1 00:00:00,030 --> 00:00:04,410 your exit doors are here here here and 2 00:00:02,399 --> 00:00:07,170 here thank you so much for joining me 3 00:00:04,410 --> 00:00:10,980 today I know this is the long haul into 4 00:00:07,170 --> 00:00:12,870 the end of the talk so I am Tracy Meili 5 00:00:10,980 --> 00:00:15,780 if I'm also known as InfoSec Sherpa on 6 00:00:12,870 --> 00:00:19,049 the Twitter's and sorry it is very dark 7 00:00:15,780 --> 00:00:20,549 up here what this talk is about I'm good 8 00:00:19,050 --> 00:00:23,820 at this but just the brief overview in 9 00:00:20,550 --> 00:00:25,650 case some of you are confused I'm just 10 00:00:23,820 --> 00:00:28,109 going to talk about some ways to better 11 00:00:25,650 --> 00:00:30,179 interact with end users and by end users 12 00:00:28,109 --> 00:00:32,040 I don't mean just the you know maybe 13 00:00:30,179 --> 00:00:33,600 admin assistants or the bank vice 14 00:00:32,040 --> 00:00:35,640 presidents I wasn't mean other 15 00:00:33,600 --> 00:00:36,840 departments you know even other tech 16 00:00:35,640 --> 00:00:39,180 departments that you may work with 17 00:00:36,840 --> 00:00:41,520 anybody who you are relying upon 18 00:00:39,180 --> 00:00:43,350 executing security you need to treat 19 00:00:41,520 --> 00:00:44,700 them as your customers so that is what 20 00:00:43,350 --> 00:00:48,090 this talk is about based on my 21 00:00:44,700 --> 00:00:49,590 experience as a librarian because I know 22 00:00:48,090 --> 00:00:54,570 I never tweet about it but yeah I used 23 00:00:49,590 --> 00:00:57,510 to be a library okay so first off yep 24 00:00:54,570 --> 00:00:59,480 there we go I also worked at a law firm 25 00:00:57,510 --> 00:01:02,760 for 10 years so I know about disclaimers 26 00:00:59,480 --> 00:01:05,580 my opinion strong or otherwise or mine 27 00:01:02,760 --> 00:01:07,979 in my own and not that of any group with 28 00:01:05,580 --> 00:01:10,830 which I am affiliated if you take issue 29 00:01:07,979 --> 00:01:12,900 with something that I say please invite 30 00:01:10,830 --> 00:01:15,450 me to the bar and buy me a drink and I 31 00:01:12,900 --> 00:01:19,250 will gladly discuss our differences with 32 00:01:15,450 --> 00:01:21,659 you over a cocktail hashtag gymflow SEC 33 00:01:19,250 --> 00:01:24,270 so I'd like to take a moment to manage 34 00:01:21,659 --> 00:01:26,310 your expectations what this talk is 35 00:01:24,270 --> 00:01:27,899 which I just said a second ago I am 36 00:01:26,310 --> 00:01:31,560 going to show you some key library 37 00:01:27,900 --> 00:01:33,390 science principles and how they pertain 38 00:01:31,560 --> 00:01:36,689 to information security dealing with 39 00:01:33,390 --> 00:01:39,270 with end users what this talk is not I'm 40 00:01:36,689 --> 00:01:41,789 not trying to sell you anything this is 41 00:01:39,270 --> 00:01:44,820 not a cure-all some of these situations 42 00:01:41,790 --> 00:01:47,130 may not you know pertain to your 43 00:01:44,820 --> 00:01:49,258 environment and that's fine but I do 44 00:01:47,130 --> 00:01:51,630 have one expectation of all of you if I 45 00:01:49,259 --> 00:01:54,659 may if you can at least please just take 46 00:01:51,630 --> 00:01:57,719 one thing no matter how small out of my 47 00:01:54,659 --> 00:01:59,610 talk and implement it back in your work 48 00:01:57,719 --> 00:02:02,369 or personal life then I will consider 49 00:01:59,610 --> 00:02:04,170 this talk a success so that those are 50 00:02:02,369 --> 00:02:06,450 the expectations 51 