And welcome back to the Career Hacking Village. We talk a lot about doing technology,
but we never really talk about how do we present, how do we get things moving forward.
And I'm really excited, I was really excited to see the proposal submission from my friend
Peter Keenan to just really talk about hacking security leadership. So Peter, take it away.
Thanks so much Kathleen, and thanks everybody for watching.
Yeah, this is my first DEF CON presentation, so thanks for accepting it.
All right, the obligatory who am I slide. So I have been in the information technology and
information security space for about 30 years. You can see from these pictures there's at least
three decades of bad haircuts there. I'm currently the chief information security officer
for a global financial services company. You all are hackers, you can figure it out if you
really want to, but I'm not allowed to use the name, so I'm not going to. Prior to the five and
a half year stint I've had there, I was global head of information security governance at Citigroup,
yeah, I owned a bunch of things like the global information security policy.
I was a director with PricewaterhouseCoopers and their information security consulting group.
I owned a firm that did information security consulting for about a decade, primarily to
military and intelligence agencies, and spent a little time working in government service before
that. Yeah, like I said, a lot of time in the space, and I have hopefully boiled down what
I've learned in the last 30 some odd years into about 30 slides, which sounds terrible
when I say it that way, that I'm getting like one slide a year, but sadly it's true. Yeah,
two kids, 24 and 21, 31 years of marriage. All right, so I'm going to start with this CISO mind
map. I think it's a great slide. I think this chart is really informative, sort of about the
things that somebody in my position is thinking about on a daily, weekly, monthly basis. The area
of this mind map that I'm going to focus on is selling information security. I think it's the
area that people struggle with most as they transition their career from sole contributors
or engineering types or very technical sort of roles to a leadership role. And it's probably
the most important part of information security. If you boil information security down to its core
nugget, the thing that's probably describes it best is influence without authority. And the
ability to drive security through an organization without directly being able to control people's
comp or control their, you know, performance reviews and all of those sorts of things
is really the challenge that we face. I mean, some things we have direct control over, but by and
large we don't. And we need to be able to convince people that this is the right thing to do both for
their own personal gain, the company's gain, society's gain, all of those things. And that's
why I think that's probably the core function that information security, probably the most
important function within information security, because it's a force multiplier. If we can get
the folks in the company all pulling in our direction, it multiplies our effectiveness
dramatically. The thing I don't like about this part of it here, and, you know, maybe it's just
me misreading it. I think the authors, like I said, did a great job. It feels like it's a lot of top
down selling, right? And I think that that's good and it's important and it's what, you know, lets
you keep your job as a CISO, convincing the, you know, the board and the CEO that you're doing a
good job and security is important. You got to do that. But if you actually want to fix security
at an organization, you've got to sell it from the bottom up because it's the people on the ground,
the people at eye level who are actually doing the things that will make you more or less secure.
And you've got to convince them that this is the right things to do. And these are the changes
they need to make in their processes to be better. And you've got to provide them with ways of doing
it that makes them more efficient, not less efficient. And, you know, it's a hard sell in a
lot of cases with security because, you know, being frank, we're introducing overhead quite
often to do things securely, right? I mean, the act of typing a password as opposed to just being
on the system introduces overhead, but short-term overhead, long-term overhead, it obviously creates
a lot of problems not having passwords. Amazon has three buckets. Yes.
All right. So jumping ahead, the key language of business, and again, something that for me,
I think is one of the really big differentiators between a sole contributor and a leader in the
information security space is the language of risk. Business leaders understand it. They may
not understand your specific technical domain, and they may not understand what a router or a
switch is, but they understand the language of risk. And it's a language that we can meet in
the middle with them all. We can meet in the middle with lawyers, with accountants, business
people, the CEO, they will all get the idea of likelihood and impact. It's a problem for us in
technical fields. In the words that I've highlighted on this page, uncertainty and
probability, we struggle with that as a group. We do. We think about these things in absolutes
like engineers. And I know that's a rough way of saying it, but too many times, it's really
a struggle to drag an estimate out of somebody who's in a technical discipline. They want to
have the right answer. With estimates, you're basically saying, I'm giving you the wrong answer,
but I hope it's close. Somebody who's got an engineering training or a mathematical training,
that makes the hair on the back of their neck stick up. What do you mean? I don't know the
answer. There's no right answer. I'm just thumbing the area. I'm putting that in front of the CEO?
Yeah, you are. That's what risk is. You take the best educated guess you can sometimes
about the likelihood, which is a soft number, and the impact of these events occurring.
