start	end	text
4180	11000	And welcome back to the Career Hacking Village. We talk a lot about doing technology,
11000	18200	but we never really talk about how do we present, how do we get things moving forward.
18200	23960	And I'm really excited, I was really excited to see the proposal submission from my friend
23960	30000	Peter Keenan to just really talk about hacking security leadership. So Peter, take it away.
30000	34600	Thanks so much Kathleen, and thanks everybody for watching.
35100	41100	Yeah, this is my first DEF CON presentation, so thanks for accepting it.
41840	49780	All right, the obligatory who am I slide. So I have been in the information technology and
49780	56580	information security space for about 30 years. You can see from these pictures there's at least
56580	63120	three decades of bad haircuts there. I'm currently the chief information security officer
63120	70040	for a global financial services company. You all are hackers, you can figure it out if you
70040	76580	really want to, but I'm not allowed to use the name, so I'm not going to. Prior to the five and
76680	84460	a half year stint I've had there, I was global head of information security governance at Citigroup,
85240	89120	yeah, I owned a bunch of things like the global information security policy.
89260	94280	I was a director with PricewaterhouseCoopers and their information security consulting group.
94460	101140	I owned a firm that did information security consulting for about a decade, primarily to
101140	105540	military and intelligence agencies, and spent a little time working in government service before
105540	113660	that. Yeah, like I said, a lot of time in the space, and I have hopefully boiled down what
113660	118480	I've learned in the last 30 some odd years into about 30 slides, which sounds terrible
118480	124780	when I say it that way, that I'm getting like one slide a year, but sadly it's true. Yeah,
124780	134160	two kids, 24 and 21, 31 years of marriage. All right, so I'm going to start with this CISO mind
134160	140580	map. I think it's a great slide. I think this chart is really informative, sort of about the
140580	148120	things that somebody in my position is thinking about on a daily, weekly, monthly basis. The area
148120	156100	of this mind map that I'm going to focus on is selling information security. I think it's the
156100	162720	area that people struggle with most as they transition their career from sole contributors
162720	170060	or engineering types or very technical sort of roles to a leadership role. And it's probably
170060	177000	the most important part of information security. If you boil information security down to its core
177000	185500	nugget, the thing that's probably describes it best is influence without authority. And the
185500	192120	ability to drive security through an organization without directly being able to control people's
192120	198080	comp or control their, you know, performance reviews and all of those sorts of things
198080	202840	is really the challenge that we face. I mean, some things we have direct control over, but by and
202840	209640	large we don't. And we need to be able to convince people that this is the right thing to do both for
209640	216600	their own personal gain, the company's gain, society's gain, all of those things. And that's
216600	221000	why I think that's probably the core function that information security, probably the most
221000	225500	important function within information security, because it's a force multiplier. If we can get
225500	230260	the folks in the company all pulling in our direction, it multiplies our effectiveness
230260	235760	dramatically. The thing I don't like about this part of it here, and, you know, maybe it's just
235760	240980	me misreading it. I think the authors, like I said, did a great job. It feels like it's a lot of top
240980	245760	down selling, right? And I think that that's good and it's important and it's what, you know, lets
245760	250660	you keep your job as a CISO, convincing the, you know, the board and the CEO that you're doing a
250660	256300	good job and security is important. You got to do that. But if you actually want to fix security
256300	261040	at an organization, you've got to sell it from the bottom up because it's the people on the ground,
261040	267180	the people at eye level who are actually doing the things that will make you more or less secure.
267180	273220	And you've got to convince them that this is the right things to do. And these are the changes
273220	277940	they need to make in their processes to be better. And you've got to provide them with ways of doing
277940	283560	it that makes them more efficient, not less efficient. And, you know, it's a hard sell in a
283560	289740	lot of cases with security because, you know, being frank, we're introducing overhead quite
289740	294220	often to do things securely, right? I mean, the act of typing a password as opposed to just being
294220	299860	on the system introduces overhead, but short-term overhead, long-term overhead, it obviously creates
300020	305900	a lot of problems not having passwords. Amazon has three buckets. Yes.
307260	315140	All right. So jumping ahead, the key language of business, and again, something that for me,
315140	320380	I think is one of the really big differentiators between a sole contributor and a leader in the
320380	325940	information security space is the language of risk. Business leaders understand it. They may
325940	332480	not understand your specific technical domain, and they may not understand what a router or a
332480	337320	switch is, but they understand the language of risk. And it's a language that we can meet in
337320	341520	the middle with them all. We can meet in the middle with lawyers, with accountants, business
341520	351680	people, the CEO, they will all get the idea of likelihood and impact. It's a problem for us in
351680	358260	technical fields. In the words that I've highlighted on this page, uncertainty and
358260	364660	probability, we struggle with that as a group. We do. We think about these things in absolutes
364660	370500	like engineers. And I know that's a rough way of saying it, but too many times, it's really
370720	376800	a struggle to drag an estimate out of somebody who's in a technical discipline. They want to
376800	382740	have the right answer. With estimates, you're basically saying, I'm giving you the wrong answer,
382740	390660	but I hope it's close. Somebody who's got an engineering training or a mathematical training,
390660	396680	that makes the hair on the back of their neck stick up. What do you mean? I don't know the
396680	403600	answer. There's no right answer. I'm just thumbing the area. I'm putting that in front of the CEO?
403600	412260	Yeah, you are. That's what risk is. You take the best educated guess you can sometimes
412260	419760	about the likelihood, which is a soft number, and the impact of these events occurring.