00:02:04,170 --> 00:02:07,920 and how am I going to do that I'm going 52 00:02:06,450 --> 00:02:10,170 to do this through storytelling I'm 53 00:02:07,920 --> 00:02:12,209 gonna tell you stories about my work 54 00:02:10,169 --> 00:02:14,730 life as a librarian also as a sake 55 00:02:12,209 --> 00:02:17,040 analyst and as you see the storyteller 56 00:02:14,730 --> 00:02:18,840 is sitting I may be sitting at some 57 00:02:17,040 --> 00:02:21,000 points I have a chair up here I have a 58 00:02:18,840 --> 00:02:22,590 wonky knee and if my knee gets wonky I'm 59 00:02:21,000 --> 00:02:24,420 sitting down it is not that I just 60 00:02:22,590 --> 00:02:25,890 respect my audience it's that I don't 61 00:02:24,420 --> 00:02:28,109 want to be in pain and I want to finish 62 00:02:25,890 --> 00:02:29,339 the talk so if you see me disappear out 63 00:02:28,110 --> 00:02:32,040 of sight it's because I'm sitting down 64 00:02:29,340 --> 00:02:34,319 so thank you so now you're like okay 65 00:02:32,040 --> 00:02:36,329 lady why should we listen to you so 66 00:02:34,319 --> 00:02:37,799 here's my street cred so that's me and 67 00:02:36,330 --> 00:02:40,050 the University of Pittsburgh mask up 68 00:02:37,800 --> 00:02:45,330 before a basketball game I have a 69 00:02:40,050 --> 00:02:48,420 master's degree allow any pit I'll beat 70 00:02:45,330 --> 00:02:49,680 myself up later to the University of 71 00:02:48,420 --> 00:02:51,958 Pittsburgh and I have a master's degree 72 00:02:49,680 --> 00:02:53,760 in library information science I also 73 00:02:51,959 --> 00:02:56,400 have undergraduate degrees from Temple 74 00:02:53,760 --> 00:02:58,769 and Penn State but I spent 15 years 75 00:02:56,400 --> 00:03:01,230 working as a librarian mostly in 76 00:02:58,769 --> 00:03:03,180 academic corporate and law firm 77 00:03:01,230 --> 00:03:05,609 environments corporate yes as in QVC 78 00:03:03,180 --> 00:03:07,920 like that QVC I was a librarian at QVC 79 00:03:05,610 --> 00:03:10,530 and I also worked in different colleges 80 00:03:07,920 --> 00:03:12,359 but mostly in law firms so no offense 81 00:03:10,530 --> 00:03:15,950 any lawyers in the room but I know what 82 00:03:12,360 --> 00:03:18,269 it's like to work with difficult patrons 83 00:03:15,950 --> 00:03:20,160 so I've been in the trenches y'all I've 84 00:03:18,269 --> 00:03:22,230 seen some things I can I can talk from 85 00:03:20,160 --> 00:03:24,630 experience but I also spent two years as 86 00:03:22,230 --> 00:03:26,548 a stock analyst I'm currently changing 87 00:03:24,630 --> 00:03:28,980 jobs which I cannot divulge at this time 88 00:03:26,549 --> 00:03:30,989 but all will be revealed soon enough I 89 00:03:28,980 --> 00:03:34,410 spent two years as a stock analyst for a 90 00:03:30,989 --> 00:03:35,910 large multinational corporation so I 91 00:03:34,410 --> 00:03:37,290 have experience there and I also have a 92 00:03:35,910 --> 00:03:39,030 jisuk I just want to put that in there 93 00:03:37,290 --> 00:03:41,429 so I do know a thing or two about a 94 00:03:39,030 --> 00:03:45,090 thing or two so that is part one of my 95 00:03:41,430 --> 00:03:46,440 street cred part two so what the last 96 00:03:45,090 --> 00:03:49,470 law firm I was at for about eight years 97 00:03:46,440 --> 00:03:51,329 every year the law firm had a customer 98 00:03:49,470 --> 00:03:54,239 satisfaction survey that they sent out 99 00:03:51,329 --> 00:03:56,310 to the entire law firm and every year 100 00:03:54,239 --> 00:03:58,049 that I was there the