And that's the way that you have to describe them. I often hear people say this phrase,
and it drives me nuts, you can't predict the future. Absolutely, you can. I mean,
with 100% certainty, no. But why else would we eat right and exercise, right? Because we don't
think we're going to die in the next hour. We don't think we're going to die tomorrow. We don't
think the world's going to end tomorrow. We don't think they're going to have miraculous cures for
diabetes and obesity tomorrow, right? That's why we save money, because we think that we're going
to live to an age where we're going to need money, right? There's a million predictions
about the future we make every day, all of us do. And I think we just have to get comfortable
with that. You can't predict it with 100% certainty, but that's okay. You have to be
able to get comfortable with the uncertainty and probabilities and presenting your risks in that
way. And it's got to be done. If you look at the way the businesses report, these things,
they all know that they're not 100% accurate. And people yell at you when your risk is way off. But
end of the day, you were clear. It's an estimate.
All right. Two other things. One last thing on this one. This is one of my pet peeves about
information security folks. When they're talking to non-security folks, lay people,
FUD is the biggest thing that drives me nuts. And you see it, the salespeople do it, the
engineers, when they get frustrated, they do it. They just throw out these FUD bombs of like,
well, you never know. Could be the Russians, those Chinese. It's just,
stop, don't do it. It may work in the short-term to win that short-term argument,
but you will lose respect from everybody in the room. And that's one of the things that
defines you as a leader is being able to hold and command that respect over time.
All right. Risk strategies. These are some of the terms that you have to understand if you're
going to communicate in risk. Risk reduction. This one's pretty straightforward, right? I have
a thousand systems that are MS-0867 vulnerable. I patched 999 of them. Have I reduced the risk?
Yeah, probably, right? That's risk reduction. There's still a risk out there that I missed
one, or that the patch isn't fully effective, or somebody didn't reboot after the patch,
or all of those things. But that's what that's about, reducing the risk associated with some
adverse event out there. Acceptance. This is another one we struggle with
as technology folks. There are some times the business is just going to go, yep, that's okay.
I get it. I get it. There's a, you know, you say there's a 10% chance that this website will get
hacked. I'm okay with it. It's only up for 30 days. I'll take that risk. And we all go,
you know, it makes our heads explode. But absolutely, that's their call. Your job
is to identify, as best as you can, quantify and report that risk. It's their job to say yes or no
to that risk, right? The CEO, whoever's in charge of that business function, they get to decide that.
And I know there's a great cartoon about their, you know, what's the magic word to get what you
want? Risk accepted, right? And, you know, there are some people who will overuse it, but
that's in a well-functioning organization, that's how that should work.
Avoidance. We're going to go through some examples later, but the classic one is just
don't be in that line of business that's going to create that risk, right? Don't launch that
website that, you know, tweaks its nose at some hacker collective or, yeah, any of those sorts of
things. Avoidance is pretty straightforward. And there are times when we're going to want to advise
that. But again, business may just say, yeah, I understand. Avoidance is probably better,
but we're not going to do it because it's too much of a gain for us in business. And I've seen a
million cases where they were right. I counseled, don't do it. And they said, well, we're going to
make $300 million off of that. So we're going to do it anyway. And, you know, they were right.
Transfer, risk transfer. This is the classic cyber insurance, right? And that's, you know,
I think there's a lot of uncertainty around cyber insurance at this point, but this is the classic
way of dealing with risk. And I think this will get better over time. The last one is probably the
most common in this area. And that's hope. You just hope you don't get hacked. And you see it
over and over and over again. Every day you see, you know, tons of people putting stuff on the
internet and, you know, just hoping that bad things don't happen. All right. So I have a cat
and she shares this office with me. So there's nothing I can do. Yeah. There's no risk avoidance
on that. This was her office for the last five years. And I've only been working here for the
last couple of months. So she'll pop in and out of frame on the background. Yeah. Her name is
Schrodinger. All right. So risk, appetite, and tolerance. These are some other terms that you're
going to need to know to speak the language of risk. Risk appetite is the amount or the type
of risk that your organization is willing to take. Thank you. Every organization is going to have a
different risk tolerance level. It's very much organization specific, right? Financial services
tend to be more risk averse. Startups or tech companies tend to be more risk favorable where
they'll just take chances. Particularly if you're a startup, right? I mean, what have you got to lose?
A lot less than a hundred and something year old global investment bank, right? I mean, it's just
those are the sorts of decisions that they're going to make. Your job is to understand what
the risk appetite of folks is. And the description below is great because this is the tricky part.
If you could just say, what's your risk appetite? And people could say seven and you'd be seven.
