55,820
they actually are.

155
00:07:56,560 --> 00:08:01,560
I think that's no surprise to any of us who are here in the security industry, but it's

156
00:08:01,560 --> 00:08:06,020
important to understand that this is a tendency that your population is going to have.

157
00:08:06,220 --> 00:08:06,360
Okay?

158
00:08:06,440 --> 00:08:11,000
They think they understand phishing emails or phishing calls, and they understand how

159
00:08:11,000 --> 00:08:13,000
they work, and they know how to recognize them.

160
00:08:13,560 --> 00:08:18,180
Proof of the matter is, is that generally speaking, they're not very good at detecting

161
00:08:18,180 --> 00:08:19,660
those kinds of things at all.

162
00:08:19,820 --> 00:08:21,980
So this is something that you need to understand.

163
00:08:24,080 --> 00:08:24,820
Confirmation bias.

164
00:08:24,980 --> 00:08:29,820
Now, I think John talked a little bit about this, but basically, the misconception is

165
00:08:29,820 --> 00:08:34,780
that our opinions about everything, about life, you know, about everything that you

166
00:08:34,780 --> 00:08:40,020
can think of, has to do with many, many years of collecting facts in a rational fashion,

167
00:08:40,240 --> 00:08:43,000
adding up the totals, and creating a body of evidence.

168
00:08:43,000 --> 00:08:43,100
Okay?

169
00:08:43,100 --> 00:08:45,280
So what we're going to do is we're going to have a balanced opinion based on facts.

170
00:08:45,780 --> 00:08:52,280
What we actually know is confirmation bias is basically a way of thinking that says,

171
00:08:52,520 --> 00:08:53,500
I have an opinion.

172
00:08:53,740 --> 00:08:58,460
I know what I think about things, and I'm going to collect and remember all the pieces

173
00:08:58,460 --> 00:09:03,700
of information that actually fit into this box and help strengthen my opinions.

174
00:09:04,000 --> 00:09:04,400
Okay?

175
00:09:04,420 --> 00:09:10,860
That's a really, really important point to think about, because people are much more

176
00:09:10,860 --> 00:09:12,640
likely to be open to you.

177
00:09:12,640 --> 00:09:12,980
Okay?

178
00:09:13,000 --> 00:09:15,980
If they agree, if they already agree with your opinion.

179
00:09:16,180 --> 00:09:18,020
So think about how difficult it is.

180
00:09:18,100 --> 00:09:22,880
If you have a population that knows they're good at detecting fish or knows what they

181
00:09:22,880 --> 00:09:27,000
need to know about security or thinks that, you know, perhaps you have management that

182
00:09:27,000 --> 00:09:30,620
thinks that security isn't a problem, that is what they believe.

183
00:09:30,960 --> 00:09:34,780
So they're going to read the stories, they're going to remember the information, and they're

184
00:09:34,780 --> 00:09:40,400
really going to bolster their opinions about security based on what they, based on the

185
00:09:40,400 --> 00:09:42,040
opinions they already have.

186
00:09:42,360 --> 00:09:42,840
Okay?

187
00:09:43,000 --> 00:09:46,680
So think about how difficult that makes your job.

188
00:09:46,920 --> 00:09:47,440
All right?

189
00:09:47,580 --> 00:09:49,860
So why does all of this matter?

190
00:09:50,120 --> 00:09:54,080
Well, this, there are dozens and dozens of biases.

191
00:09:54,200 --> 00:10:00,040
I talked about biases a couple years ago here in SE Village, and we went over some of them,

192
00:10:00,080 --> 00:10:05,760
but basically all of these affect the way your population makes decisions in life and

193
00:10:05,760 --> 00:10:07,080
in corporate life as well.

194
00:10:07,240 --> 00:10:10,900
So let me give you an example why it matters.

195
00:10:10,900 --> 00:10:19,040
So, again, overconfidence is an overestimation of one's abilities in a certain area, right?

196
00:10:19,100 --> 00:10:25,540
Dunning-Kruger is a belief that, you know, despite a relative small amount of knowledge

197
00:10:25,540 --> 00:10:30,100
in an area, that you are actually much more competent than you actually are.

198
00:10:30,300 --> 00:10:36,040
And then confirmation bias is the idea that you collect information that confirms what

199
00:10:36,040 --> 00:10:36,920
you already believe.

200
00:10:37,120 --> 00:10:40,660
How does this affect this gentleman's belief system?

201
00:10:41,820 --> 00:10:42,740
Let's take a look.

202
00:10:47,200 --> 00:10:47,680
Okay.

203
00:10:49,860 --> 00:10:55,800
The sound isn't important, but what I'm going to note is the man is in a public place doing

204
00:10:55,800 --> 00:10:59,180
coconut breaking on the news.

