1
00:00:04,180 --> 00:00:07,500
And welcome back to the Career Hacking Village.

2
00:00:07,500 --> 00:00:18,200
We talk a lot about doing technology, but we never really talk about how do we present, how do we get things moving forward.

3
00:00:18,200 --> 00:00:28,520
And I'm really excited, I was really excited to see the proposal submission from my friend Peter Keenan to just really talk about hacking security leadership.

4
00:00:28,520 --> 00:00:30,000
So Peter, take it away.

5
00:00:30,000 --> 00:00:34,600
Thanks so much Kathleen, and thanks everybody for watching.

6
00:00:35,100 --> 00:00:41,100
Yeah, this is my first DEF CON presentation, so thanks for accepting it.

7
00:00:41,840 --> 00:00:45,680
All right, the obligatory who am I slide.

8
00:00:45,680 --> 00:00:53,640
So I have been in the information technology and information security space for about 30 years.

9
00:00:53,640 --> 00:00:59,680
You can see from these pictures there's at least three decades of bad haircuts there.

10
00:01:00,080 --> 00:01:06,820
I'm currently the chief information security officer for a global financial services company.

11
00:01:07,640 --> 00:01:14,320
You all are hackers, you can figure it out if you really want to, but I'm not allowed to use the name, so I'm not going to.

12
00:01:14,500 --> 00:01:29,120
Prior to the five and a half year stint I've had there, I was global head of information security governance at Citigroup, yeah, I owned a bunch of things like the global information security policy.

13
00:01:29,260 --> 00:01:34,280
I was a director with PricewaterhouseCoopers and their information security consulting group.

14
00:01:34,460 --> 00:01:46,440
I owned a firm that did information security consulting for about a decade, primarily to military and intelligence agencies, and spent a little time working in government service before that.

15
00:01:47,360 --> 00:02:03,300
Yeah, like I said, a lot of time in the space, and I have hopefully boiled down what I've learned in the last 30 some odd years into about 30 slides, which sounds terrible when I say it that way, that I'm getting like one slide a year, but sadly it's true.

16
00:02:03,840 --> 00:02:10,200
Yeah, two kids, 24 and 21, 31 years of marriage.

17
00:02:11,460 --> 00:02:14,800
All right, so I'm going to start with this CISO mind map.

18
00:02:14,800 --> 00:02:16,660
I think it's a great slide.

19
00:02:16,660 --> 00:02:26,820
I think this chart is really informative, sort of about the things that somebody in my position is thinking about on a daily, weekly, monthly basis.

20
00:02:26,840 --> 00:02:34,540
The area of this mind map that I'm going to focus on is selling information security.

21
00:02:34,540 --> 00:02:48,600
I think it's the area that people struggle with most as they transition their career from sole contributors or engineering types or very technical sort of roles to a leadership role.

22
00:02:48,600 --> 00:02:54,000
And it's probably the most important part of information security.

23
00:02:54,000 --> 00:03:05,040
If you boil information security down to its core nugget, the thing that's probably describes it best is influence without authority.

24
00:03:05,040 --> 00:03:20,400
And the ability to drive security through an organization without directly being able to control people's comp or control their, you know, performance reviews and all of those sorts of things is really the challenge that we face.

25
00:03:20,400 --> 00:03:24,280
I mean, some things we have direct control over, but by and large we don't.

26
00:03:24,280 --> 00:03:34,940
And we need to be able to convince people that this is the right thing to do both for their own personal gain, the company's gain, society's gain, all of those things.

27
00:03:35,820 --> 00:03:44,820
And that's why I think that's probably the core function that information security, probably the most important function within information security, because it's a force multiplier.

28
00:03:44,820 --> 00:03:51,260
If we can get the folks in the company all pulling in our direction, it multiplies our effectiveness dramatically.

29
00:03:51,660 --> 00:03:56,840
The thing I don't like about this part of it here, and, you know, maybe it's just me misreading it.

30
00:03:56,840 --> 00:03:59,020
I think the authors, like I said, did a great job.

31
00:03:59,460 --> 00:04:02,040
It feels like it's a lot of top down selling, right?

32
00:04:02,040 --> 00:04:12,480
And I think that that's good and it's important and it's what, you know, lets you keep your job as a CISO, convincing the, you know, the board and the CEO that you're doing a good job and security is important.

33
00:04:12,780 --> 00:04:14,060
You got to do that.

34
00:04:14,100 --> 00:04:27,180
But if you actually want to fix security at an organization, you've got to sell it from the bottom up because it's the people on the ground, the people at eye level who are actually doing the things that will make you more or less secure.

35
00:04:27,180 --> 00:04:31,000
And you've got to convince them that this is the right things to do.

36
00:04:31,000 --> 00:04:36,100
And these are the changes they need to make in their processes to be better.

37
00:04:36,100 --> 00:04:41,200
And you've got to provide them with ways of doing it that makes them more efficient, not less efficient.

38
00:04:41,380 --> 00:04:51,140
And, you know, it's a hard sell in a lot of cases with security because, you know, being frank, we're introducing overhead quite often to do things securely, right?

39
00:04:51,140 --> 00:05:02,620
I mean, the act of typing a password as opposed to just being on the system introduces overhead, but short-term overhead, long-term overhead, it obviously creates a lot of problems not having passwords.

40
00:05:03,540 --> 00:05:05,300
Amazon has three buckets.

41
00:05:05,320 --> 00:05:05,900
Yes.

42
00:05:07,260 --> 00:05:07,720
All right.

43
00:05:07,720 --> 00:05:23,800
So jumping ahead, the key language of business, and again, something that for me, I think is one of the really big differentiators between a sole contributor and a leader in the information security space is the language of risk.

44
00:05:24,060 --> 00:05:25,780
Business leaders understand it.

45
00:05:25,780 --> 00:05:35,760
They may not understand your specific technical domain, and they may not understand what a router or a switch is, but they understand the language of risk.

46
00:05:35,760 --> 00:05:38,180
And it's a language that we can meet in the middle with them all.

47
00:05:38,180 --> 00:05:48,000
We can meet in the middle with lawyers, with accountants, business people , the CEO, they will all get the idea of likelihood and impact.

48
00:05:48,960 --> 00:05:53,180
It's a problem for us in technical fields.

49
00:05:53,600 --> 00:06:01,080
In the words that I've highlighted on this page, uncertainty and probability, we struggle with that as a group.

50
00:06:01,080 --> 00:06:02,000
We do.

51
00:06:02,180 --> 00:06:05,580
We think about these things in absolutes like engineers.

52
00:06:05,580 --> 00:06:16,060
And I know that's a rough way of saying it, but too many times, it's really a struggle to drag an estimate out of somebody who's in a technical discipline.

53
00:06:16,060 --> 00:06:18,000
They want to have the right answer.

54
00:06:18,000 --> 00:06:24,460
With estimates, you're basically saying, I'm giving you the wrong answer, but I hope it's close.

55
00:06:25,960 --> 00:06:34,580
Somebody who's got an engineering training or a mathematical training, that makes the hair on the back of their neck stick up.

56
00:06:34,580 --> 00:06:35,480
What do you mean?

57
00:06:35,480 --> 00:06:37,540
I don't know the answer.

58
00:06:37,540 --> 00:06:39,240
There's no right answer.

59
00:06:39,240 --> 00:06:41,520
I'm just thumbing the area.

60
00:06:41,620 --> 00:06:43,600
I'm putting that in front of the CEO?

61
00:06:43,600 --> 00:06:44,780
Yeah, you are.

62
00:06:44,780 --> 00:06:46,340
That's what risk is.

63
00:06:46,360 --> 00:06:59,760
You take the best educated guess you can sometimes about the likelihood, which is a soft number, and the impact of these events occurring.

64
00:06:59,760 --> 00:07:02,340
And that's the way that you have to describe them.

65
00:07:02,840 --> 00:07:07,520
I often hear people say this phrase, and it drives me nuts, you can't predict the future.

66
00:07:08,560 --> 00:07:10,180
Absolutely, you can.

67
00:07:10,300 --> 00:07:12,760
I mean, with 100% certainty, no.

68
00:07:12,760 --> 00:07:16,040
But why else would we eat right and exercise, right?

69
00:07:16,120 --> 00:07:18,620
Because we don't think we're going to die in the next hour.

70
00:07:18,620 --> 00:07:20,080
We don't think we're going to die tomorrow.

71
00:07:20,080 --> 00:07:21,680
We don't think the world's going to end tomorrow.

72
00:07:21,680 --> 00:07:28,040
We don't think they're going to have miraculous cures for diabetes and obesity tomorrow, right?

73
00:07:28,040 --> 00:07:33,080
That's why we save money, because we think that we're going to live to an age where we're going to need money, right?

74
00:07:33,080 --> 00:07:37,740
There's a million predictions about the future we make every day, all of us do.

75
00:07:37,740 --> 00:07:40,460
And I think we just have to get comfortable with that.

76
00:07:41,600 --> 00:07:46,700
You can't predict it with 100% certainty, but that's okay.

77
00:07:46,700 --> 00:07:55,440
You have to be able to get comfortable with the uncertainty and probabilities and presenting your risks in that way.

78
00:07:55,500 --> 00:07:58,820
And it's got to be done.

