WEBVTT 00:04.180 --> 00:07.500 And welcome back to the Career Hacking Village. 00:07.500 --> 00:18.200 We talk a lot about doing technology, but we never really talk about how do we present, how do we get things moving forward. 00:18.200 --> 00:28.520 And I'm really excited, I was really excited to see the proposal submission from my friend Peter Keenan to just really talk about hacking security leadership. 00:28.520 --> 00:30.000 So Peter, take it away. 00:30.000 --> 00:34.600 Thanks so much Kathleen, and thanks everybody for watching. 00:35.100 --> 00:41.100 Yeah, this is my first DEF CON presentation, so thanks for accepting it. 00:41.840 --> 00:45.680 All right, the obligatory who am I slide. 00:45.680 --> 00:53.640 So I have been in the information technology and information security space for about 30 years. 00:53.640 --> 00:59.680 You can see from these pictures there's at least three decades of bad haircuts there. 01:00.080 --> 01:06.820 I'm currently the chief information security officer for a global financial services company. 01:07.640 --> 01:14.320 You all are hackers, you can figure it out if you really want to, but I'm not allowed to use the name, so I'm not going to. 01:14.500 --> 01:29.120 Prior to the five and a half year stint I've had there, I was global head of information security governance at Citigroup, yeah, I owned a bunch of things like the global information security policy. 01:29.260 --> 01:34.280 I was a director with PricewaterhouseCoopers and their information security consulting group. 01:34.460 --> 01:46.440 I owned a firm that did information security consulting for about a decade, primarily to military and intelligence agencies, and spent a little time working in government service before that. 01:47.360 --> 02:03.300 Yeah, like I said, a lot of time in the space, and I have hopefully boiled down what I've learned in the last 30 some odd years into about 30 slides, which sounds terrible when I say it that way, that I'm getting like one slide a year, but sadly it's true. 02:03.840 --> 02:10.200 Yeah, two kids, 24 and 21, 31 years of marriage. 02:11.460 --> 02:14.800 All right, so I'm going to start with this CISO mind map. 02:14.800 --> 02:16.660 I think it's a great slide. 02:16.660 --> 02:26.820 I think this chart is really informative, sort of about the things that somebody in my position is thinking about on a daily, weekly, monthly basis. 02:26.840 --> 02:34.540 The area of this mind map that I'm going to focus on is selling information security. 02:34.540 --> 02:48.600 I think it's the area that people struggle with most as they transition their career from sole contributors or engineering types or very technical sort of roles to a leadership role. 02:48.600 --> 02:54.000 And it's probably the most important part of information security. 02:54.000 --> 03:05.040 If you boil information security down to its core nugget, the thing that's probably describes it best is influence without authority. 03:05.040 --> 03:20.400 And the ability to drive security through an organization without directly being able to control people's comp or control their, you know, performance reviews and all of those sorts of things is really the challenge that we face. 03:20.400 --> 03:24.280 I mean, some things we have direct control over, but by and large we don't. 03:24.280 --> 03:34.940 And we need to be able to convince people that this is the right thing to do both for their own personal gain, the company's gain, society's gain, all of those things. 03:35.820 --> 03:44.820 And that's why I think that's probably the core function that information security, probably the most important function within information security, because it's a force multiplier. 03:44.820 --> 03:51.260 If we can get the folks in the company all pulling in our direction, it multiplies our effectiveness dramatically. 03:51.660 --> 03:56.840 The thing I don't like about this part of it here, and, you know, maybe it's just me misreading it. 03:56.840 --> 03:59.020 I think the authors, like I said, did a great job. 03:59.460 --> 04:02.040 It feels like it's a lot of top down selling, right? 04:02.040 --> 04:12.480 And I think that that's good and it's important and it's what, you know, lets you keep your job as a CISO, convincing the, you know, the board and the CEO that you're doing a good job and security is important. 04:12.780 --> 04:14.060 You got to do that. 04:14.100 --> 04:27.180 But if you actually want to fix security at an organization, you've got to sell it from the bottom up because it's the people on the ground, the people at eye level who are actually doing the things that will make you more or less secure. 04:27.180 --> 04:31.000 And you've got to convince them that this is the right things to do. 04:31.000 --> 04:36.100 And these are the changes they need to make in their processes to be better. 04:36.100 --> 04:41.200 And you've got to provide them with ways of doing it that makes them more efficient, not less efficient. 04:41.380 --> 04:51.140 And, you know, it's a hard sell in a lot of cases with security because, you know, being frank, we're introducing overhead quite often to do things securely, right? 04:51.140 --> 05:02.620 I mean, the act of typing a password as opposed to just being on the system introduces overhead, but short-term overhead, long-term overhead, it obviously creates a lot of problems not having passwords. 05:03.540 --> 05:05.300 Amazon has three buckets. 05:05.320 --> 05:05.900 Yes. 05:07.260 --> 05:07.720 All right. 05:07.720 --> 05:23.800 So jumping ahead, the key language of business, and again, something that for me, I think is one of the really big differentiators between a sole contributor and a leader in the information security space is the language of risk. 05:24.060 --> 05:25.780 Business leaders understand it. 05:25.780 --> 05:35.760 They may not understand your specific technical domain, and they may not understand what a router or a switch is, but they understand the language of risk. 05:35.760 --> 05:38.180 And it's a language that we can meet in the middle with them all. 05:38.180 --> 05:48.000 We can meet in the middle with lawyers, with accountants, business people , the CEO, they will all get the idea of likelihood and impact. 05:48.960 --> 05:53.180 It's a problem for us in technical fields. 05:53.600 --> 06:01.080 In the words that I've highlighted on this page, uncertainty and probability, we struggle with that as a group. 06:01.080 --> 06:02.000 We do. 06:02.180 --> 06:05.580 We think about these things in absolutes like engineers. 06:05.580 --> 06:16.060 And I know that's a rough way of saying it, but too many times, it's really a struggle to drag an estimate out of somebody who's in a technical discipline. 06:16.060 --> 06:18.000 They want to have the right answer. 06:18.000 --> 06:24.460 With estimates, you're basically saying, I'm giving you the wrong answer, but I hope it's close. 06:25.960 --> 06:34.580 Somebody who's got an engineering training or a mathematical training, that makes the hair on the back of their neck stick up. 06:34.580 --> 06:35.480 What do you mean? 06:35.480 --> 06:37.540 I don't know the answer. 06:37.540 --> 06:39.240 There's no right answer. 06:39.240 --> 06:41.520 I'm just thumbing the area. 06:41.620 --> 06:43.600 I'm putting that in front of the CEO? 06:43.600 --> 06:44.780 Yeah, you are. 06:44.780 --> 06:46.340 That's what risk is. 06:46.360 --> 06:59.760 You take the best educated guess you can sometimes about the likelihood, which is a soft number, and the impact of these events occurring. 06:59.760 --> 07:02.340 And that's the way that you have to describe them. 07:02.840 --> 07:07.520 I often hear people say this phrase, and it drives me nuts, you can't predict the future. 07:08.560 --> 07:10.180 Absolutely, you can. 07:10.300 --> 07:12.760 I mean, with 100% certainty, no. 07:12.760 --> 07:16.040 But why else would we eat right and exercise, right? 