Last night I was standing out in the hallway and somebody came up and they asked me to think about a question that they were going to give me.
And it was if there was one moment in my career that adjusted my thinking and helped me to become a better social engineer.
So I gave that some thought for about an hour and then when he came back I said that one event was hiring our next speaker.
That's Michelle Fincher. Hiring her did a lot of things for my business because it added professionalism to us that we didn't have before.
It added the ability to be proud of the work that we put out and the reports that we put out.
And it made me a better social engineer, businessman, writer because she demands perfection and scientific proof of everything I say.
Which I appreciate now. Maybe I didn't at first.
But I did.
But I appreciate it now.
So I know you're going to enjoy this if you haven't heard Michelle speak before.
So just join me in welcoming Michelle Fincher.
Hey y'all.
You like the dress?
Actually my husband picked this out for me and I wanted to segue into my talk a little bit.
I'm going to tell you a story about my husband.
We met in martial arts class.
It is the classic love story.
I was a belt above him so I really thought I was badass.
And at the time what we would do is we would have a sparring session before we broke off into our separate belt levels.
And, you know, we chose each other.
I think there was probably a little preliminary chemistry there.
But, you know, I thought, this is going to be easy because he's a belt below me and I'm just going to humiliate him.
Well, what happened was the sparring match started.
He punched me right in the face.
And I said, you know, I'm not going to do that.
And I said, baby, you're going to marry me.
So let me tell you why though.
It is not because I'm a masochist.
He didn't break my nose.
He didn't give me a black eye.
Here's what he did.
He treated me as a legitimate opponent.
He tested my decision making.
He basically said, you made some decisions about not putting your hands up and I tested that appropriately.
And the reason why I fell in love with that man, that was that moment in time when I saw the measure of the man.
Because he respected me enough to give me a fair test.
And I'll tell you what, I never let my hands down around him ever again.
Okay.
So this is the talk that I want to have with you all about your security programs.
And I think all of us or many of us are involved in InfoSec.
And we like to think that we're doing a good job.
But sometimes I think everyone reaches a point in their security profession where they're saying things are just not working quite the way I thought they would.
And my population isn't listening to me like they should.
And I don't really understand why.
So let's talk about a few things that can be impactful in the decision making that you have in terms of your security program.
All right.
So let me see a show of hands here.
All right.
What is the state of your security program?
The greatest of all time.
Come on.
Show of hands.
Who's got the security program that is the greatest of all time?
Come on.
Seriously?
Oh, yes.
Yes.
The man in the back in the social engineering shirt.
The greatest of all time right there.
There's one in the room.
All right.
How about this?
How many of you have security programs that are extremely average?
Okay.
I see a few more.
This is making me a little hopeful.
Third option is still available to you.
Mostly dead.
Show of hands.
Anyone?
Anyone?
Okay.
I don't feel really bad about that.
Although, you know, it would have been nice to have more people than my boss say that
their security program is the greatest of all time.
But we're going to talk about why mostly dead is okay.
Okay.
And most of that has to do with the fact that there's a lot of room for improvement.
But next question I have for you before we get to that is simply this.
How exactly do you know?
How do you know that the state of your security program is the greatest of all time?
Well, the state of your security program is where it is today.
So let's see a show of hands.
Realistic testing, education, and statistics.
Who here does that?
Show of hands.
Ooh.
We get a few.
I like it.
Okay.
Show of hands.
You give your folks CBTs once a year.
No laughter.
No derision here in this room.
Okay.
Got a few there.
We still have a third option for the rest of you.
How about disco pants and haircuts?
Okay.
So, yeah, disco pants and haircuts.
So many of you may feel like your security programs are a little bit chaotic and it needs
a few points of emphasis.
So the good news is, you know, having a security program that is mostly dead means, you know,
it's slightly alive.
There are things that you can still do.
And because I have the background that I do, we're going to talk about three major points.
It's going to sound like I'm shoving a lot of information in your general direction.
But I promise you, it comes down to really three things.
Understanding how your population thinks, understanding how they feel, and understanding
the decisions that they make.
Okay?
So let's go to the first point here.
Understanding how your population thinks.
The previous speaker, oh, my gosh, John, had a lot of really good points about cognitive
bias and the mistakes that people make.
Now, let's talk about a couple of these.
Overconfidence effect.