79
00:07:58,840 --> 00:08:05,220
If you look at the way the businesses report, these things, they all know that they're not 100% accurate.

80
00:08:05,220 --> 00:08:07,480
And people yell at you when your risk is way off.

81
00:08:07,480 --> 00:08:09,620
But end of the day, you were clear.

82
00:08:09,620 --> 00:08:11,620
It's an estimate.

83
00:08:13,380 --> 00:08:13,800
All right.

84
00:08:14,680 --> 00:08:15,740
Two other things.

85
00:08:15,740 --> 00:08:17,200
One last thing on this one.

86
00:08:17,200 --> 00:08:20,480
This is one of my pet peeves about information security folks.

87
00:08:20,480 --> 00:08:29,020
When they're talking to non-security folks, lay people, FUD is the biggest thing that drives me nuts.

88
00:08:29,020 --> 00:08:34,640
And you see it, the salespeople do it, the engineers, when they get frustrated, they do it.

89
00:08:34,640 --> 00:08:38,660
They just throw out these FUD bombs of like, well, you never know.

90
00:08:38,660 --> 00:08:41,360
Could be the Russians, those Chinese.

91
00:08:41,360 --> 00:08:46,000
It's just, stop, don't do it.

92
00:08:46,060 --> 00:08:52,540
It may work in the short-term to win that short-term argument, but you will lose respect from everybody in the room.

93
00:08:52,540 --> 00:09:00,080
And that's one of the things that defines you as a leader is being able to hold and command that respect over time.

94
00:09:01,400 --> 00:09:02,760
All right.

95
00:09:02,760 --> 00:09:03,860
Risk strategies.

96
00:09:03,860 --> 00:09:08,840
These are some of the terms that you have to understand if you're going to communicate in risk.

97
00:09:08,840 --> 00:09:09,920
Risk reduction.

98
00:09:09,920 --> 00:09:11,980
This one's pretty straightforward, right?

99
00:09:12,200 --> 00:09:18,340
I have a thousand systems that are MS-0867 vulnerable.

100
00:09:18,840 --> 00:09:21,000
I patched 999 of them.

101
00:09:21,000 --> 00:09:22,080
Have I reduced the risk?

102
00:09:22,080 --> 00:09:23,040
Yeah, probably, right?

103
00:09:23,040 --> 00:09:24,420
That's risk reduction.

104
00:09:24,640 --> 00:09:34,100
There's still a risk out there that I missed one, or that the patch isn't fully effective, or somebody didn't reboot after the patch, or all of those things.

105
00:09:34,100 --> 00:09:40,920
But that's what that's about, reducing the risk associated with some adverse event out there.

106
00:09:41,260 --> 00:09:42,140
Acceptance.

107
00:09:42,480 --> 00:09:46,300
This is another one we struggle with as technology folks.

108
00:09:46,760 --> 00:09:49,900
There are some times the business is just going to go, yep, that's okay.

109
00:09:49,900 --> 00:09:50,780
I get it.

110
00:09:50,780 --> 00:09:51,540
I get it.

111
00:09:51,540 --> 00:09:55,740
There's a, you know, you say there's a 10% chance that this website will get hacked.

112
00:09:56,380 --> 00:09:57,860
I'm okay with it.

113
00:09:57,860 --> 00:09:59,380
It's only up for 30 days.

114
00:09:59,380 --> 00:10:00,800
I'll take that risk.

115
00:10:01,120 --> 00:10:04,280
And we all go, you know, it makes our heads explode.

116
00:10:04,280 --> 00:10:06,380
But absolutely, that's their call.

117
00:10:06,380 --> 00:10:14,940
Your job is to identify, as best as you can, quantify and report that risk.

118
00:10:14,980 --> 00:10:18,120
It's their job to say yes or no to that risk, right?

119
00:10:18,120 --> 00:10:22,520
The CEO, whoever's in charge of that business function, they get to decide that.

120
00:10:22,520 --> 00:10:28,600
And I know there's a great cartoon about their, you know, what's the magic word to get what you want?

121
00:10:28,820 --> 00:10:30,040
Risk accepted, right?

122
00:10:30,060 --> 00:10:37,440
And, you know, there are some people who will overuse it, but that's in a well-functioning organization, that's how that should work.

123
00:10:37,560 --> 00:10:38,360
Avoidance.

124
00:10:38,580 --> 00:10:45,400
We're going to go through some examples later, but the classic one is just don't be in that line of business that's going to create that risk, right?

125
00:10:45,400 --> 00:10:55,180
Don't launch that website that, you know, tweaks its nose at some hacker collective or, yeah, any of those sorts of things.

126
00:10:55,180 --> 00:10:57,100
Avoidance is pretty straightforward.

127
00:10:57,980 --> 00:11:00,960
And there are times when we're going to want to advise that.

128
00:11:00,960 --> 00:11:05,140
But again, business may just say, yeah, I understand.

129
00:11:05,260 --> 00:11:09,820
Avoidance is probably better, but we're not going to do it because it's too much of a gain for us in business.

130
00:11:09,820 --> 00:11:12,340
And I've seen a million cases where they were right.

131
00:11:12,460 --> 00:11:14,380
I counseled, don't do it.

132
00:11:14,380 --> 00:11:17,420
And they said, well, we're going to make $300 million off of that.

133
00:11:17,420 --> 00:11:19,400
So we're going to do it anyway.

134
00:11:19,600 --> 00:11:21,800
And, you know, they were right.

135
00:11:23,080 --> 00:11:25,140
Transfer, risk transfer.

136
00:11:25,140 --> 00:11:28,260
This is the classic cyber insurance, right?

137
00:11:28,260 --> 00:11:36,520
And that's, you know, I think there's a lot of uncertainty around cyber insurance at this point, but this is the classic way of dealing with risk.

138
00:11:36,520 --> 00:11:39,600
And I think this will get better over time.

139
00:11:39,960 --> 00:11:42,900
The last one is probably the most common in this area.

140
00:11:42,900 --> 00:11:43,600
And that's hope.

141
00:11:43,600 --> 00:11:45,560
You just hope you don't get hacked.

142
00:11:45,620 --> 00:11:48,160
And you see it over and over and over again.

143
00:11:48,160 --> 00:11:56,400
Every day you see, you know, tons of people putting stuff on the internet and, you know, just hoping that bad things don't happen.

144
00:11:57,940 --> 00:11:58,600
All right.

145
00:11:58,720 --> 00:12:02,580
So I have a cat and she shares this office with me.

146
00:12:02,580 --> 00:12:04,160
So there's nothing I can do.

147
00:12:04,280 --> 00:12:04,920
Yeah.

148
00:12:04,920 --> 00:12:07,000
There's no risk avoidance on that.

149
00:12:07,240 --> 00:12:09,320
This was her office for the last five years.

150
00:12:09,320 --> 00:12:11,500
And I've only been working here for the last couple of months.

151
00:12:11,500 --> 00:12:14,240
So she'll pop in and out of frame on the background.

152
00:12:15,960 --> 00:12:16,460
Yeah.

153
00:12:16,460 --> 00:12:17,820
Her name is Schrodinger.

154
00:12:18,240 --> 00:12:19,080
All right.

155
00:12:19,080 --> 00:12:22,180
So risk, appetite, and tolerance.

156
00:12:22,180 --> 00:12:27,840
These are some other terms that you're going to need to know to speak the language of risk.

157
00:12:27,840 --> 00:12:32,540
Risk appetite is the amount or the type of risk that your organization is willing to take.

158
00:12:33,360 --> 00:12:34,400
Thank you.

159
00:12:35,720 --> 00:12:39,740
Every organization is going to have a different risk tolerance level.

160
00:12:40,400 --> 00:12:44,800
It's very much organization specific, right?

161
00:12:44,800 --> 00:12:47,460
Financial services tend to be more risk averse.

162
00:12:47,780 --> 00:12:53,660
Startups or tech companies tend to be more risk favorable where they'll just take chances.

163
00:12:53,940 --> 00:12:55,240
Particularly if you're a startup, right?

164
00:12:55,240 --> 00:12:56,380
I mean, what have you got to lose?

165
00:12:56,380 --> 00:13:00,960
A lot less than a hundred and something year old global investment bank, right?

166
00:13:00,960 --> 00:13:04,420
I mean, it's just those are the sorts of decisions that they're going to make.

167
00:13:04,420 --> 00:13:08,360
Your job is to understand what the risk appetite of folks is.

168
00:13:08,360 --> 00:13:13,500
And the description below is great because this is the tricky part.

169
00:13:13,500 --> 00:13:15,760
If you could just say, what's your risk appetite?

170
00:13:15,760 --> 00:13:18,540
And people could say seven and you'd be seven.

171
00:13:18,680 --> 00:13:21,860
There is no numeric value like that.

172
00:13:22,760 --> 00:13:34,800
Everybody's going to have a different definition and you're going to have to speak to a lot of people and you're going to have to deal in fuzzy terms to get a sense for how people want to deal with this, right?

173
00:13:34,800 --> 00:13:44,440
Whether or not they want to be able to say, you know, it's a dollar value or none, right?

174
00:13:44,440 --> 00:13:48,180
Like, you know, CEO is going to be like, no, what do you mean getting hacked?

