to run official engagement and probably to run any engagement so this really
should be simple right fishing is actually from a technical perspective
one of the easiest things to do in what in guardians does you know what we do at
this conference in terms of penetration testing and red teaming in all the
different kinds of security things really easy to make a make a crafty
email that doesn't involve any Nigerian Prince's that tries to get someone to go
to a website you build a 14 website too
I don't say maybe collect credentials or give somebody malware get some malware
put on your computer you get your client to your boss to approve of that website
and that email you send email those many people as you can you watch the
passwords fly-in and sometimes you get so you get lucky and it really is this
easy you can expect about somewhere between 10 and forty percent of the
people that you send a good email to to give you their password and i gotta say
it's a wonderful feeling just watching the passwords kind of fly in at first
and then trickle in overtime and you're like this is great why I spent all this
time on home ability research and all this i can i can just get access
um and you know to that end one of my colleagues Larry Page she once had a
fishing campaign with the success rate in excess of a hundred percent the and
the deal was the company targeted a just a small subset of its employees and his
old action his give us your password or cutting your access off and you're gonna
get fired and the brothers gonna burn down and it's all gonna be your fault
that back hold action scared the crap out of them well enough that uh that
they not only gave them their props where they formed around to other people
who haven't gotten the email they went according to their other email accounts
and they sent it to like those privileged separate accounts one that
didn't get email but like almighty a counter don't want my domain admin
account to get caught off and and so he did greater than a hundred percent so so
i'm going to talk about going to talk about kind of why we fish and then
to tell you about alvin all the ways it's gone wrong for us or for people we
know
yeah I'd like to save face and say whenever this happens that my own
company this is all stuff that happened somewhere else
so why do you fish in the first place of the official engagement should make it
so that everybody individually gets better at spotting fishing at spotting
official email and not getting and so they don't get tricked by it um it
should increase every person individuals resilience but you're going to find out
later in this talk it should also make the whole organization better at
figuring out what's going on and communicating it to everybody else and
very very quickly as a group detecting you and causing you to fail so the cool
thing is after you do this a couple times the employees of companies tend to
get better
yeah and no reported higher percentages and we'll talk about that so so
officials this simple and if it's really obvious why we should do it then why am
i giving a talk of like I didn't want to speak at Derby con but there was more
than that and this is this talk is one that honestly we give inside our own
company that we the we kind of keep passing on this kind of knowledge that
we've gained and also we don't make quite the same mistakes so most people's
first few attempts they don't go this well and and is how when I'm you know
I'm one of the owners over in guardians and I would watch person after person
get assigned to official engagement and gets so frustrated with what the clients
were asking for how the clients were getting in their way or how is taking
longer than it should and and that frustration after a while you're like
okay we've got to figure out what we can do that were not frustrated in our jobs
that were feeling great about what we did
we're feeling great about it we're having great success and and we're
enjoying our work so the rest of this talk is basically looking at frustrating
situations we've had and try to teach you how to avoid them entirely and
achieve greater success so here's a quick summary one of things I want to
say is this isn't about this isn't really strictly about red team fishing
we do that too and you'll tend to
into these challenges quite so much because it's a different beast and I'll
talk about that here and there so 12 stories of failure with our specific
solutions and you're gonna see me get into some themes and it's basically that
if you're setting up any professional fishing campaign you're going to end up
in communication you're going to end up collaborating and you're gonna end up
negotiating and the more you do those three things the better your it goes
actually it turns out this is really useful for all the kinds of engagements
we do in our work and if you're not liking your it and you're not
consultants you're going to find its exact same way for you with this stuff
it's going to be well it turns out your client is basically your boss or your
organization uh you know your your client is the part of the people you're
trying to help though your client contact is basically your boss whoever
owns this project above you
i'm going to talk and I'm going to going to talk about these three things
collaboration communication and negotiation a bunch as we go through one
of the things i want you to get from this is that anything in life that
involves more than one person any conversation any well not even spoken
but any anything in life involve more than one person involved negotiation
it's often not negotiation you you're even conscious too but i'm basically in
one right now with all of you right i'm i'm asking you to stay
i'm making a bid not just for you to stay in the room but i'm making a bit
for your attention and that's the negotiations happening here will come
we'll come back to that theme so I do want to say real quick that uh this talk