419760	424560	And that's the way that you have to describe them. I often hear people say this phrase,
424560	430920	and it drives me nuts, you can't predict the future. Absolutely, you can. I mean,
430920	436760	with 100% certainty, no. But why else would we eat right and exercise, right? Because we don't
436760	440260	think we're going to die in the next hour. We don't think we're going to die tomorrow. We don't
440260	445600	think the world's going to end tomorrow. We don't think they're going to have miraculous cures for
445600	450900	diabetes and obesity tomorrow, right? That's why we save money, because we think that we're going
450900	454500	to live to an age where we're going to need money, right? There's a million predictions
454500	459440	about the future we make every day, all of us do. And I think we just have to get comfortable
459440	467320	with that. You can't predict it with 100% certainty, but that's okay. You have to be
467320	474640	able to get comfortable with the uncertainty and probabilities and presenting your risks in that
474640	482480	way. And it's got to be done. If you look at the way the businesses report, these things,
482480	487620	they all know that they're not 100% accurate. And people yell at you when your risk is way off. But
488170	491620	end of the day, you were clear. It's an estimate.
493380	498920	All right. Two other things. One last thing on this one. This is one of my pet peeves about
498920	505480	information security folks. When they're talking to non-security folks, lay people,
505480	511520	FUD is the biggest thing that drives me nuts. And you see it, the salespeople do it, the
511520	516980	engineers, when they get frustrated, they do it. They just throw out these FUD bombs of like,
516980	522680	well, you never know. Could be the Russians, those Chinese. It's just,
524040	529560	stop, don't do it. It may work in the short-term to win that short-term argument,
529560	534580	but you will lose respect from everybody in the room. And that's one of the things that
534580	540080	defines you as a leader is being able to hold and command that respect over time.
541400	547240	All right. Risk strategies. These are some of the terms that you have to understand if you're
547240	552800	going to communicate in risk. Risk reduction. This one's pretty straightforward, right? I have
553460	562080	a thousand systems that are MS-0867 vulnerable. I patched 999 of them. Have I reduced the risk?
562080	566480	Yeah, probably, right? That's risk reduction. There's still a risk out there that I missed
566480	572960	one, or that the patch isn't fully effective, or somebody didn't reboot after the patch,
572960	578760	or all of those things. But that's what that's about, reducing the risk associated with some
578760	584260	adverse event out there. Acceptance. This is another one we struggle with
584260	589900	as technology folks. There are some times the business is just going to go, yep, that's okay.
589900	595140	I get it. I get it. There's a, you know, you say there's a 10% chance that this website will get
595140	602600	hacked. I'm okay with it. It's only up for 30 days. I'll take that risk. And we all go,
602600	607140	you know, it makes our heads explode. But absolutely, that's their call. Your job
607620	616880	is to identify, as best as you can, quantify and report that risk. It's their job to say yes or no
616880	622520	to that risk, right? The CEO, whoever's in charge of that business function, they get to decide that.
622520	627840	And I know there's a great cartoon about their, you know, what's the magic word to get what you
627840	632640	want? Risk accepted, right? And, you know, there are some people who will overuse it, but
633940	637440	that's in a well-functioning organization, that's how that should work.
637560	641940	Avoidance. We're going to go through some examples later, but the classic one is just
641940	646260	don't be in that line of business that's going to create that risk, right? Don't launch that
646260	654760	website that, you know, tweaks its nose at some hacker collective or, yeah, any of those sorts of
654760	660500	things. Avoidance is pretty straightforward. And there are times when we're going to want to advise
660500	666540	that. But again, business may just say, yeah, I understand. Avoidance is probably better,
666540	670860	but we're not going to do it because it's too much of a gain for us in business. And I've seen a
670860	675620	million cases where they were right. I counseled, don't do it. And they said, well, we're going to
675620	681800	make $300 million off of that. So we're going to do it anyway. And, you know, they were right.
683080	690880	Transfer, risk transfer. This is the classic cyber insurance, right? And that's, you know,
690880	695220	I think there's a lot of uncertainty around cyber insurance at this point, but this is the classic
695220	701540	way of dealing with risk. And I think this will get better over time. The last one is probably the
701540	706540	most common in this area. And that's hope. You just hope you don't get hacked. And you see it
706540	711360	over and over and over again. Every day you see, you know, tons of people putting stuff on the
711360	720140	internet and, you know, just hoping that bad things don't happen. All right. So I have a cat
720140	726100	and she shares this office with me. So there's nothing I can do. Yeah. There's no risk avoidance
726100	730540	on that. This was her office for the last five years. And I've only been working here for the
730540	736880	last couple of months. So she'll pop in and out of frame on the background. Yeah. Her name is
736880	745740	Schrodinger. All right. So risk, appetite, and tolerance. These are some other terms that you're
745740	750120	going to need to know to speak the language of risk. Risk appetite is the amount or the type
750120	757300	of risk that your organization is willing to take. Thank you. Every organization is going to have a
757300	765580	different risk tolerance level. It's very much organization specific, right? Financial services
765580	771020	tend to be more risk averse. Startups or tech companies tend to be more risk favorable where
771020	776380	they'll just take chances. Particularly if you're a startup, right? I mean, what have you got to lose?
776380	781560	A lot less than a hundred and something year old global investment bank, right? I mean, it's just
781560	786720	those are the sorts of decisions that they're going to make. Your job is to understand what
786720	793500	the risk appetite of folks is. And the description below is great because this is the tricky part.
793500	798540	If you could just say, what's your risk appetite? And people could say seven and you'd be seven.
798680	804700	There is no numeric value like that. Everybody's going to have a different definition and you're
804700	808820	going to have to speak to a lot of people and you're going to have to deal in fuzzy terms to
808820	819400	get a sense for how people want to deal with this, right? Whether or not they want to be able to say,
820500	826280	you know, it's a dollar value or none, right? Like, you know, CEO is going to be like, no,
826280	830800	what do you mean getting hacked? You're saying you want to know how often I want to get hacked?