205
00:11:00,220 --> 00:11:01,100
Here he goes.

206
00:11:02,720 --> 00:11:03,640
He's feeling good.

207
00:11:03,840 --> 00:11:04,680
He's feeling good.

208
00:11:04,860 --> 00:11:05,740
He's feeling good.

209
00:11:05,880 --> 00:11:06,960
He's starting to wonder.

210
00:11:07,080 --> 00:11:08,060
He hurts his hand.

211
00:11:08,200 --> 00:11:08,580
Ow.

212
00:11:09,080 --> 00:11:09,560
Ow.

213
00:11:10,040 --> 00:11:10,520
Ow.

214
00:11:10,660 --> 00:11:10,760
Ow.

215
00:11:10,800 --> 00:11:16,300
And I'm really starting to feel bad about my abilities in a specific area.

216
00:11:16,580 --> 00:11:17,060
Okay?

217
00:11:17,740 --> 00:11:21,880
We don't need to go any further on this because we understand how this ends.

218
00:11:22,080 --> 00:11:22,580
Okay.

219
00:11:24,880 --> 00:11:28,420
Now, clearly, he had an opinion about his abilities.

220
00:11:28,660 --> 00:11:34,140
The man is sporting a black gi in public and breaking coconuts.

221
00:11:34,220 --> 00:11:34,760
Okay?

222
00:11:35,220 --> 00:11:40,400
So, why cognitive bias and understanding how your population thinks?

223
00:11:40,400 --> 00:11:45,760
It's because the thinking errors that we make impact our behavior.

224
00:11:46,080 --> 00:11:51,860
If you understand that as a security professional, you can start to craft your messaging in ways

225
00:11:52,200 --> 00:11:55,680
that work with your population and not against your population.

226
00:11:56,120 --> 00:11:56,540
All right.

227
00:11:56,640 --> 00:12:00,200
So, that's one-third of what I'm going to talk about, how people think.

228
00:12:00,400 --> 00:12:02,240
Let's go on to how people feel.

229
00:12:02,700 --> 00:12:03,560
All right.

230
00:12:03,920 --> 00:12:05,080
Lack of diversity.

231
00:12:05,080 --> 00:12:10,340
So, this may be something that's killing your security program simply because diversity,

232
00:12:10,580 --> 00:12:14,840
as it turns out, is really, really important in terms of the decisions that we make.

233
00:12:15,060 --> 00:12:16,500
John talked about groupthink.

234
00:12:16,720 --> 00:12:24,220
So, groupthink is something that happens because we think cohesiveness in a group is very desirable.

235
00:12:24,440 --> 00:12:26,780
We want a team that has good synergy.

236
00:12:27,080 --> 00:12:31,820
We want to be able to agree with our coworkers and make decisions together that are great.

237
00:12:32,120 --> 00:12:35,060
The problem is, when you have a highly cohesive group,

238
00:12:35,080 --> 00:12:41,920
they tend to make decisions that are bad because there may be one or two guys that disagree,

239
00:12:42,260 --> 00:12:44,500
but they don't want to break cohesion, right?

240
00:12:44,580 --> 00:12:48,300
They don't want to be the guy that says, you know, I don't think this is going to work,

241
00:12:48,380 --> 00:12:51,940
because that may affect their relationships within the group.

242
00:12:52,420 --> 00:12:59,320
So, what happens is, over time, the way the group bends is based on what people feel is consensus

243
00:12:59,320 --> 00:13:03,100
but is actually not, and that leads to really, really bad decision making.

244
00:13:03,340 --> 00:13:05,000
So, if you have a security team,

245
00:13:05,080 --> 00:13:07,640
that's really tight, you guys work really well together,

246
00:13:07,920 --> 00:13:10,220
you have great chemistry, you have good relationships,

247
00:13:10,400 --> 00:13:11,640
you play poker on the weekends,

248
00:13:12,000 --> 00:13:15,900
think how difficult it would be if you're the one guy that says,

249
00:13:16,060 --> 00:13:18,340
ooh, this is a really bad decision.

250
00:13:18,780 --> 00:13:25,380
It may be really hard to bring that up unless you have a culture that promotes this sort of disagreement.

251
00:13:27,120 --> 00:13:27,940
Creativity killers.

252
00:13:28,260 --> 00:13:32,260
Does anyone remember my talk from a couple years ago where I talked about ambiguity?

253
00:13:32,840 --> 00:13:34,620
Does anyone remember why,

254
00:13:35,080 --> 00:13:38,240
ambiguity in a situation is scary to people?

255
00:13:39,280 --> 00:13:42,940
I had a picture of a leopard that was, like, camouflaged, right?

