hi everyone and we're back from break um
and it's i'm just delighted that uh
detective sergeant chris spinks is with
us because he's doing a tremendous
amount for that next generation that has
been i think a theme that we've talked
about in terms of a lot of the
presentations today and it's certainly i
think the opportunity and the exposure
on things like our smaller community uh
uh our community events
in infosec is super important so without
further ado i give you a chris spinks i
was waiting for the round of applause
there but uh i've never had one before
so i shan't start now cheers guys before
you can sit back
sorry
are we still hot yeah i was just going
to say before we continue it's important
to point out that chris is not here to
arrest anybody yeah right well yeah and
we'll and i'll show up now and let you
continue yeah we were just talking about
like bodies all over the place at the
next vidcon i'm still note taking notes
right guys thank you so much for having
me on this is a tremendous um privilege
for me and i don't do too many public
talks which is probably why yeah cons
stay interesting and so i put a couple
of thoughts across when
mr fat hobbit gave me the opportunity as
something i might want to talk about um
so i came up with a title of our only
hope in innovation is cyber defence is
youth diversity and gender engagement
and so i kind of came up with a bit of a
blueprint but having said the word
diversity and gender engagement i'm now
going to duck before stu chucks a rant
at me or a theater fist or something
so who am i uh detective sergeant uh for
the yorks and humber regional organized
crime unit i've been in policing for 23
years
uh started off at the front line wearing
the funny bobble hat top out thing
and then working my way through to
intelligence which is where i spent a
few years doing sort of uh
some pretty sensitive intelligence areas
and then moved on into
seven years within cyber units and
that's been pretty much around the
incident response disaster recovery
assistance for small medium companies
large companies deal with themselves
and looking at what we can do to help
them and then looking at what drives the
investigations taking those nuggets of
the forensics from the back end of that
and trying to put it together and
finding that once again the threat actor
comes from a jurisdiction that we can't
touch
so that was great
um and then sort of five years the last
five years of my time have been
developing tech innovation teams
take innovation being around
law enforcement tech which they're still
in what they're still working on xp so
that's not difficult to
innovate there but in truth it's looking
at the problems
and looking at
how we can solve those problems it's
been really interesting
so uh pretty much this has been me when
i was more fit yeah i wish
pretty much this is me when i've when i
was sitting around being very bored as a
police officer but that's pretty much
what most police officers in policing
are doing is a traditional based
policing but when i moved to yorkshire i
was given the opportunity to start
developing years in industry for
computer science computer degree type
students at the time we had a henry
henry was
an intern and they had no idea what to
do with him they don't mind me saying
that so i came in and i still had no
idea but i made the choice to ask him
that's developed through i'll talk about
that journey but in the last 12 months
i've started my own company as well as
working in the police looking at digital
transformation because of what i've
learned
and that's uh that's been an interesting
journey in itself
so why why policing why are we talking
about cyber security
uh yeah pretty much everyone knows these
statistics they're made up they're taken
from cisco they're taken from ibm's cost
of data breach etc etc and we just know
that it's happening every 39 seconds
what a cyber attack is isn't defined so
look at the costs so this is for me
really what we're looking at increases
by nearly 300 over the covered times
and that's a huge increase that's what
uh you you sort of clever guys and uh
within the support and within the it
spheres are trying to cope with and
that's pretty horrendous
and we still look at
spam sixty percent malicious domains
fishing 80 reported security incidents
it still remains that user being the
issue i'd say stu i'm saying issue in a
kind and all-encompassing way
but i think user is definitely for me
where we need to be i was ashamed i
couldn't see the whole of matthew's talk
last i think it's probably going to send
around some of the same
and so it comes down to that why
well 80 data records compromised every
second
and payment fraud for 2024 looking
around 25 billion
on fraud
so this is
pretty much faceless for fraud but it's
very very much motivated by
money
so
the problem we've got in the uk is a
cyber shortage
really apparently
18 percent lack necessary tech skills 23
lakh communication leadership management
but for me communication here is really
the point
and 18
of job applicants lack communication
that's an interesting one to ponder
if we get into 41 percent like an
incident management investigation
digital forensics well that's a training
thing that's something that really that
can be built in but it comes back to
communication
and 36 percent likes to lack skills in
cyber security research
now this has been taken from ipsos
murray and department of culture media
and sport figures so can't be wrong
but
lacks cyber security research skills
pretty much everyone that i've worked
with through students in the last four
years
were pretty good on cyber security
research
so
i have to question really lack
or is this a communication issue
and we know full well we've heard it i'm
gonna um not cause a drinking fine by
saying there's a skills gap because
i disagree
i disagree there's a skills gap
up on the screen you can see a number of
people have reached notoriety good way
started their own companies
aged 22 14 12 17.