is basically about penetration testing fishing fishing engagements in this are
trying to hit the entire organization
we're trying to find out how every single person as many people as possible
response will tell you about the organization as a whole
we're trying to measure something we're trying to make you better and we're
trying to make everybody better resisting so that's what we call a
penetration test fish in a red team situation and you'll notice the golden
gardens folks around the conference you're going to start you know now that
I pointed out you're going to see all of the big logos um we are doing we also do
red team
working in the red teaming work you're looking for much smaller target pole
you're gonna send one or two emails maybe ten the most but you're sending a
few emails as few phishing emails as it takes to get access you're going to
manually determine who it is that you're gonna be targeting you're going to be
using some of the open-source reconnaissance tools out there might be
as simple as LinkedIn or connect kamar looking at the company's website and you
end up being really really targeted you're focused on a roll you're gonna be
sending you've got a word macro deliver you're going to be sending it to someone
in HR who looks at resumes all the time is quite used to opening every word
document their scent so okay let's go 12 stories uh let's see I'm going to keep
saying you're gonna hear me say or going to hear you say client you're gonna hear
me say target all three of these are synonymous
so if you are my perspective is you know it's bad more than 13 or 14 years as a
consultant outside of an organization if you're inside an organization you work
for that organization they're you're client i think we talked about that a
little bit already so let's get right into it
story number one scheduled failing in in our work when we're an outside party
schedules really important it's important to us to show that we can
deliver on time
it's important to us to make the economics work like hey I've got
something to do like this week I'm gonna be fishing you next week will be writing
a report the week after that I'm onto another time if I haven't finished
writing reward if I ran late anywhere in there I'm workin nights I don't want to
do that so schedules really important us here's what a fish
here's what more than one of our early fish engagements would look like
so monday we go to the client we give them three scenarios three stands to
choose from right three of the nigerian prince or the hey we need to reset your
password please type it in here and so on these pretexts so give them three
scenarios they choose one so we spend Tuesday we're building the pretext we're
sending the we send the emails and landing page screenshots the client the
client says hey could you change this wording here and can you make this a
little less tricky here or what have you
so we make a change on wednesday the client approves the email when page
text and we're like okay we're gonna take it easy on Friday we're gonna be
sending those emails for the whole schedule to work on friday gonna be
sending emails so we can spend Thursday kind of starting to rewrite the report
and then we get to Thursday and the client just things magic show this is my
boss already the clients boss comes by and asks like hey I heard you got this
fishing thing going on
you show me what you guys are going to do and he's like oh I totally forgot to
show it to you here here it is and the boss says no right and and says you
can't do that you know you just and and for whatever reason the clients boss
scared of your pretext like you you can't send out something that says that
it's from the company presidents you know from now on no legal process
development company's presence and so what happens to us well we're with to
restart from from day one so we're on thursday we think we're sending emails
tomorrow and instead we're having conversations inside of how we have to
change the schedule we're going to another we are ready another three days
we're going to come up with new things this early on with the point where
everyone starts getting mad at the clients and Matt the client frustrated
recliner pressure with the people around you is just not a place a lot of power
and control in your work and it sucks this so so that's where we start saying
okay what can we do to fix that and the first picks for this is step and leads
son right
ok so you've got a lead you basically have to leave your organization through
the process from the beginning and that means you've got to tell them what
you're going to need to do before you even start brainstorming pretexts you're
going to basically say okay I mean like we did a bunch of these and finally I i
gave this a try
ok so this was one of the places I had a bunch of failure and I'd like like when
the clients that ok this is our process we are going to on this day give you
some pretext choices you're going to tell us what you like and what you don't
like we're going to do an edit we're going to get ready for another round of
edits and so on you're going to show this to people as early in the process
as we can and so on so part of that meant i told them at you know it's part
of this like you have tell me on day 0 tell me before we even start giving you
pretext ideas tell me who it is that can veto that great
text and I want to tell them like i want to say tell me who can veto but i also
wanted to be important as important the client is as it is to me so I want to
tell them the story of like what happens when we get a later stage like that we
have that monday through thursday start over thing and that story is really
really helpful
now i need to set deadlines and tell everybody when they have to when they
have to accept the pretext by if they want this tall finish on time and the
next part for me is I'm going to protect the pretext sometime i'm not going to do
all the work to build a very dynamic website and all that until I've gotten