830800	834580	The answer is never, right? I mean, like, you know, I can get hacked for free. What am I paying you
834580	840020	for if we're going to get hacked, right? CFO is probably going to set aside some money for this
840020	845280	and say, put aside $8 million a year. So if you can exceed that, let me know and we'll budget some
845280	849960	more for next year. You know, and everybody else is going to have a different view of it. Your job
849960	854340	is going to be to consolidate all of that and come up with a security controls that are appropriate
854340	864500	to those risks. Yeah. Thank you. Thank you. All right. Risk impact levels. This is an interesting
864500	871480	diagram and I think it's a great way, after you've had all those conversations, to communicate this
871480	876000	back to the folks, right? To communicate this back to senior leadership and say, based on what I heard
876000	881120	from all of you, and this is just an example from the site that's listed below, these are the sort
881120	889300	of numbers or metrics I've come up with to calculate our risk levels, right? Whether something's a low
889300	894020	impact, medium impact, or high impact. And get everybody to just sort of nod yes, so that there's
894020	898460	at least a common understanding of the term, right? It's a lexicon that will help you build
900320	907700	common understanding and get people, you know, when a bad event occurs, everybody sort of freaks
907700	910920	out initially, but then you sort of can go back to this and say, listen, this is what we agreed
910920	915520	to. This is in line with what we've communicated to the board, to the CEO, and it gets everybody
915520	927560	back to at least level set. All right, managing cybersecurity risk and preparation. So this is
927560	934060	just a framework that I like to use for how you would do all of these things, right? You've got
934060	939800	to build a team, diversity on that team, so important from all aspects of it, right? The
939800	945840	type of people, the type of education, the type of functions that they've served. The more viewpoints
945840	952220	that you have on your team, the better you're going to be. And this is another thing that I
952220	958560	see a lot of technical folks, and I've been guilty of it in my past. We hire people that look a lot
958560	962320	like ourselves, right? And I don't mean that necessarily physically, but like I'm an infrastructure
962320	968340	guy. That's where I come from. I love routers and switches and networks. And, you know, early on in
968340	972960	my career, I thought those were the people that knew the most because they understood the things
972960	978660	that I understood. And as I've grown, I think I tend to gravitate more towards people who know
978660	985080	things that I don't. And I just ask them questions all day every time I meet with them. And I think
985080	989700	that's made me a better leader. And I think that's probably the most important part of building a
989700	993060	team when it comes to risks, because you've got to understand it from every angle if you're going
993060	999420	to manage it effectively. Structure, you've got to assign formal responsibility for these things.
999420	1004180	I know a lot of people say risk is everybody's responsibility. Yeah, but if you say it's
1004180	1008640	everybody's job, then it's nobody's job. It's got to be somebody's job. It's got to be somebody's
1008640	1013380	responsibility. And you've got to give them the freedom and the ability to actually manage
1014480	1022460	around that risk. Managing the risk. We talked about a bunch of these things already. Understanding
1022460	1027500	your company's cyber risk profile. How likely are you to get attacked? How often? Who's going to
1027500	1035360	come after you? What is your risk appetite? What is the impact of you getting hacked? Is it the
1035360	1041480	type of business where Congress is coming after you? All of those things have to factor into your
1041480	1048540	management of risk. Get as many viewpoints from the outside, law enforcement, your peers, industry
1048540	1057580	groups as you possibly can. And then constantly updating your profile, your processes so that
1057580	1061900	you're integrating the latest and greatest techniques for managing this stuff. The last
1061900	1069440	part of this, probably the most important, what do you do when you're wrong? When you've calculated
1069440	1076960	all of these things and the worst still happens, have a crisis response plan. I think during this
1076960	1081980	year, it's like if anybody is arguing this point, you got to go, what are you thinking, right? I mean,
1081980	1088780	we've had all of this craziness this year. I live in New York City and it's just, you know,
1088780	1093800	I can't, you know, we were waiting for locusts, right? I mean, it just, you know, everything
1093800	1103620	went wrong. And if you can't sell this now, you should probably think about moving jobs, right?
1103620	1110660	This is as important as anything could be at this point, right? What do you do when you're wrong?
1111640	1119500	All right. So I'm going to jump into a little bit of psychology. And I think this is one of the
1119500	1124840	areas, again, that I think technology people, and I hate making generalizations, but I feel like I'm
1124840	1131920	talking about myself here. So I've lived with this my whole life. We're not great sometimes at
1131920	1137360	empathy and we're not great at understanding people's motivations. We know what they did.
1137380	1141800	And maybe technically we know why they did it, but we don't know emotionally why they did it.
1141800	1147940	And I've spent the last probably 15 years really focusing myself on trying to develop that part
1147940	1153500	of my personality. So I could understand why people make the decisions that they do instead
1153500	1158140	of just going, what the hell is wrong with you? What were you thinking? I'm actually trying to
1158140	1162060	ask, hmm, that's interesting. What were you thinking instead of what the hell is wrong with
1162060	1169340	you? What are you thinking? So this chart, I think it came from a Bill Gates presentation a while
1169340	1177460	ago. I love it. If you ask people what they're worried about, what scares you? They'll be like
1177460	1187100	terrorists, murderers, all these things that just are very, very, very... sharks. People are worried
1187100	1193740	about sharks. You kidding me? Sharks? The chances of getting hit by, by getting killed by a shark,
1193740	1201740	like, or you stand a better chance of buying two winning lottery tickets while getting hit by a
1201740	1208320	meteor than you do of getting attacked by a shark. If you look at this chart, you can see some of the
1208320	1213440	reasons for it, right? You know, the media tells you, you know, media doesn't report about people
1213440	1218860	having heart attacks. They report about terrorism. Terrorism sells newspapers, right? I mean, like,
1219440	1225100	it's such a rare event. Those aren't the things you should be worrying about. And, and in the
1225100	1230460	information security space, there's lots of this, right? People talk about Stuxnet a lot.