07:16.120 --> 07:18.620 Because we don't think we're going to die in the next hour. 07:18.620 --> 07:20.080 We don't think we're going to die tomorrow. 07:20.080 --> 07:21.680 We don't think the world's going to end tomorrow. 07:21.680 --> 07:28.040 We don't think they're going to have miraculous cures for diabetes and obesity tomorrow, right? 07:28.040 --> 07:33.080 That's why we save money, because we think that we're going to live to an age where we're going to need money, right? 07:33.080 --> 07:37.740 There's a million predictions about the future we make every day, all of us do. 07:37.740 --> 07:40.460 And I think we just have to get comfortable with that. 07:41.600 --> 07:46.700 You can't predict it with 100% certainty, but that's okay. 07:46.700 --> 07:55.440 You have to be able to get comfortable with the uncertainty and probabilities and presenting your risks in that way. 07:55.500 --> 07:58.820 And it's got to be done. 07:58.840 --> 08:05.220 If you look at the way the businesses report, these things, they all know that they're not 100% accurate. 08:05.220 --> 08:07.480 And people yell at you when your risk is way off. 08:07.480 --> 08:09.620 But end of the day, you were clear. 08:09.620 --> 08:11.620 It's an estimate. 08:13.380 --> 08:13.800 All right. 08:14.680 --> 08:15.740 Two other things. 08:15.740 --> 08:17.200 One last thing on this one. 08:17.200 --> 08:20.480 This is one of my pet peeves about information security folks. 08:20.480 --> 08:29.020 When they're talking to non-security folks, lay people, FUD is the biggest thing that drives me nuts. 08:29.020 --> 08:34.640 And you see it, the salespeople do it, the engineers, when they get frustrated, they do it. 08:34.640 --> 08:38.660 They just throw out these FUD bombs of like, well, you never know. 08:38.660 --> 08:41.360 Could be the Russians, those Chinese. 08:41.360 --> 08:46.000 It's just, stop, don't do it. 08:46.060 --> 08:52.540 It may work in the short-term to win that short-term argument, but you will lose respect from everybody in the room. 08:52.540 --> 09:00.080 And that's one of the things that defines you as a leader is being able to hold and command that respect over time. 09:01.400 --> 09:02.760 All right. 09:02.760 --> 09:03.860 Risk strategies. 09:03.860 --> 09:08.840 These are some of the terms that you have to understand if you're going to communicate in risk. 09:08.840 --> 09:09.920 Risk reduction. 09:09.920 --> 09:11.980 This one's pretty straightforward, right? 09:12.200 --> 09:18.340 I have a thousand systems that are MS-0867 vulnerable. 09:18.840 --> 09:21.000 I patched 999 of them. 09:21.000 --> 09:22.080 Have I reduced the risk? 09:22.080 --> 09:23.040 Yeah, probably, right? 09:23.040 --> 09:24.420 That's risk reduction. 09:24.640 --> 09:34.100 There's still a risk out there that I missed one, or that the patch isn't fully effective, or somebody didn't reboot after the patch, or all of those things. 09:34.100 --> 09:40.920 But that's what that's about, reducing the risk associated with some adverse event out there. 09:41.260 --> 09:42.140 Acceptance. 09:42.480 --> 09:46.300 This is another one we struggle with as technology folks. 09:46.760 --> 09:49.900 There are some times the business is just going to go, yep, that's okay. 09:49.900 --> 09:50.780 I get it. 09:50.780 --> 09:51.540 I get it. 09:51.540 --> 09:55.740 There's a, you know, you say there's a 10% chance that this website will get hacked. 09:56.380 --> 09:57.860 I'm okay with it. 09:57.860 --> 09:59.380 It's only up for 30 days. 09:59.380 --> 10:00.800 I'll take that risk. 10:01.120 --> 10:04.280 And we all go, you know, it makes our heads explode. 10:04.280 --> 10:06.380 But absolutely, that's their call. 10:06.380 --> 10:14.940 Your job is to identify, as best as you can, quantify and report that risk. 10:14.980 --> 10:18.120 It's their job to say yes or no to that risk, right? 10:18.120 --> 10:22.520 The CEO, whoever's in charge of that business function, they get to decide that. 10:22.520 --> 10:28.600 And I know there's a great cartoon about their, you know, what's the magic word to get what you want? 10:28.820 --> 10:30.040 Risk accepted, right? 10:30.060 --> 10:37.440 And, you know, there are some people who will overuse it, but that's in a well-functioning organization, that's how that should work. 10:37.560 --> 10:38.360 Avoidance. 10:38.580 --> 10:45.400 We're going to go through some examples later, but the classic one is just don't be in that line of business that's going to create that risk, right? 10:45.400 --> 10:55.180 Don't launch that website that, you know, tweaks its nose at some hacker collective or, yeah, any of those sorts of things. 10:55.180 --> 10:57.100 Avoidance is pretty straightforward. 10:57.980 --> 11:00.960 And there are times when we're going to want to advise that. 11:00.960 --> 11:05.140 But again, business may just say, yeah, I understand. 11:05.260 --> 11:09.820 Avoidance is probably better, but we're not going to do it because it's too much of a gain for us in business. 11:09.820 --> 11:12.340 And I've seen a million cases where they were right. 11:12.460 --> 11:14.380 I counseled, don't do it. 11:14.380 --> 11:17.420 And they said, well, we're going to make $300 million off of that. 11:17.420 --> 11:19.400 So we're going to do it anyway. 11:19.600 --> 11:21.800 And, you know, they were right. 11:23.080 --> 11:25.140 Transfer, risk transfer. 11:25.140 --> 11:28.260 This is the classic cyber insurance, right? 11:28.260 --> 11:36.520 And that's, you know, I think there's a lot of uncertainty around cyber insurance at this point, but this is the classic way of dealing with risk. 11:36.520 --> 11:39.600 And I think this will get better over time. 11:39.960 --> 11:42.900 The last one is probably the most common in this area. 11:42.900 --> 11:43.600 And that's hope. 11:43.600 --> 11:45.560 You just hope you don't get hacked. 11:45.620 --> 11:48.160 And you see it over and over and over again. 11:48.160 --> 11:56.400 Every day you see, you know, tons of people putting stuff on the internet and, you know, just hoping that bad things don't happen. 11:57.940 --> 11:58.600 All right. 11:58.720 --> 12:02.580 So I have a cat and she shares this office with me. 12:02.580 --> 12:04.160 So there's nothing I can do. 12:04.280 --> 12:04.920 Yeah. 12:04.920 --> 12:07.000 There's no risk avoidance on that. 12:07.240 --> 12:09.320 This was her office for the last five years. 12:09.320 --> 12:11.500 And I've only been working here for the last couple of months. 12:11.500 --> 12:14.240 So she'll pop in and out of frame on the background. 12:15.960 --> 12:16.460 Yeah. 12:16.460 --> 12:17.820 Her name is Schrodinger. 12:18.240 --> 12:19.080 All right. 12:19.080 --> 12:22.180 So risk, appetite, and tolerance. 12:22.180 --> 12:27.840 These are some other terms that you're going to need to know to speak the language of risk. 12:27.840 --> 12:32.540 Risk appetite is the amount or the type of risk that your organization is willing to take. 12:33.360 --> 12:34.400 Thank you. 12:35.720 --> 12:39.740 Every organization is going to have a different risk tolerance level. 12:40.400 --> 12:44.800 It's very much organization specific, right? 12:44.800 --> 12:47.460 Financial services tend to be more risk averse. 12:47.780 --> 12:53.660 Startups or tech companies tend to be more risk favorable where they'll just take chances. 12:53.940 --> 12:55.240 Particularly if you're a startup, right? 12:55.240 --> 12:56.380 I mean, what have you got to lose? 12:56.380 --> 13:00.960 A lot less than a hundred and something year old global investment bank, right? 13:00.960 --> 13:04.420 I mean, it's just those are the sorts of decisions that they're going to make. 13:04.420 --> 13:08.360 Your job is to understand what the risk appetite of folks is. 13:08.360 --> 13:13.500 And the description below is great because this is the tricky part. 13:13.500 --> 13:15.760 If you could just say, what's your risk appetite? 13:15.760 --> 13:18.540 And people could say seven and you'd be seven. 