to say okay on the first part um what else can I do i can actually involve the
client and maybe that boss might veto in creating those pre-tax and if I involve
them there's a hacker watching a couple left lot less chance they're going to
object the last minute because they were involved in the beginning and if they
thought of somebody who might object they might involve them you get pretty
why you get you start realizing that there are more people involved in just
the two people that are on the phone when you call your client contact you
call your boss so the last part for me is realized in negotiation and now
rocket accordingly realize it's a multi-party negotiation not all the
parties are here
what do you want to do about that you want to get them on the call to you want
to meet with them you want to say okay let's get this
let's get the set of people who can veto down its it's this is the great thing
about any engagement whether it's a you know whether you're inside or outside
company you basically can say this is how it's going to go and by saying that
early arm everyone starts following the plan and if anyone's like that's not
going to work you get that conversation happen early and now you change the plan
and everything goes a heck of a lot better but when you then afterwards so I
want to say the other the other part of this for me is just realizing that
anything you do is about leadership doesn't matter what your position is
even the lowest person on the totem pole in your group and if a project belongs
to you you've got a lead
you've got a lead that project you've got to lead anybody who's involved in
that
and you can read books on managing up and managing laterally but you have to
lead someone has to stand up and lead and that's your job if you don't do it
someone else will stand up and they may not know this area much as you or they
may not care about it as much as year the other big is basically you think
through what the plan is you try to you're gonna you're going to see a bunch
of our mistakes these can be really useful think through what could go wrong
beforehand and figure out how you're going to account for it i'm going to
tell you I'm telling you 12 things that have gone wrong for us and what we did
you can kind of do this thought exercise other than playing out real life the way
i did so the other part is described your plan do it with confidence that
that confident voice tells everyone like yeah I thought this through
I know what I'm doing but then at the same time that can bolt people bet that
like I thought this through this is the plan involve people over you have to
listen you have to ask people like we're missing anything anybody like you have
to basically encourage objections and then when those come up
don't miss tiny just be ready to negotiate and get creative and we'll
talk about that some more short version for us one of things that we've learned
that we've learned in guardians now in our work is if we communicate more in
general if we communicate more in the beginning will spend a lot less time
having to communicate the way we don't like talking about our frustrations
about how it didn't were saying it's not my fault that someone else's fault and
and just overall being upset things didn't go as well as we like anybody
have anything in their work that didn't go as well as they like they kind of
regret it just want to make sure it's not just me because if I'm the only one
then like well okay this is still fun i can tell you all my files but you know
ok so story to you spend a whole bunch of time making your blue your laptop
fall off the podium so you spend a whole bunch of time developing that prototype
that that are free text email and landing page and send all emails and
they all get stuck in the spam filters nobody gets them
and it's too late to do anything about it of and this sucks so maybe this
painful these triggers domains to New maybe they trigger because you got you
know a broken configurations on SPF 4d camera or the you know general MTA so
things just look fishy in the same way that they look fisherman's family
sending stuff so the tough part is again schedule fail back to the drawing board
your schedule suffers your your clients annoyed or your bosses annoyed your kind
of frustrated and kind of lost a little bit of credibility
ok so what do you do for this there are technical fixes on the technical side
spfd chem ta think through like wait a second is this box in ipv6 on if it does
make sure that make sure that the make sure that your SPF record has the ipv6
right that's the technical part though the human parts a lot more powerful here
and that is you talk to your client or and you say listen we're not testing the
anti-spam or anti-malware anti-phishing whenever we're testing the technical
controls here let's talk about what the goal of the work is and honestly anytime
you're negotiating let's you're basically saying like what's your
overall goal and how do we best achieve it so our overall goal is to get an
email in everybody's hands and figure out whether they figure they get fooled
by it and afterwards to learn from that and make it so that they get fooled by
these things less so how about if we about if we just get whitelisted in this
in the spam filters and that's basically we do every time right listen span
vocals if you want to know what would get through we can do something about
that later on
um what's the other part of its think about what could go wrong hey if they're
gonna put whitelisting place you're going to make sure the way listing
actually did get put in place so leave time in your schedule for to take a
little while leave time in your schedule to test and make sure in that when you
stand up and leave and say what the plan is make sure the plan involves then
setting it up and tell you what it is and you testing externally before you
send all the males because we've had that we're like you're waitlisted
and you send all the emails through and they all get flagged and now this band