256
00:13:43,360 --> 00:13:48,040
And asked you why, if you go back to being a caveman,

257
00:13:48,280 --> 00:13:53,900
if you're in a situation where you're not quite sure what's going on in the environment,

258
00:13:54,000 --> 00:13:55,900
and it's very ambiguous,

259
00:13:57,830 --> 00:14:00,820
it is, but what about it?

260
00:14:00,840 --> 00:14:04,820
What about it makes us feel weirded out in situations that are unclear?

261
00:14:05,080 --> 00:14:06,120
It is?

262
00:14:06,940 --> 00:14:08,220
Or we might?

263
00:14:08,440 --> 00:14:10,100
Come on, I say this in class all the time.

264
00:14:11,020 --> 00:14:11,440
Die.

265
00:14:12,960 --> 00:14:14,540
Thank you, April.

266
00:14:14,720 --> 00:14:15,240
Yes.

267
00:14:15,500 --> 00:14:17,100
It all has to do with death.

268
00:14:17,640 --> 00:14:19,580
So basically, it's a survival instinct.

269
00:14:19,700 --> 00:14:21,940
We don't like ambiguous situations.

270
00:14:22,260 --> 00:14:23,060
And what is creativity?

271
00:14:23,380 --> 00:14:27,600
A creative person is somebody that comes in and throws a hand grenade

272
00:14:27,600 --> 00:14:30,080
and messes everything up and asks a lot of questions

273
00:14:30,080 --> 00:14:31,800
and makes you uncomfortable

274
00:14:31,800 --> 00:14:33,980
because back in the way back,

275
00:14:33,980 --> 00:14:35,280
we could die.

276
00:14:35,500 --> 00:14:36,580
And we don't like that.

277
00:14:37,280 --> 00:14:43,260
There's a lot of interesting studies that we talk about valuing creativity as a culture,

278
00:14:43,400 --> 00:14:45,340
but we really don't like it.

279
00:14:45,400 --> 00:14:47,780
We don't like the guy that comes in and asks all the questions.

280
00:14:47,980 --> 00:14:50,720
And that's because, again, it feels dangerous.

281
00:14:50,880 --> 00:14:51,560
It is unsure.

282
00:14:51,960 --> 00:14:54,320
We want to make those sure decisions,

283
00:14:54,500 --> 00:14:59,300
and creative people make environments that are really, really uncomfortable for us.

284
00:14:59,840 --> 00:15:00,360
Okay.

285
00:15:00,660 --> 00:15:02,540
Let's talk about types of diversity.

286
00:15:02,540 --> 00:15:06,420
There was a very, very interesting culture report that came out this year.

287
00:15:06,560 --> 00:15:08,500
I've got the link to it if anybody's interested.

288
00:15:08,980 --> 00:15:14,820
But diversity, I think we've been hearing about diversity a lot, right?

289
00:15:14,900 --> 00:15:18,500
We've been talking about the arguments between men and women, especially in InfoSec.

290
00:15:18,900 --> 00:15:23,600
And I'm not going to talk about the fact that it's important

291
00:15:23,600 --> 00:15:27,920
because I think we can agree that we all don't want to look the same

292
00:15:27,920 --> 00:15:30,040
and think the same and feel the same.

293
00:15:30,040 --> 00:15:36,760
But I am here to suggest to you that diversity is something that's really important to a secure culture.

294
00:15:36,940 --> 00:15:38,560
And I'll talk about a couple different things.

295
00:15:38,720 --> 00:15:39,320
Gender.

296
00:15:39,420 --> 00:15:47,560
This particular study indicated that women and men are very different in terms of risky behavior.

297
00:15:47,900 --> 00:15:52,060
If you had to guess, would you say women are probably more or less risky than men?

298
00:15:52,740 --> 00:15:53,340
Yeah.

299
00:15:53,480 --> 00:15:53,820
Less.

300
00:15:54,020 --> 00:15:54,260
Okay.

301
00:15:54,440 --> 00:15:57,040
And that means that men take greater risks.

302
00:15:57,200 --> 00:15:58,540
The interesting thing is,

303
00:15:58,540 --> 00:16:03,640
men, you reported a better understanding of the rules, but you didn't comply.

304
00:16:04,240 --> 00:16:04,720
Okay?

305
00:16:05,780 --> 00:16:10,600
So if you think about it in terms of security, why would you want to balance?

306
00:16:10,660 --> 00:16:12,660
So if you have too many women in an organization

307
00:16:12,660 --> 00:16:17,820
and you know that women generally, as a population, aren't risk takers,

308
00:16:17,900 --> 00:16:20,580
if you have too many women, what might that lead to?

309
00:16:20,880 --> 00:16:21,740
A lack of growth.

310
00:16:21,800 --> 00:16:23,440
A lack of growth, right?

311
00:16:23,540 --> 00:16:24,440
Exactly, right?