13:18.680 --> 13:21.860 There is no numeric value like that. 13:22.760 --> 13:34.800 Everybody's going to have a different definition and you're going to have to speak to a lot of people and you're going to have to deal in fuzzy terms to get a sense for how people want to deal with this, right? 13:34.800 --> 13:44.440 Whether or not they want to be able to say, you know, it's a dollar value or none, right? 13:44.440 --> 13:48.180 Like, you know, CEO is going to be like, no, what do you mean getting hacked? 13:48.180 --> 13:50.800 You're saying you want to know how often I want to get hacked? 13:50.800 --> 13:52.060 The answer is never, right? 13:52.060 --> 13:53.780 I mean, like, you know, I can get hacked for free. 13:53.780 --> 13:56.600 What am I paying you for if we're going to get hacked, right? 13:57.640 --> 14:02.840 CFO is probably going to set aside some money for this and say, put aside $8 million a year. 14:02.840 --> 14:06.480 So if you can exceed that, let me know and we'll budget some more for next year. 14:06.980 --> 14:09.060 You know, and everybody else is going to have a different view of it. 14:09.060 --> 14:15.600 Your job is going to be to consolidate all of that and come up with a security controls that are appropriate to those risks. 14:16.940 --> 14:17.520 Yeah. 14:17.520 --> 14:18.220 Thank you. 14:18.220 --> 14:19.080 Thank you. 14:20.040 --> 14:20.740 All right. 14:21.600 --> 14:23.140 Risk impact levels. 14:23.140 --> 14:33.080 This is an interesting diagram and I think it's a great way, after you've had all those conversations, to communicate this back to the folks, right? 14:33.080 --> 14:48.380 To communicate this back to senior leadership and say, based on what I heard from all of you, and this is just an example from the site that's listed below, these are the sort of numbers or metrics I've come up with to calculate our risk levels, right? 14:48.380 --> 14:51.520 Whether something's a low impact, medium impact, or high impact. 14:51.520 --> 14:56.200 And get everybody to just sort of nod yes, so that there's at least a common understanding of the term, right? 14:56.200 --> 15:11.160 It's a lexicon that will help you build common understanding and get people, you know, when a bad event occurs, everybody sort of freaks out initially, but then you sort of can go back to this and say, listen, this is what we agreed to. 15:11.160 --> 15:18.180 This is in line with what we've communicated to the board, to the CEO, and it gets everybody back to at least level set. 15:20.980 --> 15:25.140 All right, managing cybersecurity risk and preparation. 15:25.200 --> 15:33.600 So this is just a framework that I like to use for how you would do all of these things, right? 15:33.600 --> 15:39.640 You've got to build a team, diversity on that team, so important from all aspects of it, right? 15:39.640 --> 15:43.660 The type of people, the type of education, the type of functions that they've served. 15:44.140 --> 15:49.760 The more viewpoints that you have on your team, the better you're going to be. 15:49.760 --> 15:56.440 And this is another thing that I see a lot of technical folks, and I've been guilty of it in my past. 15:56.520 --> 15:59.700 We hire people that look a lot like ourselves, right? 15:59.700 --> 16:02.660 And I don't mean that necessarily physically, but like I'm an infrastructure guy. 16:02.660 --> 16:03.980 That's where I come from. 16:03.980 --> 16:06.680 I love routers and switches and networks. 16:06.680 --> 16:13.860 And, you know, early on in my career, I thought those were the people that knew the most because they understood the things that I understood. 16:13.860 --> 16:19.920 And as I've grown, I think I tend to gravitate more towards people who know things that I don't. 16:19.920 --> 16:23.560 And I just ask them questions all day every time I meet with them. 16:23.560 --> 16:26.200 And I think that's made me a better leader. 16:26.200 --> 16:34.420 And I think that's probably the most important part of building a team when it comes to risks, because you've got to understand it from every angle if you're going to manage it effectively. 16:35.140 --> 16:39.420 Structure, you've got to assign formal responsibility for these things. 16:39.420 --> 16:42.260 I know a lot of people say risk is everybody's responsibility. 16:42.400 --> 16:46.280 Yeah, but if you say it's everybody's job, then it's nobody's job. 16:46.280 --> 16:47.680 It's got to be somebody's job. 16:47.680 --> 16:49.520 It's got to be somebody's responsibility. 16:49.520 --> 16:56.080 And you've got to give them the freedom and the ability to actually manage around that risk. 16:58.940 --> 16:59.960 Managing the risk. 16:59.960 --> 17:01.980 We talked about a bunch of these things already. 17:02.060 --> 17:04.320 Understanding your company's cyber risk profile. 17:04.320 --> 17:06.220 How likely are you to get attacked? 17:06.220 --> 17:07.060 How often? 17:07.060 --> 17:08.880 Who's going to come after you? 17:08.900 --> 17:12.580 What is your risk appetite? 17:12.580 --> 17:14.740 What is the impact of you getting hacked? 17:14.740 --> 17:18.600 Is it the type of business where Congress is coming after you? 17:19.000 --> 17:23.020 All of those things have to factor into your management of risk. 17:23.780 --> 17:30.880 Get as many viewpoints from the outside, law enforcement, your peers, industry groups as you possibly can. 17:30.960 --> 17:41.500 And then constantly updating your profile, your processes so that you're integrating the latest and greatest techniques for managing this stuff. 17:41.500 --> 17:47.920 The last part of this, probably the most important, what do you do when you're wrong? 17:47.920 --> 17:54.440 When you've calculated all of these things and the worst still happens, have a crisis response plan. 17:54.440 --> 18:01.740 I think during this year, it's like if anybody is arguing this point, you got to go, what are you thinking, right? 18:01.740 --> 18:04.700 I mean, we've had all of this craziness this year. 18:04.700 --> 18:11.400 I live in New York City and it's just, you know, I can't, you know, we were waiting for locusts, right? 18:11.400 --> 18:14.680 I mean, it just, you know, everything went wrong. 18:14.680 --> 18:23.620 And if you can't sell this now, you should probably think about moving jobs, right? 18:23.620 --> 18:28.660 This is as important as anything could be at this point, right? 18:28.660 --> 18:30.660 What do you do when you're wrong? 18:31.640 --> 18:32.640 All right. 18:33.400 --> 18:36.360 So I'm going to jump into a little bit of psychology. 18:36.360 --> 18:46.220 And I think this is one of the areas, again, that I think technology people, and I hate making generalizations, but I feel like I'm talking about myself here. 18:46.220 --> 18:49.840 So I've lived with this my whole life. 18:49.840 --> 18:55.740 We're not great sometimes at empathy and we're not great at understanding people's motivations. 18:55.740 --> 18:57.360 We know what they did. 18:57.380 --> 19:01.800 And maybe technically we know why they did it, but we don't know emotionally why they did it. 19:01.800 --> 19:09.500 And I've spent the last probably 15 years really focusing myself on trying to develop that part of my personality. 19:09.500 --> 19:15.720 So I could understand why people make the decisions that they do instead of just going, what the hell is wrong with you? 19:15.720 --> 19:17.020 What were you thinking? 19:17.020 --> 19:19.860 I'm actually trying to ask, hmm, that's interesting. 19:19.860 --> 19:22.140 What were you thinking instead of what the hell is wrong with you? 19:22.140 --> 19:23.000 What are you thinking? 19:23.000 --> 19:30.140 So this chart, I think it came from a Bill Gates presentation a while ago. 19:30.200 --> 19:31.240 I love it. 19:31.840 --> 19:37.060 If you ask people what they're worried about, what scares you? 19:37.060 --> 19:46.580 They'll be like terrorists, murderers, all these things that just are very, very, very... sharks. 