1 00:00:00,000 --> 00:00:05,609 to run official engagement and probably to run any engagement so this really 2 00:00:05,609 --> 00:00:08,700 should be simple right fishing is actually from a technical perspective 3 00:00:08,700 --> 00:00:15,000 one of the easiest things to do in what in guardians does you know what we do at 4 00:00:15,000 --> 00:00:18,330 this conference in terms of penetration testing and red teaming in all the 5 00:00:18,330 --> 00:00:22,799 different kinds of security things really easy to make a make a crafty 6 00:00:22,800 --> 00:00:26,849 email that doesn't involve any Nigerian Prince's that tries to get someone to go 7 00:00:26,849 --> 00:00:30,630 to a website you build a 14 website too 8 00:00:30,630 --> 00:00:35,339 I don't say maybe collect credentials or give somebody malware get some malware 9 00:00:35,340 --> 00:00:41,910 put on your computer you get your client to your boss to approve of that website 10 00:00:41,910 --> 00:00:45,148 and that email you send email those many people as you can you watch the 11 00:00:45,149 --> 00:00:48,780 passwords fly-in and sometimes you get so you get lucky and it really is this 12 00:00:48,780 --> 00:00:52,020 easy you can expect about somewhere between 10 and forty percent of the 13 00:00:52,020 --> 00:00:57,149 people that you send a good email to to give you their password and i gotta say 14 00:00:57,149 --> 00:01:00,930 it's a wonderful feeling just watching the passwords kind of fly in at first 15 00:01:00,930 --> 00:01:05,040 and then trickle in overtime and you're like this is great why I spent all this 16 00:01:05,040 --> 00:01:08,700 time on home ability research and all this i can i can just get access 17 00:01:09,210 --> 00:01:14,639 um and you know to that end one of my colleagues Larry Page she once had a 18 00:01:14,640 --> 00:01:21,570 fishing campaign with the success rate in excess of a hundred percent the and 19 00:01:21,570 --> 00:01:26,850 the deal was the company targeted a just a small subset of its employees and his 20 00:01:26,850 --> 00:01:32,669 old action his give us your password or cutting your access off and you're gonna 21 00:01:32,670 --> 00:01:36,750 get fired and the brothers gonna burn down and it's all gonna be your fault 22 00:01:36,750 --> 00:01:41,640 that back hold action scared the crap out of them well enough that uh that 23 00:01:41,640 --> 00:01:45,329 they not only gave them their props where they formed around to other people 24 00:01:45,329 --> 00:01:48,570 who haven't gotten the email they went according to their other email accounts 25 00:01:48,570 --> 00:01:54,298 and they sent it to like those privileged separate accounts one that 26 00:01:54,299 --> 00:01:57,479 didn't get email but like almighty a counter don't want my domain admin 27 00:01:57,479 --> 00:02:04,950 account to get caught off and and so he did greater than a hundred percent so so 28 00:02:04,950 --> 00:02:08,330 i'm going to talk about going to talk about kind of why we fish and then 29 00:02:08,330 --> 00:02:12,650 to tell you about alvin all the ways it's gone wrong for us or for people we 30 00:02:12,650 --> 00:02:13,190 know 31 00:02:13,190 --> 00:02:16,280 yeah I'd like to save face and say whenever this happens that my own 32 00:02:16,280 --> 00:02:18,680 company this is all stuff that happened somewhere else 33 00:02:18,680 --> 00:02:24,200 so why do you fish in the first place of the official engagement should make it 34 00:02:24,200 --> 00:02:28,970 so that everybody individually gets better at spotting fishing at spotting 35 00:02:28,970 --> 00:02:34,490 official email and not getting and so they don't get tricked by it um it 36 00:02:34,490 --> 00:02:37,940 should increase every person individuals resilience but you're going to find out 37 00:02:37,940 --> 00:02:41,120 later in this talk it should also make the whole organization better at 38 00:02:41,120 --> 00:02:44,000 figuring out what's going on and communicating it to everybody else and 39 00:02:44,000 --> 00:02:49,880 very very quickly as a group detecting you and causing you to fail so the cool 40 00:02:49,880 --> 00:02:53,180 thing is after you do this a couple times the employees of companies tend to 41 00:02:53,180 --> 00:02:54,260 get better 42 00:02:54,260 --> 00:02:58,730 yeah and no reported higher percentages and we'll talk about that so so 43 00:02:58,730 --> 00:03:03,200 officials this simple and if it's really obvious why we should do it then why am 44 00:03:03,200 --> 00:03:08,089 i giving a talk of like I didn't want to speak at Derby con but there was more 45 00:03:08,090 --> 00:03:11,990 than that and this is this talk is one that honestly we give inside our own 46 00:03:11,990 --> 00:03:17,239 company that we the we kind of keep passing on this kind of knowledge that 47 00:03:17,239 --> 00:03:21,709 we've gained and also we don't make quite the same mistakes so most people's 48 00:03:21,709 --> 00:03:26,570 first few attempts they don't go this well and and is how when I'm you know 49 00:03:26,570 --> 00:03:30,620 I'm one of the owners over in guardians and I would watch person after person 50 00:03:30,620 --> 00:03:36,440 get assigned to official engagement and gets so frustrated with what the clients 51 00:03:36,440 --> 00:03:39,800 were asking for how the clients were getting in their way or how is taking 52 00:03:39,800 --> 00:03:43,580 longer than it should and and that frustration after a while you're like 53 00:03:43,580 --> 00:03:48,860 okay we've got to figure out what we can do that were not frustrated in our jobs 54 00:03:48,860 --> 00:03:51,410 that were feeling great about what we did 55 00:03:51,410 --> 00:03:54,950 we're feeling great about it we're having great success and and we're 56 00:03:54,950 --> 00:03:59,660 enjoying our work so the rest of this talk is basically looking at frustrating 57 00:03:59,660 --> 00:04:04,070 situations we've had and try to teach you how to avoid them entirely and 58 00:04:04,070 --> 00:04:09,560 achieve greater success so here's a quick summary one of things I want to 59 00:04:09,560 --> 00:04:12,799 say is this isn't about this isn't really strictly about red team fishing 60 00:04:12,799 --> 00:04:15,190 we do that too and you'll tend to 61 00:04:15,190 --> 00:04:18,160 into these challenges quite so much because it's a different beast and I'll 62 00:04:18,160 --> 00:04:22,150 talk about that here and there so 12 stories of failure with our specific 63 00:04:22,150 --> 00:04:26,320 solutions and you're gonna see me get into some themes and it's basically that 64 00:04:26,320 --> 00:04:30,099 if you're setting up any professional fishing campaign you're going to end up 65 00:04:30,100 --> 00:04:34,150 in communication you're going to end up collaborating and you're gonna end up 66 00:04:34,150 --> 00:04:38,440 negotiating and the more you do those three things the better your it goes 67 00:04:38,440 --> 00:04:41,740 actually it turns out this is really useful for all the kinds of engagements 68 00:04:41,740 --> 00:04:45,430 we do in our work and if you're not liking your it and you're not 69 00:04:45,430 --> 00:04:49,180 consultants you're going to find its exact same way for you with this stuff 70 00:04:49,180 --> 00:04:54,400 it's going to be well it turns out your client is basically your boss or your 71 00:04:54,400 --> 00:04:59,020 organization uh you know your your client is the part of the people you're 72 00:04:59,020 --> 00:05:03,700 trying to help though your client contact is basically your boss whoever 73 00:05:03,700 --> 00:05:05,830 owns this project above you 74 00:05:05,830 --> 00:05:09,010 i'm going to talk and I'm going to going to talk about these three things 75 00:05:09,010 --> 00:05:14,650 