There is no numeric value like that. Everybody's going to have a different definition and you're
going to have to speak to a lot of people and you're going to have to deal in fuzzy terms to
get a sense for how people want to deal with this, right? Whether or not they want to be able to say,
you know, it's a dollar value or none, right? Like, you know, CEO is going to be like, no,
what do you mean getting hacked? You're saying you want to know how often I want to get hacked?
The answer is never, right? I mean, like, you know, I can get hacked for free. What am I paying you
for if we're going to get hacked, right? CFO is probably going to set aside some money for this
and say, put aside $8 million a year. So if you can exceed that, let me know and we'll budget some
more for next year. You know, and everybody else is going to have a different view of it. Your job
is going to be to consolidate all of that and come up with a security controls that are appropriate
to those risks. Yeah. Thank you. Thank you. All right. Risk impact levels. This is an interesting
diagram and I think it's a great way, after you've had all those conversations, to communicate this
back to the folks, right? To communicate this back to senior leadership and say, based on what I heard
from all of you, and this is just an example from the site that's listed below, these are the sort
of numbers or metrics I've come up with to calculate our risk levels, right? Whether something's a low
impact, medium impact, or high impact. And get everybody to just sort of nod yes, so that there's
at least a common understanding of the term, right? It's a lexicon that will help you build
common understanding and get people, you know, when a bad event occurs, everybody sort of freaks
out initially, but then you sort of can go back to this and say, listen, this is what we agreed
to. This is in line with what we've communicated to the board, to the CEO, and it gets everybody
back to at least level set. All right, managing cybersecurity risk and preparation. So this is
just a framework that I like to use for how you would do all of these things, right? You've got
to build a team, diversity on that team, so important from all aspects of it, right? The
type of people, the type of education, the type of functions that they've served. The more viewpoints
that you have on your team, the better you're going to be. And this is another thing that I
see a lot of technical folks, and I've been guilty of it in my past. We hire people that look a lot
like ourselves, right? And I don't mean that necessarily physically, but like I'm an infrastructure
guy. That's where I come from. I love routers and switches and networks. And, you know, early on in
my career, I thought those were the people that knew the most because they understood the things
that I understood. And as I've grown, I think I tend to gravitate more towards people who know
things that I don't. And I just ask them questions all day every time I meet with them. And I think
that's made me a better leader. And I think that's probably the most important part of building a
team when it comes to risks, because you've got to understand it from every angle if you're going
to manage it effectively. Structure, you've got to assign formal responsibility for these things.
I know a lot of people say risk is everybody's responsibility. Yeah, but if you say it's
everybody's job, then it's nobody's job. It's got to be somebody's job. It's got to be somebody's
responsibility. And you've got to give them the freedom and the ability to actually manage
around that risk. Managing the risk. We talked about a bunch of these things already. Understanding
your company's cyber risk profile. How likely are you to get attacked? How often? Who's going to
come after you? What is your risk appetite? What is the impact of you getting hacked? Is it the
type of business where Congress is coming after you? All of those things have to factor into your
management of risk. Get as many viewpoints from the outside, law enforcement, your peers, industry
groups as you possibly can. And then constantly updating your profile, your processes so that
you're integrating the latest and greatest techniques for managing this stuff. The last
part of this, probably the most important, what do you do when you're wrong? When you've calculated
all of these things and the worst still happens, have a crisis response plan. I think during this
year, it's like if anybody is arguing this point, you got to go, what are you thinking, right? I mean,
we've had all of this craziness this year. I live in New York City and it's just, you know,
I can't, you know, we were waiting for locusts, right? I mean, it just, you know, everything
went wrong. And if you can't sell this now, you should probably think about moving jobs, right?
This is as important as anything could be at this point, right? What do you do when you're wrong?
All right. So I'm going to jump into a little bit of psychology. And I think this is one of the
areas, again, that I think technology people, and I hate making generalizations, but I feel like I'm
talking about myself here. So I've lived with this my whole life. We're not great sometimes at
empathy and we're not great at understanding people's motivations. We know what they did.
And maybe technically we know why they did it, but we don't know emotionally why they did it.
And I've spent the last probably 15 years really focusing myself on trying to develop that part
of my personality. So I could understand why people make the decisions that they do instead
of just going, what the hell is wrong with you? What were you thinking? I'm actually trying to
ask, hmm, that's interesting. What were you thinking instead of what the hell is wrong with
you? What are you thinking? So this chart, I think it came from a Bill Gates presentation a while
ago. I love it. If you ask people what they're worried about, what scares you? They'll be like
terrorists, murderers, all these things that just are very, very, very... sharks. People are worried
about sharks. You kidding me? Sharks? The chances of getting hit by, by getting killed by a shark,
like, or you stand a better chance of buying two winning lottery tickets while getting hit by a
meteor than you do of getting attacked by a shark. If you look at this chart, you can see some of the
reasons for it, right? You know, the media tells you, you know, media doesn't report about people
having heart attacks. They report about terrorism. Terrorism sells newspapers, right? I mean, like,
it's such a rare event. Those aren't the things you should be worrying about. And, and in the
information security space, there's lots of this, right? People talk about Stuxnet a lot.