19:46.580 --> 19:48.200 People are worried about sharks. 19:48.200 --> 19:48.840 You kidding me? 19:48.840 --> 19:49.760 Sharks? 19:49.960 --> 20:04.160 The chances of getting hit by, by getting killed by a shark, like, or you stand a better chance of buying two winning lottery tickets while getting hit by a meteor than you do of getting attacked by a shark. 20:04.600 --> 20:09.200 If you look at this chart, you can see some of the reasons for it, right? 20:09.200 --> 20:14.400 You know, the media tells you, you know, media doesn't report about people having heart attacks. 20:14.400 --> 20:15.900 They report about terrorism. 20:15.900 --> 20:17.800 Terrorism sells newspapers, right? 20:17.800 --> 20:21.620 I mean, like, it's such a rare event. 20:21.620 --> 20:24.100 Those aren't the things you should be worrying about. 20:24.100 --> 20:27.560 And, and in the information security space, there's lots of this, right? 20:27.560 --> 20:30.460 People talk about Stuxnet a lot. 20:30.700 --> 20:36.700 There's one Stuxnet, you know, and there's, there are APTs out there, and some of us have to deal with that. 20:37.160 --> 20:38.880 It's really rare. 20:38.880 --> 20:39.840 It's really rare. 20:39.840 --> 20:45.080 Chances are you're going to get owned by a mediocre ransomware crew. 20:45.440 --> 20:47.560 I mean, that's just, you know, probability. 20:48.020 --> 20:49.560 Overwhelmingly, that's who's going to own you. 20:49.560 --> 20:52.380 And we certainly had a lot of evidence of that this year. 20:52.400 --> 20:59.200 And, and I think there's a couple of biases at play here that I'm going to talk through in a little bit more detail. 20:59.440 --> 21:04.140 Public service announcement on this stuff, though, it freaks people out. 21:04.240 --> 21:10.800 When you reveal to them their cognitive biases, it pisses them the ass off. 21:10.800 --> 21:15.720 Like people will get really, really mad at you when you highlight this stuff to them. 21:16.100 --> 21:18.400 They killed Socrates for it, basically. 21:18.400 --> 21:21.840 So, you know, this is not new, but it's absolutely true. 21:21.840 --> 21:25.380 People do not like to deal with the fact that they have cognitive biases. 21:25.380 --> 21:31.880 So public service announcement, use this internally in your inside voice, don't necessarily communicate it to the folks in the room. 21:31.880 --> 21:34.560 I love this graphic up in the corner here, though. 21:34.560 --> 21:40.540 I mean, people have been talking about like, how social media is being used to change our politics. 21:40.580 --> 21:45.700 And this, you know, most of you are probably too young to even know what a TV guide is. 21:45.700 --> 21:50.400 But this TV guide from the 1980s basically had the same message about television, right? 21:50.400 --> 21:51.700 I mean, it's not new. 21:51.700 --> 21:55.360 This, you know, the foreign state actors are controlling the elections. 21:56.260 --> 21:58.680 They've been doing, you know, it's old hat. 21:58.680 --> 22:00.420 We've seen this a million times. 22:01.880 --> 22:02.860 All right. 22:03.040 --> 22:07.180 So if I can get my presentation to work again. 22:07.180 --> 22:08.240 All right, here we go. 22:09.600 --> 22:12.260 Why are people so bad at estimating risk? 22:12.260 --> 22:13.520 The optimism bias. 22:13.520 --> 22:16.660 This is the first one of the biases that I'm going to talk to you about. 22:18.580 --> 22:19.800 It's really funny. 22:19.800 --> 22:21.320 It's not really funny, I guess. 22:21.320 --> 22:24.800 But when you ask people, what are your chances of getting cancer? 22:25.460 --> 22:26.640 They'll give you a number, right? 22:26.680 --> 22:28.620 Estimate your percentage chances of it. 22:28.620 --> 22:30.120 And they'll say something like 10%. 22:30.120 --> 22:31.320 Or 60%. 22:31.320 --> 22:33.580 Because they, you know, most people have no idea. 22:34.920 --> 22:38.100 If they say 10%, the answer is 30%, right? 22:38.100 --> 22:46.480 It's like, it's, you know, we have so much data on this, we know how many people get cancer, we know what percentage, it's, you know, it's pretty, pretty solid, right? 22:46.600 --> 22:47.860 It's 30%, right? 22:47.860 --> 22:49.600 30% of people get cancer. 22:49.800 --> 22:58.600 And, but if people underestimate and say 10%, and then you give them the answer and say it's 30%, they'll go, nah, for me, it's 10%. 22:58.600 --> 22:59.500 You go, why? 22:59.580 --> 23:01.120 I just feel that way. 23:01.200 --> 23:07.200 But if they say it's 60%, and then they learn it's 30%, they'll be like, oh, no, yeah, no, I'm better than that. 23:07.200 --> 23:07.840 I'm like 20. 23:07.840 --> 23:13.100 They'll adjust dramatically, if they overestimate, but not if they underestimate. 23:13.120 --> 23:21.560 And I think this bias carries through in all aspects of our life, where nobody thinks that they are below average at anything. 23:22.100 --> 23:26.120 And this is, this is like a psychological fact you can prove over and over again. 23:26.120 --> 23:29.680 90% of drivers think they're above average drivers , right? 23:29.680 --> 23:37.060 Which is, you know, demonstrably false, of course, but there's very few people who admit they are a below average driver. 23:37.060 --> 23:45.520 And anybody who spent any kind of time on New York City's will know that that is definitely not true, particularly among the taxi set. 23:45.860 --> 23:49.940 So how does this translate to information security? 23:50.220 --> 24:00.220 I've linked to a report that I did some work on, and I was part of the advisory team for this ESI Thought Lab piece, which was published about a month ago. 24:00.220 --> 24:01.580 It's a great report. 24:01.580 --> 24:03.900 I'm not just shilling it because I was involved with it. 24:03.900 --> 24:08.320 I actually think it's great, but you can read it and make your own determination. 24:08.320 --> 24:15.800 There's some great data in there about what the chances are of having a breach. 24:15.800 --> 24:26.040 And they did a lot of great work around looking at the, you know, the entire universe of companies and what percentage of them actually suffered breaches during the previous year. 24:26.040 --> 24:34.760 And if you go with the moderate or material level, people estimated 45% said, you know, that was our chance. 24:34.760 --> 24:35.980 And it's way higher. 24:35.980 --> 24:40.180 It's almost double that for a lot of industries, their chance of actually getting breached. 24:40.260 --> 24:43.480 So people do not believe they're going to get hacked. 24:43.480 --> 24:49.680 Even after they've been hacked, they will still believe their chances of getting hacked again are way lower than they actually are. 24:49.680 --> 24:53.020 And it's just a cognitive bias that you have to get people passed. 24:57.060 --> 24:58.800 Why are people so bad at estimating risk? 24:59.140 --> 24:59.980 Availability bias. 24:59.980 --> 25:01.000 This is the second one. 25:01.000 --> 25:04.000 And this is, you know, got a couple of my favorite examples in it. 25:05.420 --> 25:08.780 Australia's national terrorism threat level is probable. 25:09.020 --> 25:19.340 And if you look at the data, I think, like, two people had been killed in terrorist incidents in a 20-year period in Australia. 25:19.640 --> 25:22.420 It's like, I don't think you know what the word probable means. 25:22.420 --> 25:27.840 I mean, like, it's a terrible, these are terrible things, they're terrible tragedies, every one of them horrible and shouldn't happen. 25:27.840 --> 25:47.080 But that's not what the word probable means, and I think we struggle with these things that are emotional and impactful like that, and estimating them in sort of cold calculated terms so that we can get an accurate perception of risk. 25:47.180 --> 25:51.940 And nobody wants to say, that's ridiculous, a terrorist attack is not probable, right? 