1230700	1235740	There's one Stuxnet, you know, and there's, there are APTs out there, and some of us have to deal
1235740	1242160	with that. It's really rare. It's really rare. Chances are you're going to get owned by a
1242160	1248840	mediocre ransomware crew. I mean, that's just, you know, probability. Overwhelmingly, that's who's
1248840	1253780	going to own you. And we certainly had a lot of evidence of that this year. And, and I think
1254840	1259200	there's a couple of biases at play here that I'm going to talk through in a little bit more detail.
1259440	1266120	Public service announcement on this stuff, though, it freaks people out. When you reveal to them
1266120	1273420	their cognitive biases, it pisses them the ass off. Like people will get really, really mad at
1273420	1279580	you when you highlight this stuff to them. They killed Socrates for it, basically. So, you know,
1279580	1284320	this is not new, but it's absolutely true. People do not like to deal with the fact that they have
1284320	1289540	cognitive biases. So public service announcement, use this internally in your inside voice, don't
1289540	1294100	necessarily communicate it to the folks in the room. I love this graphic up in the corner here,
1294100	1299260	though. I mean, people have been talking about like, how social media is being used to change
1299260	1305700	our politics. And this, you know, most of you are probably too young to even know what a TV guide is.
1305700	1310640	But this TV guide from the 1980s basically had the same message about television, right? I mean,
1310640	1315360	it's not new. This, you know, the foreign state actors are controlling the elections.
1316260	1320420	They've been doing, you know, it's old hat. We've seen this a million times.
1321880	1328240	All right. So if I can get my presentation to work again. All right, here we go.
1329600	1334460	Why are people so bad at estimating risk? The optimism bias. This is the first one of the
1334460	1341460	biases that I'm going to talk to you about. It's really funny. It's not really funny, I guess. But
1341460	1346280	when you ask people, what are your chances of getting cancer? They'll give you a number,
1346280	1350120	right? Estimate your percentage chances of it. And they'll say something like 10%.
1350120	1357780	Or 60%. Because they, you know, most people have no idea. If they say 10%, the answer is 30%,
1357780	1363040	right? It's like, it's, you know, we have so much data on this, we know how many people get cancer,
1363040	1367860	we know what percentage, it's, you know, it's pretty, pretty solid, right? It's 30%, right?
1367860	1374260	30% of people get cancer. And, but if people underestimate and say 10%, and then you give
1374260	1380380	them the answer and say it's 30%, they'll go, nah, for me, it's 10%. You go, why? I just feel
1380380	1386180	that way. But if they say it's 60%, and then they learn it's 30%, they'll be like, oh, no, yeah,
1386180	1391320	no, I'm better than that. I'm like 20. They'll adjust dramatically, if they overestimate,
1391320	1396640	but not if they underestimate. And I think this bias carries through in all aspects of our life,
1396640	1404160	where nobody thinks that they are below average at anything. And this is, this is like a
1404160	1409140	psychological fact you can prove over and over again. 90% of drivers think they're above average
1409140	1414240	drivers, right? Which is, you know, demonstrably false, of course, but there's very few people who
1414240	1420340	admit they are a below average driver. And anybody who spent any kind of time on New York City's
1420340	1425520	will know that that is definitely not true, particularly among the taxi set.
1425860	1433420	So how does this translate to information security? I've linked to a report that I did
1433420	1438640	some work on, and I was part of the advisory team for this ESI Thought Lab piece, which was
1438640	1443500	published about a month ago. It's a great report. I'm not just shilling it because I was involved
1443500	1448320	with it. I actually think it's great, but you can read it and make your own determination.
1448320	1456780	There's some great data in there about what the chances are of having a breach. And they did a lot
1456780	1462740	of great work around looking at the, you know, the entire universe of companies and what percentage
1462740	1468640	of them actually suffered breaches during the previous year. And if you go with the moderate
1468640	1475980	or material level, people estimated 45% said, you know, that was our chance. And it's way higher.
1475980	1480180	It's almost double that for a lot of industries, their chance of actually getting breached.
1480260	1485660	So people do not believe they're going to get hacked. Even after they've been hacked, they will
1485660	1489680	still believe their chances of getting hacked again are way lower than they actually are.
1489680	1493020	And it's just a cognitive bias that you have to get people passed.
1497060	1501180	Why are people so bad at estimating risk? Availability bias. This is the second one. And this
1501180	1507400	is, you know, got a couple of my favorite examples in it. Australia's national terrorism threat level
1507400	1516620	is probable. And if you look at the data, I think, like, two people had been killed in terrorist
1516620	1521560	incidents in a 20-year period in Australia. It's like, I don't think you know what the word
1521560	1525560	probable means. I mean, like, it's a terrible, these are terrible things, they're terrible tragedies,
1525560	1531700	every one of them horrible and shouldn't happen. But that's not what the word probable means,
1531700	1540540	and I think we struggle with these things that are emotional and impactful like that,
1540540	1545940	and estimating them in sort of cold calculated terms so that we can get an accurate perception
1545940	1551780	of risk. And nobody wants to say, that's ridiculous, a terrorist attack is not probable,
1551780	1557780	right? It's just, you know, it's just, it's emotionally, it just doesn't make us feel good
1557780	1561320	to say things like that. And there's a bunch of other examples here, right? Like the shark
1561320	1571720	attack one is just my favorite, like 186 in 20 years, among 6 billion people. I mean, that's like,
1571720	1577160	that's less, I don't even know how to describe that as it's so infinitesimally small, right?