312
00:16:24,560 --> 00:16:28,300
But if you have too many men in an organization, what might that lead to?

313
00:16:28,540 --> 00:16:29,280
Chaos.

314
00:16:29,360 --> 00:16:30,160
Yeah, chaos.

315
00:16:30,280 --> 00:16:31,580
Not following the rules.

316
00:16:32,100 --> 00:16:32,660
Okay.

317
00:16:32,700 --> 00:16:37,280
So gender, ideally, what we would like to see is a balance.

318
00:16:37,460 --> 00:16:41,800
We want to be in a company that has good growth but doesn't make stupid decisions.

319
00:16:42,840 --> 00:16:43,580
All right.

320
00:16:43,740 --> 00:16:44,780
Cultural differences.

321
00:16:45,560 --> 00:16:48,760
There were definitely differences found between cultures,

322
00:16:49,240 --> 00:16:53,580
and that is sort of culture in terms of nations and where you come from and your people.

323
00:16:54,560 --> 00:16:56,800
Some cultures report higher understanding.

324
00:16:57,060 --> 00:16:58,520
Some cultures report higher risk.

325
00:16:58,520 --> 00:16:58,920
Some cultures report higher compliance.

326
00:16:59,520 --> 00:17:05,580
Some cultures report have a culture where they talk a lot amongst themselves about what's secure.

327
00:17:05,860 --> 00:17:12,400
So think about your population as both your security team and who you're trying to protect,

328
00:17:12,640 --> 00:17:16,620
and the fact that you are working with lots of different cultures

329
00:17:16,620 --> 00:17:19,980
and not just where you're from but what your family's like,

330
00:17:20,140 --> 00:17:22,800
whether or not you like to talk, whether or not you like to think,

331
00:17:22,940 --> 00:17:25,120
and that will make a huge, huge difference.

332
00:17:25,440 --> 00:17:25,840
All right.

333
00:17:25,840 --> 00:17:28,260
Age versus exposure to tech.

334
00:17:28,400 --> 00:17:30,500
Now, I'm not crapping on the millennials here,

335
00:17:30,620 --> 00:17:34,060
but this was, I'm going to caveat this.

336
00:17:34,140 --> 00:17:35,400
This was a cross-sectional study.

337
00:17:35,580 --> 00:17:35,680
Okay.

338
00:17:35,740 --> 00:17:38,960
This was just, it took a slice of the culture at a single point in time.

339
00:17:39,020 --> 00:17:41,080
It didn't follow a population over time.

340
00:17:41,240 --> 00:17:46,620
But what they found was that secure behavior actually was better in the older population

341
00:17:46,620 --> 00:17:48,880
as opposed to the younger population.

342
00:17:49,560 --> 00:17:55,820
And so it's not really an exposure to technology issue because young people have been exposed to technology.

343
00:17:55,840 --> 00:17:56,580
Right?

344
00:17:57,460 --> 00:18:00,760
Us old folks, we still remember what the rotary phone was.

345
00:18:01,000 --> 00:18:04,360
I think it was one of our guys, Mike, had to explain to his kid,

346
00:18:04,460 --> 00:18:07,240
what does it mean to say, I'm going to hang up the phone now?

347
00:18:07,440 --> 00:18:08,120
Weird, right?

348
00:18:08,160 --> 00:18:09,220
Because he didn't understand it.

349
00:18:09,500 --> 00:18:13,780
So his son had been exposed to technology from the beginning,

350
00:18:13,840 --> 00:18:19,460
and yet what we're seeing is that that is not the factor that tends to predict secure behavior.

351
00:18:19,820 --> 00:18:21,140
It is age.

352
00:18:21,880 --> 00:18:24,620
Also makes sense with a lot of biopsychology stuff.

353
00:18:24,620 --> 00:18:30,640
We know for a fact that our brains continue to evolve in terms of logic and reasoning well into our mid-20s.

354
00:18:30,700 --> 00:18:34,880
So that makes perfect sense when you're 21 and you're posting, you know, drunk nudies on Facebook.

355
00:18:35,140 --> 00:18:36,140
We get that.

356
00:18:37,320 --> 00:18:39,940
But, again, think about your population.

357
00:18:39,940 --> 00:18:44,080
If you're dealing with a lot of millennials or just a younger population in general,

358
00:18:44,220 --> 00:18:49,060
you're going to have to make different decisions and craft your messaging differently to really reach them.

359
00:18:49,800 --> 00:18:50,520
All right.

360
00:18:50,580 --> 00:18:51,400
Time on the job.

361
00:18:51,500 --> 00:18:54,600
Again, this has to do with thinking about the future.

362
00:18:54,620 --> 00:18:55,640
Think about culture, right?

363
00:18:55,700 --> 00:19:01,700
If you've just been hired, you're not going to be really invested in making sure your company is safe.