25:51.940 --> 25:58.940 It's just, you know, it's just, it's emotionally, it just doesn't make us feel good to say things like that. 25:58.940 --> 26:00.740 And there's a bunch of other examples here, right? 26:00.740 --> 26:10.140 Like the shark attack one is just my favorite, like 186 in 20 years, among 6 billion people. 26:10.140 --> 26:17.160 I mean, that's like, that's less, I don't even know how to describe that as it's so infinitesimally small, right? 26:18.340 --> 26:23.140 Yeah, I guess I could do the math and actually come up with a number, but it's really, really small. 26:23.180 --> 26:30.700 And, you know, if you look at like, there was this huge warnings about Zika, and I mean, it's just, it was very, very small. 26:31.220 --> 26:34.600 And I think we have to take those things into perspective. 26:34.600 --> 26:39.000 And this is what keeps us from getting into the FUD area when it comes to information security. 26:39.080 --> 26:49.460 Look at the numbers, look at the data and figure out what the real risks are and what really is probable and what really is likely and what really isn't. 26:49.640 --> 26:55.660 And yeah, the good news is we generally don't have to deal with, you know, people dying and all of that kind of thing. 26:55.660 --> 26:59.000 It's just like a computer getting hacked and some guy losing money or something. 26:59.000 --> 27:02.420 So it's not, it's not as serious and it's not as emotional, but it still is. 27:02.420 --> 27:08.500 I mean, people, people will generally, you know, you get hacked in a material way, people are losing their jobs, right? 27:08.500 --> 27:10.680 I mean, it's just, that's sort of the way that that works. 27:10.680 --> 27:13.760 And people will get emotional and defensive about it. 27:13.760 --> 27:20.140 Like I said, when you expose a cognitive bias, it's like, ah, makes their head explode and they freak out on you. 27:21.120 --> 27:23.160 All right, learn helplessness. 27:23.160 --> 27:24.280 This is the other one. 27:24.280 --> 27:27.280 Oh my god, I see this one so often. 27:27.560 --> 27:29.160 They're like, why are we patching? 27:29.160 --> 27:30.900 Everybody gets hacked anyway. 27:31.060 --> 27:32.140 What's the deal? 27:32.140 --> 27:32.820 Who cares? 27:32.820 --> 27:34.780 You know, like everybody gets hacked anyway. 27:34.780 --> 27:36.460 It's not like I can stop these hackers. 27:36.460 --> 27:42.100 I mean, like there's a big group of people who think the hackers are all powerful and they can't be stopped anyway. 27:42.100 --> 27:43.340 So why are we bothering? 27:43.460 --> 27:53.560 I mean, at least three times, every, every time I teach information security awareness, at least one person comes up to me and say, why are we bothering? 27:53.560 --> 27:55.380 Everybody's getting hacked anyway. 27:55.380 --> 27:58.500 Like I click, you know, you can't stop people from clicking. 27:58.500 --> 28:00.380 Why are you bothering teaching this? 28:00.380 --> 28:04.200 And it's just the wrong way to look at this, right? 28:04.380 --> 28:06.080 Nothing is ever perfect. 28:06.080 --> 28:07.680 Nothing in life is perfect. 28:08.220 --> 28:10.140 But you can make it better. 28:10.140 --> 28:17.760 And that's the message that you have to communicate to folks, that it's never going to be perfect, but we can get better every day. 28:21.100 --> 28:22.060 Yeah. 28:23.920 --> 28:27.480 I'm not sure whose quote that was at the end of this, but it's great. 28:27.480 --> 28:29.620 You can't spend your way out of cyber problems. 28:29.620 --> 28:31.880 It's like exercise and eating right. 28:32.000 --> 28:34.160 You just have to wake up every morning and do it. 28:34.160 --> 28:36.240 And that is absolutely the truth. 28:36.240 --> 28:41.800 You can't buy enough things to fix cybersecurity. 28:41.800 --> 28:46.660 You actually have to do the work and that's hard for people to accept. 28:47.000 --> 28:55.060 And I think, um, yeah, it takes a while to get people over that, but, you know, there's no, I'm going to patch and be done. 28:55.060 --> 28:57.340 It's you're going to patch today and you're going to patch tomorrow. 28:57.760 --> 29:02.920 And, you know, they're going to feel like Sisyphus pushing that rock up the hill and waiting for it to roll back on. 29:02.920 --> 29:05.000 But that's, that's sort of the game. 29:05.000 --> 29:10.600 Every patch Tuesday is the Microsoft Sisyphean rock coming to roll, roll over you down the hill. 29:13.390 --> 29:14.390 This is so weird. 29:14.390 --> 29:19.010 I feel like I should stop and ask for questions, but there's nobody to ask questions of. 29:19.010 --> 29:19.310 All right. 29:19.310 --> 29:20.650 So we're going to keep going. 29:21.330 --> 29:28.450 Um, anybody who hasn't read Cliff Stoll's book, The Cuckoo's Egg, please stop listening to me right now. 29:28.450 --> 29:30.410 Go buy the book and read it right now. 29:30.410 --> 29:38.470 This is absolutely required reading for anybody who wants to develop a career in information security, particularly if you want to be a leader. 29:38.470 --> 29:50.950 It's unbelievably still prescient about, you know, this happens in the eighties and people are using analog modems and dial-up terminals and TTY green screens, the kind of stuff that I grew up on. 29:50.990 --> 29:57.070 Um, but it's still really, really applies to today. 29:57.070 --> 29:59.370 All of the same principles apply. 29:59.370 --> 30:03.290 And he has a great quote from, from a Sam's conference not too long ago. 30:03.290 --> 30:13.990 Um, this was in 2017 where he's talking about, you know, how he found these guys in his system and he was trying to convince people they needed to do something about this. 30:14.310 --> 30:21.670 And he said, well, I thought all I had to do was show them the data and they'd understand, but it turns out I had to, I had to tell a story. 30:21.910 --> 30:25.010 And that's what people will respond to is a story. 30:25.050 --> 30:26.910 And, and absolutely. 30:27.250 --> 30:28.670 Um, he learns that lesson. 30:28.670 --> 30:31.430 And I think as we read the book, um, we do too. 30:31.430 --> 30:32.430 It's a great read. 30:33.910 --> 30:35.630 Cannot recommend it highly enough. 30:35.790 --> 30:36.470 Absolutely. 30:36.590 --> 30:39.990 Uh, you, you should, you should go and buy and read that book. 30:43.510 --> 30:43.930 All right. 30:43.950 --> 30:49.610 Here's some thoughts I had about selling I, uh, security to IT. 30:52.020 --> 30:55.240 We think, well, we're all technology folks. 30:55.640 --> 31:04.560 We've got a similar mindset, so this should be easy and it's not, it's not impossible, but it has its challenges, very different mindsets. 31:04.560 --> 31:09.920 IT people, they care about uptime costs and user experience. 31:10.320 --> 31:14.300 Um, they, they, that is what they get comped on, right? 31:14.300 --> 31:15.660 That's what they get paid on. 31:15.660 --> 31:17.220 What was the uptime? 31:17.220 --> 31:18.940 Did they deliver the features? 31:18.980 --> 31:20.520 Are the users happy? 31:20.760 --> 31:26.260 I don't want to say they don't care about security, but it's, it's not one of their goals, right? 31:26.260 --> 31:29.120 I mean, like they'll tell you it's one of their goals, but it's really not. 31:29.120 --> 31:37.500 It's, you know, it's one of the things that's adjacent to their goals and we have to convince them that security will help those three. 31:37.500 --> 31:40.020 And there's a few strategies to do that. 31:40.820 --> 31:44.960 Um, you got to get them over the hurdles of some of these things here. 31:46.240 --> 31:47.460 I got a firewall. 31:47.460 --> 31:48.640 I bought a firewall. 31:48.640 --> 31:49.480 I plugged it in. 31:49.480 --> 31:52.440 I'm secure, but there's an any, any rule at the front of it. 31:52.780 --> 31:55.400 Why would they sell me a firewall that isn't secure? 31:55.400 --> 31:57.060 Why would Cisco do that to me? 31:57.060 --> 32:01.100 It's like, you know, that's, that's not how firewalls work. 32:01.100 --> 32:06.620 That's not how life works, but, um, yeah, you have to do the work to get them through that. 32:06.660 --> 32:11.740 Um, they'll tell you about their audit and regulatory reports, all of these sorts of things. 