and t sphinx my son 10.
regularly beats the parent security
cross i can put in
i wouldn't say he likes skills
i'd like say he's lacked direction
or maybe all these people have got all
the skills we need
and actually what we're doing is we're
just not translating them properly
and then mca on the bottom
from 2015 figures um average age of
cyber crime suspect falling to 17.
well
cybercrime i
have my own feelings around the cyber
crime side i think the prevent needs to
be built up so we can uh divert and
bring them into uh blue teaming red
teaming i mean that's where the skills
are but again it points to not
necessarily a skills gap but maybe that
sort of translation error
so let's have a look at the problem 50
in the uk uh of companies have basic
technical skills
gaps are 680 000 companies in the uk
have a basic technical skills gap and
they define those skills gap
even sort of been able to store and
transfer public information private
identifiable information safely
detect remove malware setting up
firewalls i mean these are not big
skills to have i'm
pretty sure that a lot of the kids that
we've seen out there
could pretty quickly have these skills
and and help these 680 000 companies but
they're not being given the chance
so then just above the very strange
looking giraffe um 28
businesses offering internships
so
we've got 50 of all businesses
have basic skills gaps
and less than 20 and less than and just
over a quarter of businesses at the
whole of the uk are actually offering
any chance to gain experience and let me
tell you an internship is not expensive
it definitely shouldn't be free and i've
seen those questions on linkedin and
twitter and we should always be paying
our kids but
what are they actually going to do
i've had feedback from others going into
intern placements to say that their
first line they're answering phone calls
okay these are gifted individuals why
have we gotten answering phone calls i
know yeah character building i know yeah
so the answer they understand the
problem but
that's not giving them that real leg up
that real foot up
i've had others saying they're just
spending day and day out for 12 months
looking at pcap files looking at
anomalies sure
important understand that but for 12
months
we should be working better than this i
think
and these kids are our gateway
into
us when we're pensioners and i extend i
understand ian that i've got less years
than you to get to my pension age but
it's just because i had a light paper
round
but actually why are we asking are we
asking them for their thoughts are we
asking the kids and students coming
through on internships so we asking them
for how they feel we could do better
not usually
so cyber sector lacks skills but fails
to offer experience
and then boot ducks diversity chucking
in there but what are we looking at
ten percent of all cyber roles in
neurodivergent
that's
along onto the spectrum and autism
dyslexia dyspraxia it is calculated
that's
that's calculated that's where i come in
two percent of senior roles
are neurodivergent
so that's not translating to the top
three percent
of senior roles of women
ethnic minorities three percent of
senior roles one percent of senior roles
are disabled really isn't representing
society
i've seen some real opportunities here
some real potential for unconscious bias
recruitment issues
maybe this is part of the problem but
why is it important well
it's important because of two things
many things but two main things that i
said one
the attack
is coming from
society
if we don't represent society in our
cyber defense how do we understand what
that attack vector looks like what that
next attack
thought processes
and
how do we understand what our users are
doing we've heard in the last talk about
the user and understanding what that
user is going through
but if we don't reflect the user in our
staffing then how do we know what their
problems are how do we know why they're
circumnavigating the security controls
we don't
so it comes on to me telling you there's
a huge cyber crime problem as usual
that's me doing my policing bit and
being 10 years behind everything else
and the main attack vector is via the
user
nothing new there
we know companies can't recruit into
cyber roles they label skills to define
roles but that label i feeling is is
wrong this is where the labeling needs
to be redefined
and
funnily enough they fail to attract
relevant applicants and don't offer the
experience to those people in there and
of course we come on to the age old one
that we've seen many times that require
years of experience 10 years of
experience for kubernetes pretty sure it
hasn't been around for 10 years but i've
seen the adverts
asking for these unreasonable amounts
so effectively cyber sector our good
people all the people here do not
reflect the threat
and don't reflect the users
so let's quickly go through recruitment
heard it fantastic uh
yesterday to go through this from dan i
think it was superb summed out really
nicely but someone leaves a new role or
a new role is created
senior role
don't forget that
diversity-wise not reflection of society