1578340	1582180	Yeah, I guess I could do the math and actually come up with a number, but it's really, really
1582180	1588480	small. And, you know, if you look at like, there was this huge warnings about Zika, and I mean,
1588480	1594600	it's just, it was very, very small. And I think we have to take those things into perspective.
1594600	1599000	And this is what keeps us from getting into the FUD area when it comes to information security.
1599080	1606240	Look at the numbers, look at the data and figure out what the real risks are and what really is
1606240	1612040	probable and what really is likely and what really isn't. And yeah, the good news is we
1612040	1615660	generally don't have to deal with, you know, people dying and all of that kind of thing.
1615660	1619440	It's just like a computer getting hacked and some guy losing money or something. So it's not,
1619440	1624040	it's not as serious and it's not as emotional, but it still is. I mean, people, people will
1624040	1628700	generally, you know, you get hacked in a material way, people are losing their jobs, right? I mean,
1628700	1633140	it's just, that's sort of the way that that works. And people will get emotional and defensive about
1633140	1638640	it. Like I said, when you expose a cognitive bias, it's like, ah, makes their head explode
1638640	1644980	and they freak out on you. All right, learn helplessness. This is the other one. Oh my god,
1644980	1650900	I see this one so often. They're like, why are we patching? Everybody gets hacked anyway.
1651060	1655100	What's the deal? Who cares? You know, like everybody gets hacked anyway. It's not like
1655100	1660140	I can stop these hackers. I mean, like there's a big group of people who think the hackers are
1660140	1665140	all powerful and they can't be stopped anyway. So why are we bothering? I mean, at least three
1665140	1672060	times, every, every time I teach information security awareness, at least one person comes
1672060	1676140	up to me and say, why are we bothering? Everybody's getting hacked anyway. Like I click,
1676140	1680520	you know, you can't stop people from clicking. Why are you bothering teaching this? And
1682000	1686860	it's just the wrong way to look at this, right? Nothing is ever perfect. Nothing in life is
1686860	1693780	perfect. But you can make it better. And that's the message that you have to communicate to folks,
1693780	1702060	that it's never going to be perfect, but we can get better every day. Yeah.
1703920	1708520	I'm not sure whose quote that was at the end of this, but it's great. You can't spend your way
1708520	1713400	out of cyber problems. It's like exercise and eating right. You just have to wake up every
1713400	1720880	morning and do it. And that is absolutely the truth. You can't buy enough things to fix
1720880	1728500	cybersecurity. You actually have to do the work and that's hard for people to accept. And I think,
1728500	1733760	um, yeah, it takes a while to get people over that, but, you know, there's no,
1733760	1737340	I'm going to patch and be done. It's you're going to patch today and you're going to patch tomorrow.
1737760	1741460	And, you know, they're going to feel like Sisyphus pushing that rock up the hill and
1741460	1745880	waiting for it to roll back on. But that's, that's sort of the game. Every patch Tuesday
1745880	1750600	is the Microsoft Sisyphean rock coming to roll, roll over you down the hill.
1753390	1757710	This is so weird. I feel like I should stop and ask for questions, but there's nobody to
1757710	1764110	ask questions of. All right. So we're going to keep going. Um, anybody who hasn't read Cliff
1764110	1769490	Stoll's book, The Cuckoo's Egg, please stop listening to me right now. Go buy the book and
1769490	1775590	read it right now. This is absolutely required reading for anybody who wants to develop a career
1775590	1780890	in information security, particularly if you want to be a leader. It's unbelievably still prescient
1780890	1786110	about, you know, this happens in the eighties and people are using analog modems and dial-up
1786110	1793910	terminals and TTY green screens, the kind of stuff that I grew up on. Um, but it's still really,
1793910	1801510	really applies to today. All of the same principles apply. And he has a great quote from, from a Sam's
1801510	1808630	conference not too long ago. Um, this was in 2017 where he's talking about, you know, how he found
1808630	1813430	these guys in his system and he was trying to convince people they needed to do something about
1813430	1818230	this. And he said, well, I thought all I had to do was show them the data and they'd understand,
1818230	1825010	but it turns out I had to, I had to tell a story. And that's what people will respond to is a story.
1825050	1831430	And, and absolutely. Um, he learns that lesson. And I think as we read the book, um, we do too.
1831430	1837930	It's a great read. Cannot recommend it highly enough. Absolutely. Uh, you, you should, you
1837930	1848190	should go and buy and read that book. All right. Here's some thoughts I had about selling I, uh,
1848190	1857420	security to IT. We think, well, we're all technology folks. We've got a similar mindset,
1857420	1862760	so this should be easy and it's not, it's not impossible, but it has its challenges,
1862760	1871440	very different mindsets. IT people, they care about uptime costs and user experience. Um,
1871440	1875660	they, they, that is what they get comped on, right? That's what they get paid on.
1875660	1881740	What was the uptime? Did they deliver the features? Are the users happy? I don't want to say they
1881740	1887240	don't care about security, but it's, it's not one of their goals, right? I mean, like they'll tell
1887240	1890840	you it's one of their goals, but it's really not. It's, you know, it's one of the things that's
1890840	1897600	adjacent to their goals and we have to convince them that security will help those three. And
1897600	1904240	there's a few strategies to do that. Um, you got to get them over the hurdles of some of these
1904240	1911300	things here. I got a firewall. I bought a firewall. I plugged it in. I'm secure, but there's an any,
1911300	1916080	any rule at the front of it. Why would they sell me a firewall that isn't secure? Why would Cisco
1916080	1922280	do that to me? It's like, you know, that's, that's not how firewalls work. That's not how life works,
1922280	1927660	but, um, yeah, you have to do the work to get them through that. Um, they'll tell you about
1927660	1935500	their audit and regulatory reports, all of these sorts of things. Um, and, and your strategy for
1935500	1941740	selling them is going to be to show them it's going to be a story, but it's going to be a story
1941740	1946260	with data, right? I think pen tests are a great way to do this, where you show this guy walking
1946260	1950000	through their environment, right? And you've got to make them as close to real life as possible.