Now, this is the tendency to overestimate your ability or knowledge in specific areas.
We all have a tendency to do this.
But if you had to guess, between men and women, who suffers the most from overconfidence?
Yeah, guys.
Men, generally speaking, tend to rely a little bit more on overconfidence.
We'll talk about why that can be.
It can be an issue.
Because the next one is one of my favorites.
Dunning-Kruger.
Does anyone know what Dunning-Kruger effect is?
Okay.
So Dunning-Kruger is the interesting effect that when you learn something a little, you
know, you learn about this much about a particular area, you suddenly feel like the heavens have
opened, and you are now an expert.
That's why if anybody says that they're an expert in something, you know, have caution
with that.
I remember in my martial arts class, the philosophy was that if you're an expert in something,
if you got to first black, that's when you actually had the door open to you.
That's when you were a legitimate student of the art.
But what we had were a bunch of white and yellow belts running around saying, I know
all there is to know about kung fu, and I'm going to prove it to you in this sparring
match.
So Dunning-Kruger is interesting because there's a point in time where a novice has
just enough information to be deadly.
Okay?
And there is a point as you go in terms of knowledge in the martial arts world where
there's a lot of information in the field, and you actually realize that you don't
know as much as you should, or the field is much more complex, or there's way more stuff
to know here, and your confidence actually takes a dip.
Finally, there's a point in time where you feel like you've spent enough time, enough
research, and understand your topic.
Hey, Mike.
White rhino.
And understand your topic so that you can feel relatively confident about your choices.
In terms of overconfidence and Dunning-Kruger, UTSA did a really interesting study where
they found that most people think they're much better at detecting phishing emails than
they actually are.
I think that's no surprise to any of us who are here in the security industry, but it's
important to understand that this is a tendency that your population is going to have.
Okay?
They think they understand phishing emails or phishing calls, and they understand how
they work, and they know how to recognize them.
Proof of the matter is, is that generally speaking, they're not very good at detecting
those kinds of things at all.
So this is something that you need to understand.
Confirmation bias.
Now, I think John talked a little bit about this, but basically, the misconception is
that our opinions about everything, about life, you know, about everything that you
can think of, has to do with many, many years of collecting facts in a rational fashion,
adding up the totals, and creating a body of evidence.
Okay?
So what we're going to do is we're going to have a balanced opinion based on facts.
What we actually know is confirmation bias is basically a way of thinking that says,
I have an opinion.
I know what I think about things, and I'm going to collect and remember all the pieces
of information that actually fit into this box and help strengthen my opinions.
Okay?
That's a really, really important point to think about, because people are much more
likely to be open to you.
Okay?
If they agree, if they already agree with your opinion.
So think about how difficult it is.
If you have a population that knows they're good at detecting fish or knows what they
need to know about security or thinks that, you know, perhaps you have management that
thinks that security isn't a problem, that is what they believe.
So they're going to read the stories, they're going to remember the information, and they're
really going to bolster their opinions about security based on what they, based on the
opinions they already have.
Okay?
So think about how difficult that makes your job.
All right?
So why does all of this matter?
Well, this, there are dozens and dozens of biases.
I talked about biases a couple years ago here in SE Village, and we went over some of them,
but basically all of these affect the way your population makes decisions in life and
in corporate life as well.
So let me give you an example why it matters.
So, again, overconfidence is an overestimation of one's abilities in a certain area, right?
Dunning-Kruger is a belief that, you know, despite a relative small amount of knowledge
in an area, that you are actually much more competent than you actually are.
And then confirmation bias is the idea that you collect information that confirms what
you already believe.
How does this affect this gentleman's belief system?
Let's take a look.
Okay.
The sound isn't important, but what I'm going to note is the man is in a public place doing
coconut breaking on the news.
Here he goes.
He's feeling good.
He's feeling good.
He's feeling good.
He's starting to wonder.
He hurts his hand.
Ow.
Ow.
Ow.
Ow.
And I'm really starting to feel bad about my abilities in a specific area.
Okay?
We don't need to go any further on this because we understand how this ends.
Okay.
Now, clearly, he had an opinion about his abilities.
The man is sporting a black gi in public and breaking coconuts.
Okay?
So, why cognitive bias and understanding how your population thinks?
It's because the thinking errors that we make impact our behavior.
If you understand that as a security professional, you can start to craft your messaging in ways
that work with your population and not against your population.