364
00:19:01,820 --> 00:19:04,840
So if you work for a company where there's a lot of turnover,

365
00:19:05,220 --> 00:19:09,320
something about the development of culture is very, very important.

366
00:19:09,480 --> 00:19:13,360
You have to consider how you're going to create that messaging for your population

367
00:19:13,360 --> 00:19:16,920
based on the fact that you've got people that are constantly coming in.

368
00:19:17,100 --> 00:19:21,800
But if you have a kind of population where people stay on the job a long time,

369
00:19:21,860 --> 00:19:24,460
that means they've internalized the culture.

370
00:19:24,620 --> 00:19:31,440
They understand and they sort of take, they feel like the culture is a part of them.

371
00:19:31,580 --> 00:19:35,160
And so secure behavior is going to be something that's very, very important.

372
00:19:36,400 --> 00:19:37,620
Why does this matter?

373
00:19:37,840 --> 00:19:41,800
Well, this was actually a really interesting example.

374
00:19:41,860 --> 00:19:43,520
World War Z was a fun book.

375
00:19:43,660 --> 00:19:44,820
It was an okay movie.

376
00:19:45,060 --> 00:19:50,020
But there was an interesting scene in this where Brad Pitt, the main guy,

377
00:19:50,060 --> 00:19:53,700
was flying around trying to figure out what was happening with the zombie culture.

378
00:19:53,840 --> 00:19:54,180
You know.

379
00:19:54,620 --> 00:19:56,080
There were zombies attacking and everybody was dying.

380
00:19:56,200 --> 00:20:01,420
But for a very brief period of time in the movie, Jerusalem was safe.

381
00:20:01,600 --> 00:20:06,660
They had caught the infection very early and built a wall around the city.

382
00:20:06,860 --> 00:20:12,000
So in this particular scene, Brad Pitt is asking his Israeli counterpart,

383
00:20:12,420 --> 00:20:13,680
how did you guys know?

384
00:20:13,900 --> 00:20:16,140
How did you predict what was going to happen?

385
00:20:16,340 --> 00:20:18,280
So again, this is a movie. I get it.

386
00:20:18,360 --> 00:20:23,180
But this relates to all of these cultural kinds of emotional decision making

387
00:20:23,180 --> 00:20:30,380
and how these folks overcame this with the way they set up their decision making process.

388
00:20:33,140 --> 00:20:37,520
In the 30s, Jews refused to believe that they could be sent to concentration camps.

389
00:20:38,140 --> 00:20:42,460
In 72, we refused to fatally be massacred by the Israelis.

390
00:20:42,940 --> 00:20:47,000
In the month before October 1973, we saw Arab troop movements

391
00:20:47,000 --> 00:20:49,920
and we unanimously believed they did pose a threat.

392
00:20:51,260 --> 00:20:53,080
Well, a month later...

393
00:20:53,080 --> 00:20:55,020
They are attacking all those folks that you see.

394
00:20:55,840 --> 00:20:58,280
So we decided to make change.

395
00:20:59,520 --> 00:21:00,040
Change?

396
00:21:00,840 --> 00:21:01,860
The Tenth Mount.

397
00:21:03,640 --> 00:21:06,000
The United Us, with the same information,

398
00:21:06,180 --> 00:21:07,900
arrived at the exact same conclusion.

399
00:21:08,560 --> 00:21:10,220
Is it duty of the Tenth Mount?

400
00:21:10,380 --> 00:21:10,860
It should be.

401
00:21:11,520 --> 00:21:13,920
No matter how improbable it may seem,

402
00:21:14,200 --> 00:21:18,540
the Tenth Mount has to stop eating the assumption that the other nine are wrong.

403
00:21:20,680 --> 00:21:22,260
And you were the Tenth Mount?

404
00:21:25,160 --> 00:21:25,640
Exactly.

405
00:21:26,260 --> 00:21:27,200
Very dramatic.

406
00:21:28,140 --> 00:21:31,980
But it was kind of like a perfect illustration of what I was trying to talk about.

407
00:21:32,140 --> 00:21:37,740
And the reason why that's important is because we tend to hire people that we like

408
00:21:37,740 --> 00:21:41,540
and that are like us, who think like us, who have the same kind of values.

409
00:21:41,740 --> 00:21:45,960
But really what you can be doing is hamstringing your security program

410
00:21:45,960 --> 00:21:49,840
if your entire security team looks and thinks and acts just like you.

411
00:21:50,340 --> 00:21:51,220
I get it.

412
00:21:51,220 --> 00:21:56,520
You're not always going to be able to hire an Asian woman, a black guy, a teenager.

413
00:21:56,840 --> 00:21:58,040
That's not going to happen.