1950000	1956780	I think there's a big part of this where you're going to need to convince them that that data is
1956780	1960320	not manufactured and all of those sorts of things. And you're going to have to help partner with
1960320	1964520	them, right? You, you can't throw them under the bus. You can't sell them out to audit.
1964680	1970080	Sometimes you have to, but you generally, those, you want those to be your last resorts. You want
1970080	1977560	to help them and enable them to make themselves more secure without affecting their uptime too
1977560	1982700	much, without affecting their ability to deliver features and without driving their costs through
1982700	1988320	the roof. I think this is one of the things we're really bad at security is we push that cost.
1988680	1994640	Hey, we were cost neutral this year, but we, you know, caused IT to double their, their budgets.
1997880	2003480	The strategies, like I said, fear, uncertainty, and doubt, awful. Don't do it. Wrap them out to
2003480	2012760	management. Yeah. The availability bias, just put it in their face every day. That kind of works,
2012760	2018980	believe it or not. Demonstrate their fallibility. This is one of those things that will help with
2018980	2024140	the optimism bias. If you demonstrate clearly that they are capable of making mistakes,
2024140	2029140	they'll be angry at first, but generally if they're professionals, they'll get over it and
2029140	2037660	want to be better. Metrics. This is hard to argue with. Patching metrics, fantastic. Just cold,
2037660	2043740	hard facts about patching metrics. And then a story to go with it that says, here's, you know,
2043740	2050660	MS-867, here's MS-1710. And if you have this open, this is the horrible things that happen to you.
2050660	2056340	And this is how many systems we have open and show the trend so that people get a story out of it.
2056960	2062560	Pay for it. Put it in your budget. The more tools that you can get in your budget. And listen,
2062560	2069400	right now we've got insecurity, a huge advantage, right? I think everybody, cyber is the cool thing
2069400	2074460	at the board table. If you ask for money, it's very hard for them to say no. If IT asks for money,
2074460	2080860	it's really easy for them to say no. So I think it's, that's one of the ways that you'll win
2080860	2085320	people over. And of course you're going to have to have air cover from the board and senior
2085320	2094740	management. All right. Selling security to the board. This is a challenge, right? I think it's
2094740	2098720	not as much of a challenge now as it used to be. I think boards have really focused on this. And I
2098720	2103820	think boards, they want to know, you know, they all know this is a risk and they want to know
2103820	2108780	that somebody is covering them to make sure that they are doing the bare minimum, you know, not the
2108780	2113620	bare minimum, but they're doing the things that they need to, to make the company secure from,
2113620	2119660	from cyber attacks. Most of them don't have a technical background. Almost none of them have a
2119660	2125460	cyber security related background. And you're going to need to figure out ways to communicate
2125460	2133380	to them in fairly simple terms. This is the way that I do it. I've got these pretty simple four
2134300	2141340	questions that I use and I find it really helps me get the message across in a succinct one slide
2141340	2146720	presentation. And then I usually have some, some details behind it, but I don't want to inundate
2146720	2151460	them with data. I know that some people's strategy is just throw everything in the deck and, you know,
2151460	2155700	this way you're ready for any question. I think these four are the only four questions that a
2155700	2159920	board member really cares about, but every board is going to be different. So are we compromised
2159920	2164320	right now? Right. Everybody, this is one that scares security people. Like how would I know?
2164320	2168260	Oh my God, they're going to, you know, you've got to give them a high, medium, and low, and
2168260	2173300	some reasoning why you think that. How vulnerable? Again, this is even fuzzier.
2173740	2179020	High, medium, or low? Why do you think that? Who might attack us? What would they use? And how are
2179020	2185180	we defending against it? Just a couple of sentences. How are we going to address, you know, because
2185180	2191140	there's so much uncertainty in this, how are we going to address that next level of threats? And
2191140	2195440	this is early on in the presentation. I love those maps with the dragons at the end of the earth and
2195440	2200300	falling off the end of the earth, the uncertainty bit. That's why they used to draw those, right?
2200300	2204140	Because nobody knew what was on the other side of those maps. And that's fun, right? You know,
2204140	2211320	the dragons at the end of the map are fun. Yeah. And then what's our plan if we do get compromised?
2211320	2215640	Like I said, you have to have thought through this. You have to be able to communicate this.
2216880	2221320	Some of the things that I've got at the back end of this deck are folks who didn't, right? Some
2221320	2227300	examples of folks who struggled with that. All right. I'm going to move along a little bit here.
2228360	2232600	Yep. Here's some other examples of things that you can communicate to the board.
2232600	2237820	Some metrics, agree on metrics, make your metrics consistent and show a trend over time. That's what
2237820	2241280	they're going to understand. They're not going to know what an attempted attack means, but they're
2241280	2244900	going to want to know, am I getting more? Am I getting less? Are they getting better? Are they
2244900	2249540	getting worse? Those are the sorts of things that a board and senior management is going to want to
2249540	2260620	understand. I think this is another great way to report risk. How is high, medium, low risk and
2260620	2265220	impact on our core risks? What are those core risks around cybersecurity that we face? What's
2265220	2270660	the trend? What do you view the residual risk after the controls that you've put in place?
2270660	2274560	It's the difference between inherent risk, which is the risk as it stands naturally,
2274560	2280360	and residual risk, which is the risk after the controls and mitigations you put in place to deal
2280360	2287500	with that risk. All right, so here's some case studies. Everybody probably remembers this.