175
00:13:48,180 --> 00:13:50,800
You're saying you want to know how often I want to get hacked?

176
00:13:50,800 --> 00:13:52,060
The answer is never, right?

177
00:13:52,060 --> 00:13:53,780
I mean, like, you know, I can get hacked for free.

178
00:13:53,780 --> 00:13:56,600
What am I paying you for if we're going to get hacked, right?

179
00:13:57,640 --> 00:14:02,840
CFO is probably going to set aside some money for this and say, put aside $8 million a year.

180
00:14:02,840 --> 00:14:06,480
So if you can exceed that, let me know and we'll budget some more for next year.

181
00:14:06,980 --> 00:14:09,060
You know, and everybody else is going to have a different view of it.

182
00:14:09,060 --> 00:14:15,600
Your job is going to be to consolidate all of that and come up with a security controls that are appropriate to those risks.

183
00:14:16,940 --> 00:14:17,520
Yeah.

184
00:14:17,520 --> 00:14:18,220
Thank you.

185
00:14:18,220 --> 00:14:19,080
Thank you.

186
00:14:20,040 --> 00:14:20,740
All right.

187
00:14:21,600 --> 00:14:23,140
Risk impact levels.

188
00:14:23,140 --> 00:14:33,080
This is an interesting diagram and I think it's a great way, after you've had all those conversations, to communicate this back to the folks, right?

189
00:14:33,080 --> 00:14:48,380
To communicate this back to senior leadership and say, based on what I heard from all of you, and this is just an example from the site that's listed below, these are the sort of numbers or metrics I've come up with to calculate our risk levels, right?

190
00:14:48,380 --> 00:14:51,520
Whether something's a low impact, medium impact, or high impact.

191
00:14:51,520 --> 00:14:56,200
And get everybody to just sort of nod yes, so that there's at least a common understanding of the term, right?

192
00:14:56,200 --> 00:15:11,160
It's a lexicon that will help you build common understanding and get people, you know, when a bad event occurs, everybody sort of freaks out initially, but then you sort of can go back to this and say, listen, this is what we agreed to.

193
00:15:11,160 --> 00:15:18,180
This is in line with what we've communicated to the board, to the CEO, and it gets everybody back to at least level set.

194
00:15:20,980 --> 00:15:25,140
All right, managing cybersecurity risk and preparation.

195
00:15:25,200 --> 00:15:33,600
So this is just a framework that I like to use for how you would do all of these things, right?

196
00:15:33,600 --> 00:15:39,640
You've got to build a team, diversity on that team, so important from all aspects of it, right?

197
00:15:39,640 --> 00:15:43,660
The type of people, the type of education, the type of functions that they've served.

198
00:15:44,140 --> 00:15:49,760
The more viewpoints that you have on your team, the better you're going to be.

199
00:15:49,760 --> 00:15:56,440
And this is another thing that I see a lot of technical folks, and I've been guilty of it in my past.

200
00:15:56,520 --> 00:15:59,700
We hire people that look a lot like ourselves, right?

201
00:15:59,700 --> 00:16:02,660
And I don't mean that necessarily physically, but like I'm an infrastructure guy.

202
00:16:02,660 --> 00:16:03,980
That's where I come from.

203
00:16:03,980 --> 00:16:06,680
I love routers and switches and networks.

204
00:16:06,680 --> 00:16:13,860
And, you know, early on in my career, I thought those were the people that knew the most because they understood the things that I understood.

205
00:16:13,860 --> 00:16:19,920
And as I've grown, I think I tend to gravitate more towards people who know things that I don't.

206
00:16:19,920 --> 00:16:23,560
And I just ask them questions all day every time I meet with them.

207
00:16:23,560 --> 00:16:26,200
And I think that's made me a better leader.

208
00:16:26,200 --> 00:16:34,420
And I think that's probably the most important part of building a team when it comes to risks, because you've got to understand it from every angle if you're going to manage it effectively.

209
00:16:35,140 --> 00:16:39,420
Structure, you've got to assign formal responsibility for these things.

210
00:16:39,420 --> 00:16:42,260
I know a lot of people say risk is everybody's responsibility.

211
00:16:42,400 --> 00:16:46,280
Yeah, but if you say it's everybody's job, then it's nobody's job.

212
00:16:46,280 --> 00:16:47,680
It's got to be somebody's job.

213
00:16:47,680 --> 00:16:49,520
It's got to be somebody's responsibility.

214
00:16:49,520 --> 00:16:56,080
And you've got to give them the freedom and the ability to actually manage around that risk.

215
00:16:58,940 --> 00:16:59,960
Managing the risk.

216
00:16:59,960 --> 00:17:01,980
We talked about a bunch of these things already.

217
00:17:02,060 --> 00:17:04,320
Understanding your company's cyber risk profile.

218
00:17:04,320 --> 00:17:06,220
How likely are you to get attacked?

219
00:17:06,220 --> 00:17:07,060
How often?

220
00:17:07,060 --> 00:17:08,880
Who's going to come after you?

221
00:17:08,900 --> 00:17:12,580
What is your risk appetite?

222
00:17:12,580 --> 00:17:14,740
What is the impact of you getting hacked?

223
00:17:14,740 --> 00:17:18,600
Is it the type of business where Congress is coming after you?

224
00:17:19,000 --> 00:17:23,020
All of those things have to factor into your management of risk.

225
00:17:23,780 --> 00:17:30,880
Get as many viewpoints from the outside, law enforcement, your peers, industry groups as you possibly can.

226
00:17:30,960 --> 00:17:41,500
And then constantly updating your profile, your processes so that you're integrating the latest and greatest techniques for managing this stuff.

227
00:17:41,500 --> 00:17:47,920
The last part of this, probably the most important, what do you do when you're wrong?

228
00:17:47,920 --> 00:17:54,440
When you've calculated all of these things and the worst still happens, have a crisis response plan.

229
00:17:54,440 --> 00:18:01,740
I think during this year, it's like if anybody is arguing this point, you got to go, what are you thinking, right?

230
00:18:01,740 --> 00:18:04,700
I mean, we've had all of this craziness this year.

231
00:18:04,700 --> 00:18:11,400
I live in New York City and it's just, you know, I can't, you know, we were waiting for locusts, right?

232
00:18:11,400 --> 00:18:14,680
I mean, it just, you know, everything went wrong.

233
00:18:14,680 --> 00:18:23,620
And if you can't sell this now, you should probably think about moving jobs, right?

234
00:18:23,620 --> 00:18:28,660
This is as important as anything could be at this point, right?

235
00:18:28,660 --> 00:18:30,660
What do you do when you're wrong?

236
00:18:31,640 --> 00:18:32,640
All right.

237
00:18:33,400 --> 00:18:36,360
So I'm going to jump into a little bit of psychology.

238
00:18:36,360 --> 00:18:46,220
And I think this is one of the areas, again, that I think technology people, and I hate making generalizations, but I feel like I'm talking about myself here.

239
00:18:46,220 --> 00:18:49,840
So I've lived with this my whole life.

240
00:18:49,840 --> 00:18:55,740
We're not great sometimes at empathy and we're not great at understanding people's motivations.

241
00:18:55,740 --> 00:18:57,360
We know what they did.

242
00:18:57,380 --> 00:19:01,800
And maybe technically we know why they did it, but we don't know emotionally why they did it.

243
00:19:01,800 --> 00:19:09,500
And I've spent the last probably 15 years really focusing myself on trying to develop that part of my personality.

244
00:19:09,500 --> 00:19:15,720
So I could understand why people make the decisions that they do instead of just going, what the hell is wrong with you?

245
00:19:15,720 --> 00:19:17,020
What were you thinking?

246
00:19:17,020 --> 00:19:19,860
I'm actually trying to ask, hmm, that's interesting.

247
00:19:19,860 --> 00:19:22,140
What were you thinking instead of what the hell is wrong with you?

248
00:19:22,140 --> 00:19:23,000
What are you thinking?

249
00:19:23,000 --> 00:19:30,140
So this chart, I think it came from a Bill Gates presentation a while ago.

250
00:19:30,200 --> 00:19:31,240
I love it.

251
00:19:31,840 --> 00:19:37,060
If you ask people what they're worried about, what scares you?

252
00:19:37,060 --> 00:19:46,580
They'll be like terrorists, murderers, all these things that just are very, very, very... sharks.

253
00:19:46,580 --> 00:19:48,200
People are worried about sharks.

254
00:19:48,200 --> 00:19:48,840
You kidding me?

255
00:19:48,840 --> 00:19:49,760
Sharks?

256
00:19:49,960 --> 00:20:04,160
The chances of getting hit by, by getting killed by a shark, like, or you stand a better chance of buying two winning lottery tickets while getting hit by a meteor than you do of getting attacked by a shark.

257
00:20:04,600 --> 00:20:09,200
If you look at this chart, you can see some of the reasons for it, right?

258
00:20:09,200 --> 00:20:14,400
You know, the media tells you, you know, media doesn't report about people having heart attacks.

259
00:20:14,400 --> 00:20:15,900
They report about terrorism.

260
00:20:15,900 --> 00:20:17,800
Terrorism sells newspapers, right?

261
00:20:17,800 --> 00:20:21,620
I mean, like, it's such a rare event.