There's one Stuxnet, you know, and there's, there are APTs out there, and some of us have to deal
with that. It's really rare. It's really rare. Chances are you're going to get owned by a
mediocre ransomware crew. I mean, that's just, you know, probability. Overwhelmingly, that's who's
going to own you. And we certainly had a lot of evidence of that this year. And, and I think
there's a couple of biases at play here that I'm going to talk through in a little bit more detail.
Public service announcement on this stuff, though, it freaks people out. When you reveal to them
their cognitive biases, it pisses them the ass off. Like people will get really, really mad at
you when you highlight this stuff to them. They killed Socrates for it, basically. So, you know,
this is not new, but it's absolutely true. People do not like to deal with the fact that they have
cognitive biases. So public service announcement, use this internally in your inside voice, don't
necessarily communicate it to the folks in the room. I love this graphic up in the corner here,
though. I mean, people have been talking about like, how social media is being used to change
our politics. And this, you know, most of you are probably too young to even know what a TV guide is.
But this TV guide from the 1980s basically had the same message about television, right? I mean,
it's not new. This, you know, the foreign state actors are controlling the elections.
They've been doing, you know, it's old hat. We've seen this a million times.
All right. So if I can get my presentation to work again. All right, here we go.
Why are people so bad at estimating risk? The optimism bias. This is the first one of the
biases that I'm going to talk to you about. It's really funny. It's not really funny, I guess. But
when you ask people, what are your chances of getting cancer? They'll give you a number,
right? Estimate your percentage chances of it. And they'll say something like 10%.
Or 60%. Because they, you know, most people have no idea. If they say 10%, the answer is 30%,
right? It's like, it's, you know, we have so much data on this, we know how many people get cancer,
we know what percentage, it's, you know, it's pretty, pretty solid, right? It's 30%, right?
30% of people get cancer. And, but if people underestimate and say 10%, and then you give
them the answer and say it's 30%, they'll go, nah, for me, it's 10%. You go, why? I just feel
that way. But if they say it's 60%, and then they learn it's 30%, they'll be like, oh, no, yeah,
no, I'm better than that. I'm like 20. They'll adjust dramatically, if they overestimate,
but not if they underestimate. And I think this bias carries through in all aspects of our life,
where nobody thinks that they are below average at anything. And this is, this is like a
psychological fact you can prove over and over again. 90% of drivers think they're above average
drivers, right? Which is, you know, demonstrably false, of course, but there's very few people who
admit they are a below average driver. And anybody who spent any kind of time on New York City's
will know that that is definitely not true, particularly among the taxi set.
So how does this translate to information security? I've linked to a report that I did
some work on, and I was part of the advisory team for this ESI Thought Lab piece, which was
published about a month ago. It's a great report. I'm not just shilling it because I was involved
with it. I actually think it's great, but you can read it and make your own determination.
There's some great data in there about what the chances are of having a breach. And they did a lot
of great work around looking at the, you know, the entire universe of companies and what percentage
of them actually suffered breaches during the previous year. And if you go with the moderate
or material level, people estimated 45% said, you know, that was our chance. And it's way higher.
It's almost double that for a lot of industries, their chance of actually getting breached.
So people do not believe they're going to get hacked. Even after they've been hacked, they will
still believe their chances of getting hacked again are way lower than they actually are.
And it's just a cognitive bias that you have to get people passed.
Why are people so bad at estimating risk? Availability bias. This is the second one. And this
is, you know, got a couple of my favorite examples in it. Australia's national terrorism threat level
is probable. And if you look at the data, I think, like, two people had been killed in terrorist
incidents in a 20-year period in Australia. It's like, I don't think you know what the word
probable means. I mean, like, it's a terrible, these are terrible things, they're terrible tragedies,
every one of them horrible and shouldn't happen. But that's not what the word probable means,
and I think we struggle with these things that are emotional and impactful like that,
and estimating them in sort of cold calculated terms so that we can get an accurate perception
of risk. And nobody wants to say, that's ridiculous, a terrorist attack is not probable,
right? It's just, you know, it's just, it's emotionally, it just doesn't make us feel good
to say things like that. And there's a bunch of other examples here, right? Like the shark
attack one is just my favorite, like 186 in 20 years, among 6 billion people. I mean, that's like,
that's less, I don't even know how to describe that as it's so infinitesimally small, right?