2287500	2294000	H.P. Gary, CEO of the company, got up there and said really bad things about Anonymous and how
2294000	2300660	he was all up in their business. And this ended really, really badly for him. He taunted Anonymous
2300660	2308140	and they went through him like a hot knife through butter. They owned him three ways from Sunday to
2308140	2312060	wiping his personal iPad at the end of the attack. I mean, it was just
2313660	2318920	completely unprepared for the onslaught that came his way.
2320340	2329380	Yeah, there's a great video if you ever have a chance to Google it on YouTube. I can't remember
2329380	2333340	the guy's name, but one of the late night comedians does about this hack on H.P. Gary,
2333340	2340960	it's fantastic. So the other one that I'd like to talk about here in the same kind of group
2340960	2347560	is Sony Pictures, right? And this got all wrapped into politics, but end of the day,
2347560	2356900	they made a movie that was poking the eye of the dictator of North Korea, right? And you just go,
2356900	2360520	you know, risk avoidance, somebody should have said, you know, you could
2360520	2366280	just call it something else, not North Korea, and you wouldn't piss these guys off so much.
2366600	2370000	Again, they went through these guys like a hot knife through butter, and they owned
2370000	2375000	them three ways from Sunday, released movies, dumped all their emails. It was just horrible.
2375760	2384340	And, you know, if you look at the common elements here, they were engaged in an activity that was
2384340	2390000	not universally admired, right? I mean, you pissed somebody off. Management didn't understand
2390000	2396820	how dangerous that adversary was. The information security controls were not up to the task of
2396820	2403400	defending against somebody who, you know, is very well prepared to attack you. And the attackers have
2403400	2410260	all the advantage in that space, right? So, you know, from then, and then, you know, obviously,
2410260	2415120	neither of them was prepared with any kind of response once this had happened, right? None of
2415120	2422500	them had any kind of a disaster recovery or recovery strategy at all, it seemed, to deal
2422500	2426520	with these things, you know, they were both on pen and paper for months afterwards, supposedly.
2427200	2431200	You know, and the responses were, you know, followed the standard script there at the bottom.
2433800	2438640	Right, so here's our lessons, you know, from this is my view of it, don't pick fights with
2438640	2442560	people who have nothing to lose. You know, you have everything, I mean, literally, they have
2442560	2447580	nothing to lose, you have everything to lose. That's dumb, right? Private companies with,
2447580	2451640	you know, profit loss calculations, if they go against people who don't,
2451640	2456480	that's going to end badly for you, right? They got all the time and energy in the world.
2456840	2460840	You know, if you give somebody that much leeway, they're going to get through.
2461600	2467460	Know your enemy and yourself. No cybersecurity presentation is complete without a Sun Tzu quote.
2468640	2473580	All right, just some questions to think about, right? There's a great statement in the Sony
2474520	2479100	case that came out maybe a year before, it's a valid business decision to accept the risk of
2479200	2484500	a security breach. I will not invest 10 million to avoid a possible $1 million loss. That's a
2484500	2491080	valid statement. The problem is, he was totally wrong about the amount of loss, right? I mean,
2491080	2498480	totally, way, hundreds of times off base on the order of magnitude there. And that was the issue.
2501560	2506500	I want to cry and not patch it. And I think I'm wrapping up my time here. So I'm going to talk
2506500	2513080	through these next few slides fairly quickly. And I'm happy to chat about these. Afterwards,
2513080	2523380	I'll be on chat. So obviously, everybody knows what these were from 2017. Big Worms, MS-1710,
2523380	2528780	spread through the networks. Want to cry was an amateur version, not patch it was like, you know,
2528780	2533780	somebody who knew what they were doing said, hold my beer, watch this and just let loose on the
2533780	2539360	world. I don't think it meant to spread as far as it did, but it sure did. And boy, was it a whopper.
2540520	2546480	It taught me a few things, right? Patching is not optional, right? And I think IT will tell you,
2546480	2552780	why would I patch? Every time I patch, I lose 2% of my systems or whatever percent of my systems.
2553520	2561000	And here's why, right? You just got to patch everything. And it's not the same as it used
2561000	2567180	to be where you had security through obscurity. Shodan's out there, man. And they can scan your
2567180	2571940	whole network in seconds. And they will find every single one that you didn't patch. So
2571940	2578560	patching 99% is marginally better than patching nothing, because they'll find that 1%. And then,
2579320	2584440	if you got hit with not patching, it was it. They just needed to find one. And
2585680	2589700	there's a bunch of other things here that are pretty relevant, like email, having email.
2589860	2593360	So it's not connected to the internet, but it's got email. That's the same thing. Maybe
2593360	2603400	it's low latency, a high latency network, but it's still on the internet. Yeah.
2604020	2608160	Why is patching so hard? I think we covered it, right? Some other questions to think about. I
2608160	2613260	think these are the sorts of things, to me, these questions, are what lets me get inside the head
2613260	2619000	of the people in IT and the people in management, so that I can better understand the problems
2619000	2623160	they're going with. And hopefully, this is a helpful exercise for you. And again, I'm willing
2623160	2628840	to talk and chat through any of these things with anybody. But this is the sort of thinking
2628840	2633100	that will get you to that high empathy state, so that you can relate to why they're having
2633100	2638200	problems and maybe help design solutions, instead of just, you know, flinging vulnerabilities out,
2638200	2644560	which is fun. Absolutely. But actually helping solve a problem will actually increase your
2644560	2651160	company's risk tolerance. All right. Equifax. Everybody knows this one. I'm not going to spend
2651380	2656120	a lot of time recounting what happened there. But let's just say Congress gets involved. And
2656120	2661320	if you're a private company and Congress starts interviewing you on stage, that's about as bad as
2661320	2666580	it gets, right? You're up there and they're going, they're wagging their finger at you. That's not a
2666580	2673760	good thing. And sort of the same results that we were talking about before, patching 99%,
2673760	2678080	only marginally better than patching one. You know, the CEO at one point was saying,
2678080	2684280	it was this one guy in the test unit who didn't patch his server. And that's why all of this
2684280	2689200	happened. And it's like, dude, you're missing the point, if you think that, right? You don't have a
2689200	2695740	process that covers your entire organization. It's on you. Yeah. And I think he went to jail
2695740	2699760	and a couple other people, like, because they all sold stock as soon as they heard the breach.