collaboration communication and negotiation a bunch as we go through one 76 00:05:14,650 --> 00:05:18,729 of the things i want you to get from this is that anything in life that 77 00:05:18,730 --> 00:05:23,320 involves more than one person any conversation any well not even spoken 78 00:05:23,320 --> 00:05:27,099 but any anything in life involve more than one person involved negotiation 79 00:05:27,100 --> 00:05:32,020 it's often not negotiation you you're even conscious too but i'm basically in 80 00:05:32,020 --> 00:05:36,099 one right now with all of you right i'm i'm asking you to stay 81 00:05:36,100 --> 00:05:39,940 i'm making a bid not just for you to stay in the room but i'm making a bit 82 00:05:39,940 --> 00:05:43,690 for your attention and that's the negotiations happening here will come 83 00:05:43,690 --> 00:05:50,169 we'll come back to that theme so I do want to say real quick that uh this talk 84 00:05:50,169 --> 00:05:55,180 is basically about penetration testing fishing fishing engagements in this are 85 00:05:55,180 --> 00:05:58,000 trying to hit the entire organization 86 00:05:58,000 --> 00:06:01,150 we're trying to find out how every single person as many people as possible 87 00:06:01,150 --> 00:06:03,909 response will tell you about the organization as a whole 88 00:06:03,910 --> 00:06:06,940 we're trying to measure something we're trying to make you better and we're 89 00:06:06,940 --> 00:06:10,390 trying to make everybody better resisting so that's what we call a 90 00:06:10,390 --> 00:06:14,860 penetration test fish in a red team situation and you'll notice the golden 91 00:06:14,860 --> 00:06:17,590 gardens folks around the conference you're going to start you know now that 92 00:06:17,590 --> 00:06:23,530 I pointed out you're going to see all of the big logos um we are doing we also do 93 00:06:23,530 --> 00:06:24,179 red team 94 00:06:24,180 --> 00:06:27,960 working in the red teaming work you're looking for much smaller target pole 95 00:06:27,960 --> 00:06:31,620 you're gonna send one or two emails maybe ten the most but you're sending a 96 00:06:31,620 --> 00:06:36,030 few emails as few phishing emails as it takes to get access you're going to 97 00:06:36,030 --> 00:06:39,359 manually determine who it is that you're gonna be targeting you're going to be 98 00:06:39,360 --> 00:06:42,360 using some of the open-source reconnaissance tools out there might be 99 00:06:42,360 --> 00:06:46,830 as simple as LinkedIn or connect kamar looking at the company's website and you 100 00:06:46,830 --> 00:06:50,070 end up being really really targeted you're focused on a roll you're gonna be 101 00:06:50,070 --> 00:06:54,270 sending you've got a word macro deliver you're going to be sending it to someone 102 00:06:54,270 --> 00:06:58,198 in HR who looks at resumes all the time is quite used to opening every word 103 00:06:58,199 --> 00:07:06,960 document their scent so okay let's go 12 stories uh let's see I'm going to keep 104 00:07:06,960 --> 00:07:10,770 saying you're gonna hear me say or going to hear you say client you're gonna hear 105 00:07:10,770 --> 00:07:13,469 me say target all three of these are synonymous 106 00:07:13,470 --> 00:07:18,690 so if you are my perspective is you know it's bad more than 13 or 14 years as a 107 00:07:18,690 --> 00:07:23,430 consultant outside of an organization if you're inside an organization you work 108 00:07:23,430 --> 00:07:26,160 for that organization they're you're client i think we talked about that a 109 00:07:26,160 --> 00:07:29,250 little bit already so let's get right into it 110 00:07:29,250 --> 00:07:34,110 story number one scheduled failing in in our work when we're an outside party 111 00:07:34,110 --> 00:07:37,050 schedules really important it's important to us to show that we can 112 00:07:37,050 --> 00:07:38,159 deliver on time 113 00:07:38,159 --> 00:07:41,460 it's important to us to make the economics work like hey I've got 114 00:07:41,460 --> 00:07:44,698 something to do like this week I'm gonna be fishing you next week will be writing 115 00:07:44,699 --> 00:07:48,930 a report the week after that I'm onto another time if I haven't finished 116 00:07:48,930 --> 00:07:53,220 writing reward if I ran late anywhere in there I'm workin nights I don't want to 117 00:07:53,220 --> 00:07:57,300 do that so schedules really important us here's what a fish 118 00:07:57,300 --> 00:08:00,750 here's what more than one of our early fish engagements would look like 119 00:08:00,750 --> 00:08:04,889 so monday we go to the client we give them three scenarios three stands to 120 00:08:04,889 --> 00:08:09,960 choose from right three of the nigerian prince or the hey we need to reset your 121 00:08:09,960 --> 00:08:14,130 password please type it in here and so on these pretexts so give them three 122 00:08:14,130 --> 00:08:19,620 scenarios they choose one so we spend Tuesday we're building the pretext we're 123 00:08:19,620 --> 00:08:24,570 sending the we send the emails and landing page screenshots the client the 124 00:08:24,570 --> 00:08:28,620 client says hey could you change this wording here and can you make this a 125 00:08:28,620 --> 00:08:30,990 little less tricky here or what have you 126 00:08:30,990 --> 00:08:35,310 so we make a change on wednesday the client approves the email when page 127 00:08:35,309 --> 00:08:39,089 text and we're like okay we're gonna take it easy on Friday we're gonna be 128 00:08:39,090 --> 00:08:41,760 sending those emails for the whole schedule to work on friday gonna be 129 00:08:41,760 --> 00:08:45,480 sending emails so we can spend Thursday kind of starting to rewrite the report 130 00:08:45,480 --> 00:08:50,580 and then we get to Thursday and the client just things magic show this is my 131 00:08:50,580 --> 00:08:54,330 boss already the clients boss comes by and asks like hey I heard you got this 132 00:08:54,330 --> 00:08:55,650 fishing thing going on 133 00:08:55,650 --> 00:08:58,800 you show me what you guys are going to do and he's like oh I totally forgot to 134 00:08:58,800 --> 00:09:04,680 show it to you here here it is and the boss says no right and and says you 135 00:09:04,680 --> 00:09:09,209 can't do that you know you just and and for whatever reason the clients boss 136 00:09:09,210 --> 00:09:13,800 scared of your pretext like you you can't send out something that says that 137 00:09:13,800 --> 00:09:17,579 it's from the company presidents you know from now on no legal process 138 00:09:17,580 --> 00:09:21,690 development company's presence and so what happens to us well we're with to 139 00:09:21,690 --> 00:09:25,950 restart from from day one so we're on thursday we think we're sending emails 140 00:09:25,950 --> 00:09:29,760 tomorrow and instead we're having conversations inside of how we have to 141 00:09:29,760 --> 00:09:33,089 change the schedule we're going to another we are ready another three days 142 00:09:33,089 --> 00:09:37,110 we're going to come up with new things this early on with the point where 143 00:09:37,110 --> 00:09:41,250 everyone starts getting mad at the clients and Matt the client frustrated 144 00:09:41,250 --> 00:09:45,360 recliner pressure with the people around you is just not a place a lot of power 145 00:09:45,360 --> 00:09:50,820 and control in your work and it sucks this so so that's where we start saying 146 00:09:50,820 --> 00:09:56,070 okay what can we do to fix that and the first picks for this is step and leads 147 00:09:56,070 --> 00:09:57,900 son right 148 00:09:57,900 --> 00:10:03,360 ok so you've got a lead you basically have to leave your organization through 149 00:10:03,360 --> 00:10:06,600 the process from the beginning and that means you've got to tell them what 150 00:10:06,600 --> 00:10:10,800 you're going to need to do before you even start brainstorming pretexts you're 151 00:10:10,800 --> 00:10:13,859 going to basically say okay I mean like we did a bunch of these and finally I i 152 00:10:13,860 --> 00:10:15,150 gave this a try 153 00:10:15,150 --> 00:10:18,569 ok so this was one of the places I had a bunch of failure and I'd like like when 154 00:10:18,570 --> 00:10:22,800 the clients that ok this is our process we are going to on this day give you 155 00:10:22,800 --> 00:10:26,609 some pretext choices you're going to tell us what you like and what you don't 156 00:10:26,610 --> 00:10:29,940 like we're going to do an edit we're going to get ready for another round of 157 00:10:29,940 --> 00:10:34,170 edits and so on you're going to show this to people as early in the process 158 00:10:34,170 --> 00:10:38,520 as we can and so on so part of that meant i told them at you know it's part 159 00:10:38,520 --> 00:10:43,439 of this like you have tell me on day 0 tell me before we even start giving you 160 00:10:43,440 --> 00:10:47,260 pretext ideas tell me who it is that can veto that great 161 00:10:47,260 --> 00:10:51,610 text and I want to tell them like i want to say tell me who can veto but i also 162 00:10:51,610 --> 00:10:55,720 wanted to be important as important the client is as it is to me so I want to 163 00:10:55,720 --> 00:11:01,030 tell them the story of like what happens when we get a later stage like that we 164 00:11:01,030 --> 00:11:05,140 have that monday through thursday start over thing and that story is really 165 00:11:05,140 --> 00:11:05,949 really helpful 166 00:11:05,950 --> 00:11:09,760 now i need to set deadlines and tell everybody when they have to when they 167 00:11:09,760 --> 00:11:15,220 have to accept the pretext by if they want this tall finish on time and the 168 00:11:15,220 --> 00:11:19,030 next part for me is I'm going to protect the pretext sometime i'm not going to do 169 00:11:19,030 --> 00:11:23,530 all the work to build a very dynamic website and all that until I've gotten 170 00:11:23,530 --> 00:11:28,390 to say okay on the first part um what else can I do i can actually involve the 171 00:11:28,390 --> 00:11:33,910 client and maybe that boss might veto in creating those pre-tax and if I involve 172 00:11:33,910 --> 00:11:37,180 them there's a hacker watching a couple left lot less chance they're going to 173 00:11:37,180 --> 00:11:40,300 object the last minute because they were involved in the beginning and if they 174 00:11:40,300 --> 00:11:43,719 thought of somebody who might object they might involve them you get pretty 175 00:11:43,720 --> 00:11:47,890 why you get you start realizing that there are more people involved in just 176 00:11:47,890 --> 00:11:50,710 the two people that are on the phone when you call your client contact you 177 00:11:50,710 --> 00:11:56,290 call your boss so the last part for me is realized in negotiation and now 178 00:11:56,290 --> 00:11:59,530 rocket accordingly realize it's a multi-party negotiation not all the 179 00:11:59,530 --> 00:12:00,790 parties are here 180 00:12:00,790 --> 00:12:04,300 what do you want to do about that you want to get them on the call to you want 181 00:12:04,300 --> 00:12:08,170 to meet with them you want to say okay let's get this 182 00:12:08,170 --> 00:12:12,370 let's get the set of people who can veto down its it's this is the great thing 183 00:12:12,370 --> 00:12:15,730 about any engagement whether it's a you know whether you're inside or outside 184 00:12:15,730 --> 00:12:21,850 company you basically can say this is how it's going to go and by saying that 185 00:12:21,850 --> 00:12:26,830 early arm everyone starts following the plan and if anyone's like that's not 186 00:12:26,830 --> 00:12:31,570 going to work you get that conversation happen early and now you change the plan 187 00:12:31,570 --> 00:12:36,820 and everything goes a heck of a lot better but when you then afterwards so I 188 00:12:36,820 --> 00:12:40,750 want to say the other the other part of this for me is just realizing that 189 00:12:40,750 --> 00:12:44,890 anything you do is about leadership doesn't matter what your position is 190 00:12:44,890 --> 00:12:50,140 even the lowest person on the totem pole in your group and if a project belongs 191 00:12:50,140 --> 00:12:51,520 to you you've got a lead 192 00:12:51,520 --> 00:12:54,280 you've got a lead that project you've got to lead anybody who's involved in 193 00:12:54,280 --> 00:12:54,800 that 194 00:12:54,800 --> 00:12:59,390 and you can read books on managing up and managing laterally but you have to 195 00:12:59,390 --> 00:13:03,980 lead someone has to stand up and lead and that's your job if you don't do it 196 00:13:03,980 --> 00:13:07,970 someone else will stand up and they may not know this area much as you or they 197 00:13:07,970 --> 00:13:13,430 may not care about it as much as year the other big is basically you think 198 00:13:13,430 --> 00:13:16,790 through what the plan is you try to you're gonna you're going to see a bunch 199 00:13:16,790 --> 00:13:21,140 of our mistakes these can be really useful think through what could go wrong 200 00:13:21,140 --> 00:13:25,610 beforehand and figure out how you're going to account for it i'm going to 201 00:13:25,610 --> 00:13:29,240 tell you I'm telling you 12 things that have gone wrong for us and what we did 202 00:13:29,240 --> 00:13:33,050 you can kind of do this thought exercise other than playing out real life the way 203 00:13:33,050 --> 00:13:38,029 i did so the other part is described your plan do it with confidence that 204 00:13:38,029 --> 00:13:41,540 that confident voice tells everyone like yeah I thought this through 205 00:13:42,079 --> 00:13:46,880 I know what I'm doing but then at the same time that can bolt people bet that 206 00:13:46,880 --> 00:13:51,050 like I thought this through this is the plan involve people over you have to 207 00:13:51,050 --> 00:13:55,939 listen you have to ask people like we're missing anything anybody like you have 208 00:13:55,940 --> 00:13:59,600 to basically encourage objections and then when those come up 209 00:13:59,600 --> 00:14:03,649 don't miss tiny just be ready to negotiate and get creative and we'll 210 00:14:03,649 --> 00:14:07,220 talk about that some more short version for us one of things that we've learned 211 00:14:07,220 --> 00:14:12,740 that we've learned in guardians now in our work is if we communicate more in 212 00:14:12,740 --> 00:14:15,829 general if we communicate more in the beginning will spend a lot less time 213 00:14:15,829 --> 00:14:19,279 having to communicate the way we don't like talking about our frustrations 214 00:14:19,279 --> 00:14:23,450 about how it didn't were saying it's not my fault that someone else's fault and 215 00:14:23,450 --> 00:14:27,920 and just overall being upset things didn't go as well as we like anybody 216 00:14:27,920 --> 00:14:30,770 have anything in their work that didn't go as well as they like they kind of 217 00:14:30,770 --> 00:14:34,670 regret it just want to make sure it's not just me because if I'm the only one 218 00:14:34,670 --> 00:14:39,110 then like well okay this is still fun i can tell you all my files but you know 219 00:14:39,920 --> 00:14:47,630 ok so story to you spend a whole bunch of time making your blue your laptop 220 00:14:47,630 --> 00:14:51,560 fall off the podium so you spend a whole bunch of time developing that prototype 221 00:14:51,560 --> 00:14:57,079 that that are free text email and landing page and send all emails and 222 00:14:57,079 --> 00:15:00,839 they all get stuck in the spam filters nobody gets them 223 00:15:00,840 --> 00:15:06,690 and it's too late to do anything about