All right.
So, that's one-third of what I'm going to talk about, how people think.
Let's go on to how people feel.
All right.
Lack of diversity.
So, this may be something that's killing your security program simply because diversity,
as it turns out, is really, really important in terms of the decisions that we make.
John talked about groupthink.
So, groupthink is something that happens because we think cohesiveness in a group is very desirable.
We want a team that has good synergy.
We want to be able to agree with our coworkers and make decisions together that are great.
The problem is, when you have a highly cohesive group,
they tend to make decisions that are bad because there may be one or two guys that disagree,
but they don't want to break cohesion, right?
They don't want to be the guy that says, you know, I don't think this is going to work,
because that may affect their relationships within the group.
So, what happens is, over time, the way the group bends is based on what people feel is consensus
but is actually not, and that leads to really, really bad decision making.
So, if you have a security team,
that's really tight, you guys work really well together,
you have great chemistry, you have good relationships,
you play poker on the weekends,
think how difficult it would be if you're the one guy that says,
ooh, this is a really bad decision.
It may be really hard to bring that up unless you have a culture that promotes this sort of disagreement.
Creativity killers.
Does anyone remember my talk from a couple years ago where I talked about ambiguity?
Does anyone remember why,
ambiguity in a situation is scary to people?
I had a picture of a leopard that was, like, camouflaged, right?
And asked you why, if you go back to being a caveman,
if you're in a situation where you're not quite sure what's going on in the environment,
and it's very ambiguous,
it is, but what about it?
What about it makes us feel weirded out in situations that are unclear?
It is?
Or we might?
Come on, I say this in class all the time.
Die.
Thank you, April.
Yes.
It all has to do with death.
So basically, it's a survival instinct.
We don't like ambiguous situations.
And what is creativity?
A creative person is somebody that comes in and throws a hand grenade
and messes everything up and asks a lot of questions
and makes you uncomfortable
because back in the way back,
we could die.
And we don't like that.
There's a lot of interesting studies that we talk about valuing creativity as a culture,
but we really don't like it.
We don't like the guy that comes in and asks all the questions.
And that's because, again, it feels dangerous.
It is unsure.
We want to make those sure decisions,
and creative people make environments that are really, really uncomfortable for us.
Okay.
Let's talk about types of diversity.
There was a very, very interesting culture report that came out this year.
I've got the link to it if anybody's interested.
But diversity, I think we've been hearing about diversity a lot, right?
We've been talking about the arguments between men and women, especially in InfoSec.
And I'm not going to talk about the fact that it's important
because I think we can agree that we all don't want to look the same
and think the same and feel the same.
But I am here to suggest to you that diversity is something that's really important to a secure culture.
And I'll talk about a couple different things.
Gender.
This particular study indicated that women and men are very different in terms of risky behavior.
If you had to guess, would you say women are probably more or less risky than men?
Yeah.
Less.
Okay.
And that means that men take greater risks.
The interesting thing is,
men, you reported a better understanding of the rules, but you didn't comply.
Okay?
So if you think about it in terms of security, why would you want to balance?
So if you have too many women in an organization
and you know that women generally, as a population, aren't risk takers,
if you have too many women, what might that lead to?
A lack of growth.
A lack of growth, right?
Exactly, right?
But if you have too many men in an organization, what might that lead to?
Chaos.
Yeah, chaos.
Not following the rules.
Okay.
So gender, ideally, what we would like to see is a balance.
We want to be in a company that has good growth but doesn't make stupid decisions.
All right.
Cultural differences.
There were definitely differences found between cultures,
and that is sort of culture in terms of nations and where you come from and your people.
Some cultures report higher understanding.
Some cultures report higher risk.
Some cultures report higher compliance.
Some cultures report have a culture where they talk a lot amongst themselves about what's secure.
So think about your population as both your security team and who you're trying to protect,
and the fact that you are working with lots of different cultures
and not just where you're from but what your family's like,
whether or not you like to talk, whether or not you like to think,
and that will make a huge, huge difference.
All right.
Age versus exposure to tech.
Now, I'm not crapping on the millennials here,
but this was, I'm going to caveat this.
This was a cross-sectional study.
Okay.
This was just, it took a slice of the culture at a single point in time.
It didn't follow a population over time.
But what they found was that secure behavior actually was better in the older population
as opposed to the younger population.