32:12.020 --> 32:22.520 Um, and, and your strategy for selling them is going to be to show them it's going to be a story, but it's going to be a story with data, right? 32:22.520 --> 32:27.620 I think pen tests are a great way to do this, where you show this guy walking through their environment, right? 32:27.620 --> 32:30.000 And you've got to make them as close to real life as possible. 32:30.000 --> 32:39.140 I think there's a big part of this where you're going to need to convince them that that data is not manufactured and all of those sorts of things. 32:39.140 --> 32:40.720 And you're going to have to help partner with them, right? 32:40.720 --> 32:42.860 You, you can't throw them under the bus. 32:42.860 --> 32:44.520 You can't sell them out to audit. 32:44.680 --> 32:49.800 Sometimes you have to, but you generally, those, you want those to be your last resorts. 32:49.800 --> 33:03.180 You want to help them and enable them to make themselves more secure without affecting their uptime too much, without affecting their ability to deliver features and without driving their costs through the roof. 33:03.180 --> 33:08.320 I think this is one of the things we're really bad at security is we push that cost. 33:08.680 --> 33:14.640 Hey, we were cost neutral this year, but we, you know, caused IT to double their, their budgets. 33:17.880 --> 33:21.740 The strategies, like I said, fear, uncertainty, and doubt, awful. 33:21.740 --> 33:22.900 Don't do it. 33:22.900 --> 33:24.820 Wrap them out to management. 33:26.140 --> 33:26.940 Yeah. 33:26.940 --> 33:31.500 The availability bias, just put it in their face every day. 33:31.500 --> 33:33.880 That kind of works, believe it or not. 33:34.820 --> 33:36.600 Demonstrate their fallibility. 33:36.600 --> 33:40.400 This is one of those things that will help with the optimism bias. 33:40.400 --> 33:50.340 If you demonstrate clearly that they are capable of making mistakes, they'll be angry at first, but generally if they're professionals, they'll get over it and want to be better. 33:50.560 --> 33:51.520 Metrics. 33:52.600 --> 33:54.180 This is hard to argue with. 33:54.180 --> 33:56.320 Patching metrics, fantastic. 33:56.580 --> 33:59.900 Just cold, hard facts about patching metrics. 33:59.920 --> 34:06.800 And then a story to go with it that says, here's, you know, MS-867, here's MS-1710. 34:06.840 --> 34:10.660 And if you have this open, this is the horrible things that happen to you. 34:10.660 --> 34:16.340 And this is how many systems we have open and show the trend so that people get a story out of it. 34:16.960 --> 34:18.160 Pay for it. 34:18.160 --> 34:19.580 Put it in your budget. 34:20.140 --> 34:22.100 The more tools that you can get in your budget. 34:22.100 --> 34:27.280 And listen, right now we've got insecurity, a huge advantage, right? 34:27.280 --> 34:31.060 I think everybody, cyber is the cool thing at the board table. 34:31.060 --> 34:33.380 If you ask for money, it's very hard for them to say no. 34:33.380 --> 34:36.340 If IT asks for money, it's really easy for them to say no. 34:36.680 --> 34:41.800 So I think it's, that's one of the ways that you'll win people over. 34:42.760 --> 34:46.100 And of course you're going to have to have air cover from the board and senior management. 34:48.080 --> 34:49.100 All right. 34:50.540 --> 34:52.380 Selling security to the board. 34:52.600 --> 34:54.060 This is a challenge, right? 34:54.060 --> 34:56.800 I think it's not as much of a challenge now as it used to be. 34:56.800 --> 34:58.560 I think boards have really focused on this. 34:58.560 --> 35:11.160 And I think boards, they want to know, you know, they all know this is a risk and they want to know that somebody is covering them to make sure that they are doing the bare minimum, you know, not the bare minimum, but they're doing the things that they need to, 35:11.160 --> 35:15.040 to make the company secure from, from cyber attacks. 35:15.340 --> 35:18.300 Most of them don't have a technical background. 35:18.300 --> 35:21.840 Almost none of them have a cyber security related background. 35:22.140 --> 35:28.820 And you're going to need to figure out ways to communicate to them in fairly simple terms. 35:28.820 --> 35:30.760 This is the way that I do it. 35:30.880 --> 35:42.200 I've got these pretty simple four questions that I use and I find it really helps me get the message across in a succinct one slide presentation. 35:42.440 --> 35:47.340 And then I usually have some, some details behind it, but I don't want to inundate them with data. 35:47.340 --> 35:53.260 I know that some people's strategy is just throw everything in the deck and, you know, this way you're ready for any question. 35:53.260 --> 35:58.440 I think these four are the only four questions that a board member really cares about, but every board is going to be different. 35:58.440 --> 36:00.680 So are we compromised right now? 36:00.680 --> 36:00.900 Right. 36:00.920 --> 36:03.520 Everybody, this is one that scares security people. 36:03.520 --> 36:04.260 Like how would I know? 36:04.260 --> 36:10.480 Oh my God, they're going to, you know, you've got to give them a high, medium, and low, and some reasoning why you think that. 36:10.480 --> 36:11.440 How vulnerable? 36:11.440 --> 36:13.300 Again, this is even fuzzier. 36:13.740 --> 36:14.960 High, medium, or low? 36:14.960 --> 36:16.120 Why do you think that? 36:16.120 --> 36:17.440 Who might attack us? 36:17.440 --> 36:18.500 What would they use? 36:18.500 --> 36:20.140 And how are we defending against it? 36:20.140 --> 36:21.700 Just a couple of sentences. 36:23.080 --> 36:31.040 How are we going to address, you know, because there's so much uncertainty in this, how are we going to address that next level of threats? 36:31.040 --> 36:32.720 And this is early on in the presentation. 36:32.720 --> 36:38.920 I love those maps with the dragons at the end of the earth and falling off the end of the earth, the uncertainty bit. 36:38.920 --> 36:40.300 That's why they used to draw those, right? 36:40.300 --> 36:42.540 Because nobody knew what was on the other side of those maps. 36:42.540 --> 36:43.700 And that's fun, right? 36:43.700 --> 36:46.880 You know, the dragons at the end of the map are fun. 36:48.500 --> 36:49.100 Yeah. 36:49.100 --> 36:51.320 And then what's our plan if we do get compromised? 36:51.320 --> 36:53.700 Like I said, you have to have thought through this. 36:53.700 --> 36:55.640 You have to be able to communicate this. 36:56.880 --> 37:01.160 Some of the things that I've got at the back end of this deck are folks who didn't, right? 37:01.160 --> 37:03.560 Some examples of folks who struggled with that. 37:04.100 --> 37:04.760 All right. 37:04.980 --> 37:07.300 I'm going to move along a little bit here. 37:08.360 --> 37:08.900 Yep. 37:08.900 --> 37:12.600 Here's some other examples of things that you can communicate to the board. 37:12.600 --> 37:17.420 Some metrics, agree on metrics, make your metrics consistent and show a trend over time. 37:17.420 --> 37:18.900 That's what they're going to understand. 37:18.900 --> 37:23.120 They're not going to know what an attempted attack means, but they're going to want to know, am I getting more? 37:23.120 --> 37:23.820 Am I getting less? 37:23.820 --> 37:24.680 Are they getting better? 37:24.680 --> 37:25.460 Are they getting worse? 37:25.460 --> 37:30.460 Those are the sorts of things that a board and senior management is going to want to understand. 37:32.060 --> 37:35.020 I think this is another great way to report risk. 37:35.900 --> 37:42.220 How is high, medium, low risk and impact on our core risks? 37:42.220 --> 37:44.920 What are those core risks around cybersecurity that we face? 37:44.920 --> 37:46.240 What's the trend? 37:46.440 --> 37:50.660 What do you view the residual risk after the controls that you've put in place? 