it of and this sucks so maybe this 224 00:15:06,690 --> 00:15:11,220 painful these triggers domains to New maybe they trigger because you got you 225 00:15:11,220 --> 00:15:17,550 know a broken configurations on SPF 4d camera or the you know general MTA so 226 00:15:17,550 --> 00:15:20,400 things just look fishy in the same way that they look fisherman's family 227 00:15:20,400 --> 00:15:25,230 sending stuff so the tough part is again schedule fail back to the drawing board 228 00:15:25,230 --> 00:15:31,650 your schedule suffers your your clients annoyed or your bosses annoyed your kind 229 00:15:31,650 --> 00:15:35,069 of frustrated and kind of lost a little bit of credibility 230 00:15:35,070 --> 00:15:39,150 ok so what do you do for this there are technical fixes on the technical side 231 00:15:39,150 --> 00:15:45,990 spfd chem ta think through like wait a second is this box in ipv6 on if it does 232 00:15:45,990 --> 00:15:50,760 make sure that make sure that the make sure that your SPF record has the ipv6 233 00:15:50,760 --> 00:15:56,189 right that's the technical part though the human parts a lot more powerful here 234 00:15:56,190 --> 00:16:02,160 and that is you talk to your client or and you say listen we're not testing the 235 00:16:02,160 --> 00:16:06,360 anti-spam or anti-malware anti-phishing whenever we're testing the technical 236 00:16:06,360 --> 00:16:10,560 controls here let's talk about what the goal of the work is and honestly anytime 237 00:16:10,560 --> 00:16:13,500 you're negotiating let's you're basically saying like what's your 238 00:16:13,500 --> 00:16:19,140 overall goal and how do we best achieve it so our overall goal is to get an 239 00:16:19,140 --> 00:16:22,650 email in everybody's hands and figure out whether they figure they get fooled 240 00:16:22,650 --> 00:16:27,300 by it and afterwards to learn from that and make it so that they get fooled by 241 00:16:27,300 --> 00:16:33,060 these things less so how about if we about if we just get whitelisted in this 242 00:16:33,060 --> 00:16:37,560 in the spam filters and that's basically we do every time right listen span 243 00:16:37,560 --> 00:16:41,219 vocals if you want to know what would get through we can do something about 244 00:16:41,220 --> 00:16:42,570 that later on 245 00:16:42,570 --> 00:16:46,560 um what's the other part of its think about what could go wrong hey if they're 246 00:16:46,560 --> 00:16:49,410 gonna put whitelisting place you're going to make sure the way listing 247 00:16:49,410 --> 00:16:53,310 actually did get put in place so leave time in your schedule for to take a 248 00:16:53,310 --> 00:16:57,329 little while leave time in your schedule to test and make sure in that when you 249 00:16:57,330 --> 00:17:01,170 stand up and leave and say what the plan is make sure the plan involves then 250 00:17:01,170 --> 00:17:04,560 setting it up and tell you what it is and you testing externally before you 251 00:17:04,560 --> 00:17:07,589 send all the males because we've had that we're like you're waitlisted 252 00:17:08,319 --> 00:17:11,138 and you send all the emails through and they all get flagged and now this band 253 00:17:11,138 --> 00:17:15,250 filters are trained on those and you're like what happened like oh the waitlist 254 00:17:15,250 --> 00:17:18,579 wasn't in place yet sorry we didn't realize like sorry 255 00:17:18,579 --> 00:17:27,428 so you get a better plan ok so story 3i use all the best tools i use multi go I 256 00:17:27,429 --> 00:17:31,929 i I'd like learned everything about OS since i'm looking for email addresses 257 00:17:31,929 --> 00:17:36,309 and at the end of the day i only get 15 email addresses that actually work but 258 00:17:36,309 --> 00:17:39,129 my goal was to test the organization as a whole and I'm gonna need a heck of a 259 00:17:39,130 --> 00:17:44,289 lot more email addresses in 15 right I need all of them already at least enough 260 00:17:44,289 --> 00:17:48,250 that i'm going to be able to take a real measurement and it's not fair right so 261 00:17:48,250 --> 00:17:50,799 as a sudden you can't break the law 262 00:17:50,799 --> 00:17:56,080 I don't get to do you know or can't break my can't break my clients your 263 00:17:56,080 --> 00:17:58,870 email infrastructure I don't get to do the same thing they do i'm not gonna buy 264 00:17:58,870 --> 00:18:00,008 mailing lists 265 00:18:00,009 --> 00:18:03,309 I'm not gonna you know I'm not gonna hack machines and getting all the 266 00:18:03,309 --> 00:18:07,418 dresses that way i'm not going to do something that one of our guys may or 267 00:18:07,419 --> 00:18:11,860 may not have no no none of our guys with this but Bob this guy I know named Bob 268 00:18:11,860 --> 00:18:15,820 might have at some point you know been working on a doing fishing exercise 269 00:18:15,820 --> 00:18:20,980 against the hospital and setup and sniffed all their printer driver and got 270 00:18:20,980 --> 00:18:25,360 email addresses out of the pagers so no that's that's that's not something I 271 00:18:25,360 --> 00:18:28,299 would do but the bad guys get to do that we don't 272 00:18:28,299 --> 00:18:33,668 so what do you do about that let's just stipulate like right but you know if 273 00:18:33,669 --> 00:18:36,700 your lawyers and court and talk about stimulating something so let's just 274 00:18:36,700 --> 00:18:40,659 stipulate the people that any attacker could get a very comprehensive list of 275 00:18:40,659 --> 00:18:44,080 email addresses they could root force the mail servers they could do that very 276 00:18:44,080 --> 00:18:47,830 slowly over the course of a year until they've gotten every possible email 277 00:18:47,830 --> 00:18:50,320 address that will work in your organization at least the ones that are 278 00:18:50,320 --> 00:18:51,639 the characters or less 279 00:18:51,639 --> 00:18:55,269 so at this point realize I'm gonna negotiate with the client maybe the 280 00:18:55,269 --> 00:18:59,590 client says damn it I you know I really wanted to really want this to be 281 00:18:59,590 --> 00:19:04,149 realistic i wanted to know how many email addresses you could get like okay 282 00:19:04,149 --> 00:19:09,279 how about this will find all the email addresses we can get you might be 15 it 283 00:19:09,279 --> 00:19:13,840 might be four hundred and let's make part of the plan that once i give you 284 00:19:13,840 --> 00:19:15,908 those email addresses in exchange 285 00:19:15,909 --> 00:19:19,690 you're going to give me is the complete set of email addresses will fish with 286 00:19:19,690 --> 00:19:23,799 please send email addresses and you'll know you'll know what would have 287 00:19:23,799 --> 00:19:26,559 happened if we had that we have less complete set 288 00:19:26,559 --> 00:19:30,789 you look at the results without the with using only the email addresses we got so 289 00:19:30,789 --> 00:19:34,269 we both get to achieve our goal my clients to find out what email address i 290 00:19:34,269 --> 00:19:37,509 could find he gets to have that realism and you can even see the report 291 00:19:37,509 --> 00:19:41,620 structured that way and i get to get what I wanted which was in my mind the 292 00:19:41,620 --> 00:19:45,969 goal was passed every single person organization are you seeing like kind of 293 00:19:45,970 --> 00:19:49,659 like that kind of trick that's another part of just negotiating i'm getting 294 00:19:49,659 --> 00:19:54,340 creative what is my client my client says nowhere keep it like that and early 295 00:19:54,340 --> 00:19:59,110 on what would happen what would happen in my work is we say ok the client said 296 00:19:59,110 --> 00:20:02,860 we had to do it that way and we feel kind of stock and would be annoyed of 297 00:20:02,860 --> 00:20:07,090 our clients a client didn't get it right but that complaint is no fun 298 00:20:07,690 --> 00:20:11,440 what's fun is figuring out something creative and find a way around it and 299 00:20:11,440 --> 00:20:15,309 getting the client what they saw giving the client we know they need and having 300 00:20:15,309 --> 00:20:16,928 everybody win 301 00:20:16,929 --> 00:20:22,779 ok next story um I love this one I did this one of the email says that it's 302 00:20:22,779 --> 00:20:27,759 from Dave Kennedy of at our client organization and so the the email says 303 00:20:27,759 --> 00:20:31,450 this is the IT director David Kennedy I need you all to send me your password 304 00:20:31,450 --> 00:20:34,690 you know please no please click this link and give me your password 305 00:20:35,649 --> 00:20:39,580 what happened well my target organization they turned out they sit in 306 00:20:39,580 --> 00:20:41,769 a really big one story 307 00:20:41,769 --> 00:20:45,730 floorplan I visited later and found out that's how the seating work I didn't 308 00:20:45,730 --> 00:20:49,269 know that's how it works but until we got our next task and internal sense 309 00:20:49,269 --> 00:20:51,220 when we realize they're all on one floor 310 00:20:51,220 --> 00:20:56,769 it's like a big aircraft hangar of desks it was it was kind of ugly an awful but 311 00:20:56,769 --> 00:21:01,269 but it did have one advantage and that was that ever going to basically see day 312 00:21:01,269 --> 00:21:04,330 where they could see somebody you could see Dave when they just people start 313 00:21:04,330 --> 00:21:07,779 walking over until they've basically I pulled out the walmart night and said 314 00:21:07,779 --> 00:21:14,500 this is dave that email is not for me don't give me your password which is all 315 00:21:14,500 --> 00:21:18,759 okay see this is why I danced to the joke you don't left 316 00:21:19,280 --> 00:21:25,850 so so anyway this all goes badly for success rate plummets so how do you will 317 00:21:25,850 --> 00:21:27,230 always the pics for this 318 00:21:27,230 --> 00:21:31,400 okay well from now on we find out we will learn a little bit more about where 319 00:21:31,400 --> 00:21:36,320 everybody says so I want to learn where they said how do they communicate what's 320 00:21:36,320 --> 00:21:40,100 the escalation procedure what's what's going to happen when the first person 321 00:21:40,100 --> 00:21:43,189 who realizes this is a scam finds out 322 00:21:43,190 --> 00:21:46,970 are they are they going to call are they going to call the helpdesk if they're 323 00:21:46,970 --> 00:21:49,460 going to call the helpdesk maybe I need to get the helpdesk involved and say hey 324 00:21:49,460 --> 00:21:53,810 guys can you give us a pass on this one this one is this one is your partner 325 00:21:53,810 --> 00:21:58,159 this is the visit internal thing or this is you know where were your pen test 326 00:21:58,160 --> 00:22:03,740 partner um I want to make another part of that though is can I get more people 327 00:22:03,740 --> 00:22:05,810 involved and brings coming the pretext 328 00:22:05,810 --> 00:22:09,950 can I have better communication so I have my boss or my clients and maybe one 329 00:22:09,950 --> 00:22:13,430 level of management above them involved in creating that pretext and when they 330 00:22:13,430 --> 00:22:17,690 go and check that pretext and say hey go check that you know go discuss this with 331 00:22:17,690 --> 00:22:22,400 HR disgusted with legal votes discuss with compliance let's figure out of Jack 332 00:22:22,400 --> 00:22:31,490 could be part of the alert chain so uh next fail my client says hey you i want 333 00:22:31,490 --> 00:22:35,120 to send these emails nice and slow because i want to avoid detection 334 00:22:36,020 --> 00:22:39,770 so you're like okay yeah we'll send one every five minutes and by the time 335 00:22:39,770 --> 00:22:44,000 you've sent out 10 almost an hour has gone by someone alerted the security 336 00:22:44,000 --> 00:22:47,690 folks the help desk or whatever they send out a mass email the whole 337 00:22:47,690 --> 00:22:49,400 organization has caught you 338 00:22:49,400 --> 00:22:55,790 the jig is up sure low and slow was not sneaky turned out low and slow was very 339 00:22:55,790 --> 00:22:59,030 very unsteady I need to go on a heck of a lot faster 340 00:22:59,030 --> 00:23:03,830 um I do like this though the organization caught me right they caught 341 00:23:03,830 --> 00:23:07,220 me by all talking to each other I what they weren't just relying on each one 342 00:23:07,220 --> 00:23:11,210 person can scan that's not what i was trying to measure but it was a really 343 00:23:11,210 --> 00:23:15,470 cool results find and that's part of what i like about fishing is that you 344 00:23:15,470 --> 00:23:18,740 end up getting to find out you get you end up getting to improve that 345 00:23:18,740 --> 00:23:22,310 so as far as I'm concerned it's all about speed it's all about speed and you 346 00:23:22,310 --> 00:23:26,210 should take as much speed as you know of this is not about amphetamines 347 00:23:26,210 --> 00:23:27,309 ok so 348 00:23:27,309 --> 00:23:32,379 fishing is all about speed you have to rush take whatever legal impediments you 349 00:23:32,379 --> 00:23:34,870 have to do so let's go for coffee 350 00:23:34,870 --> 00:23:39,370 you're racing their ability to catch you as a group to communicate and 351 00:23:39,370 --> 00:23:43,330 collaborate so realize the communication collaboration this talk is happening on 352 00:23:43,330 --> 00:23:48,970 all sides of make sure that your email gives such a short deadline that people 353 00:23:48,970 --> 00:23:51,610 are rushing but they're not getting a chance to think and see 354 00:23:51,610 --> 00:23:56,439 wait why would Dave need my password was reset academy or whatever like don't 355 00:23:56,440 --> 00:24:04,149 give them time to talk get the emails out as fast as you can okay next fail we 356 00:24:04,149 --> 00:24:08,379 have a case where you're like you know this is your first mission exercise and 357 00:24:08,379 --> 00:24:13,299 and you do what you've always right about the books and your domain is lines 358 00:24:13,299 --> 00:24:18,700 domain with the l change to one or with one of the elves pulled out right that's 359 00:24:18,700 --> 00:24:21,940 the kind of like yeah I can get that domain and get a certificate certain the 360 00:24:21,940 --> 00:24:25,600 domain everyone's gonna fool and then you realize what we realized really 361 00:24:25,600 --> 00:24:26,529 quickly 362 00:24:26,529 --> 00:24:29,980 this is the one thing that everybody's really well-trained that they're looking 363 00:24:29,980 --> 00:24:34,929 to see is the domain just like ours but a little different and so no none of 364 00:24:34,929 --> 00:24:35,980 them are rules 365 00:24:35,980 --> 00:24:39,940 well okay a few still get fooled anyway you always get somebody that's great i 366 00:24:39,940 --> 00:24:41,019 love fishing 367 00:24:41,019 --> 00:24:46,269 um but not enough of them are fool you need a better domain choice so here's 368 00:24:46,269 --> 00:24:50,710 some of the ideas that we've had we've done things like said you know and I've 369 00:24:50,710 --> 00:24:54,460 got I've got a sum of people in this room who actually you know steered us in 370 00:24:54,460 --> 00:25:00,100 this direction like haha maybe its clients pipe and benefits . com that 371 00:25:00,100 --> 00:25:05,289 sounds good enough maybe it's a sub-domain we have like clients name . 