library which was 101 00:03:56,310 --> 00:04:00,780 the department where I worked ranked 102 00:03:58,049 --> 00:04:02,850 number one in customer satisfaction now 103 00:04:00,780 --> 00:04:05,790 before you think I'm full of myself I am 104 00:04:02,850 --> 00:04:07,858 not trying to say that was because of me 105 00:04:05,790 --> 00:04:10,048 I mentioned this because again further 106 00:04:07,859 --> 00:04:12,450 to my street cred I know what it's like 107 00:04:10,049 --> 00:04:15,060 to be on a high-performing team in a 108 00:04:12,450 --> 00:04:17,399 difficult environment in a high-pressure 109 00:04:15,060 --> 00:04:19,079 environment so I know what success looks 110 00:04:17,399 --> 00:04:20,370 like so this is why I want to share this 111 00:04:19,079 --> 00:04:23,160 with you because I've been through this 112 00:04:20,370 --> 00:04:25,320 so hopefully you understand why I feel 113 00:04:23,160 --> 00:04:28,080 that I'm qualified to speak about this 114 00:04:25,320 --> 00:04:31,139 and why the Derby con CFP committee how 115 00:04:28,080 --> 00:04:32,789 that has come I to speak about this so 116 00:04:31,139 --> 00:04:35,550 before we go any further I also want to 117 00:04:32,790 --> 00:04:39,360 clarify something everything is not 118 00:04:35,550 --> 00:04:42,960 sympathy sometimes people use them 119 00:04:39,360 --> 00:04:45,470 interchangeably they're different and 120 00:04:42,960 --> 00:04:48,060 that hotlink therefore merriam-webster 121 00:04:45,470 --> 00:04:49,050 hotlink I'm one might like 85 I don't 122 00:04:48,060 --> 00:04:52,710 know where that came from 123 00:04:49,050 --> 00:04:56,430 sorry Benjamin buttoning myself up here 124 00:04:52,710 --> 00:04:57,840 okay anyway um the link up there goes to 125 00:04:56,430 --> 00:05:00,150 a really good page on merriam-webster 126 00:04:57,840 --> 00:05:02,039 and great detail explaining the 127 00:05:00,150 --> 00:05:05,460 difference I don't want you to feel 128 00:05:02,040 --> 00:05:07,770 sorry for your end users I want you to 129 00:05:05,460 --> 00:05:11,099 understand what it's like to be in their 130 00:05:07,770 --> 00:05:14,430 shoes okay I want you to understand what 131 00:05:11,100 --> 00:05:17,910 it's like to be scared of security to be 132 00:05:14,430 --> 00:05:20,430 scared of Technology to be confused know 133 00:05:17,910 --> 00:05:21,990 and things like that because that's 134 00:05:20,430 --> 00:05:23,310 really important I don't know what you 135 00:05:21,990 --> 00:05:24,720 feel sorry for them I want you to know 136 00:05:23,310 --> 00:05:26,669 what what they might be feeling because 137 00:05:24,720 --> 00:05:27,970 that's going to help you better assist 138 00:05:26,669 --> 00:05:30,099 them 139 00:05:27,970 --> 00:05:32,290 and why do I care about this so if you 140 00:05:30,100 --> 00:05:34,600 have a hat I suggest you hold on to it 141 00:05:32,290 --> 00:05:36,640 if you are wearing a pearl necklace I 142 00:05:34,600 --> 00:05:38,320 suggest that you clutch it and be 143 00:05:36,640 --> 00:05:42,090 prepared to gasp because I'm gonna drop 144 00:05:38,320 --> 00:05:42,090 a drop a big one on you here ready 145 00:05:42,300 --> 00:05:50,520 information security is a service 146 00:05:44,800 --> 00:05:53,820 industry job thank you can I get an amen 147 00:05:50,520 --> 00:05:57,430 yes preach it preach it 148 00:05:53,820 --> 00:05:58,930 hashtag truth bomb I hide the reason why 149 00:05:57,430 --> 00:06:01,720 this talk came about is when I made my 150 00:05:58,930 --> 