37:50.660 --> 38:01.580 It's the difference between inherent risk, which is the risk as it stands naturally, and residual risk, which is the risk after the controls and mitigations you put in place to deal with that risk. 38:03.040 --> 38:05.520 All right, so here's some case studies. 38:05.520 --> 38:07.500 Everybody probably remembers this. 38:07.500 --> 38:08.000 H.P. 38:08.000 --> 38:15.920 Gary, CEO of the company, got up there and said really bad things about Anonymous and how he was all up in their business. 38:15.920 --> 38:19.420 And this ended really, really badly for him. 38:19.420 --> 38:24.900 He taunted Anonymous and they went through him like a hot knife through butter. 38:24.900 --> 38:31.280 They owned him three ways from Sunday to wiping his personal iPad at the end of the attack. 38:31.280 --> 38:38.920 I mean, it was just completely unprepared for the onslaught that came his way. 38:40.340 --> 38:47.360 Yeah, there's a great video if you ever have a chance to Google it on YouTube. 38:48.960 --> 38:53.000 I can't remember the guy's name, but one of the late night comedians does about this hack on H.P. 38:53.000 --> 38:54.520 Gary, it's fantastic. 38:57.440 --> 39:02.920 So the other one that I'd like to talk about here in the same kind of group is Sony Pictures, right? 39:02.920 --> 39:13.080 And this got all wrapped into politics, but end of the day, they made a movie that was poking the eye of the dictator of North Korea, right? 39:13.840 --> 39:26.280 And you just go, you know, risk avoidance, somebody should have said, you know, you could just call it something else, not North Korea, and you wouldn't piss these guys off so much. 39:26.600 --> 39:33.520 Again, they went through these guys like a hot knife through butter, and they owned them three ways from Sunday, released movies, dumped all their emails. 39:33.520 --> 39:35.000 It was just horrible. 39:35.760 --> 39:46.080 And, you know, if you look at the common elements here, they were engaged in an activity that was not universally admired, right? 39:46.080 --> 39:48.480 I mean, you pissed somebody off. 39:48.620 --> 39:52.480 Management didn't understand how dangerous that adversary was. 39:52.480 --> 40:02.600 The information security controls were not up to the task of defending against somebody who, you know, is very well prepared to attack you. 40:02.600 --> 40:05.520 And the attackers have all the advantage in that space, right? 40:05.520 --> 40:14.820 So, you know, from then, and then, you know, obviously, neither of them was prepared with any kind of response once this had happened, right? 40:14.820 --> 40:26.520 None of them had any kind of a disaster recovery or recovery strategy at all, it seemed, to deal with these things, you know, they were both on pen and paper for months afterwards, supposedly. 40:27.200 --> 40:31.200 You know, and the responses were, you know, followed the standard script there at the bottom. 40:33.800 --> 40:40.220 Right, so here's our lessons, you know, from this is my view of it, don't pick fights with people who have nothing to lose. 40:40.280 --> 40:44.500 You know, you have everything, I mean, literally, they have nothing to lose, you have everything to lose. 40:44.500 --> 40:45.860 That's dumb, right? 40:46.160 --> 40:53.620 Private companies with, you know, profit loss calculations, if they go against people who don't, that's going to end badly for you, right? 40:53.620 --> 40:56.480 They got all the time and energy in the world. 40:56.840 --> 41:00.840 You know, if you give somebody that much leeway, they're going to get through. 41:01.600 --> 41:03.700 Know your enemy and yourself. 41:03.880 --> 41:07.460 No cybersecurity presentation is complete without a Sun Tzu quote. 41:08.640 --> 41:11.720 All right, just some questions to think about, right? 41:11.720 --> 41:20.160 There's a great statement in the Sony case that came out maybe a year before, it's a valid business decision to accept the risk of a security breach. 41:20.160 --> 41:23.880 I will not invest 10 million to avoid a possible $1 million loss. 41:23.880 --> 41:25.440 That's a valid statement. 41:25.520 --> 41:30.440 The problem is, he was totally wrong about the amount of loss, right? 41:30.440 --> 41:36.540 I mean, totally , way, hundreds of times off base on the order of magnitude there. 41:36.540 --> 41:38.480 And that was the issue. 41:41.560 --> 41:43.480 I want to cry and not patch it. 41:43.560 --> 41:45.580 And I think I'm wrapping up my time here. 41:45.580 --> 41:50.100 So I'm going to talk through these next few slides fairly quickly. 41:50.100 --> 41:51.820 And I'm happy to chat about these. 41:52.460 --> 41:55.380 Afterwards, I'll be on chat. 41:55.380 --> 42:00.540 So obviously, everybody knows what these were from 2017. 42:00.760 --> 42:04.920 Big Worms, MS-1710, spread through the networks. 42:05.180 --> 42:14.160 Want to cry was an amateur version, not patch it was like, you know, somebody who knew what they were doing said, hold my beer, watch this and just let loose on the world. 42:14.160 --> 42:17.720 I don't think it meant to spread as far as it did, but it sure did. 42:17.720 --> 42:19.360 And boy, was it a whopper. 42:20.520 --> 42:22.280 It taught me a few things, right? 42:22.280 --> 42:24.440 Patching is not optional, right? 42:24.440 --> 42:28.100 And I think IT will tell you, why would I patch? 42:28.100 --> 42:32.780 Every time I patch, I lose 2% of my systems or whatever percent of my systems. 42:33.520 --> 42:35.660 And here's why, right? 42:36.920 --> 42:39.460 You just got to patch everything. 42:39.460 --> 42:43.980 And it's not the same as it used to be where you had security through obscurity. 42:44.420 --> 42:45.780 Shodan's out there, man. 42:45.780 --> 42:48.700 And they can scan your whole network in seconds. 42:48.700 --> 42:51.580 And they will find every single one that you didn't patch. 42:51.580 --> 42:57.900 So patching 99% is marginally better than patching nothing, because they'll find that 1%. 42:57.900 --> 43:02.720 And then, if you got hit with not patching, it was it. 43:02.720 --> 43:04.160 They just needed to find one. 43:04.440 --> 43:09.700 And there's a bunch of other things here that are pretty relevant, like email, having email. 43:09.860 --> 43:11.980 So it's not connected to the internet, but it's got email. 43:11.980 --> 43:13.200 That's the same thing. 43:13.200 --> 43:17.780 Maybe it's low latency, a high latency network, but it's still on the internet. 43:19.160 --> 43:19.280 Yeah 43:23.040 --> 43:23.400 . 43:24.020 --> 43:25.420 Why is patching so hard? 43:25.420 --> 43:26.540 I think we covered it, right? 43:26.540 --> 43:28.060 Some other questions to think about. 43:28.060 --> 43:39.820 I think these are the sorts of things, to me, these questions, are what lets me get inside the head of the people in IT and the people in management, so that I can better understand the problems they're going with. 43:39.820 --> 43:42.360 And hopefully, this is a helpful exercise for you. 43:42.360 --> 43:45.760 And again, I'm willing to talk and chat through any of these things with anybody. 43:45.800 --> 43:59.040 But this is the sort of thinking that will get you to that high empathy state, so that you can relate to why they're having problems and maybe help design solutions, instead of just, you know, flinging vulnerabilities out, which is fun. 43:59.320 --> 44:00.360 Absolutely. 44:00.440 --> 44:07.420 But actually helping solve a problem will actually increase your company's risk tolerance. 44:08.300 --> 44:08.760 All right. 44:08.800 --> 44:09.640 Equifax. 44:09.640 --> 44:10.600 Everybody knows this one. 44:10.600 --> 44:13.560 I'm not going to spend a lot of time recounting what happened there. 44:13.560 --> 44:16.040 But let's just say Congress gets involved. 44:16.040 --> 44:22.340 And if you're a private company and Congress starts interviewing you on stage, that's about as bad as it gets, right? 