Yeah, I guess I could do the math and actually come up with a number, but it's really, really
small. And, you know, if you look at like, there was this huge warnings about Zika, and I mean,
it's just, it was very, very small. And I think we have to take those things into perspective.
And this is what keeps us from getting into the FUD area when it comes to information security.
Look at the numbers, look at the data and figure out what the real risks are and what really is
probable and what really is likely and what really isn't. And yeah, the good news is we
generally don't have to deal with, you know, people dying and all of that kind of thing.
It's just like a computer getting hacked and some guy losing money or something. So it's not,
it's not as serious and it's not as emotional, but it still is. I mean, people, people will
generally, you know, you get hacked in a material way, people are losing their jobs, right? I mean,
it's just, that's sort of the way that that works. And people will get emotional and defensive about
it. Like I said, when you expose a cognitive bias, it's like, ah, makes their head explode
and they freak out on you. All right, learn helplessness. This is the other one. Oh my god,
I see this one so often. They're like, why are we patching? Everybody gets hacked anyway.
What's the deal? Who cares? You know, like everybody gets hacked anyway. It's not like
I can stop these hackers. I mean, like there's a big group of people who think the hackers are
all powerful and they can't be stopped anyway. So why are we bothering? I mean, at least three
times, every, every time I teach information security awareness, at least one person comes
up to me and say, why are we bothering? Everybody's getting hacked anyway. Like I click,
you know, you can't stop people from clicking. Why are you bothering teaching this? And
it's just the wrong way to look at this, right? Nothing is ever perfect. Nothing in life is
perfect. But you can make it better. And that's the message that you have to communicate to folks,
that it's never going to be perfect, but we can get better every day. Yeah.
I'm not sure whose quote that was at the end of this, but it's great. You can't spend your way
out of cyber problems. It's like exercise and eating right. You just have to wake up every
morning and do it. And that is absolutely the truth. You can't buy enough things to fix
cybersecurity. You actually have to do the work and that's hard for people to accept. And I think,
um, yeah, it takes a while to get people over that, but, you know, there's no,
I'm going to patch and be done. It's you're going to patch today and you're going to patch tomorrow.
And, you know, they're going to feel like Sisyphus pushing that rock up the hill and
waiting for it to roll back on. But that's, that's sort of the game. Every patch Tuesday
is the Microsoft Sisyphean rock coming to roll, roll over you down the hill.
This is so weird. I feel like I should stop and ask for questions, but there's nobody to
ask questions of. All right. So we're going to keep going. Um, anybody who hasn't read Cliff
Stoll's book, The Cuckoo's Egg, please stop listening to me right now. Go buy the book and
read it right now. This is absolutely required reading for anybody who wants to develop a career
in information security, particularly if you want to be a leader. It's unbelievably still prescient
about, you know, this happens in the eighties and people are using analog modems and dial-up
terminals and TTY green screens, the kind of stuff that I grew up on. Um, but it's still really,
really applies to today. All of the same principles apply. And he has a great quote from, from a Sam's
conference not too long ago. Um, this was in 2017 where he's talking about, you know, how he found
these guys in his system and he was trying to convince people they needed to do something about
this. And he said, well, I thought all I had to do was show them the data and they'd understand,
but it turns out I had to, I had to tell a story. And that's what people will respond to is a story.
And, and absolutely. Um, he learns that lesson. And I think as we read the book, um, we do too.
It's a great read. Cannot recommend it highly enough. Absolutely. Uh, you, you should, you
should go and buy and read that book. All right. Here's some thoughts I had about selling I, uh,
security to IT. We think, well, we're all technology folks. We've got a similar mindset,
so this should be easy and it's not, it's not impossible, but it has its challenges,
very different mindsets. IT people, they care about uptime costs and user experience. Um,
they, they, that is what they get comped on, right? That's what they get paid on.
What was the uptime? Did they deliver the features? Are the users happy? I don't want to say they
don't care about security, but it's, it's not one of their goals, right? I mean, like they'll tell
you it's one of their goals, but it's really not. It's, you know, it's one of the things that's
adjacent to their goals and we have to convince them that security will help those three. And
there's a few strategies to do that. Um, you got to get them over the hurdles of some of these
things here. I got a firewall. I bought a firewall. I plugged it in. I'm secure, but there's an any,
any rule at the front of it. Why would they sell me a firewall that isn't secure? Why would Cisco
do that to me? It's like, you know, that's, that's not how firewalls work. That's not how life works,
but, um, yeah, you have to do the work to get them through that. Um, they'll tell you about
their audit and regulatory reports, all of these sorts of things. Um, and, and your strategy for
selling them is going to be to show them it's going to be a story, but it's going to be a story
with data, right? I think pen tests are a great way to do this, where you show this guy walking
through their environment, right? And you've got to make them as close to real life as possible.