00:06:04,030 career change from library science into 151 00:06:01,720 --> 00:06:08,050 information security I was dumbfounded 152 00:06:04,030 --> 00:06:11,200 that the way that contempt and the 153 00:06:08,050 --> 00:06:13,600 hatred and the the attitude towards end 154 00:06:11,200 --> 00:06:15,370 users that a lot of infoset people had 155 00:06:13,600 --> 00:06:16,960 and you know you have to understand 156 00:06:15,370 --> 00:06:18,670 before I was a librarian I was a travel 157 00:06:16,960 --> 00:06:20,799 agent before that I also did a lot of 158 00:06:18,670 --> 00:06:22,150 customer service facing jobs so my 159 00:06:20,800 --> 00:06:24,430 entire professional career has been 160 00:06:22,150 --> 00:06:26,049 customer facing I am very well aware 161 00:06:24,430 --> 00:06:28,810 that those customers the reasons why I 162 00:06:26,050 --> 00:06:30,730 had a job so when I come into security 163 00:06:28,810 --> 00:06:33,250 I'm like you know that we have jobs 164 00:06:30,730 --> 00:06:35,919 because we're servicing their security 165 00:06:33,250 --> 00:06:37,660 needs right like so this is kind of how 166 00:06:35,919 --> 00:06:39,609 this talk came about so information 167 00:06:37,660 --> 00:06:42,700 security is a service industry job 168 00:06:39,610 --> 00:06:44,440 because customer service is it's an 169 00:06:42,700 --> 00:06:47,260 attitude or as we say in Philadelphia 170 00:06:44,440 --> 00:06:48,820 attitude it is an attitude it's not a 171 00:06:47,260 --> 00:06:51,219 separate department it's not someone 172 00:06:48,820 --> 00:06:52,599 else's job it's all of our jobs no 173 00:06:51,220 --> 00:06:54,400 matter what department you're in it is 174 00:06:52,600 --> 00:06:57,040 an attitude and with apologies the 175 00:06:54,400 --> 00:07:00,729 IceCube check yourself before you wreck 176 00:06:57,040 --> 00:07:02,290 it for everybody else ok get yourself in 177 00:07:00,730 --> 00:07:03,820 line so I'm gonna give you a little 178 00:07:02,290 --> 00:07:07,530 exercise here to try and help get you 179 00:07:03,820 --> 00:07:10,990 into that empathetic mindset here 180 00:07:07,530 --> 00:07:12,010 remember a time when you were a noob did 181 00:07:10,990 --> 00:07:15,460 you ever have learn how to play an 182 00:07:12,010 --> 00:07:17,980 instrument I did I had a mean music 183 00:07:15,460 --> 00:07:20,440 teacher who used to yell at me for not 184 00:07:17,980 --> 00:07:24,220 knowing my scales and every good boy 185 00:07:20,440 --> 00:07:26,169 deserves fudge and all that I still grew 186 00:07:24,220 --> 00:07:29,530 up to be a respected member of society 187 00:07:26,169 --> 00:07:31,330 mr. Bratton so there you know so that 188 00:07:29,530 --> 00:07:32,710 was scary right I didn't understand how 189 00:07:31,330 --> 00:07:33,039 to read music and I was trying to do 190 00:07:32,710 --> 00:07:35,049 that 191 00:07:33,040 --> 00:07:38,320 what about Dungeons and Dragons did you 192 00:07:35,050 --> 00:07:40,600 ever have alright did you ever have a 193 00:07:38,320 --> 00:07:42,250 mean Dungeon Master who got mad at you 194 00:07:40,600 --> 00:07:44,350 because you didn't know how to cast a 195 00:07:42,250 --> 00:07:45,310 spell on an elf or don't at me whatever 196 00:07:44,350 --> 00:07:48,789 I don't know what I'm saying 197 00:07:45,310 --> 00:07:51,340 but anyway that just sounded right in my 198 00:07:48,789 --> 00:07:53,590 head so I'm just gonna go with it but in 199 00:07:51,340 --> 00:07:55,570 order to understand empathy think about 200 