filters are trained on those and you're like what happened like oh the waitlist
wasn't in place yet sorry we didn't realize like sorry
so you get a better plan ok so story 3i use all the best tools i use multi go I
i I'd like learned everything about OS since i'm looking for email addresses
and at the end of the day i only get 15 email addresses that actually work but
my goal was to test the organization as a whole and I'm gonna need a heck of a
lot more email addresses in 15 right I need all of them already at least enough
that i'm going to be able to take a real measurement and it's not fair right so
as a sudden you can't break the law
I don't get to do you know or can't break my can't break my clients your
email infrastructure I don't get to do the same thing they do i'm not gonna buy
mailing lists
I'm not gonna you know I'm not gonna hack machines and getting all the
dresses that way i'm not going to do something that one of our guys may or
may not have no no none of our guys with this but Bob this guy I know named Bob
might have at some point you know been working on a doing fishing exercise
against the hospital and setup and sniffed all their printer driver and got
email addresses out of the pagers so no that's that's that's not something I
would do but the bad guys get to do that we don't
so what do you do about that let's just stipulate like right but you know if
your lawyers and court and talk about stimulating something so let's just
stipulate the people that any attacker could get a very comprehensive list of
email addresses they could root force the mail servers they could do that very
slowly over the course of a year until they've gotten every possible email
address that will work in your organization at least the ones that are
the characters or less
so at this point realize I'm gonna negotiate with the client maybe the
client says damn it I you know I really wanted to really want this to be
realistic i wanted to know how many email addresses you could get like okay
how about this will find all the email addresses we can get you might be 15 it
might be four hundred and let's make part of the plan that once i give you
those email addresses in exchange
you're going to give me is the complete set of email addresses will fish with
please send email addresses and you'll know you'll know what would have
happened if we had that we have less complete set
you look at the results without the with using only the email addresses we got so
we both get to achieve our goal my clients to find out what email address i
could find he gets to have that realism and you can even see the report
structured that way and i get to get what I wanted which was in my mind the
goal was passed every single person organization are you seeing like kind of
like that kind of trick that's another part of just negotiating i'm getting
creative what is my client my client says nowhere keep it like that and early
on what would happen what would happen in my work is we say ok the client said
we had to do it that way and we feel kind of stock and would be annoyed of
our clients a client didn't get it right but that complaint is no fun
what's fun is figuring out something creative and find a way around it and
getting the client what they saw giving the client we know they need and having
everybody win
ok next story um I love this one I did this one of the email says that it's
from Dave Kennedy of at our client organization and so the the email says
this is the IT director David Kennedy I need you all to send me your password
you know please no please click this link and give me your password
what happened well my target organization they turned out they sit in
a really big one story
floorplan I visited later and found out that's how the seating work I didn't
know that's how it works but until we got our next task and internal sense
when we realize they're all on one floor
it's like a big aircraft hangar of desks it was it was kind of ugly an awful but
but it did have one advantage and that was that ever going to basically see day
where they could see somebody you could see Dave when they just people start
walking over until they've basically I pulled out the walmart night and said
this is dave that email is not for me don't give me your password which is all
okay see this is why I danced to the joke you don't left
so so anyway this all goes badly for success rate plummets so how do you will
always the pics for this
okay well from now on we find out we will learn a little bit more about where
everybody says so I want to learn where they said how do they communicate what's
the escalation procedure what's what's going to happen when the first person
who realizes this is a scam finds out
are they are they going to call are they going to call the helpdesk if they're
going to call the helpdesk maybe I need to get the helpdesk involved and say hey
guys can you give us a pass on this one this one is this one is your partner
this is the visit internal thing or this is you know where were your pen test
partner um I want to make another part of that though is can I get more people
involved and brings coming the pretext
can I have better communication so I have my boss or my clients and maybe one
level of management above them involved in creating that pretext and when they
go and check that pretext and say hey go check that you know go discuss this with
HR disgusted with legal votes discuss with compliance let's figure out of Jack
could be part of the alert chain so uh next fail my client says hey you i want
to send these emails nice and slow because i want to avoid detection
so you're like okay yeah we'll send one every five minutes and by the time
you've sent out 10 almost an hour has gone by someone alerted the security
folks the help desk or whatever they send out a mass email the whole
organization has caught you
the jig is up sure low and slow was not sneaky turned out low and slow was very