at all but the senior role decides to
advertise
hr gets involved
not techy at all don't understand
anything and they deal with a strategy
they deal with getting that marketing
out there
and they use that existing role profile
because well bob's left so we need to
replace bob
with bob
that's not moving forward
and they send out that exciting advert
looking for their ideal candidate
yeah well
most people don't see it as an exciting
advert and has been said previously you
know they're asking for really
unrealistic
expectations on some really basic areas
and then hr do the paper shift
if it's automated or if it's not that's
not but hr do that paper shift
and
that means
that they've just missed
all the kids that didn't work their
applications right who have the skills
and i've been there and i've seen it
because for our intern placements
we have on the last count on the last
group 128 applications came in for five
rolls
and within those
the applications were awful
they were truly bad
because these are kids they're really
gifted kids but they're kids
and on a couple of
applications that came in i saw that
they'd answered one of my questions i
wrote the questions one of my questions
not applicable it's like you know i
wrote the question it probably is
applicable
but one of those one-line answers was
top 10 in the uk bug bounty for tesla
and microsoft
this kid's got skills but he would have
been missed had it gone through the hr
process i took him in
very short time later he was head hunted
by a fantastic pentest company superb
job done got him into cyber
then it comes down to the interview
that's when we start to get into the
reality of meeting people and maybe the
process can rectify itself but it's too
late so end up that we offer another
middle-aged guy with years of experience
the same experience as the last
middle-aged guy
so i think the problem is translation
younger and older generations just don't
get each other i speak to my kids i
speak to my son
and we have fallouts many times mostly
because of communication
because what he thinks are his skills
i don't see as a translation into real
world skills
but in truth they really are
he describes his skills differently and
experienced really differently but
actually when you look at that and
really delve into what he's saying as a
10 year old kid
there's real world opportunities
to put application in
and of course with younger generations
now and i speak as an older generation
despite my years
but as it's speaking to the younger
generations they're filled with
confidence
they are of a generation
and a lot of the speakers we've had here
are the same people
that are used to having information on
their fingertips
we can ask the voice assessment
voice assistant he says turning us off
before i say the word
we can ask google we can ask anything
else for information and it's there at
our fingertips why wouldn't
our younger generations be hugely
confident in their abilities
and this thing comes down to the fact
that
that confidence can sometimes come
across as arrogance
but this is where i say wait
these cultural differences are the same
as the societal differences
and this is again showing that split
where we're not pulling in from that
diverse background and part of the
reason for this
you could always have a cat picture this
has to be a cat picture
so the problem is the user we know that
it's called layer rate or whichever you
want to put it and not counting them out
because actually they're really
important but the user is the problem
the user needs training and educating
and the tech moves too fast for the
training to evolve
the user finds the tech training boring
and irrelevant
and the user is under increasing work
pressure so cats corners misses threat
identifiers
doesn't use mfa
uses easy passwords
prints out those documents sticks the
usb in boom company's just been taken
down
and of course now covered to come along
and the user
has just been moved away from the office
environment and
yep put into an uncontrolled environment
where they have their own iot their own
cameras their own wi-fi their own kids
using their own devices and using their
work devices to play games on and yep
updating and uploading those mods which
are infected
onto work devices and that's putting a
lot of strain on the gifted people here
that are working in input second
security
but it is the user that keeps the
business going
so my conclusion
is that to defend ourselves we need to
recruit better
and improving improvement will
absolutely help with bringing those new
ideas in from youth gender diversity
neurodiversity into the companies which
will help us defend better
and to change
we need the seniors those one percent
two percent three percent to trust and
listen to the juniors
because they know their chisel okay
there we are but
i know none of that's new and i can't
stand i'll sit in a beer con and put
across stuff that's not new
so before you rip me apart
there's a bigger
problem the user
the users out there the user
is always going to look to try and get
around your security
and yet we can do some phishing training
and yet we can do some awareness