372 00:25:05,289 --> 00:25:09,100 you know my health benefits shit that I just ruin whatever domains 373 00:25:09,639 --> 00:25:15,399 okay well please don't black list these domains there we like them up so you 374 00:25:15,399 --> 00:25:19,809 know figure out what will work and part of figuring out what a work is talk to 375 00:25:19,809 --> 00:25:23,320 your client will talk about that and they'll also have the best ideas for 376 00:25:23,320 --> 00:25:28,509 pretexts they've been hoping for this for a long time but also going to talk 377 00:25:28,509 --> 00:25:32,019 to your colleagues like I'm gonna go and say hey John I was thinking about you to 378 00:25:32,019 --> 00:25:35,180 me like Lily with 1l change on be like to 379 00:25:35,180 --> 00:25:40,610 I've been there done that it doesn't work it doesn't work bad don't even like 380 00:25:40,610 --> 00:25:44,780 how about what if you tried this and you collaborate and you get much better 381 00:25:44,780 --> 00:25:45,440 results 382 00:25:45,440 --> 00:25:48,890 that's honestly one of the strongest things and gardens whenever one of our 383 00:25:48,890 --> 00:25:52,220 greatest friends and guardians is that we're all talking as we're working the 384 00:25:52,220 --> 00:25:56,120 world helping each other out we're all learning from each other and and it 385 00:25:56,120 --> 00:26:04,040 makes us much much stronger so so here's so what if in that story right now where 386 00:26:04,040 --> 00:26:08,540 I chose the boneheaded domain and eli lilly with with 1l change what if it's 387 00:26:08,540 --> 00:26:10,220 the client who asked for that 388 00:26:10,220 --> 00:26:14,150 what if the clients and just ask where they told you had to write like we've 389 00:26:14,150 --> 00:26:17,420 all had that experience where we think we have no choice 390 00:26:17,420 --> 00:26:22,070 the boss just said we have to do this maybe the Boston mean it quite that way 391 00:26:22,070 --> 00:26:27,290 maybe he did but we want to take it that way so this is where i'll come back to 392 00:26:27,290 --> 00:26:31,250 my theme that the fishing is about collaborating and communicating 393 00:26:31,250 --> 00:26:37,220 negotiating the easiest way to lose out in a negotiation is to not realize 394 00:26:37,220 --> 00:26:38,180 you're in one 395 00:26:38,180 --> 00:26:43,940 ok sure the client said you had used that domain can you talk and say that 396 00:26:43,940 --> 00:26:46,100 I'm really worried that might not work 397 00:26:46,100 --> 00:26:50,209 you kind of reveal your own concerns and do it in a way that your client can get 398 00:26:50,210 --> 00:26:54,140 with empathize with I'm really worried that's not gonna work and i'm going to 399 00:26:54,140 --> 00:26:58,520 give you a false sense of security or you know I'm gonna get laughed at you're 400 00:26:58,520 --> 00:27:01,970 gonna get lapped at people are going to think that we did a good job and if they 401 00:27:01,970 --> 00:27:05,240 still don't see it say okay I tell you I can we just get a couple more people 402 00:27:05,240 --> 00:27:09,860 from you know we get a couple of more of your years you know or your boss's boss 403 00:27:09,860 --> 00:27:13,370 being on this conversation so we you know so we can just check this out and 404 00:27:13,370 --> 00:27:15,889 let somebody else say it's a brain-dead idea 405 00:27:15,890 --> 00:27:22,460 okay uh next story broken grammar we have this we've gotten this one a lot 406 00:27:22,460 --> 00:27:26,990 this is one of the biggest things that's ever frustrated of our people is when 407 00:27:26,990 --> 00:27:31,820 you're is when the client says hey I want to use broken grammar and bad 408 00:27:31,820 --> 00:27:34,730 spelling because that's I get tons of these phishing emails we always have 409 00:27:34,730 --> 00:27:37,730 broken grammar and bad spelling and I want this to be realistic 410 00:27:38,510 --> 00:27:42,770 ok if you go with it you're going to be your your success rates going to plumb 411 00:27:42,770 --> 00:27:44,269 it you're going to feel frustrated 412 00:27:44,269 --> 00:27:48,529 you know that it wasn't realistic the problem at the end of that is that your 413 00:27:48,529 --> 00:27:52,489 client has your client has basically given his company a false sense of 414 00:27:52,489 --> 00:27:56,239 security and you did it because you felt like you had to 415 00:27:56,809 --> 00:28:00,379 ok so your client was a negotiation you were negotiating with your client you 416 00:28:00,379 --> 00:28:03,889 didn't realize your association your client one the negotiation and by 417 00:28:03,889 --> 00:28:10,099 winning it really he lost so this is my you know first rule of negotiation if 418 00:28:10,099 --> 00:28:14,809 anybody losses everybody loses this is similar to the the play or movie Chicago 419 00:28:14,809 --> 00:28:20,029 right mom ain't happy ain't nobody happy my corollary to that that's when it's 420 00:28:20,029 --> 00:28:25,579 going to stop me my corollary to that is if anybody in happy ain't nobody happy 421 00:28:25,579 --> 00:28:29,809 we all know this from our families right things have anybody unhappy and your 422 00:28:29,809 --> 00:28:34,249 family without everybody basically being like please not for any length of time 423 00:28:34,249 --> 00:28:40,279 so so what do you do you get creative you tell you tell your client liked how 424 00:28:40,279 --> 00:28:44,239 the broken after the heartbroken grammar is going to hard it is not going to 425 00:28:44,239 --> 00:28:48,649 harden them against Fisher's who do right well if I don't believe you 426 00:28:48,649 --> 00:28:51,829 this is about realism for them maybe you go and find a phishing email that you 427 00:28:51,829 --> 00:28:56,539 received that had good grammar and good spelling it was pretty dark convincing 428 00:28:56,539 --> 00:29:00,739 maybe when you asked quietly pulled by was like oh yeah that did happen me once 429 00:29:00,739 --> 00:29:04,429 like okay you remember that one that's what we're aiming for and now you've got 430 00:29:04,429 --> 00:29:10,099 somebody on board with you now if you're still stock get right again realize 431 00:29:10,099 --> 00:29:14,418 you're negotiating it's not just it's not just that one person's idea has to 432 00:29:14,419 --> 00:29:16,609 win and you find something we both win 433 00:29:16,609 --> 00:29:20,928 so you could say tell you what I'll do one round of fishing maybe against half 434 00:29:20,929 --> 00:29:25,579 the organization that has broken grammar and one round that has not broken 435 00:29:25,579 --> 00:29:29,658 grammar and we'll get to see what you know we'll get to see the difference and 436 00:29:29,659 --> 00:29:32,659 we'll get we'll both get the data that we were looking for 437 00:29:33,649 --> 00:29:37,279 ok so keep checking my time 438 00:29:37,279 --> 00:29:42,739 ok good so the story eight and this one may or may not happen recently it was 439 00:29:42,739 --> 00:29:46,549 kind of fun the the client client comes to us we hate when this happens 440 00:29:46,549 --> 00:29:52,158 courthouse listen only me and my boss know that this is happening at all 441 00:29:52,700 --> 00:29:55,890 we've never told anybody planning fish were just fishing ourselves 442 00:29:55,890 --> 00:30:03,150 okay and I whenever anybody says I'm like no of right so so what happened was 443 00:30:03,150 --> 00:30:06,720 one time we did that nobody else gonna hear we're like but we really should 444 00:30:06,720 --> 00:30:10,380 involve legal and and if you guys have compliance involve them maybe tell the 445 00:30:10,380 --> 00:30:16,200 helpdesk about like no one's gonna know and and so we said okay fine we sent out 446 00:30:16,200 --> 00:30:20,610 phishing emails and other client holding for guard and the investigation got 447 00:30:20,610 --> 00:30:24,240 opens and a whole bunch of us got egg on our face 448 00:30:25,260 --> 00:30:29,100 this is happened with