very unsteady I need to go on a heck of a lot faster
um I do like this though the organization caught me right they caught
me by all talking to each other I what they weren't just relying on each one
person can scan that's not what i was trying to measure but it was a really
cool results find and that's part of what i like about fishing is that you
end up getting to find out you get you end up getting to improve that
so as far as I'm concerned it's all about speed it's all about speed and you
should take as much speed as you know of this is not about amphetamines
ok so
fishing is all about speed you have to rush take whatever legal impediments you
have to do so let's go for coffee
you're racing their ability to catch you as a group to communicate and
collaborate so realize the communication collaboration this talk is happening on
all sides of make sure that your email gives such a short deadline that people
are rushing but they're not getting a chance to think and see
wait why would Dave need my password was reset academy or whatever like don't
give them time to talk get the emails out as fast as you can okay next fail we
have a case where you're like you know this is your first mission exercise and
and you do what you've always right about the books and your domain is lines
domain with the l change to one or with one of the elves pulled out right that's
the kind of like yeah I can get that domain and get a certificate certain the
domain everyone's gonna fool and then you realize what we realized really
quickly
this is the one thing that everybody's really well-trained that they're looking
to see is the domain just like ours but a little different and so no none of
them are rules
well okay a few still get fooled anyway you always get somebody that's great i
love fishing
um but not enough of them are fool you need a better domain choice so here's
some of the ideas that we've had we've done things like said you know and I've
got I've got a sum of people in this room who actually you know steered us in
this direction like haha maybe its clients pipe and benefits . com that
sounds good enough maybe it's a sub-domain we have like clients name .
you know my health benefits shit that I just ruin whatever domains
okay well please don't black list these domains there we like them up so you
know figure out what will work and part of figuring out what a work is talk to
your client will talk about that and they'll also have the best ideas for
pretexts they've been hoping for this for a long time but also going to talk
to your colleagues like I'm gonna go and say hey John I was thinking about you to
me like Lily with 1l change on be like to
I've been there done that it doesn't work it doesn't work bad don't even like
how about what if you tried this and you collaborate and you get much better
results
that's honestly one of the strongest things and gardens whenever one of our
greatest friends and guardians is that we're all talking as we're working the
world helping each other out we're all learning from each other and and it
makes us much much stronger so so here's so what if in that story right now where
I chose the boneheaded domain and eli lilly with with 1l change what if it's
the client who asked for that
what if the clients and just ask where they told you had to write like we've
all had that experience where we think we have no choice
the boss just said we have to do this maybe the Boston mean it quite that way
maybe he did but we want to take it that way so this is where i'll come back to
my theme that the fishing is about collaborating and communicating
negotiating the easiest way to lose out in a negotiation is to not realize
you're in one
ok sure the client said you had used that domain can you talk and say that
I'm really worried that might not work
you kind of reveal your own concerns and do it in a way that your client can get
with empathize with I'm really worried that's not gonna work and i'm going to
give you a false sense of security or you know I'm gonna get laughed at you're
gonna get lapped at people are going to think that we did a good job and if they
still don't see it say okay I tell you I can we just get a couple more people
from you know we get a couple of more of your years you know or your boss's boss
being on this conversation so we you know so we can just check this out and
let somebody else say it's a brain-dead idea
okay uh next story broken grammar we have this we've gotten this one a lot
this is one of the biggest things that's ever frustrated of our people is when
you're is when the client says hey I want to use broken grammar and bad
spelling because that's I get tons of these phishing emails we always have
broken grammar and bad spelling and I want this to be realistic
ok if you go with it you're going to be your your success rates going to plumb
it you're going to feel frustrated
you know that it wasn't realistic the problem at the end of that is that your
client has your client has basically given his company a false sense of
security and you did it because you felt like you had to
ok so your client was a negotiation you were negotiating with your client you
didn't realize your association your client one the negotiation and by
winning it really he lost so this is my you know first rule of negotiation if
anybody losses everybody loses this is similar to the the play or movie Chicago
right mom ain't happy ain't nobody happy my corollary to that that's when it's
going to stop me my corollary to that is if anybody in happy ain't nobody happy
we all know this from our families right things have anybody unhappy and your
family without everybody basically being like please not for any length of time
so so what do you do you get creative you tell you tell your client liked how
the broken after the heartbroken grammar is going to hard it is not going to
harden them against Fisher's who do right well if I don't believe you
this is about realism for them maybe you go and find a phishing email that you