44:22.600 --> 44:25.780 You're up there and they're going, they're wagging their finger at you. 44:25.780 --> 44:27.320 That's not a good thing. 44:28.400 --> 44:35.720 And sort of the same results that we were talking about before, patching 99%, only marginally better than patching one. 44:35.920 --> 44:42.760 You know, the CEO at one point was saying, it was this one guy in the test unit who didn't patch his server. 44:42.760 --> 44:44.720 And that's why all of this happened . 44:44.740 --> 44:48.100 And it's like, dude, you're missing the point, if you think that, right? 44:48.280 --> 44:51.640 You don't have a process that covers your entire organization. 44:51.640 --> 44:52.660 It's on you. 44:53.280 --> 44:53.840 Yeah. 44:53.840 --> 44:59.760 And I think he went to jail and a couple other people, like, because they all sold stock as soon as they heard the breach. 44:59.760 --> 45:01.120 That's lesson number one. 45:01.120 --> 45:05.240 If you're involved in a breach, stop selling or buying stock. 45:05.680 --> 45:06.560 Absolutely. 45:06.740 --> 45:07.520 Do not. 45:07.520 --> 45:08.340 Do not. 45:08.340 --> 45:08.800 Yeah. 45:08.800 --> 45:09.720 Planning for an incident. 45:09.720 --> 45:12.040 This is another one where they were totally unprepared, right? 45:12.040 --> 45:16.260 I mean, it was just, it was like comical to watch those couple of weeks afterwards. 45:16.260 --> 45:19.760 It was like, oh my God, what are they doing over there? 45:20.740 --> 45:23.990 Yeah. 45:24.430 --> 45:26.510 Some more big questions to think about. 45:26.510 --> 45:30.710 And the one that I like here, and I'm as guilty of it as anybody, right? 45:30.710 --> 45:32.290 This was victim blaming, right? 45:32.290 --> 45:34.690 Everybody was like, Equifax, you're horrible. 45:34.950 --> 45:38.470 What if somebody showed up at their offices with a gun and stole the files? 45:38.470 --> 45:39.670 Would we say the same thing? 45:39.670 --> 45:43.770 And I don't know why this is fundamentally different, but I guess it is. 45:43.770 --> 45:44.870 I don't know. 45:45.010 --> 45:55.730 But I mean, you wouldn't expect them to have armored personnel carriers outside their office and all of their staff wearing bulletproof vests so that they could fight off the guys who came in with a gun to steal the files. 45:55.730 --> 45:58.170 But we expect that from them in a cyber realm. 45:58.370 --> 46:01.990 And, but it's, you know, read the terrain. 46:01.990 --> 46:03.530 That's the way the world is, I guess, right now. 46:03.530 --> 46:07.730 But those are the sorts of things I think about when I read these things. 46:08.670 --> 46:08.890 All right. 46:08.890 --> 46:13.630 A couple of documents, and I'm going to wrap up because I'm probably going to get yelled at pretty soon. 46:14.550 --> 46:17.710 This is a great document on what it takes to become a leader. 46:17.710 --> 46:19.230 There's a link to it on the bottom. 46:19.590 --> 46:23.710 The Cyber Security Guide for Leaders in Today's Digital World from the World Economic Forum. 46:23.910 --> 46:25.330 Fantastic document. 46:25.330 --> 46:32.890 These 10 things, like, just absolutely nail it for what you need to do to get to a leadership role in cybersecurity. 46:34.610 --> 46:35.830 Best practices. 46:35.830 --> 46:39.150 These are the best practices from the ESI Thought Lab piece. 46:40.110 --> 46:42.230 Again, I think really nails it. 46:42.230 --> 46:47.670 A different take on it because I think it's from CISOs themselves, as opposed to folks on the outside. 46:47.670 --> 46:48.790 But fantastic. 46:48.790 --> 46:55.110 It really gives you some great examples of what you can do to improve any cybersecurity program. 46:55.950 --> 46:57.910 This is a method that I like. 46:57.910 --> 47:03.370 I've used it for a long time for how to build a cybersecurity strategy. 47:03.370 --> 47:04.790 Sort of what's the funnel look like? 47:04.790 --> 47:06.750 What goes into that process? 47:06.990 --> 47:13.430 What are the things that make up the levers that drive your cybersecurity strategy? 47:15.190 --> 47:15.870 Great. 47:15.870 --> 47:17.490 Putting it all together. 47:17.490 --> 47:19.550 These are my closing thoughts. 47:19.770 --> 47:24.670 Everybody talks about APTs and nation-state elite hackers. 47:25.550 --> 47:30.770 Yeah, they probably could get through because they have unlimited time and budget, but they probably don't care about you. 47:30.770 --> 47:32.910 That's not where I would spend most of my time. 47:32.910 --> 47:38.170 I mean, you got to do... but, you know, chances are overwhelmingly you're going to get attacked. 47:38.170 --> 47:42.710 You're going to get owned by some chintzy ransomware gang out of nowhere. 47:42.910 --> 47:50.710 If management makes bad decisions, there's not a lot you can do other than be prepared with a response plan. 47:50.810 --> 47:53.970 Your job is to tell them when they're making bad decisions. 47:53.970 --> 47:57.730 Even if they yell at you and say, why do you always shut down my plans? 47:57.730 --> 47:59.010 Because your plans always suck. 47:59.010 --> 48:01.810 No, you have to do that. 48:01.810 --> 48:07.570 You have to have the emotional courage to say, this plan is stupid, and I'm going to tell you this plan is stupid. 48:07.570 --> 48:10.730 I'm not going to stop you from doing it, but I'm going to tell you that it's stupid. 48:12.270 --> 48:12.970 Yeah. 48:13.130 --> 48:20.370 The vast majority of this stuff, almost all of it, like almost all of these things happen because we suck at inventory and patching. 48:20.370 --> 48:22.210 Just suck at it. 48:22.210 --> 48:34.250 And I think the basics, and everybody says this, and it drives me nuts when I hear it because it's like a platitude, but if we could patch our stuff and we knew where our stuff was, 99% of this stuff wouldn't happen. 48:34.250 --> 48:39.670 If we did that and put MFA on all of our logins, almost, it would be almost impossible. 48:39.670 --> 48:42.450 Like it would be really, this would be really, really hard. 48:42.770 --> 48:46.070 You know, I say that and then they'll figure out 10 ways around that stuff. 48:46.070 --> 48:51.190 But if we were just effective at this stuff, we would take off so much below hanging fruit. 48:51.730 --> 48:52.330 Yeah. 48:52.330 --> 48:55.950 And these are the five rules about how to manage cybersecurity risk. 48:55.950 --> 49:02.530 Assign responsibility, identify and quantify the risks, mitigation strategies, communicate. 49:02.530 --> 49:07.870 Like I said, tell them when they're doing something stupid and make sure you highlight the risks. 49:07.870 --> 49:09.070 And plan for when you fail, right? 49:09.070 --> 49:10.110 Because everybody's going to fail. 49:10.110 --> 49:10.850 You're going to be wrong. 49:10.850 --> 49:11.510 You're going to be wrong. 49:11.510 --> 49:12.150 They're going to be wrong. 49:12.230 --> 49:13.950 Everybody's going to be wrong sometimes. 49:13.950 --> 49:15.650 You got to have a plan to deal with that. 49:16.570 --> 49:17.670 And that's it for me. 49:17.670 --> 49:20.170 I'll hang around and chat and answer questions. 49:21.330 --> 49:23.210 Peter , thank you so much. 49:23.210 --> 49:24.670 That was absolutely wonderful. 49:24.690 --> 49:26.010 And I missed the cat. 49:26.010 --> 49:27.950 I wish the cat would come back more. 49:29.290 --> 49:30.030 Thank you. 49:30.030 --> 49:31.530 Thank you so much for having me. 49:31.530 --> 49:32.450 No problem. 49:32.450 --> 49:40.110 In addition to Peter being in the chat to talk about this topic, he's also going to be available for career coaching. 49:40.410 --> 49:48.750 So be sure to check out the schedule that's pinned in the Discord channel to sign up to be coached by Peter. 49:48.750 --> 49:50.050 Peter, it was great seeing you. 49:50.050 --> 49:53.090 I'm sorry, I have to cut off and go to the next one. 49:53.090 --> 49:53.970 Take care. 49:53.970 --> 49:54.810 Thank you very much. 49:54.810 --> 49:55.350 Bye-bye.