262
00:20:21,620 --> 00:20:24,100
Those aren't the things you should be worrying about.

263
00:20:24,100 --> 00:20:27,560
And, and in the information security space, there's lots of this, right?

264
00:20:27,560 --> 00:20:30,460
People talk about Stuxnet a lot.

265
00:20:30,700 --> 00:20:36,700
There's one Stuxnet, you know, and there's, there are APTs out there, and some of us have to deal with that.

266
00:20:37,160 --> 00:20:38,880
It's really rare.

267
00:20:38,880 --> 00:20:39,840
It's really rare.

268
00:20:39,840 --> 00:20:45,080
Chances are you're going to get owned by a mediocre ransomware crew.

269
00:20:45,440 --> 00:20:47,560
I mean, that's just, you know, probability.

270
00:20:48,020 --> 00:20:49,560
Overwhelmingly, that's who's going to own you.

271
00:20:49,560 --> 00:20:52,380
And we certainly had a lot of evidence of that this year.

272
00:20:52,400 --> 00:20:59,200
And, and I think there's a couple of biases at play here that I'm going to talk through in a little bit more detail.

273
00:20:59,440 --> 00:21:04,140
Public service announcement on this stuff, though, it freaks people out.

274
00:21:04,240 --> 00:21:10,800
When you reveal to them their cognitive biases, it pisses them the ass off.

275
00:21:10,800 --> 00:21:15,720
Like people will get really, really mad at you when you highlight this stuff to them.

276
00:21:16,100 --> 00:21:18,400
They killed Socrates for it, basically.

277
00:21:18,400 --> 00:21:21,840
So, you know, this is not new, but it's absolutely true.

278
00:21:21,840 --> 00:21:25,380
People do not like to deal with the fact that they have cognitive biases.

279
00:21:25,380 --> 00:21:31,880
So public service announcement, use this internally in your inside voice, don't necessarily communicate it to the folks in the room.

280
00:21:31,880 --> 00:21:34,560
I love this graphic up in the corner here, though.

281
00:21:34,560 --> 00:21:40,540
I mean, people have been talking about like, how social media is being used to change our politics.

282
00:21:40,580 --> 00:21:45,700
And this, you know, most of you are probably too young to even know what a TV guide is.

283
00:21:45,700 --> 00:21:50,400
But this TV guide from the 1980s basically had the same message about television, right?

284
00:21:50,400 --> 00:21:51,700
I mean, it's not new.

285
00:21:51,700 --> 00:21:55,360
This, you know, the foreign state actors are controlling the elections.

286
00:21:56,260 --> 00:21:58,680
They've been doing, you know, it's old hat.

287
00:21:58,680 --> 00:22:00,420
We've seen this a million times.

288
00:22:01,880 --> 00:22:02,860
All right.

289
00:22:03,040 --> 00:22:07,180
So if I can get my presentation to work again.

290
00:22:07,180 --> 00:22:08,240
All right, here we go.

291
00:22:09,600 --> 00:22:12,260
Why are people so bad at estimating risk?

292
00:22:12,260 --> 00:22:13,520
The optimism bias.

293
00:22:13,520 --> 00:22:16,660
This is the first one of the biases that I'm going to talk to you about.

294
00:22:18,580 --> 00:22:19,800
It's really funny.

295
00:22:19,800 --> 00:22:21,320
It's not really funny, I guess.

296
00:22:21,320 --> 00:22:24,800
But when you ask people, what are your chances of getting cancer?

297
00:22:25,460 --> 00:22:26,640
They'll give you a number, right?

298
00:22:26,680 --> 00:22:28,620
Estimate your percentage chances of it.

299
00:22:28,620 --> 00:22:30,120
And they'll say something like 10%.

300
00:22:30,120 --> 00:22:31,320
Or 60%.

301
00:22:31,320 --> 00:22:33,580
Because they, you know, most people have no idea.

302
00:22:34,920 --> 00:22:38,100
If they say 10%, the answer is 30%, right?

303
00:22:38,100 --> 00:22:46,480
It's like, it's, you know, we have so much data on this, we know how many people get cancer, we know what percentage, it's, you know, it's pretty, pretty solid, right?

304
00:22:46,600 --> 00:22:47,860
It's 30%, right?

305
00:22:47,860 --> 00:22:49,600
30% of people get cancer.

306
00:22:49,800 --> 00:22:58,600
And, but if people underestimate and say 10%, and then you give them the answer and say it's 30%, they'll go, nah, for me, it's 10%.

307
00:22:58,600 --> 00:22:59,500
You go, why?

308
00:22:59,580 --> 00:23:01,120
I just feel that way.

309
00:23:01,200 --> 00:23:07,200
But if they say it's 60%, and then they learn it's 30%, they'll be like, oh, no, yeah, no, I'm better than that.

310
00:23:07,200 --> 00:23:07,840
I'm like 20.

311
00:23:07,840 --> 00:23:13,100
They'll adjust dramatically, if they overestimate, but not if they underestimate.

312
00:23:13,120 --> 00:23:21,560
And I think this bias carries through in all aspects of our life, where nobody thinks that they are below average at anything.

313
00:23:22,100 --> 00:23:26,120
And this is, this is like a psychological fact you can prove over and over again.

314
00:23:26,120 --> 00:23:29,680
90% of drivers think they're above average drivers , right?

315
00:23:29,680 --> 00:23:37,060
Which is, you know, demonstrably false, of course, but there's very few people who admit they are a below average driver.

316
00:23:37,060 --> 00:23:45,520
And anybody who spent any kind of time on New York City's will know that that is definitely not true, particularly among the taxi set.

317
00:23:45,860 --> 00:23:49,940
So how does this translate to information security?

318
00:23:50,220 --> 00:24:00,220
I've linked to a report that I did some work on, and I was part of the advisory team for this ESI Thought Lab piece, which was published about a month ago.

319
00:24:00,220 --> 00:24:01,580
It's a great report.

320
00:24:01,580 --> 00:24:03,900
I'm not just shilling it because I was involved with it.

321
00:24:03,900 --> 00:24:08,320
I actually think it's great, but you can read it and make your own determination.

322
00:24:08,320 --> 00:24:15,800
There's some great data in there about what the chances are of having a breach.

323
00:24:15,800 --> 00:24:26,040
And they did a lot of great work around looking at the, you know, the entire universe of companies and what percentage of them actually suffered breaches during the previous year.

324
00:24:26,040 --> 00:24:34,760
And if you go with the moderate or material level, people estimated 45% said, you know, that was our chance.

325
00:24:34,760 --> 00:24:35,980
And it's way higher.

326
00:24:35,980 --> 00:24:40,180
It's almost double that for a lot of industries, their chance of actually getting breached.

327
00:24:40,260 --> 00:24:43,480
So people do not believe they're going to get hacked.

328
00:24:43,480 --> 00:24:49,680
Even after they've been hacked, they will still believe their chances of getting hacked again are way lower than they actually are.

329
00:24:49,680 --> 00:24:53,020
And it's just a cognitive bias that you have to get people passed.

330
00:24:57,060 --> 00:24:58,800
Why are people so bad at estimating risk?

331
00:24:59,140 --> 00:24:59,980
Availability bias.

332
00:24:59,980 --> 00:25:01,000
This is the second one.

333
00:25:01,000 --> 00:25:04,000
And this is, you know, got a couple of my favorite examples in it.

334
00:25:05,420 --> 00:25:08,780
Australia's national terrorism threat level is probable.

335
00:25:09,020 --> 00:25:19,340
And if you look at the data, I think, like, two people had been killed in terrorist incidents in a 20-year period in Australia.

336
00:25:19,640 --> 00:25:22,420
It's like, I don't think you know what the word probable means.

337
00:25:22,420 --> 00:25:27,840
I mean, like, it's a terrible, these are terrible things, they're terrible tragedies, every one of them horrible and shouldn't happen.

338
00:25:27,840 --> 00:25:47,080
But that's not what the word probable means, and I think we struggle with these things that are emotional and impactful like that, and estimating them in sort of cold calculated terms so that we can get an accurate perception of risk.

339
00:25:47,180 --> 00:25:51,940
And nobody wants to say, that's ridiculous, a terrorist attack is not probable, right?

340
00:25:51,940 --> 00:25:58,940
It's just, you know, it's just, it's emotionally, it just doesn't make us feel good to say things like that.

341
00:25:58,940 --> 00:26:00,740
And there's a bunch of other examples here, right?

342
00:26:00,740 --> 00:26:10,140
Like the shark attack one is just my favorite, like 186 in 20 years, among 6 billion people.

343
00:26:10,140 --> 00:26:17,160
I mean, that's like, that's less, I don't even know how to describe that as it's so infinitesimally small, right?

344
00:26:18,340 --> 00:26:23,140
Yeah, I guess I could do the math and actually come up with a number, but it's really, really small.

345
00:26:23,180 --> 00:26:30,700
And, you know, if you look at like, there was this huge warnings about Zika, and I mean, it's just, it was very, very small.

346
00:26:31,220 --> 00:26:34,600
And I think we have to take those things into perspective.

347
00:26:34,600 --> 00:26:39,000
And this is what keeps us from getting into the FUD area when it comes to information security.