414
00:21:58,220 --> 00:22:01,760
What is important, though, is that you make it a priority

415
00:22:01,760 --> 00:22:05,180
to hire people who don't think just like you,

416
00:22:05,300 --> 00:22:07,080
who have a difference of opinion,

417
00:22:07,380 --> 00:22:08,840
who come from a different place.

418
00:22:09,160 --> 00:22:12,700
Because what you want is a cohesive team, yes.

419
00:22:12,920 --> 00:22:16,940
But what you also want is a team that's comfortable enough to disagree

420
00:22:16,940 --> 00:22:21,120
and to think differently and to think about different creative solutions to the problem.

421
00:22:21,220 --> 00:22:21,800
Okay?

422
00:22:21,920 --> 00:22:22,460
Does that make sense?

423
00:22:22,880 --> 00:22:23,640
All right.

424
00:22:23,720 --> 00:22:26,760
So let's go on to the point number three.

425
00:22:26,780 --> 00:22:29,020
And that is the decisions that they make.

426
00:22:29,240 --> 00:22:29,900
All right.

427
00:22:30,580 --> 00:22:36,480
Lack of consistency may be a third aspect of what is harming your security program.

428
00:22:36,820 --> 00:22:40,160
Now, consistent messaging with respect to training

429
00:22:40,160 --> 00:22:43,720
and what kinds of decisions you want your population to make

430
00:22:43,720 --> 00:22:47,220
and how you want them to report and what happens as a result,

431
00:22:47,380 --> 00:22:49,720
these are all consistency of messaging.

432
00:22:49,800 --> 00:22:50,900
And these are reflected.

433
00:22:50,900 --> 00:22:52,460
These are reflected in your cultural norms.

434
00:22:52,660 --> 00:22:52,840
Okay?

435
00:22:52,960 --> 00:22:56,200
We figure out what is okay and what is not okay

436
00:22:56,200 --> 00:22:59,680
based on what is continually rewarded and or punished.

437
00:23:00,040 --> 00:23:05,600
Like Kaz and me, we come from a culture where we value the screaming of babies.

438
00:23:05,780 --> 00:23:05,960
Okay?

439
00:23:06,100 --> 00:23:07,520
Maybe not so much here.

440
00:23:07,700 --> 00:23:09,020
But this was good luck, man.

441
00:23:09,100 --> 00:23:10,340
This drives off evil spirits.

442
00:23:11,140 --> 00:23:13,220
Many of you may think this is strange.

443
00:23:13,280 --> 00:23:14,520
Kaz and I think it's awesome.

444
00:23:15,960 --> 00:23:18,420
But basically your cultural norms

445
00:23:18,420 --> 00:23:22,620
are going to have an impact on the decisions that people make.

446
00:23:22,800 --> 00:23:24,420
Again, this is what they internalize.

447
00:23:24,640 --> 00:23:24,660
Okay?

448
00:23:24,920 --> 00:23:27,600
So if you are inconsistent in your messaging,

449
00:23:27,760 --> 00:23:31,380
if people aren't sure if they're supposed to report fish here or here

450
00:23:31,380 --> 00:23:35,240
or if they feel like they're going to be punished for something they do one way

451
00:23:35,240 --> 00:23:37,720
and rewarded for something they do another way,

452
00:23:37,900 --> 00:23:41,300
it creates a situation where they can't make a good decision

453
00:23:41,300 --> 00:23:44,220
and they're not going to be learning the lessons that you want to provide.

454
00:23:45,220 --> 00:23:47,920
This goes right into learning theory.

455
00:23:47,920 --> 00:23:51,480
If any of you have familiarity with learning theory,

456
00:23:51,780 --> 00:23:54,420
reinforcement schedules are really important.

457
00:23:54,800 --> 00:23:58,440
Are you rewarding your populations for the behaviors that you want to see?

458
00:23:58,680 --> 00:24:00,640
How often are you rewarding them?

459
00:24:00,720 --> 00:24:01,800
Because that makes a difference.

460
00:24:02,180 --> 00:24:05,480
If your populations are learning a brand new behavior,

461
00:24:05,800 --> 00:24:08,060
they need to be reinforced on a regular schedule.

462
00:24:08,740 --> 00:24:10,840
After that behavior is acquired,

463
00:24:11,220 --> 00:24:16,920
you want to reinforce your population on a less than regular schedule.

464
00:24:17,120 --> 00:24:17,300
Okay?

465
00:24:17,920 --> 00:24:20,300
That's the reason why Las Vegas is still in business, right?

466
00:24:20,480 --> 00:24:23,580
Because you're pulling the slot machines and sometimes you win

467
00:24:23,580 --> 00:24:25,180
and sometimes you don't.

468
00:24:25,180 --> 00:24:26,900
You know how to pull the slot machines.