I think there's a big part of this where you're going to need to convince them that that data is
not manufactured and all of those sorts of things. And you're going to have to help partner with
them, right? You, you can't throw them under the bus. You can't sell them out to audit.
Sometimes you have to, but you generally, those, you want those to be your last resorts. You want
to help them and enable them to make themselves more secure without affecting their uptime too
much, without affecting their ability to deliver features and without driving their costs through
the roof. I think this is one of the things we're really bad at security is we push that cost.
Hey, we were cost neutral this year, but we, you know, caused IT to double their, their budgets.
The strategies, like I said, fear, uncertainty, and doubt, awful. Don't do it. Wrap them out to
management. Yeah. The availability bias, just put it in their face every day. That kind of works,
believe it or not. Demonstrate their fallibility. This is one of those things that will help with
the optimism bias. If you demonstrate clearly that they are capable of making mistakes,
they'll be angry at first, but generally if they're professionals, they'll get over it and
want to be better. Metrics. This is hard to argue with. Patching metrics, fantastic. Just cold,
hard facts about patching metrics. And then a story to go with it that says, here's, you know,
MS-867, here's MS-1710. And if you have this open, this is the horrible things that happen to you.
And this is how many systems we have open and show the trend so that people get a story out of it.
Pay for it. Put it in your budget. The more tools that you can get in your budget. And listen,
right now we've got insecurity, a huge advantage, right? I think everybody, cyber is the cool thing
at the board table. If you ask for money, it's very hard for them to say no. If IT asks for money,
it's really easy for them to say no. So I think it's, that's one of the ways that you'll win
people over. And of course you're going to have to have air cover from the board and senior
management. All right. Selling security to the board. This is a challenge, right? I think it's
not as much of a challenge now as it used to be. I think boards have really focused on this. And I
think boards, they want to know, you know, they all know this is a risk and they want to know
that somebody is covering them to make sure that they are doing the bare minimum, you know, not the
bare minimum, but they're doing the things that they need to, to make the company secure from,
from cyber attacks. Most of them don't have a technical background. Almost none of them have a
cyber security related background. And you're going to need to figure out ways to communicate
to them in fairly simple terms. This is the way that I do it. I've got these pretty simple four
questions that I use and I find it really helps me get the message across in a succinct one slide
presentation. And then I usually have some, some details behind it, but I don't want to inundate
them with data. I know that some people's strategy is just throw everything in the deck and, you know,
this way you're ready for any question. I think these four are the only four questions that a
board member really cares about, but every board is going to be different. So are we compromised
right now? Right. Everybody, this is one that scares security people. Like how would I know?
Oh my God, they're going to, you know, you've got to give them a high, medium, and low, and
some reasoning why you think that. How vulnerable? Again, this is even fuzzier.
High, medium, or low? Why do you think that? Who might attack us? What would they use? And how are
we defending against it? Just a couple of sentences. How are we going to address, you know, because
there's so much uncertainty in this, how are we going to address that next level of threats? And
this is early on in the presentation. I love those maps with the dragons at the end of the earth and
falling off the end of the earth, the uncertainty bit. That's why they used to draw those, right?
Because nobody knew what was on the other side of those maps. And that's fun, right? You know,
the dragons at the end of the map are fun. Yeah. And then what's our plan if we do get compromised?
Like I said, you have to have thought through this. You have to be able to communicate this.
Some of the things that I've got at the back end of this deck are folks who didn't, right? Some
examples of folks who struggled with that. All right. I'm going to move along a little bit here.
Yep. Here's some other examples of things that you can communicate to the board.
Some metrics, agree on metrics, make your metrics consistent and show a trend over time. That's what
they're going to understand. They're not going to know what an attempted attack means, but they're
going to want to know, am I getting more? Am I getting less? Are they getting better? Are they
getting worse? Those are the sorts of things that a board and senior management is going to want to
understand. I think this is another great way to report risk. How is high, medium, low risk and
impact on our core risks? What are those core risks around cybersecurity that we face? What's
the trend? What do you view the residual risk after the controls that you've put in place?