348
00:26:39,080 --> 00:26:49,460
Look at the numbers, look at the data and figure out what the real risks are and what really is probable and what really is likely and what really isn't.

349
00:26:49,640 --> 00:26:55,660
And yeah, the good news is we generally don't have to deal with, you know, people dying and all of that kind of thing.

350
00:26:55,660 --> 00:26:59,000
It's just like a computer getting hacked and some guy losing money or something.

351
00:26:59,000 --> 00:27:02,420
So it's not, it's not as serious and it's not as emotional, but it still is.

352
00:27:02,420 --> 00:27:08,500
I mean, people, people will generally, you know, you get hacked in a material way, people are losing their jobs, right?

353
00:27:08,500 --> 00:27:10,680
I mean, it's just, that's sort of the way that that works.

354
00:27:10,680 --> 00:27:13,760
And people will get emotional and defensive about it.

355
00:27:13,760 --> 00:27:20,140
Like I said, when you expose a cognitive bias, it's like, ah, makes their head explode and they freak out on you.

356
00:27:21,120 --> 00:27:23,160
All right, learn helplessness.

357
00:27:23,160 --> 00:27:24,280
This is the other one.

358
00:27:24,280 --> 00:27:27,280
Oh my god, I see this one so often.

359
00:27:27,560 --> 00:27:29,160
They're like, why are we patching?

360
00:27:29,160 --> 00:27:30,900
Everybody gets hacked anyway.

361
00:27:31,060 --> 00:27:32,140
What's the deal?

362
00:27:32,140 --> 00:27:32,820
Who cares?

363
00:27:32,820 --> 00:27:34,780
You know, like everybody gets hacked anyway.

364
00:27:34,780 --> 00:27:36,460
It's not like I can stop these hackers.

365
00:27:36,460 --> 00:27:42,100
I mean, like there's a big group of people who think the hackers are all powerful and they can't be stopped anyway.

366
00:27:42,100 --> 00:27:43,340
So why are we bothering?

367
00:27:43,460 --> 00:27:53,560
I mean, at least three times, every, every time I teach information security awareness, at least one person comes up to me and say, why are we bothering?

368
00:27:53,560 --> 00:27:55,380
Everybody's getting hacked anyway.

369
00:27:55,380 --> 00:27:58,500
Like I click, you know, you can't stop people from clicking.

370
00:27:58,500 --> 00:28:00,380
Why are you bothering teaching this?

371
00:28:00,380 --> 00:28:04,200
And it's just the wrong way to look at this, right?

372
00:28:04,380 --> 00:28:06,080
Nothing is ever perfect.

373
00:28:06,080 --> 00:28:07,680
Nothing in life is perfect.

374
00:28:08,220 --> 00:28:10,140
But you can make it better.

375
00:28:10,140 --> 00:28:17,760
And that's the message that you have to communicate to folks, that it's never going to be perfect, but we can get better every day.

376
00:28:21,100 --> 00:28:22,060
Yeah.

377
00:28:23,920 --> 00:28:27,480
I'm not sure whose quote that was at the end of this, but it's great.

378
00:28:27,480 --> 00:28:29,620
You can't spend your way out of cyber problems.

379
00:28:29,620 --> 00:28:31,880
It's like exercise and eating right.

380
00:28:32,000 --> 00:28:34,160
You just have to wake up every morning and do it.

381
00:28:34,160 --> 00:28:36,240
And that is absolutely the truth.

382
00:28:36,240 --> 00:28:41,800
You can't buy enough things to fix cybersecurity.

383
00:28:41,800 --> 00:28:46,660
You actually have to do the work and that's hard for people to accept.

384
00:28:47,000 --> 00:28:55,060
And I think, um, yeah, it takes a while to get people over that, but, you know, there's no, I'm going to patch and be done.

385
00:28:55,060 --> 00:28:57,340
It's you're going to patch today and you're going to patch tomorrow.

386
00:28:57,760 --> 00:29:02,920
And, you know, they're going to feel like Sisyphus pushing that rock up the hill and waiting for it to roll back on.

387
00:29:02,920 --> 00:29:05,000
But that's, that's sort of the game.

388
00:29:05,000 --> 00:29:10,600
Every patch Tuesday is the Microsoft Sisyphean rock coming to roll, roll over you down the hill.

389
00:29:13,390 --> 00:29:14,390
This is so weird.

390
00:29:14,390 --> 00:29:19,010
I feel like I should stop and ask for questions, but there's nobody to ask questions of.

391
00:29:19,010 --> 00:29:19,310
All right.

392
00:29:19,310 --> 00:29:20,650
So we're going to keep going.

393
00:29:21,330 --> 00:29:28,450
Um, anybody who hasn't read Cliff Stoll's book, The Cuckoo's Egg, please stop listening to me right now.

394
00:29:28,450 --> 00:29:30,410
Go buy the book and read it right now.

395
00:29:30,410 --> 00:29:38,470
This is absolutely required reading for anybody who wants to develop a career in information security, particularly if you want to be a leader.

396
00:29:38,470 --> 00:29:50,950
It's unbelievably still prescient about, you know, this happens in the eighties and people are using analog modems and dial-up terminals and TTY green screens, the kind of stuff that I grew up on.

397
00:29:50,990 --> 00:29:57,070
Um, but it's still really, really applies to today.

398
00:29:57,070 --> 00:29:59,370
All of the same principles apply.

399
00:29:59,370 --> 00:30:03,290
And he has a great quote from, from a Sam's conference not too long ago.

400
00:30:03,290 --> 00:30:13,990
Um, this was in 2017 where he's talking about, you know, how he found these guys in his system and he was trying to convince people they needed to do something about this.

401
00:30:14,310 --> 00:30:21,670
And he said, well, I thought all I had to do was show them the data and they'd understand, but it turns out I had to, I had to tell a story.

402
00:30:21,910 --> 00:30:25,010
And that's what people will respond to is a story.

403
00:30:25,050 --> 00:30:26,910
And, and absolutely.

404
00:30:27,250 --> 00:30:28,670
Um, he learns that lesson.

405
00:30:28,670 --> 00:30:31,430
And I think as we read the book, um, we do too.

406
00:30:31,430 --> 00:30:32,430
It's a great read.

407
00:30:33,910 --> 00:30:35,630
Cannot recommend it highly enough.

408
00:30:35,790 --> 00:30:36,470
Absolutely.

409
00:30:36,590 --> 00:30:39,990
Uh, you, you should, you should go and buy and read that book.

410
00:30:43,510 --> 00:30:43,930
All right.

411
00:30:43,950 --> 00:30:49,610
Here's some thoughts I had about selling I, uh, security to IT.

412
00:30:52,020 --> 00:30:55,240
We think, well, we're all technology folks.

413
00:30:55,640 --> 00:31:04,560
We've got a similar mindset, so this should be easy and it's not, it's not impossible, but it has its challenges, very different mindsets.

414
00:31:04,560 --> 00:31:09,920
IT people, they care about uptime costs and user experience.

415
00:31:10,320 --> 00:31:14,300
Um, they, they, that is what they get comped on, right?

416
00:31:14,300 --> 00:31:15,660
That's what they get paid on.

417
00:31:15,660 --> 00:31:17,220
What was the uptime?

418
00:31:17,220 --> 00:31:18,940
Did they deliver the features?

419
00:31:18,980 --> 00:31:20,520
Are the users happy?

420
00:31:20,760 --> 00:31:26,260
I don't want to say they don't care about security, but it's, it's not one of their goals, right?

421
00:31:26,260 --> 00:31:29,120
I mean, like they'll tell you it's one of their goals, but it's really not.

422
00:31:29,120 --> 00:31:37,500
It's, you know, it's one of the things that's adjacent to their goals and we have to convince them that security will help those three.

423
00:31:37,500 --> 00:31:40,020
And there's a few strategies to do that.

424
00:31:40,820 --> 00:31:44,960
Um, you got to get them over the hurdles of some of these things here.

425
00:31:46,240 --> 00:31:47,460
I got a firewall.

426
00:31:47,460 --> 00:31:48,640
I bought a firewall.

427
00:31:48,640 --> 00:31:49,480
I plugged it in.

428
00:31:49,480 --> 00:31:52,440
I'm secure, but there's an any, any rule at the front of it.

429
00:31:52,780 --> 00:31:55,400
Why would they sell me a firewall that isn't secure?

430
00:31:55,400 --> 00:31:57,060
Why would Cisco do that to me?

431
00:31:57,060 --> 00:32:01,100
It's like, you know, that's, that's not how firewalls work.

432
00:32:01,100 --> 00:32:06,620
That's not how life works, but, um, yeah, you have to do the work to get them through that.

433
00:32:06,660 --> 00:32:11,740
Um, they'll tell you about their audit and regulatory reports, all of these sorts of things.

434
00:32:12,020 --> 00:32:22,520
Um, and, and your strategy for selling them is going to be to show them it's going to be a story, but it's going to be a story with data, right?

435
00:32:22,520 --> 00:32:27,620
I think pen tests are a great way to do this, where you show this guy walking through their environment, right?

436
00:32:27,620 --> 00:32:30,000
And you've got to make them as close to real life as possible.