training
but they don't think it's relevant
they don't think it's relevant because
just the same as when they're on
facebook or meta or whatever it's going
to be called
and instagram and snapchat and
everything else they're involved they're
as they're
involved in their phone they're
completely absorbed in their device
so they don't see the threat they don't
live the threat like we do
this is no great surprise to anyone we
know that the security layer builds on
more security but that takes away from
functionality so we need more functional
side of our product so we move it less
from security and more functional
but then it's yes usable
and it's that balance this is the
crucial point for me and having that
balance of where the user sits in that
triangle i think is key
so who could we possibly help that would
help those users at home and help us in
that balance
not joking
kids are me
kids from all over society
can help
and here's why they get tech
and they learn fast
they get tech because they live here
that's everything they do
we need a program that builds across the
country to teach our kids
to defend
through the basics remembering back 680
000 companies just in the uk alone don't
have basic security
so
let's get our kids to learn the basics
mfa password security not putting that
usb in
and we build peer teams of kids
now i'm saying kids i'm talking our
youth i'm talking across society
bringing in people from anywhere from
phd students right down through
cyber first and chucking it out there
anyone that comes in onto the scheme and
we build peer teams through this trusted
beer farmers network but people
ultimately who are trying to do some
good
and we build these peer teams out of the
kids and we put in those kids that would
have probably been on the wrong side of
sub compute misusage
and we send those peer teams out to
support the user through clinics and
surgeries
put them into our elderly places put
them into our care homes put them into
companies put them into universities put
them into churches
anywhere else and i think this may just
give us a real opportunity to provide
some meaningful support
to our communities
think of all those schools all as
parents that if their kids knew what
they were doing and they were trusted
because they're part of this security
peer team network
they could help their parents
their parents are the directors their
parents are the owners of the companies
and of course the benefit from that was
the kids they gained knowledge they
gained experience they gained experience
of talking audit they get experience of
talking assurance and all these lovely
bits that we enjoy spending our time
writing documents about and so they get
jobs
and the other benefit is the users are
then provided with a security letter
it's like a layer eight pairing security
layer
so what's appear to me
kids with all sorts of gifts all sorts
of experience
who can drop in they can get some
experience in red teams blue teams
yellow teams pink teams purple teams
whatever team you want to put them in
just give them short term experience
don't get them sitting watching the ecap
files or giving first tier response
let's get them across and get them
across the entire sector to get
meaningful experience
and we pull in kids that are completely
disenfranchised from schooling we pull
in kids that just are not interested in
mainstream schooling but let's get hold
of them let's put them in the peer teams
and let's drive them forward so that we
actually give them a future
and that can draw from anywhere in
society
that's everything
to give the user
some support
now i'm afraid i've finished a tiny bit
earlier than i'd hoped that's because i
got excited and ian knows what i'm like
so i just want to finish with a couple
of thank yous and that is very much
thank you to the beer farmers for this
absolutely awesome conference and to uh
for letting me present here because this
was something very different for
policing to be part of
and uh i also just want to quickly say
thank you to all the interns and
students that i've worked with in the
last four years for showing me what true
innovation is
and just
reminding me to think differently
so that's it from me thank you so much
for putting up with my waffle and i'll
let you get back to the real speakers
i think thank you hugely chris for
spinning sort of the
the viewpoint of everyone uh in that was
in our audience and attending the talks
today and anyone that will see that talk
in the future um i i kind of have a
question about like
it it's clear that you're working with
um you know the neurodiverse those
different communities i think
what's interesting is our business is
having those conversations with you as
well are you getting into those
companies and saying you know i've got
potentially um something that you should
pay attention to or something you should
embrace absolutely we are starting to
see that happen
and it's absolutely truly wonderful
because i do believe that the only way
that we can really start to make a
difference for both the kids that are
coming through our pipeline and for the
companies that are reaching out is to