It's the difference between inherent risk, which is the risk as it stands naturally,
and residual risk, which is the risk after the controls and mitigations you put in place to deal
with that risk. All right, so here's some case studies. Everybody probably remembers this.
H.P. Gary, CEO of the company, got up there and said really bad things about Anonymous and how
he was all up in their business. And this ended really, really badly for him. He taunted Anonymous
and they went through him like a hot knife through butter. They owned him three ways from Sunday to
wiping his personal iPad at the end of the attack. I mean, it was just
completely unprepared for the onslaught that came his way.
Yeah, there's a great video if you ever have a chance to Google it on YouTube. I can't remember
the guy's name, but one of the late night comedians does about this hack on H.P. Gary,
it's fantastic. So the other one that I'd like to talk about here in the same kind of group
is Sony Pictures, right? And this got all wrapped into politics, but end of the day,
they made a movie that was poking the eye of the dictator of North Korea, right? And you just go,
you know, risk avoidance, somebody should have said, you know, you could
just call it something else, not North Korea, and you wouldn't piss these guys off so much.
Again, they went through these guys like a hot knife through butter, and they owned
them three ways from Sunday, released movies, dumped all their emails. It was just horrible.
And, you know, if you look at the common elements here, they were engaged in an activity that was
not universally admired, right? I mean, you pissed somebody off. Management didn't understand
how dangerous that adversary was. The information security controls were not up to the task of
defending against somebody who, you know, is very well prepared to attack you. And the attackers have
all the advantage in that space, right? So, you know, from then, and then, you know, obviously,
neither of them was prepared with any kind of response once this had happened, right? None of
them had any kind of a disaster recovery or recovery strategy at all, it seemed, to deal
with these things, you know, they were both on pen and paper for months afterwards, supposedly.
You know, and the responses were, you know, followed the standard script there at the bottom.
Right, so here's our lessons, you know, from this is my view of it, don't pick fights with
people who have nothing to lose. You know, you have everything, I mean, literally, they have
nothing to lose, you have everything to lose. That's dumb, right? Private companies with,
you know, profit loss calculations, if they go against people who don't,
that's going to end badly for you, right? They got all the time and energy in the world.
You know, if you give somebody that much leeway, they're going to get through.
Know your enemy and yourself. No cybersecurity presentation is complete without a Sun Tzu quote.
All right, just some questions to think about, right? There's a great statement in the Sony
case that came out maybe a year before, it's a valid business decision to accept the risk of
a security breach. I will not invest 10 million to avoid a possible $1 million loss. That's a
valid statement. The problem is, he was totally wrong about the amount of loss, right? I mean,
totally, way, hundreds of times off base on the order of magnitude there. And that was the issue.
I want to cry and not patch it. And I think I'm wrapping up my time here. So I'm going to talk
through these next few slides fairly quickly. And I'm happy to chat about these. Afterwards,
I'll be on chat. So obviously, everybody knows what these were from 2017. Big Worms, MS-1710,
spread through the networks. Want to cry was an amateur version, not patch it was like, you know,
somebody who knew what they were doing said, hold my beer, watch this and just let loose on the
world. I don't think it meant to spread as far as it did, but it sure did. And boy, was it a whopper.
It taught me a few things, right? Patching is not optional, right? And I think IT will tell you,
why would I patch? Every time I patch, I lose 2% of my systems or whatever percent of my systems.
And here's why, right? You just got to patch everything. And it's not the same as it used
to be where you had security through obscurity. Shodan's out there, man. And they can scan your
whole network in seconds. And they will find every single one that you didn't patch. So
patching 99% is marginally better than patching nothing, because they'll find that 1%. And then,
if you got hit with not patching, it was it. They just needed to find one. And
there's a bunch of other things here that are pretty relevant, like email, having email.
So it's not connected to the internet, but it's got email. That's the same thing. Maybe
it's low latency, a high latency network, but it's still on the internet. Yeah.
Why is patching so hard? I think we covered it, right? Some other questions to think about. I
think these are the sorts of things, to me, these questions, are what lets me get inside the head
of the people in IT and the people in management, so that I can better understand the problems
they're going with. And hopefully, this is a helpful exercise for you. And again, I'm willing
to talk and chat through any of these things with anybody. But this is the sort of thinking
that will get you to that high empathy state, so that you can relate to why they're having
problems and maybe help design solutions, instead of just, you know, flinging vulnerabilities out,
which is fun. Absolutely. But actually helping solve a problem will actually increase your
company's risk tolerance. All right. Equifax. Everybody knows this one. I'm not going to spend
a lot of time recounting what happened there. But let's just say Congress gets involved. And
if you're a private company and Congress starts interviewing you on stage, that's about as bad as
it gets, right? You're up there and they're going, they're wagging their finger at you. That's not a
good thing. And sort of the same results that we were talking about before, patching 99%,
only marginally better than patching one. You know, the CEO at one point was saying,
it was this one guy in the test unit who didn't patch his server. And that's why all of this
happened. And it's like, dude, you're missing the point, if you think that, right? You don't have a
process that covers your entire organization. It's on you. Yeah. And I think he went to jail
and a couple other people, like, because they all sold stock as soon as they heard the breach.