received that had good grammar and good spelling it was pretty dark convincing
maybe when you asked quietly pulled by was like oh yeah that did happen me once
like okay you remember that one that's what we're aiming for and now you've got
somebody on board with you now if you're still stock get right again realize
you're negotiating it's not just it's not just that one person's idea has to
win and you find something we both win
so you could say tell you what I'll do one round of fishing maybe against half
the organization that has broken grammar and one round that has not broken
grammar and we'll get to see what you know we'll get to see the difference and
we'll get we'll both get the data that we were looking for
ok so keep checking my time
ok good so the story eight and this one may or may not happen recently it was
kind of fun the the client client comes to us we hate when this happens
courthouse listen only me and my boss know that this is happening at all
we've never told anybody planning fish were just fishing ourselves
okay and I whenever anybody says I'm like no of right so so what happened was
one time we did that nobody else gonna hear we're like but we really should
involve legal and and if you guys have compliance involve them maybe tell the
helpdesk about like no one's gonna know and and so we said okay fine we sent out
phishing emails and other client holding for guard and the investigation got
opens and a whole bunch of us got egg on our face
this is happened with other organizations be so I didn't regard but
I'm uh I'm not going to go into that so what do you do to avoid this situation
right first you have to leave you have to stay you have to basically be very
very confident you have to know that you're the one that's got the experience
or you're the one that cares about this the most or what have you but you have
to stand up and lead and you have to say just honestly it's part of my checklist
as I'm taking a client through what we're going to do
it's like and here's the stage where you tell HR legal and so on about the test
um and I make brainstorming who those people are part of setting up for this
the other thing i do is tell stories humans were optimized for storing it
turns out that if I tell you a story with 20 plotlines you can repeat them
back to me in order and you can pass that along and it will still come out in
order where our brains for one reason or another evolved for stories you can't do
the same thing necessarily the 22 not digit number okay he can but the rest of
us probably can't
ok at least I can handle of the recipe ok so what are the other parts you have
to know the client know the target right know your target is the way the military
talks about this look at what are the escalation paths and where do I want to
set my break points so it's going to go to help desk and I want to clue them in
but helpdesk is going to go to security next
cool let's make sure Security's part of this ok next story the client called you
hourly for results the fishing exercise going out two days and every hour on the
hour you get another call from a client and it's driving you nuts
I kinda like that many calls from people I'm really
social but let's just assume you're introverted of so what do you do
this is where you manage expectations this is a you keep that level of effort
under control
this is part of you have to lead you say early on when the what when we started
fishing i'm going to call you every 15 minutes for the first hour after that
we're going to talk twice that day we're gonna talk twice the next day and if the
clients like I really wish you know at that point what you're going to say it's
strongly and now you you can't shut down the conversation you've got to basically
something to figure out how that felt the other person and say okay how did
that feel
and they're like really but that sounds good but at the beginning I really wish
like you could give me those instead of every 15 minutes how about hourly for
the first four hours like same amount of communication that's what works better
for you
I can deal with that sounds great and so you basically have to leave and then you
have to listen okay so story 10 where 10 through 10 out of 12 I like the way this
is going so your campaign is successful you've got tons of passwords you want it
I wonder if I got that on camera and it wasn't looking for it without a license
can I fake it but i can fake that one when you get that again you rock
we said that to me i'm negotiating he's not even using words but i'm watching
his face and watching his actions
it's going to work out better I mean maybe he's like no I'm not gonna forget
to send that to you or I'm gonna take that picture but if it didn't ask i
don't get to find out if that's a possibility and that's really good for
getting cool pictures of conferences it's also really cool for making your
professional life from your personal life work so in this situation your
campaign successful but your client doesn't feel like you're communicating
enough they didn't they didn't score this used to say this as they didn't
feel the love you got to make him feel loved
so maybe they thought you didn't care or maybe Steve it was worse than that maybe
because you weren't communicating very much with them when something bad
happens when management freak tower or when employees got went nuts they didn't
feel like they could call you would ask for help
where they didn't call you and ask for help because they didn't feel like you
know they're just like much communication going on and so then
things go badly the organization is going to fish again for years and you
could have done something about that but could only do something about that if
you were in conversation with them if you kind of built up that that rapport
that conversation that trust that when something went bad the client instead of
being mad at you comes to you and says hey this is what's going on and you're