2699760	2705240	That's lesson number one. If you're involved in a breach, stop selling or buying stock.
2705680	2710640	Absolutely. Do not. Do not. Yeah. Planning for an incident. This is another one where they were
2710640	2715440	totally unprepared, right? I mean, it was just, it was like comical to watch those couple of
2715440	2725050	weeks afterwards. It was like, oh my God, what are they doing over there? Yeah. Some more big
2725050	2730710	questions to think about. And the one that I like here, and I'm as guilty of it as anybody, right?
2730710	2735510	This was victim blaming, right? Everybody was like, Equifax, you're horrible. What if somebody
2735510	2739890	showed up at their offices with a gun and stole the files? Would we say the same thing? And I
2739890	2745850	don't know why this is fundamentally different, but I guess it is. I don't know. But I mean,
2745850	2749570	you wouldn't expect them to have armored personnel carriers outside their office and
2749570	2754150	all of their staff wearing bulletproof vests so that they could fight off the guys who came
2754150	2760450	in with a gun to steal the files. But we expect that from them in a cyber realm. And, but it's,
2760450	2765330	you know, read the terrain. That's the way the world is, I guess, right now. But those are the
2765330	2770270	sorts of things I think about when I read these things. All right. A couple of documents, and I'm
2770270	2775510	going to wrap up because I'm probably going to get yelled at pretty soon. This is a great
2775510	2780430	document on what it takes to become a leader. There's a link to it on the bottom. The Cyber
2780430	2784350	Security Guide for Leaders in Today's Digital World from the World Economic Forum. Fantastic
2784350	2791450	document. These 10 things, like, just absolutely nail it for what you need to do to get to a
2791450	2798090	leadership role in cybersecurity. Best practices. These are the best practices from the ESI
2798090	2804190	Thought Lab piece. Again, I think really nails it. A different take on it because I think it's
2804190	2809490	from CISOs themselves, as opposed to folks on the outside. But fantastic. It really gives you
2809490	2815110	some great examples of what you can do to improve any cybersecurity program.
2815950	2822530	This is a method that I like. I've used it for a long time for how to build a cybersecurity
2822530	2827930	strategy. Sort of what's the funnel look like? What goes into that process? What are the things
2827930	2833430	that make up the levers that drive your cybersecurity strategy?
2835190	2839550	Great. Putting it all together. These are my closing thoughts.
2839770	2847310	Everybody talks about APTs and nation-state elite hackers. Yeah, they probably could get through
2847310	2851170	because they have unlimited time and budget, but they probably don't care about you. That's not
2851170	2856350	where I would spend most of my time. I mean, you got to do... but, you know, chances are
2856350	2859230	overwhelmingly you're going to get attacked. You're going to get owned by some
2859230	2866790	chintzy ransomware gang out of nowhere. If management makes bad decisions, there's not
2866930	2872550	a lot you can do other than be prepared with a response plan. Your job is to tell them when
2872550	2877110	they're making bad decisions. Even if they yell at you and say, why do you always shut down my
2877110	2882950	plans? Because your plans always suck. No, you have to do that. You have to have the emotional
2882950	2887750	courage to say, this plan is stupid, and I'm going to tell you this plan is stupid. I'm not
2887750	2894150	going to stop you from doing it, but I'm going to tell you that it's stupid. Yeah. The vast majority
2894150	2899410	of this stuff, almost all of it, like almost all of these things happen because we suck at inventory
2899410	2905710	and patching. Just suck at it. And I think the basics, and everybody says this, and it drives me
2905710	2910610	nuts when I hear it because it's like a platitude, but if we could patch our stuff and we knew where
2910610	2918030	our stuff was, 99% of this stuff wouldn't happen. If we did that and put MFA on all of our logins,
2918030	2921570	almost, it would be almost impossible. Like it would be really, this would be really, really
2921570	2926190	hard. You know, I say that and then they'll figure out 10 ways around that stuff. But
2926190	2931190	if we were just effective at this stuff, we would take off so much below hanging fruit.
2931730	2937590	Yeah. And these are the five rules about how to manage cybersecurity risk. Assign responsibility,
2937590	2943290	identify and quantify the risks, mitigation strategies, communicate. Like I said,
2943290	2948330	tell them when they're doing something stupid and make sure you highlight the risks. And plan for
2948330	2951130	when you fail, right? Because everybody's going to fail. You're going to be wrong. You're going to
2951130	2954710	be wrong. They're going to be wrong. Everybody's going to be wrong sometimes. You got to have a
2954710	2961690	plan to deal with that. And that's it for me. I'll hang around and chat and answer questions.
2961690	2966450	Peter, thank you so much. That was absolutely wonderful. And I missed the cat. I wish the
2966450	2973390	cat would come back more. Thank you. Thank you so much for having me. No problem. In addition to
2973390	2979210	Peter being in the chat to talk about this topic, he's also going to be available for career
2979210	2985790	coaching. So be sure to check out the schedule that's pinned in the Discord channel to sign up
2985790	2992250	to be coached by Peter. Peter, it was great seeing you. I'm sorry, I have to cut off and go to the
2992250	2995350	next one. Take care. Thank you very much. Bye-bye.