other organizations be so I didn't regard but 449 00:30:29,100 --> 00:30:34,020 I'm uh I'm not going to go into that so what do you do to avoid this situation 450 00:30:34,020 --> 00:30:39,780 right first you have to leave you have to stay you have to basically be very 451 00:30:39,780 --> 00:30:42,210 very confident you have to know that you're the one that's got the experience 452 00:30:42,210 --> 00:30:46,680 or you're the one that cares about this the most or what have you but you have 453 00:30:46,680 --> 00:30:50,700 to stand up and lead and you have to say just honestly it's part of my checklist 454 00:30:50,700 --> 00:30:52,650 as I'm taking a client through what we're going to do 455 00:30:52,650 --> 00:30:58,050 it's like and here's the stage where you tell HR legal and so on about the test 456 00:30:58,050 --> 00:31:03,060 um and I make brainstorming who those people are part of setting up for this 457 00:31:03,660 --> 00:31:08,910 the other thing i do is tell stories humans were optimized for storing it 458 00:31:08,910 --> 00:31:12,690 turns out that if I tell you a story with 20 plotlines you can repeat them 459 00:31:12,690 --> 00:31:17,100 back to me in order and you can pass that along and it will still come out in 460 00:31:17,100 --> 00:31:21,480 order where our brains for one reason or another evolved for stories you can't do 461 00:31:21,480 --> 00:31:26,220 the same thing necessarily the 22 not digit number okay he can but the rest of 462 00:31:26,220 --> 00:31:27,300 us probably can't 463 00:31:27,300 --> 00:31:32,730 ok at least I can handle of the recipe ok so what are the other parts you have 464 00:31:32,730 --> 00:31:37,050 to know the client know the target right know your target is the way the military 465 00:31:37,050 --> 00:31:41,040 talks about this look at what are the escalation paths and where do I want to 466 00:31:41,040 --> 00:31:44,220 set my break points so it's going to go to help desk and I want to clue them in 467 00:31:44,220 --> 00:31:46,500 but helpdesk is going to go to security next 468 00:31:46,500 --> 00:31:51,750 cool let's make sure Security's part of this ok next story the client called you 469 00:31:51,750 --> 00:31:56,730 hourly for results the fishing exercise going out two days and every hour on the 470 00:31:56,730 --> 00:31:59,940 hour you get another call from a client and it's driving you nuts 471 00:31:59,940 --> 00:32:02,890 I kinda like that many calls from people I'm really 472 00:32:02,890 --> 00:32:07,300 social but let's just assume you're introverted of so what do you do 473 00:32:07,870 --> 00:32:12,159 this is where you manage expectations this is a you keep that level of effort 474 00:32:12,160 --> 00:32:13,180 under control 475 00:32:13,180 --> 00:32:18,820 this is part of you have to lead you say early on when the what when we started 476 00:32:18,820 --> 00:32:22,810 fishing i'm going to call you every 15 minutes for the first hour after that 477 00:32:22,810 --> 00:32:26,440 we're going to talk twice that day we're gonna talk twice the next day and if the 478 00:32:26,440 --> 00:32:30,700 clients like I really wish you know at that point what you're going to say it's 479 00:32:30,700 --> 00:32:34,990 strongly and now you you can't shut down the conversation you've got to basically 480 00:32:34,990 --> 00:32:38,980 something to figure out how that felt the other person and say okay how did 481 00:32:38,980 --> 00:32:39,790 that feel 482 00:32:39,790 --> 00:32:42,970 and they're like really but that sounds good but at the beginning I really wish 483 00:32:42,970 --> 00:32:46,480 like you could give me those instead of every 15 minutes how about hourly for 484 00:32:46,480 --> 00:32:50,920 the first four hours like same amount of communication that's what works better 485 00:32:50,920 --> 00:32:51,790 for you 486 00:32:51,790 --> 00:32:56,590 I can deal with that sounds great and so you basically have to leave and then you 487 00:32:56,590 --> 00:33:03,459 have to listen okay so story 10 where 10 through 10 out of 12 I like the way this 488 00:33:03,460 --> 00:33:08,770 is going so your campaign is successful you've got tons of passwords you want it 489 00:33:08,770 --> 00:33:13,180 I wonder if I got that on camera and it wasn't looking for it without a license 490 00:33:13,180 --> 00:33:18,790 can I fake it but i can fake that one when you get that again you rock 491 00:33:22,210 --> 00:33:30,040 we said that to me i'm negotiating he's not even using words but i'm watching 492 00:33:30,040 --> 00:33:32,020 his face and watching his actions 493 00:33:32,020 --> 00:33:35,740 it's going to work out better I mean maybe he's like no I'm not gonna forget 494 00:33:35,740 --> 00:33:39,460 to send that to you or I'm gonna take that picture but if it didn't ask i 495 00:33:39,460 --> 00:33:43,450 don't get to find out if that's a possibility and that's really good for 496 00:33:43,450 --> 00:33:46,720 getting cool pictures of conferences it's also really cool for making your 497 00:33:46,720 --> 00:33:50,890 professional life from your personal life work so in this situation your 498 00:33:50,890 --> 00:33:53,560 campaign successful but your client doesn't feel like you're communicating 499 00:33:53,560 --> 00:33:57,280 enough they didn't they didn't score this used to say this as they didn't 500 00:33:57,280 --> 00:33:59,889 feel the love you got to make him feel loved 501 00:33:59,890 --> 00:34:04,210 so maybe they thought you didn't care or maybe Steve it was worse than that maybe 502 00:34:04,210 --> 00:34:07,240 because you weren't communicating very much with them when something bad 503 00:34:07,240 --> 00:34:11,980 happens when management freak tower or when employees got went nuts they didn't 504 00:34:11,980 --> 00:34:14,530 feel like they could call you would ask for help 505 00:34:14,530 --> 00:34:17,620 where they didn't call you and ask for help because they didn't feel like you 506 00:34:17,620 --> 00:34:20,679 know they're just like much communication going on and so then 507 00:34:20,679 --> 00:34:24,489 things go badly the organization is going to fish again for years and you 508 00:34:24,489 --> 00:34:27,250 could have done something about that but could only do something about that if 509 00:34:27,250 --> 00:34:30,790 you were in conversation with them if you kind of built up that that rapport 510 00:34:30,790 --> 00:34:35,350 that conversation that trust that when something went bad the client instead of 511 00:34:35,350 --> 00:34:38,409 being mad at you comes to you and says hey this is what's going on and you're 512 00:34:38,409 --> 00:34:41,649 like oh hey we've done this before I would do this 513 00:34:41,650 --> 00:34:48,340 ok so success and a happy client your ears we do that remember most of all 514 00:34:48,340 --> 00:34:52,390 like empathy remember that your security people over their client they've been 515 00:34:52,389 --> 00:34:56,589 rooting for this for a long time they've been wanting an exercise like this for a 516 00:34:56,590 --> 00:34:58,300 long time before they got it 517 00:34:58,300 --> 00:35:02,170 um another part is making me feel loved given stats really often during the 518 00:35:02,170 --> 00:35:05,740 first day have that conversation about how often you're going to here's another 519 00:35:05,740 --> 00:35:08,529 one and I had talked about this a little bit communicate more 520 00:35:08,530 --> 00:35:13,720 yeah we all know more but we also want to know how much and how and the cool 521 00:35:13,720 --> 00:35:16,870 thing is you can ask i can ask my client what do you want in terms of 522 00:35:16,870 --> 00:35:19,960 communication i was thinking this could be like well that sounds kind of good 523 00:35:19,960 --> 