469
00:24:27,260 --> 00:24:29,220
But the reason why people...

470
00:24:29,220 --> 00:24:31,960
Why is it that people continue to pull those slot machines?

471
00:24:36,180 --> 00:24:41,940
Because the chances are that the next pull they're going to win.

472
00:24:42,120 --> 00:24:44,540
And that is a reinforcement schedule that is irregular.

473
00:24:44,960 --> 00:24:46,300
It's extremely powerful.

474
00:24:46,300 --> 00:24:49,760
The other thing you guys got to know is punishment does not work.

475
00:24:49,900 --> 00:24:54,740
And punishment is where you are providing something bad to decrease the behavior.

476
00:24:55,060 --> 00:24:58,060
Now punishment basically needs to be severe.

477
00:24:58,180 --> 00:24:59,480
It needs to be immediate.

478
00:24:59,660 --> 00:25:02,560
And the effect goes away as soon as you leave the room.

479
00:25:02,800 --> 00:25:03,020
Okay?

480
00:25:03,040 --> 00:25:03,800
So think about this.

481
00:25:03,860 --> 00:25:07,200
Think about when y'all were kids and you were trying to get away with something.

482
00:25:07,440 --> 00:25:09,680
What did punishment actually teach you?

483
00:25:10,480 --> 00:25:12,680
How to get around the rules, right?

484
00:25:12,780 --> 00:25:13,240
Exactly.

485
00:25:13,700 --> 00:25:16,280
So think about this and how important that is.

486
00:25:16,280 --> 00:25:17,840
And that is with respect to your population.

487
00:25:18,220 --> 00:25:18,640
Okay?

488
00:25:18,840 --> 00:25:20,380
So why is this important?

489
00:25:20,720 --> 00:25:22,820
Well, because we're basically monkeys.

490
00:25:23,040 --> 00:25:23,540
Okay?

491
00:25:23,680 --> 00:25:25,080
And my example is monkeys.

492
00:25:25,520 --> 00:25:28,160
I won't show all of this, but this was just so awesome.

493
00:25:28,840 --> 00:25:32,480
And now onto an unusual tip to fight off a business crisis.

494
00:25:32,820 --> 00:25:37,820
A Japanese tabernacle is bringing up a new generation of customer-pleasing waiters.

495
00:25:37,920 --> 00:25:39,020
The cart monkeys.

496
00:25:39,440 --> 00:25:40,960
Ready for some monkey business?

497
00:25:42,680 --> 00:25:44,840
This sake house in northern Tokyo

498
00:25:44,840 --> 00:25:47,680
employs two popular and unusual waiters.

499
00:25:47,800 --> 00:25:50,180
They are named Yatchan and Fukuchan

500
00:25:50,180 --> 00:25:52,600
and are a pair of Japanese macaque monkeys.

501
00:25:53,120 --> 00:25:57,960
Four-year-old Fukuchan has already two years of experience under his furry belt.

502
00:25:58,200 --> 00:26:03,040
His main duty is delivering hot towels to customers before they order their drinks.

503
00:26:05,140 --> 00:26:08,460
Yatchan first learned by watching me working in the restaurant.

504
00:26:08,900 --> 00:26:12,720
It all started one day when I gave him a hot towel out of curiosity.

505
00:26:12,720 --> 00:26:15,160
And he brought the towel to the customer.

506
00:26:15,640 --> 00:26:20,600
Both monkeys are well appreciated by customers who tip them with boiled soybeans.

507
00:26:21,780 --> 00:26:26,400
The monkeys are actually better waiters than some really bad human ones.

508
00:26:27,600 --> 00:26:28,520
All right.

509
00:26:30,120 --> 00:26:31,780
So here is the point.

510
00:26:32,260 --> 00:26:37,780
These are pretty complex behaviors, but even monkeys can be taught proper behavior

511
00:26:37,780 --> 00:26:40,920
provided they are given proper reinforcement.

512
00:26:41,220 --> 00:26:41,760
Okay?

513
00:26:41,760 --> 00:26:42,660
So that is the point.

514
00:26:42,740 --> 00:26:45,080
I know your population is smarter than monkeys.

515
00:26:45,220 --> 00:26:46,500
I promise you they are.

516
00:26:47,340 --> 00:26:50,160
So I know I've only got five minutes left, so I'm going to rush through this.

517
00:26:50,300 --> 00:26:51,180
What can you do?

518
00:26:51,340 --> 00:26:53,180
Here are some things that I want you to consider.

519
00:26:53,940 --> 00:26:55,720
First of all, you need to be aware of bias.

520
00:26:55,980 --> 00:26:59,600
Your bias, your security team's bias, and your population's bias.

521
00:26:59,900 --> 00:27:00,940
How are they thinking?