work together we have to work smarter
because this is a fast revolving problem
that a sup than a siloed company can
evolve to
and as i've said already we've had
kids taken into
pen test companies we've had kids go
through to some fantastic companies
locally which is giving real opportunity
for those kids
but the great the main thing that
happens for me is that people don't just
see their application
because we're able to put these kids
into this into the companies for short
periods of time and that work with them
they realize that actually the
neurodivergence or the the cultural
difference or the gender difference or
anything else
really doesn't matter these kids and
these these young people are just gifted
individuals and they have wonderful
viewpoints that can really enrich any
company they go into
but for me this is why i think the
question doesn't come from what we can
do
as policing i've just done a proof of
concept that's all we've done here this
is not something particularly new
but this needs to really scale up across
the communities and start see where we
can really enhance digital
transformation across those companies
that would never even see the
opportunity for taking on an intern
yeah you said that you you i've only
done a proof of concept i i think you
can actually shorten that too at least
you've done something like i keep
hearing about problems in the industry
but i don't actually see the same people
complaining there's problems trying to
make solutions yeah or at least even
just go here's my idea i know it's crap
someone take it open source it do what
you want with it you build on it build
something and continue on
it's just uh here's a problem write them
off now bye okay
let's actually try and fix it so it's
awesome there's a lot of that around
yeah and it's obviously if you're not
part of the solution you're part of the
problem right yeah and it's a i think
it's a relevant thing to say the
feedback has been great uh you've
inspired somebody that's actually said
you've inspired them so that's that's a
that's a good outcome right i think he
was referring to the last speaker he was
just delayed on his text that's what it
was yeah
did he have an echo as well
but definitely uh definitely aimed at
yourself chris yeah absolutely brilliant
and
everybody can do more but it's great
seeing
it in action
and and it being outcome driven and
that's what everything really should be
about when we're talking about improving
life chances
for individuals whoever they are we've
seen that i was just going to say we've
seen that
for example one kid that came through
looked at one of the processes being
used by policing
to move images across get a hash for
that image move it across onto a file
create a couple of documents from it and
stick it out that was taking each copper
around an hour and a half to do
he automated it it took him a bit of
automation to pull it from the sources
and get it all hashed properly but he
automated it
the net saving for uk law enforcement
was estimated to be around six hundred
thousand pounds
for about four months of one young
person's work
but this process is now this process is
not unique to policing all the companies
out there that are manipulating
spreadsheets or doing payroll or doing
all these things
these kids can help them
yeah i i am
just as a camera final point for me
i attended a talk um at b-sides
manchester in 2017 and one of the the
speakers was talking about and i can
only cite the number that she used in
her talk so that's the other basis for
this statistic that i've got
but she said that
it was estimated that 42
of the people convicted of cyber crime
in the uk
were neurodiverse
and which is a high number relative to
the per capita
um
so rather than just kind of look at that
number and bemoan it has been a tragedy
the ncsc and law enforcement uk the nca
and all those people are actually trying
to
go into those environments and catch
these kids at a young age
and and put them on the right path
and get them into communities are
probably very similar people but doing
the right thing
before they get to that tipping point of
being
alone in their bedroom doing the wrong
thing
and i think that's fascinating i think
not a lot of people really understand
that that stuff goes on
um and you've highlighted an example of
it does go on and it's you know it's
fantastic it happens regularly and it's
the partnerships with companies out
there that provide like for example
gamified learning platforms and uh
hacking platforms and things like that
that work with us that allow us to then
put that diversion tactic in but it
needs to be better
yeah
there are other programs overseas i mean
i want to actually give them a shout out
because they're basically in the
netherlands they're doing they're doing
similar-ish stuff it's called hack right
they're fantastic and just the idea of
trying to get
kids who are bored to do the right thing
and actually help help policing help
businesses
help you keep people safe yeah that's
that's awesome
there it is
all right well we're gonna say goodbye
to chris goodbye chris thanks for having
me guys