And so it's not really an exposure to technology issue because young people have been exposed to technology.
Right?
Us old folks, we still remember what the rotary phone was.
I think it was one of our guys, Mike, had to explain to his kid,
what does it mean to say, I'm going to hang up the phone now?
Weird, right?
Because he didn't understand it.
So his son had been exposed to technology from the beginning,
and yet what we're seeing is that that is not the factor that tends to predict secure behavior.
It is age.
Also makes sense with a lot of biopsychology stuff.
We know for a fact that our brains continue to evolve in terms of logic and reasoning well into our mid-20s.
So that makes perfect sense when you're 21 and you're posting, you know, drunk nudies on Facebook.
We get that.
But, again, think about your population.
If you're dealing with a lot of millennials or just a younger population in general,
you're going to have to make different decisions and craft your messaging differently to really reach them.
All right.
Time on the job.
Again, this has to do with thinking about the future.
Think about culture, right?
If you've just been hired, you're not going to be really invested in making sure your company is safe.
So if you work for a company where there's a lot of turnover,
something about the development of culture is very, very important.
You have to consider how you're going to create that messaging for your population
based on the fact that you've got people that are constantly coming in.
But if you have a kind of population where people stay on the job a long time,
that means they've internalized the culture.
They understand and they sort of take, they feel like the culture is a part of them.
And so secure behavior is going to be something that's very, very important.
Why does this matter?
Well, this was actually a really interesting example.
World War Z was a fun book.
It was an okay movie.
But there was an interesting scene in this where Brad Pitt, the main guy,
was flying around trying to figure out what was happening with the zombie culture.
You know.
There were zombies attacking and everybody was dying.
But for a very brief period of time in the movie, Jerusalem was safe.
They had caught the infection very early and built a wall around the city.
So in this particular scene, Brad Pitt is asking his Israeli counterpart,
how did you guys know?
How did you predict what was going to happen?
So again, this is a movie. I get it.
But this relates to all of these cultural kinds of emotional decision making
and how these folks overcame this with the way they set up their decision making process.
In the 30s, Jews refused to believe that they could be sent to concentration camps.
In 72, we refused to fatally be massacred by the Israelis.
In the month before October 1973, we saw Arab troop movements
and we unanimously believed they did pose a threat.
Well, a month later...
They are attacking all those folks that you see.
So we decided to make change.
Change?
The Tenth Mount.
The United Us, with the same information,
arrived at the exact same conclusion.
Is it duty of the Tenth Mount?
It should be.
No matter how improbable it may seem,
the Tenth Mount has to stop eating the assumption that the other nine are wrong.
And you were the Tenth Mount?
Exactly.
Very dramatic.
But it was kind of like a perfect illustration of what I was trying to talk about.
And the reason why that's important is because we tend to hire people that we like
and that are like us, who think like us, who have the same kind of values.
But really what you can be doing is hamstringing your security program
if your entire security team looks and thinks and acts just like you.
I get it.
You're not always going to be able to hire an Asian woman, a black guy, a teenager.
That's not going to happen.
What is important, though, is that you make it a priority
to hire people who don't think just like you,
who have a difference of opinion,
who come from a different place.
Because what you want is a cohesive team, yes.
But what you also want is a team that's comfortable enough to disagree
and to think differently and to think about different creative solutions to the problem.
Okay?
Does that make sense?
All right.
So let's go on to the point number three.
And that is the decisions that they make.
All right.
Lack of consistency may be a third aspect of what is harming your security program.
Now, consistent messaging with respect to training
and what kinds of decisions you want your population to make
and how you want them to report and what happens as a result,
these are all consistency of messaging.
And these are reflected.
These are reflected in your cultural norms.
Okay?
We figure out what is okay and what is not okay
based on what is continually rewarded and or punished.
Like Kaz and me, we come from a culture where we value the screaming of babies.
Okay?
Maybe not so much here.
But this was good luck, man.
This drives off evil spirits.
Many of you may think this is strange.
Kaz and I think it's awesome.
But basically your cultural norms
are going to have an impact on the decisions that people make.
Again, this is what they internalize.
Okay?
So if you are inconsistent in your messaging,
if people aren't sure if they're supposed to report fish here or here
or if they feel like they're going to be punished for something they do one way
and rewarded for something they do another way,
it creates a situation where they can't make a good decision
and they're not going to be learning the lessons that you want to provide.