522
00:27:01,180 --> 00:27:03,460
How are they making decisions as a result?

523
00:27:03,680 --> 00:27:07,380
And where can you have a little fudge to teach them a little bit?

524
00:27:07,460 --> 00:27:10,120
And where do you have to work outside of those bounds?

525
00:27:10,800 --> 00:27:11,600
Higher diversity.

526
00:27:11,600 --> 00:27:14,000
It doesn't have to be skin color or gender.

527
00:27:14,240 --> 00:27:17,880
It has to be people who think differently and bring different things to your team.

528
00:27:18,820 --> 00:27:19,720
Be available.

529
00:27:20,100 --> 00:27:20,240
Okay?

530
00:27:20,400 --> 00:27:25,260
One of those things is you don't want to have an adversarial relationship with your population.

531
00:27:25,560 --> 00:27:28,920
They need to feel like they can come to you with questions and problems.

532
00:27:29,920 --> 00:27:31,080
Understand learning theory.

533
00:27:31,200 --> 00:27:32,220
This is so important.

534
00:27:32,400 --> 00:27:34,780
We see so many companies that punish their population,

535
00:27:35,060 --> 00:27:38,860
but really if you provide proper reinforcement, you're going to get that behavior.

536
00:27:39,000 --> 00:27:39,520
I promise.

537
00:27:39,580 --> 00:27:40,320
We are monkeys.

538
00:27:40,320 --> 00:27:43,620
And remember that this is an ongoing process.

539
00:27:43,900 --> 00:27:44,740
You're never done.

540
00:27:44,900 --> 00:27:45,000
Okay?

541
00:27:45,040 --> 00:27:45,580
This is security.

542
00:27:45,740 --> 00:27:46,740
This is something that we do.

543
00:27:46,880 --> 00:27:48,160
It's not something that is done.

544
00:27:49,120 --> 00:27:49,740
All right.

545
00:27:49,780 --> 00:27:50,620
Last slide.

546
00:27:50,800 --> 00:27:51,600
Well, second to last slide.

547
00:27:51,760 --> 00:27:51,980
Okay.

548
00:27:52,120 --> 00:27:54,100
Here are the three things I want you to take away.

549
00:27:54,760 --> 00:27:56,040
Humans rely on shortcuts.

550
00:27:56,400 --> 00:27:56,800
Okay?

551
00:27:56,860 --> 00:27:58,020
That is how we think.

552
00:27:58,160 --> 00:28:03,080
We have to do it because we don't have enough mental energy to process all the information that's coming in.

553
00:28:03,440 --> 00:28:04,380
That's how we think.

554
00:28:04,840 --> 00:28:07,120
Humans care about norms and groups.

555
00:28:07,400 --> 00:28:08,940
We belong to cultures.

556
00:28:08,940 --> 00:28:11,040
We have values as a result of cultures.

557
00:28:11,160 --> 00:28:12,540
We internalize that information.

558
00:28:12,960 --> 00:28:14,440
That is how we feel.

559
00:28:15,620 --> 00:28:19,880
Simply filling people up with facts is not going to make them better decision makers.

560
00:28:20,080 --> 00:28:21,000
That's a deficit model.

561
00:28:21,200 --> 00:28:25,920
That says if I just throw more facts at people, if I just train and go over and over,

562
00:28:26,080 --> 00:28:27,560
they're just going to make the right decisions.

563
00:28:28,080 --> 00:28:33,340
Here's what we found in a particular study is that there is a relatively weak correlation

564
00:28:33,860 --> 00:28:36,400
between the amount of training and decision making.

565
00:28:36,620 --> 00:28:36,780
Okay?

566
00:28:36,780 --> 00:28:42,640
That missing piece is culture and decision helping people make decisions

567
00:28:42,640 --> 00:28:46,800
as opposed to just throwing more facts at them assuming they're going to know what to do.

568
00:28:47,100 --> 00:28:47,400
Okay?

569
00:28:47,800 --> 00:28:49,460
I hope that made sense to you.

570
00:28:49,500 --> 00:28:54,120
I know this was a very short presentation, but I'm afraid to go over because Amanda is going to smack me.

571
00:28:54,480 --> 00:28:58,660
So if you have questions, please feel free to contact me.

572
00:28:58,760 --> 00:28:59,480
There's my email.

573
00:28:59,700 --> 00:29:00,740
I'm Sultry Asian.

574
00:29:00,920 --> 00:29:03,160
I promise I didn't make up that handle on my own.

575
00:29:03,600 --> 00:29:04,880
No, I did not.

576
00:29:05,380 --> 00:29:05,820
.

577
00:29:06,440 --> 00:29:09,780
But I thank you so much for your attention and thank you for coming to the Village.

578
00:29:09,920 --> 00:29:10,360
Love you guys.