437
00:32:30,000 --> 00:32:39,140
I think there's a big part of this where you're going to need to convince them that that data is not manufactured and all of those sorts of things.

438
00:32:39,140 --> 00:32:40,720
And you're going to have to help partner with them, right?

439
00:32:40,720 --> 00:32:42,860
You, you can't throw them under the bus.

440
00:32:42,860 --> 00:32:44,520
You can't sell them out to audit.

441
00:32:44,680 --> 00:32:49,800
Sometimes you have to, but you generally, those, you want those to be your last resorts.

442
00:32:49,800 --> 00:33:03,180
You want to help them and enable them to make themselves more secure without affecting their uptime too much, without affecting their ability to deliver features and without driving their costs through the roof.

443
00:33:03,180 --> 00:33:08,320
I think this is one of the things we're really bad at security is we push that cost.

444
00:33:08,680 --> 00:33:14,640
Hey, we were cost neutral this year, but we, you know, caused IT to double their, their budgets.

445
00:33:17,880 --> 00:33:21,740
The strategies, like I said, fear, uncertainty, and doubt, awful.

446
00:33:21,740 --> 00:33:22,900
Don't do it.

447
00:33:22,900 --> 00:33:24,820
Wrap them out to management.

448
00:33:26,140 --> 00:33:26,940
Yeah.

449
00:33:26,940 --> 00:33:31,500
The availability bias, just put it in their face every day.

450
00:33:31,500 --> 00:33:33,880
That kind of works, believe it or not.

451
00:33:34,820 --> 00:33:36,600
Demonstrate their fallibility.

452
00:33:36,600 --> 00:33:40,400
This is one of those things that will help with the optimism bias.

453
00:33:40,400 --> 00:33:50,340
If you demonstrate clearly that they are capable of making mistakes, they'll be angry at first, but generally if they're professionals, they'll get over it and want to be better.

454
00:33:50,560 --> 00:33:51,520
Metrics.

455
00:33:52,600 --> 00:33:54,180
This is hard to argue with.

456
00:33:54,180 --> 00:33:56,320
Patching metrics, fantastic.

457
00:33:56,580 --> 00:33:59,900
Just cold, hard facts about patching metrics.

458
00:33:59,920 --> 00:34:06,800
And then a story to go with it that says, here's, you know, MS-867, here's MS-1710.

459
00:34:06,840 --> 00:34:10,660
And if you have this open, this is the horrible things that happen to you.

460
00:34:10,660 --> 00:34:16,340
And this is how many systems we have open and show the trend so that people get a story out of it.

461
00:34:16,960 --> 00:34:18,160
Pay for it.

462
00:34:18,160 --> 00:34:19,580
Put it in your budget.

463
00:34:20,140 --> 00:34:22,100
The more tools that you can get in your budget.

464
00:34:22,100 --> 00:34:27,280
And listen, right now we've got insecurity, a huge advantage, right?

465
00:34:27,280 --> 00:34:31,060
I think everybody, cyber is the cool thing at the board table.

466
00:34:31,060 --> 00:34:33,380
If you ask for money, it's very hard for them to say no.

467
00:34:33,380 --> 00:34:36,340
If IT asks for money, it's really easy for them to say no.

468
00:34:36,680 --> 00:34:41,800
So I think it's, that's one of the ways that you'll win people over.

469
00:34:42,760 --> 00:34:46,100
And of course you're going to have to have air cover from the board and senior management.

470
00:34:48,080 --> 00:34:49,100
All right.

471
00:34:50,540 --> 00:34:52,380
Selling security to the board.

472
00:34:52,600 --> 00:34:54,060
This is a challenge, right?

473
00:34:54,060 --> 00:34:56,800
I think it's not as much of a challenge now as it used to be.

474
00:34:56,800 --> 00:34:58,560
I think boards have really focused on this.

475
00:34:58,560 --> 00:35:11,160
And I think boards, they want to know, you know, they all know this is a risk and they want to know that somebody is covering them to make sure that they are doing the bare minimum, you know, not the bare minimum, but they're doing the things that they need to,

476
00:35:11,160 --> 00:35:15,040
to make the company secure from, from cyber attacks.

477
00:35:15,340 --> 00:35:18,300
Most of them don't have a technical background.

478
00:35:18,300 --> 00:35:21,840
Almost none of them have a cyber security related background.

479
00:35:22,140 --> 00:35:28,820
And you're going to need to figure out ways to communicate to them in fairly simple terms.

480
00:35:28,820 --> 00:35:30,760
This is the way that I do it.

481
00:35:30,880 --> 00:35:42,200
I've got these pretty simple four questions that I use and I find it really helps me get the message across in a succinct one slide presentation.

482
00:35:42,440 --> 00:35:47,340
And then I usually have some, some details behind it, but I don't want to inundate them with data.

483
00:35:47,340 --> 00:35:53,260
I know that some people's strategy is just throw everything in the deck and, you know, this way you're ready for any question.

484
00:35:53,260 --> 00:35:58,440
I think these four are the only four questions that a board member really cares about, but every board is going to be different.

485
00:35:58,440 --> 00:36:00,680
So are we compromised right now?

486
00:36:00,680 --> 00:36:00,900
Right.

487
00:36:00,920 --> 00:36:03,520
Everybody, this is one that scares security people.

488
00:36:03,520 --> 00:36:04,260
Like how would I know?

489
00:36:04,260 --> 00:36:10,480
Oh my God, they're going to, you know, you've got to give them a high, medium, and low, and some reasoning why you think that.

490
00:36:10,480 --> 00:36:11,440
How vulnerable?

491
00:36:11,440 --> 00:36:13,300
Again, this is even fuzzier.

492
00:36:13,740 --> 00:36:14,960
High, medium, or low?

493
00:36:14,960 --> 00:36:16,120
Why do you think that?

494
00:36:16,120 --> 00:36:17,440
Who might attack us?

495
00:36:17,440 --> 00:36:18,500
What would they use?

496
00:36:18,500 --> 00:36:20,140
And how are we defending against it?

497
00:36:20,140 --> 00:36:21,700
Just a couple of sentences.

498
00:36:23,080 --> 00:36:31,040
How are we going to address, you know, because there's so much uncertainty in this, how are we going to address that next level of threats?

499
00:36:31,040 --> 00:36:32,720
And this is early on in the presentation.

500
00:36:32,720 --> 00:36:38,920
I love those maps with the dragons at the end of the earth and falling off the end of the earth, the uncertainty bit.

501
00:36:38,920 --> 00:36:40,300
That's why they used to draw those, right?

502
00:36:40,300 --> 00:36:42,540
Because nobody knew what was on the other side of those maps.

503
00:36:42,540 --> 00:36:43,700
And that's fun, right?

504
00:36:43,700 --> 00:36:46,880
You know, the dragons at the end of the map are fun.

505
00:36:48,500 --> 00:36:49,100
Yeah.

506
00:36:49,100 --> 00:36:51,320
And then what's our plan if we do get compromised?

507
00:36:51,320 --> 00:36:53,700
Like I said, you have to have thought through this.

508
00:36:53,700 --> 00:36:55,640
You have to be able to communicate this.

509
00:36:56,880 --> 00:37:01,160
Some of the things that I've got at the back end of this deck are folks who didn't, right?

510
00:37:01,160 --> 00:37:03,560
Some examples of folks who struggled with that.

511
00:37:04,100 --> 00:37:04,760
All right.

512
00:37:04,980 --> 00:37:07,300
I'm going to move along a little bit here.

513
00:37:08,360 --> 00:37:08,900
Yep.

514
00:37:08,900 --> 00:37:12,600
Here's some other examples of things that you can communicate to the board.

515
00:37:12,600 --> 00:37:17,420
Some metrics, agree on metrics, make your metrics consistent and show a trend over time.

516
00:37:17,420 --> 00:37:18,900
That's what they're going to understand.

517
00:37:18,900 --> 00:37:23,120
They're not going to know what an attempted attack means, but they're going to want to know, am I getting more?

518
00:37:23,120 --> 00:37:23,820
Am I getting less?

519
00:37:23,820 --> 00:37:24,680
Are they getting better?

520
00:37:24,680 --> 00:37:25,460
Are they getting worse?

521
00:37:25,460 --> 00:37:30,460
Those are the sorts of things that a board and senior management is going to want to understand.

522
00:37:32,060 --> 00:37:35,020
I think this is another great way to report risk.

523
00:37:35,900 --> 00:37:42,220
How is high, medium, low risk and impact on our core risks?

524
00:37:42,220 --> 00:37:44,920
What are those core risks around cybersecurity that we face?

525
00:37:44,920 --> 00:37:46,240
What's the trend?

526
00:37:46,440 --> 00:37:50,660
What do you view the residual risk after the controls that you've put in place?

527
00:37:50,660 --> 00:38:01,580
It's the difference between inherent risk, which is the risk as it stands naturally, and residual risk, which is the risk after the controls and mitigations you put in place to deal with that risk.

528
00:38:03,040 --> 00:38:05,520
All right, so here's some case studies.

529
00:38:05,520 --> 00:38:07,500
Everybody probably remembers this.

530
00:38:07,500 --> 00:38:08,000
H.P.

531
00:38:08,000 --> 00:38:15,920
Gary, CEO of the company, got up there and said really bad things about Anonymous and how he was all up in their business.