This goes right into learning theory.
If any of you have familiarity with learning theory,
reinforcement schedules are really important.
Are you rewarding your populations for the behaviors that you want to see?
How often are you rewarding them?
Because that makes a difference.
If your populations are learning a brand new behavior,
they need to be reinforced on a regular schedule.
After that behavior is acquired,
you want to reinforce your population on a less than regular schedule.
Okay?
That's the reason why Las Vegas is still in business, right?
Because you're pulling the slot machines and sometimes you win
and sometimes you don't.
You know how to pull the slot machines.
But the reason why people...
Why is it that people continue to pull those slot machines?
Because the chances are that the next pull they're going to win.
And that is a reinforcement schedule that is irregular.
It's extremely powerful.
The other thing you guys got to know is punishment does not work.
And punishment is where you are providing something bad to decrease the behavior.
Now punishment basically needs to be severe.
It needs to be immediate.
And the effect goes away as soon as you leave the room.
Okay?
So think about this.
Think about when y'all were kids and you were trying to get away with something.
What did punishment actually teach you?
How to get around the rules, right?
Exactly.
So think about this and how important that is.
And that is with respect to your population.
Okay?
So why is this important?
Well, because we're basically monkeys.
Okay?
And my example is monkeys.
I won't show all of this, but this was just so awesome.
And now onto an unusual tip to fight off a business crisis.
A Japanese tabernacle is bringing up a new generation of customer-pleasing waiters.
The cart monkeys.
Ready for some monkey business?
This sake house in northern Tokyo
employs two popular and unusual waiters.
They are named Yatchan and Fukuchan
and are a pair of Japanese macaque monkeys.
Four-year-old Fukuchan has already two years of experience under his furry belt.
His main duty is delivering hot towels to customers before they order their drinks.
Yatchan first learned by watching me working in the restaurant.
It all started one day when I gave him a hot towel out of curiosity.
And he brought the towel to the customer.
Both monkeys are well appreciated by customers who tip them with boiled soybeans.
The monkeys are actually better waiters than some really bad human ones.
All right.
So here is the point.
These are pretty complex behaviors, but even monkeys can be taught proper behavior
provided they are given proper reinforcement.
Okay?
So that is the point.
I know your population is smarter than monkeys.
I promise you they are.
So I know I've only got five minutes left, so I'm going to rush through this.
What can you do?
Here are some things that I want you to consider.
First of all, you need to be aware of bias.
Your bias, your security team's bias, and your population's bias.
How are they thinking?
How are they making decisions as a result?
And where can you have a little fudge to teach them a little bit?
And where do you have to work outside of those bounds?
Higher diversity.
It doesn't have to be skin color or gender.
It has to be people who think differently and bring different things to your team.
Be available.
Okay?
One of those things is you don't want to have an adversarial relationship with your population.
They need to feel like they can come to you with questions and problems.
Understand learning theory.
This is so important.
We see so many companies that punish their population,
but really if you provide proper reinforcement, you're going to get that behavior.
I promise.
We are monkeys.
And remember that this is an ongoing process.
You're never done.
Okay?
This is security.
This is something that we do.
It's not something that is done.
All right.
Last slide.
Well, second to last slide.
Okay.
Here are the three things I want you to take away.
Humans rely on shortcuts.
Okay?
That is how we think.
We have to do it because we don't have enough mental energy to process all the information that's coming in.
That's how we think.
Humans care about norms and groups.
We belong to cultures.
We have values as a result of cultures.
We internalize that information.
That is how we feel.
Simply filling people up with facts is not going to make them better decision makers.
That's a deficit model.
That says if I just throw more facts at people, if I just train and go over and over,
they're just going to make the right decisions.
Here's what we found in a particular study is that there is a relatively weak correlation
between the amount of training and decision making.
Okay?
That missing piece is culture and decision helping people make decisions
as opposed to just throwing more facts at them assuming they're going to know what to do.
Okay?
I hope that made sense to you.
I know this was a very short presentation, but I'm afraid to go over because Amanda is going to smack me.
So if you have questions, please feel free to contact me.
There's my email.
I'm Sultry Asian.
I promise I didn't make up that handle on my own.
No, I did not.
.
But I thank you so much for your attention and thank you for coming to the Village.
Love you guys.