00:35:23,530 but that would be annoying what if you did this on people 524 00:35:23,530 --> 00:35:26,470 this is the cool thing about life is that we all train each other and I've 525 00:35:26,470 --> 00:35:29,660 heard this in the last knowing the in Guard spokesman here for a few days 526 00:35:29,660 --> 00:35:33,618 for conference we've all been talking I realized like God we will train each 527 00:35:33,619 --> 00:35:37,490 other on how we want to be communicated with how often what we want that to look 528 00:35:37,490 --> 00:35:41,209 like hey when you text me before you call me is one but another one is like 529 00:35:41,210 --> 00:35:44,599 if you want something for me yelling views not going to help could you 530 00:35:44,599 --> 00:35:49,069 instead tell me what's important to you or whatever so these are the people who 531 00:35:49,069 --> 00:35:53,808 trained me and if you think in your own life you've got you've got these people 532 00:35:53,809 --> 00:35:57,289 to these are my these are my this is my family home 533 00:35:57,289 --> 00:36:00,920 these are my family at work they're the ones who tell me each day with a like 534 00:36:00,920 --> 00:36:05,390 and how this is going to land better and hopefully after this talk so if you'll 535 00:36:05,390 --> 00:36:08,839 come and talk to me and you'll train me and tell me how you'd like to hear this 536 00:36:08,839 --> 00:36:12,440 kind of how they would like to hear this kind of material the conference I know a 537 00:36:12,440 --> 00:36:15,440 bunch of you who like it well i hope the ones who don't like it well too 538 00:36:16,280 --> 00:36:23,539 ok so I'm check we're doing good so story 11 reinventing the wheel this is 539 00:36:23,539 --> 00:36:27,380 something we did the first for fishing engagements and guardians did we 540 00:36:27,380 --> 00:36:31,490 everything built their own fishing infrastructure from scratch and they 541 00:36:31,490 --> 00:36:34,788 generally build something that would last only for that one engagement and 542 00:36:34,789 --> 00:36:38,599 never again which meant that we were spending more time than we needed to and 543 00:36:38,599 --> 00:36:43,010 we weren't getting crafty we weren't getting we weren't getting better so 544 00:36:43,010 --> 00:36:46,700 we're kind of like we're not getting better we're just basically building and 545 00:36:46,700 --> 00:36:52,399 rebuilding and and reinventing the wheel over and over again so for us we think 546 00:36:52,400 --> 00:36:57,410 either find a good tool fishing friends is one of our favorites or develop your 547 00:36:57,410 --> 00:37:01,220 own and then teach everybody how to use it if it's important to you you gotta 548 00:37:01,220 --> 00:37:05,390 talk to people you gotta talk to a lot of people I got frustrated like I built 549 00:37:05,390 --> 00:37:07,940 a tool it's really good and no one's using it 550 00:37:07,940 --> 00:37:12,349 oh did I go around and tell people about it that I do my part in making sure that 551 00:37:12,349 --> 00:37:14,420 they that they knew that it existed 552 00:37:14,420 --> 00:37:17,930 did I trained some people on the tools they made it so that I lowered so I so I 553 00:37:17,930 --> 00:37:21,200 made it easier for them to get into it and easier for them to go where I want 554 00:37:21,200 --> 00:37:28,399 them to go up every fishing test should make you better fishing so get better 555 00:37:28,400 --> 00:37:33,289 stagnate this is true on again for everything in your work life so for us 556 00:37:33,289 --> 00:37:36,829 it's kind of like we create some mail servers and we stopped reading mail 557 00:37:36,829 --> 00:37:40,609 servers at this point we know that every time that we use a fishing else or 558 00:37:40,609 --> 00:37:42,210 anyone existing ones 559 00:37:42,210 --> 00:37:47,430 new domains but we've made it really easy is to switch over the domains uh I 560 00:37:47,430 --> 00:37:51,419 really i started out like many of us and security as a system administrator where 561 00:37:51,420 --> 00:37:55,200 he learns the rule of enlightened laziness side of Larry pull out of Larry 562 00:37:55,200 --> 00:37:59,430 pearls program / lightly ball and it basically said automate everything you 563 00:37:59,430 --> 00:38:02,819 can or if you're going to do it twice automated heck you gonna do once 564 00:38:02,820 --> 00:38:06,810 probably automated but automate everything you can let your laziness let 565 00:38:06,810 --> 00:38:10,650 your own desire not redo something over and over again and have that be boring 566 00:38:10,650 --> 00:38:15,240 of end up saving you time and making it so that you can take time and truly 567 00:38:15,240 --> 00:38:20,399 create and that way you can actually up and up and up it so last story an omen 568 00:38:20,400 --> 00:38:26,040 unknown impact we did a ton of fishing and pigments and we never found out my 569 00:38:26,040 --> 00:38:30,869 client we never went ask the client hey uh what was the impact like are you guys 570 00:38:30,869 --> 00:38:34,260 getting better reporting you guys you know are people getting cautious as much 571 00:38:34,260 --> 00:38:39,540 by pitching after as before and eventually what happened was client came 572 00:38:39,540 --> 00:38:43,200 to us and said hey I want to let you know like here's a slide that I 573 00:38:43,200 --> 00:38:44,640 presented to our board 574 00:38:44,640 --> 00:38:49,920 I'm like you're bored wow I like that and said this is this is what happened 575 00:38:49,920 --> 00:38:53,940 before your fishing engagement our reporting rates on phishing scams worth 576 00:38:53,940 --> 00:38:54,810 this level 577 00:38:54,810 --> 00:38:59,670 afterwards they jumped up to this level and people are way better at calling 578 00:38:59,670 --> 00:39:03,450 helpdesk and telling them something is going on and i found that when the 579 00:39:03,450 --> 00:39:07,919 client told me that I got this kind of joy and I got satisfaction knowing that 580 00:39:07,920 --> 00:39:11,550 what I was doing was making some kind of a difference and often communicating is 581 00:39:11,550 --> 00:39:13,890 the only way you do that going to ask what kind of difference you're making 582 00:39:13,890 --> 00:39:18,118 how did that work for you uh you should I think everyone's probably getting this 583 00:39:18,119 --> 00:39:19,650 talk is really about fishing 584 00:39:19,650 --> 00:39:23,430 I mean it is we're talking about fishing entirely this is really useful stuff 585 00:39:23,430 --> 00:39:28,980 efficient but this is kind of like Jays rules for life whether it's you know 586 00:39:28,980 --> 00:39:32,520 like with your family life inside your company like with your client 587 00:39:32,520 --> 00:39:36,720 this is just stuff that really really really helps ask the people ask the 588 00:39:36,720 --> 00:39:39,810 people you're acting with how that interaction went afterwards 589 00:39:39,810 --> 00:39:44,460 what did they get out of it and you'll be surprised how much joy you get out of 590 00:39:44,460 --> 00:39:45,509 people saying 591 00:39:45,509 --> 00:39:48,659 you know I know that call was really hard and we were fighting and i was so 592 00:39:48,659 --> 00:39:52,109 happy for I learned so much for it felt so much closer to you or whatever 593 00:39:53,369 --> 00:39:58,709 Oh last slide I've been presenting for a very long time of the conference's 1999 594 00:39:58,709 --> 00:40:01,678 somewhere in the middle i had this much hair 595 00:40:01,679 --> 00:40:08,189 not much uh I lost my hair by not following this kind of advice so I hope 596 00:40:08,189 --> 00:40:13,348 you will have much more Joyce less stressful and less hair losing careers 597 00:40:13,349 --> 00:40:13,949 thank you very much