532
00:38:15,920 --> 00:38:19,420
And this ended really, really badly for him.

533
00:38:19,420 --> 00:38:24,900
He taunted Anonymous and they went through him like a hot knife through butter.

534
00:38:24,900 --> 00:38:31,280
They owned him three ways from Sunday to wiping his personal iPad at the end of the attack.

535
00:38:31,280 --> 00:38:38,920
I mean, it was just completely unprepared for the onslaught that came his way.

536
00:38:40,340 --> 00:38:47,360
Yeah, there's a great video if you ever have a chance to Google it on YouTube.

537
00:38:48,960 --> 00:38:53,000
I can't remember the guy's name, but one of the late night comedians does about this hack on H.P.

538
00:38:53,000 --> 00:38:54,520
Gary, it's fantastic.

539
00:38:57,440 --> 00:39:02,920
So the other one that I'd like to talk about here in the same kind of group is Sony Pictures, right?

540
00:39:02,920 --> 00:39:13,080
And this got all wrapped into politics, but end of the day, they made a movie that was poking the eye of the dictator of North Korea, right?

541
00:39:13,840 --> 00:39:26,280
And you just go, you know, risk avoidance, somebody should have said, you know, you could just call it something else, not North Korea, and you wouldn't piss these guys off so much.

542
00:39:26,600 --> 00:39:33,520
Again, they went through these guys like a hot knife through butter, and they owned them three ways from Sunday, released movies, dumped all their emails.

543
00:39:33,520 --> 00:39:35,000
It was just horrible.

544
00:39:35,760 --> 00:39:46,080
And, you know, if you look at the common elements here, they were engaged in an activity that was not universally admired, right?

545
00:39:46,080 --> 00:39:48,480
I mean, you pissed somebody off.

546
00:39:48,620 --> 00:39:52,480
Management didn't understand how dangerous that adversary was.

547
00:39:52,480 --> 00:40:02,600
The information security controls were not up to the task of defending against somebody who, you know, is very well prepared to attack you.

548
00:40:02,600 --> 00:40:05,520
And the attackers have all the advantage in that space, right?

549
00:40:05,520 --> 00:40:14,820
So, you know, from then, and then, you know, obviously, neither of them was prepared with any kind of response once this had happened, right?

550
00:40:14,820 --> 00:40:26,520
None of them had any kind of a disaster recovery or recovery strategy at all, it seemed, to deal with these things, you know, they were both on pen and paper for months afterwards, supposedly.

551
00:40:27,200 --> 00:40:31,200
You know, and the responses were, you know, followed the standard script there at the bottom.

552
00:40:33,800 --> 00:40:40,220
Right, so here's our lessons, you know, from this is my view of it, don't pick fights with people who have nothing to lose.

553
00:40:40,280 --> 00:40:44,500
You know, you have everything, I mean, literally, they have nothing to lose, you have everything to lose.

554
00:40:44,500 --> 00:40:45,860
That's dumb, right?

555
00:40:46,160 --> 00:40:53,620
Private companies with, you know, profit loss calculations, if they go against people who don't, that's going to end badly for you, right?

556
00:40:53,620 --> 00:40:56,480
They got all the time and energy in the world.

557
00:40:56,840 --> 00:41:00,840
You know, if you give somebody that much leeway, they're going to get through.

558
00:41:01,600 --> 00:41:03,700
Know your enemy and yourself.

559
00:41:03,880 --> 00:41:07,460
No cybersecurity presentation is complete without a Sun Tzu quote.

560
00:41:08,640 --> 00:41:11,720
All right, just some questions to think about, right?

561
00:41:11,720 --> 00:41:20,160
There's a great statement in the Sony case that came out maybe a year before, it's a valid business decision to accept the risk of a security breach.

562
00:41:20,160 --> 00:41:23,880
I will not invest 10 million to avoid a possible $1 million loss.

563
00:41:23,880 --> 00:41:25,440
That's a valid statement.

564
00:41:25,520 --> 00:41:30,440
The problem is, he was totally wrong about the amount of loss, right?

565
00:41:30,440 --> 00:41:36,540
I mean, totally , way, hundreds of times off base on the order of magnitude there.

566
00:41:36,540 --> 00:41:38,480
And that was the issue.

567
00:41:41,560 --> 00:41:43,480
I want to cry and not patch it.

568
00:41:43,560 --> 00:41:45,580
And I think I'm wrapping up my time here.

569
00:41:45,580 --> 00:41:50,100
So I'm going to talk through these next few slides fairly quickly.

570
00:41:50,100 --> 00:41:51,820
And I'm happy to chat about these.

571
00:41:52,460 --> 00:41:55,380
Afterwards, I'll be on chat.

572
00:41:55,380 --> 00:42:00,540
So obviously, everybody knows what these were from 2017.

573
00:42:00,760 --> 00:42:04,920
Big Worms, MS-1710, spread through the networks.

574
00:42:05,180 --> 00:42:14,160
Want to cry was an amateur version, not patch it was like, you know, somebody who knew what they were doing said, hold my beer, watch this and just let loose on the world.

575
00:42:14,160 --> 00:42:17,720
I don't think it meant to spread as far as it did, but it sure did.

576
00:42:17,720 --> 00:42:19,360
And boy, was it a whopper.

577
00:42:20,520 --> 00:42:22,280
It taught me a few things, right?

578
00:42:22,280 --> 00:42:24,440
Patching is not optional, right?

579
00:42:24,440 --> 00:42:28,100
And I think IT will tell you, why would I patch?

580
00:42:28,100 --> 00:42:32,780
Every time I patch, I lose 2% of my systems or whatever percent of my systems.

581
00:42:33,520 --> 00:42:35,660
And here's why, right?

582
00:42:36,920 --> 00:42:39,460
You just got to patch everything.

583
00:42:39,460 --> 00:42:43,980
And it's not the same as it used to be where you had security through obscurity.

584
00:42:44,420 --> 00:42:45,780
Shodan's out there, man.

585
00:42:45,780 --> 00:42:48,700
And they can scan your whole network in seconds.

586
00:42:48,700 --> 00:42:51,580
And they will find every single one that you didn't patch.

587
00:42:51,580 --> 00:42:57,900
So patching 99% is marginally better than patching nothing, because they'll find that 1%.

588
00:42:57,900 --> 00:43:02,720
And then, if you got hit with not patching, it was it.

589
00:43:02,720 --> 00:43:04,160
They just needed to find one.

590
00:43:04,440 --> 00:43:09,700
And there's a bunch of other things here that are pretty relevant, like email, having email.

591
00:43:09,860 --> 00:43:11,980
So it's not connected to the internet, but it's got email.

592
00:43:11,980 --> 00:43:13,200
That's the same thing.

593
00:43:13,200 --> 00:43:17,780
Maybe it's low latency, a high latency network, but it's still on the internet.

594
00:43:19,160 --> 00:43:19,280
Yeah

595
00:43:23,040 --> 00:43:23,400
.

596
00:43:24,020 --> 00:43:25,420
Why is patching so hard?

597
00:43:25,420 --> 00:43:26,540
I think we covered it, right?

598
00:43:26,540 --> 00:43:28,060
Some other questions to think about.

599
00:43:28,060 --> 00:43:39,820
I think these are the sorts of things, to me, these questions, are what lets me get inside the head of the people in IT and the people in management, so that I can better understand the problems they're going with.

600
00:43:39,820 --> 00:43:42,360
And hopefully, this is a helpful exercise for you.

601
00:43:42,360 --> 00:43:45,760
And again, I'm willing to talk and chat through any of these things with anybody.

602
00:43:45,800 --> 00:43:59,040
But this is the sort of thinking that will get you to that high empathy state, so that you can relate to why they're having problems and maybe help design solutions, instead of just, you know, flinging vulnerabilities out, which is fun.

603
00:43:59,320 --> 00:44:00,360
Absolutely.

604
00:44:00,440 --> 00:44:07,420
But actually helping solve a problem will actually increase your company's risk tolerance.

605
00:44:08,300 --> 00:44:08,760
All right.

606
00:44:08,800 --> 00:44:09,640
Equifax.

607
00:44:09,640 --> 00:44:10,600
Everybody knows this one.

608
00:44:10,600 --> 00:44:13,560
I'm not going to spend a lot of time recounting what happened there.

609
00:44:13,560 --> 00:44:16,040
But let's just say Congress gets involved.

610
00:44:16,040 --> 00:44:22,340
And if you're a private company and Congress starts interviewing you on stage, that's about as bad as it gets, right?

611
00:44:22,600 --> 00:44:25,780
You're up there and they're going, they're wagging their finger at you.

612
00:44:25,780 --> 00:44:27,320
That's not a good thing.

613
00:44:28,400 --> 00:44:35,720
And sort of the same results that we were talking about before, patching 99%, only marginally better than patching one.

614
00:44:35,920 --> 00:44:42,760
You know, the CEO at one point was saying, it was this one guy in the test unit who didn't patch his server.

615
00:44:42,760 --> 00:44:44,720
And that's why all of this happened .

616
00:44:44,740 --> 00:44:48,100
And it's like, dude, you're missing the point, if you think that, right?

617
00:44:48,280 --> 00:44:51,640
You don't have a process that covers your entire organization.