That's lesson number one. If you're involved in a breach, stop selling or buying stock.
Absolutely. Do not. Do not. Yeah. Planning for an incident. This is another one where they were
totally unprepared, right? I mean, it was just, it was like comical to watch those couple of
weeks afterwards. It was like, oh my God, what are they doing over there? Yeah. Some more big
questions to think about. And the one that I like here, and I'm as guilty of it as anybody, right?
This was victim blaming, right? Everybody was like, Equifax, you're horrible. What if somebody
showed up at their offices with a gun and stole the files? Would we say the same thing? And I
don't know why this is fundamentally different, but I guess it is. I don't know. But I mean,
you wouldn't expect them to have armored personnel carriers outside their office and
all of their staff wearing bulletproof vests so that they could fight off the guys who came
in with a gun to steal the files. But we expect that from them in a cyber realm. And, but it's,
you know, read the terrain. That's the way the world is, I guess, right now. But those are the
sorts of things I think about when I read these things. All right. A couple of documents, and I'm
going to wrap up because I'm probably going to get yelled at pretty soon. This is a great
document on what it takes to become a leader. There's a link to it on the bottom. The Cyber
Security Guide for Leaders in Today's Digital World from the World Economic Forum. Fantastic
document. These 10 things, like, just absolutely nail it for what you need to do to get to a
leadership role in cybersecurity. Best practices. These are the best practices from the ESI
Thought Lab piece. Again, I think really nails it. A different take on it because I think it's
from CISOs themselves, as opposed to folks on the outside. But fantastic. It really gives you
some great examples of what you can do to improve any cybersecurity program.
This is a method that I like. I've used it for a long time for how to build a cybersecurity
strategy. Sort of what's the funnel look like? What goes into that process? What are the things
that make up the levers that drive your cybersecurity strategy?
Great. Putting it all together. These are my closing thoughts.
Everybody talks about APTs and nation-state elite hackers. Yeah, they probably could get through
because they have unlimited time and budget, but they probably don't care about you. That's not
where I would spend most of my time. I mean, you got to do... but, you know, chances are
overwhelmingly you're going to get attacked. You're going to get owned by some
chintzy ransomware gang out of nowhere. If management makes bad decisions, there's not
a lot you can do other than be prepared with a response plan. Your job is to tell them when
they're making bad decisions. Even if they yell at you and say, why do you always shut down my
plans? Because your plans always suck. No, you have to do that. You have to have the emotional
courage to say, this plan is stupid, and I'm going to tell you this plan is stupid. I'm not
going to stop you from doing it, but I'm going to tell you that it's stupid. Yeah. The vast majority
of this stuff, almost all of it, like almost all of these things happen because we suck at inventory
and patching. Just suck at it. And I think the basics, and everybody says this, and it drives me
nuts when I hear it because it's like a platitude, but if we could patch our stuff and we knew where
our stuff was, 99% of this stuff wouldn't happen. If we did that and put MFA on all of our logins,
almost, it would be almost impossible. Like it would be really, this would be really, really
hard. You know, I say that and then they'll figure out 10 ways around that stuff. But
if we were just effective at this stuff, we would take off so much below hanging fruit.
Yeah. And these are the five rules about how to manage cybersecurity risk. Assign responsibility,
identify and quantify the risks, mitigation strategies, communicate. Like I said,
tell them when they're doing something stupid and make sure you highlight the risks. And plan for
when you fail, right? Because everybody's going to fail. You're going to be wrong. You're going to
be wrong. They're going to be wrong. Everybody's going to be wrong sometimes. You got to have a
plan to deal with that. And that's it for me. I'll hang around and chat and answer questions.
Peter, thank you so much. That was absolutely wonderful. And I missed the cat. I wish the
cat would come back more. Thank you. Thank you so much for having me. No problem. In addition to
Peter being in the chat to talk about this topic, he's also going to be available for career
coaching. So be sure to check out the schedule that's pinned in the Discord channel to sign up
to be coached by Peter. Peter, it was great seeing you. I'm sorry, I have to cut off and go to the
next one. Take care. Thank you very much. Bye-bye.