like oh hey we've done this before I would do this
ok so success and a happy client your ears we do that remember most of all
like empathy remember that your security people over their client they've been
rooting for this for a long time they've been wanting an exercise like this for a
long time before they got it
um another part is making me feel loved given stats really often during the
first day have that conversation about how often you're going to here's another
one and I had talked about this a little bit communicate more
yeah we all know more but we also want to know how much and how and the cool
thing is you can ask i can ask my client what do you want in terms of
communication i was thinking this could be like well that sounds kind of good
but that would be annoying what if you did this on people
this is the cool thing about life is that we all train each other and I've
heard this in the last knowing the in Guard spokesman here for a few days
for conference we've all been talking I realized like God we will train each
other on how we want to be communicated with how often what we want that to look
like hey when you text me before you call me is one but another one is like
if you want something for me yelling views not going to help could you
instead tell me what's important to you or whatever so these are the people who
trained me and if you think in your own life you've got you've got these people
to these are my these are my this is my family home
these are my family at work they're the ones who tell me each day with a like
and how this is going to land better and hopefully after this talk so if you'll
come and talk to me and you'll train me and tell me how you'd like to hear this
kind of how they would like to hear this kind of material the conference I know a
bunch of you who like it well i hope the ones who don't like it well too
ok so I'm check we're doing good so story 11 reinventing the wheel this is
something we did the first for fishing engagements and guardians did we
everything built their own fishing infrastructure from scratch and they
generally build something that would last only for that one engagement and
never again which meant that we were spending more time than we needed to and
we weren't getting crafty we weren't getting we weren't getting better so
we're kind of like we're not getting better we're just basically building and
rebuilding and and reinventing the wheel over and over again so for us we think
either find a good tool fishing friends is one of our favorites or develop your
own and then teach everybody how to use it if it's important to you you gotta
talk to people you gotta talk to a lot of people I got frustrated like I built
a tool it's really good and no one's using it
oh did I go around and tell people about it that I do my part in making sure that
they that they knew that it existed
did I trained some people on the tools they made it so that I lowered so I so I
made it easier for them to get into it and easier for them to go where I want
them to go up every fishing test should make you better fishing so get better
stagnate this is true on again for everything in your work life so for us
it's kind of like we create some mail servers and we stopped reading mail
servers at this point we know that every time that we use a fishing else or
anyone existing ones
new domains but we've made it really easy is to switch over the domains uh I
really i started out like many of us and security as a system administrator where
he learns the rule of enlightened laziness side of Larry pull out of Larry
pearls program / lightly ball and it basically said automate everything you
can or if you're going to do it twice automated heck you gonna do once
probably automated but automate everything you can let your laziness let
your own desire not redo something over and over again and have that be boring
of end up saving you time and making it so that you can take time and truly
create and that way you can actually up and up and up it so last story an omen
unknown impact we did a ton of fishing and pigments and we never found out my
client we never went ask the client hey uh what was the impact like are you guys
getting better reporting you guys you know are people getting cautious as much
by pitching after as before and eventually what happened was client came
to us and said hey I want to let you know like here's a slide that I
presented to our board
I'm like you're bored wow I like that and said this is this is what happened
before your fishing engagement our reporting rates on phishing scams worth
this level
afterwards they jumped up to this level and people are way better at calling
helpdesk and telling them something is going on and i found that when the
client told me that I got this kind of joy and I got satisfaction knowing that
what I was doing was making some kind of a difference and often communicating is
the only way you do that going to ask what kind of difference you're making
how did that work for you uh you should I think everyone's probably getting this
talk is really about fishing
I mean it is we're talking about fishing entirely this is really useful stuff
efficient but this is kind of like Jays rules for life whether it's you know
like with your family life inside your company like with your client
this is just stuff that really really really helps ask the people ask the
people you're acting with how that interaction went afterwards
what did they get out of it and you'll be surprised how much joy you get out of
people saying
you know I know that call was really hard and we were fighting and i was so
happy for I learned so much for it felt so much closer to you or whatever
Oh last slide I've been presenting for a very long time of the conference's 1999
somewhere in the middle i had this much hair
not much uh I lost my hair by not following this kind of advice so I hope
you will have much more Joyce less stressful and less hair losing careers
thank you very much