618
00:44:51,640 --> 00:44:52,660
It's on you.

619
00:44:53,280 --> 00:44:53,840
Yeah.

620
00:44:53,840 --> 00:44:59,760
And I think he went to jail and a couple other people, like, because they all sold stock as soon as they heard the breach.

621
00:44:59,760 --> 00:45:01,120
That's lesson number one.

622
00:45:01,120 --> 00:45:05,240
If you're involved in a breach, stop selling or buying stock.

623
00:45:05,680 --> 00:45:06,560
Absolutely.

624
00:45:06,740 --> 00:45:07,520
Do not.

625
00:45:07,520 --> 00:45:08,340
Do not.

626
00:45:08,340 --> 00:45:08,800
Yeah.

627
00:45:08,800 --> 00:45:09,720
Planning for an incident.

628
00:45:09,720 --> 00:45:12,040
This is another one where they were totally unprepared, right?

629
00:45:12,040 --> 00:45:16,260
I mean, it was just, it was like comical to watch those couple of weeks afterwards.

630
00:45:16,260 --> 00:45:19,760
It was like, oh my God, what are they doing over there?

631
00:45:20,740 --> 00:45:23,990
Yeah.

632
00:45:24,430 --> 00:45:26,510
Some more big questions to think about.

633
00:45:26,510 --> 00:45:30,710
And the one that I like here, and I'm as guilty of it as anybody, right?

634
00:45:30,710 --> 00:45:32,290
This was victim blaming, right?

635
00:45:32,290 --> 00:45:34,690
Everybody was like, Equifax, you're horrible.

636
00:45:34,950 --> 00:45:38,470
What if somebody showed up at their offices with a gun and stole the files?

637
00:45:38,470 --> 00:45:39,670
Would we say the same thing?

638
00:45:39,670 --> 00:45:43,770
And I don't know why this is fundamentally different, but I guess it is.

639
00:45:43,770 --> 00:45:44,870
I don't know.

640
00:45:45,010 --> 00:45:55,730
But I mean, you wouldn't expect them to have armored personnel carriers outside their office and all of their staff wearing bulletproof vests so that they could fight off the guys who came in with a gun to steal the files.

641
00:45:55,730 --> 00:45:58,170
But we expect that from them in a cyber realm.

642
00:45:58,370 --> 00:46:01,990
And, but it's, you know, read the terrain.

643
00:46:01,990 --> 00:46:03,530
That's the way the world is, I guess, right now.

644
00:46:03,530 --> 00:46:07,730
But those are the sorts of things I think about when I read these things.

645
00:46:08,670 --> 00:46:08,890
All right.

646
00:46:08,890 --> 00:46:13,630
A couple of documents, and I'm going to wrap up because I'm probably going to get yelled at pretty soon.

647
00:46:14,550 --> 00:46:17,710
This is a great document on what it takes to become a leader.

648
00:46:17,710 --> 00:46:19,230
There's a link to it on the bottom.

649
00:46:19,590 --> 00:46:23,710
The Cyber Security Guide for Leaders in Today's Digital World from the World Economic Forum.

650
00:46:23,910 --> 00:46:25,330
Fantastic document.

651
00:46:25,330 --> 00:46:32,890
These 10 things, like, just absolutely nail it for what you need to do to get to a leadership role in cybersecurity.

652
00:46:34,610 --> 00:46:35,830
Best practices.

653
00:46:35,830 --> 00:46:39,150
These are the best practices from the ESI Thought Lab piece.

654
00:46:40,110 --> 00:46:42,230
Again, I think really nails it.

655
00:46:42,230 --> 00:46:47,670
A different take on it because I think it's from CISOs themselves, as opposed to folks on the outside.

656
00:46:47,670 --> 00:46:48,790
But fantastic.

657
00:46:48,790 --> 00:46:55,110
It really gives you some great examples of what you can do to improve any cybersecurity program.

658
00:46:55,950 --> 00:46:57,910
This is a method that I like.

659
00:46:57,910 --> 00:47:03,370
I've used it for a long time for how to build a cybersecurity strategy.

660
00:47:03,370 --> 00:47:04,790
Sort of what's the funnel look like?

661
00:47:04,790 --> 00:47:06,750
What goes into that process?

662
00:47:06,990 --> 00:47:13,430
What are the things that make up the levers that drive your cybersecurity strategy?

663
00:47:15,190 --> 00:47:15,870
Great.

664
00:47:15,870 --> 00:47:17,490
Putting it all together.

665
00:47:17,490 --> 00:47:19,550
These are my closing thoughts.

666
00:47:19,770 --> 00:47:24,670
Everybody talks about APTs and nation-state elite hackers.

667
00:47:25,550 --> 00:47:30,770
Yeah, they probably could get through because they have unlimited time and budget, but they probably don't care about you.

668
00:47:30,770 --> 00:47:32,910
That's not where I would spend most of my time.

669
00:47:32,910 --> 00:47:38,170
I mean, you got to do... but, you know, chances are overwhelmingly you're going to get attacked.

670
00:47:38,170 --> 00:47:42,710
You're going to get owned by some chintzy ransomware gang out of nowhere.

671
00:47:42,910 --> 00:47:50,710
If management makes bad decisions, there's not a lot you can do other than be prepared with a response plan.

672
00:47:50,810 --> 00:47:53,970
Your job is to tell them when they're making bad decisions.

673
00:47:53,970 --> 00:47:57,730
Even if they yell at you and say, why do you always shut down my plans?

674
00:47:57,730 --> 00:47:59,010
Because your plans always suck.

675
00:47:59,010 --> 00:48:01,810
No, you have to do that.

676
00:48:01,810 --> 00:48:07,570
You have to have the emotional courage to say, this plan is stupid, and I'm going to tell you this plan is stupid.

677
00:48:07,570 --> 00:48:10,730
I'm not going to stop you from doing it, but I'm going to tell you that it's stupid.

678
00:48:12,270 --> 00:48:12,970
Yeah.

679
00:48:13,130 --> 00:48:20,370
The vast majority of this stuff, almost all of it, like almost all of these things happen because we suck at inventory and patching.

680
00:48:20,370 --> 00:48:22,210
Just suck at it.

681
00:48:22,210 --> 00:48:34,250
And I think the basics, and everybody says this, and it drives me nuts when I hear it because it's like a platitude, but if we could patch our stuff and we knew where our stuff was, 99% of this stuff wouldn't happen.

682
00:48:34,250 --> 00:48:39,670
If we did that and put MFA on all of our logins, almost, it would be almost impossible.

683
00:48:39,670 --> 00:48:42,450
Like it would be really, this would be really, really hard.

684
00:48:42,770 --> 00:48:46,070
You know, I say that and then they'll figure out 10 ways around that stuff.

685
00:48:46,070 --> 00:48:51,190
But if we were just effective at this stuff, we would take off so much below hanging fruit.

686
00:48:51,730 --> 00:48:52,330
Yeah.

687
00:48:52,330 --> 00:48:55,950
And these are the five rules about how to manage cybersecurity risk.

688
00:48:55,950 --> 00:49:02,530
Assign responsibility, identify and quantify the risks, mitigation strategies, communicate.

689
00:49:02,530 --> 00:49:07,870
Like I said, tell them when they're doing something stupid and make sure you highlight the risks.

690
00:49:07,870 --> 00:49:09,070
And plan for when you fail, right?

691
00:49:09,070 --> 00:49:10,110
Because everybody's going to fail.

692
00:49:10,110 --> 00:49:10,850
You're going to be wrong.

693
00:49:10,850 --> 00:49:11,510
You're going to be wrong.

694
00:49:11,510 --> 00:49:12,150
They're going to be wrong.

695
00:49:12,230 --> 00:49:13,950
Everybody's going to be wrong sometimes.

696
00:49:13,950 --> 00:49:15,650
You got to have a plan to deal with that.

697
00:49:16,570 --> 00:49:17,670
And that's it for me.

698
00:49:17,670 --> 00:49:20,170
I'll hang around and chat and answer questions.

699
00:49:21,330 --> 00:49:23,210
Peter , thank you so much.

700
00:49:23,210 --> 00:49:24,670
That was absolutely wonderful.

701
00:49:24,690 --> 00:49:26,010
And I missed the cat.

702
00:49:26,010 --> 00:49:27,950
I wish the cat would come back more.

703
00:49:29,290 --> 00:49:30,030
Thank you.

704
00:49:30,030 --> 00:49:31,530
Thank you so much for having me.

705
00:49:31,530 --> 00:49:32,450
No problem.

706
00:49:32,450 --> 00:49:40,110
In addition to Peter being in the chat to talk about this topic, he's also going to be available for career coaching.

707
00:49:40,410 --> 00:49:48,750
So be sure to check out the schedule that's pinned in the Discord channel to sign up to be coached by Peter.

708
00:49:48,750 --> 00:49:50,050
Peter, it was great seeing you.

709
00:49:50,050 --> 00:49:53,090
I'm sorry, I have to cut off and go to the next one.

710
00:49:53,090 --> 00:49:53,970
Take care.

711
00:49:53,970 --> 00:49:54,810
Thank you very much.

712
00:49:54,810 --> 00:49:55,350
Bye-bye.