00:07:53,590 --> 00:07:57,310 back to when you were new at something 201 00:07:55,570 --> 00:07:59,050 because this is what your end users feel 202 00:07:57,310 --> 00:08:00,280 like they don't deal with you know they 203 00:07:59,050 --> 00:08:02,200 don't necessarily deal with the high 204 00:08:00,280 --> 00:08:04,599 tech everyday or or they don't deal with 205 00:08:02,200 --> 00:08:07,180 security every day so it's kind of 206 00:08:04,600 --> 00:08:09,370 intimidating and scary and you need to 207 00:08:07,180 --> 00:08:12,039 kind of have an empathetic ear in mind 208 00:08:09,370 --> 00:08:14,200 and I to better service them for 209 00:08:12,039 --> 00:08:16,630 customer service so let's get to the 210 00:08:14,200 --> 00:08:18,880 meat and potatoes use my Philly accent 211 00:08:16,630 --> 00:08:20,800 so this is the reference interview so I 212 00:08:18,880 --> 00:08:22,409 told you I went to university Pittsburgh 213 00:08:20,800 --> 00:08:25,000 for masters library information science 214 00:08:22,410 --> 00:08:27,970 degree I also call that library school 215 00:08:25,000 --> 00:08:30,220 so in library school this was drummed 216 00:08:27,970 --> 00:08:31,479 into us this is a well-known principal 217 00:08:30,220 --> 00:08:33,550 and library science called the reference 218 00:08:31,479 --> 00:08:34,900 interview and I'm not going to read the 219 00:08:33,549 --> 00:08:36,520 slides because you were all capable of 220 00:08:34,900 --> 00:08:38,579 reading I believe unless somebody yells 221 00:08:36,520 --> 00:08:41,140 out they want me to read it to them 222 00:08:38,580 --> 00:08:42,190 these are the seven steps so what I'm 223 00:08:41,140 --> 00:08:44,110 gonna do is I'm going to go through 224 00:08:42,190 --> 00:08:46,360 these steps I'm going to explain through 225 00:08:44,110 --> 00:08:48,010 storytelling and examples of how I've 226 00:08:46,360 --> 00:08:50,070 been able to take these steps and apply 227 00:08:48,010 --> 00:08:50,069 it 228 00:08:54,010 --> 00:08:58,840 - life in InfoSec specifically as a 229 00:08:56,500 --> 00:09:00,460 stock analyst now I admit this print 230 00:08:58,840 --> 00:09:01,840 here is really tiny so this I'm going to 231 00:09:00,460 --> 00:09:04,000 read out we have a little play going on 232 00:09:01,840 --> 00:09:06,430 here the person on the Left says I 233 00:09:04,000 --> 00:09:06,850 clicked on a phishing link exclamation 234 00:09:06,430 --> 00:09:08,770 point 235 00:09:06,850 --> 00:09:11,410 and the info set professional on the 236 00:09:08,770 --> 00:09:14,040 right says I can help with an 237 00:09:11,410 --> 00:09:18,490 exclamation point so let's dig in 238 00:09:14,040 --> 00:09:21,010 approachability how easily is it for 239 00:09:18,490 --> 00:09:22,930 your end users to contact you does your 240 00:09:21,010 --> 00:09:25,810 department have maybe security at 241 00:09:22,930 --> 00:09:27,670 company comm or is it all individuals 242 00:09:25,810 --> 00:09:29,650 does someone know how to get in touch 243 00:09:27,670 --> 00:09:31,209 with you and you know and a lot of 244 00:09:29,650 --> 00:09:33,250 people like oh I don't want anybody 245 00:09:31,210 --> 00:09:37,240 contacted me directly get over it it's 246 00:09:33,250 --> 00:09:38,850 your job okay but make it easy for the 247 00:09:37,240 --> 00:09:41,320 end users do they know who to contact 248 00:09:38,850 --> 00:09:43,450 you know do you like it if you call some 249 00:09:41,320 --> 00:09:45,070 company you get bounced around like oh I 250 00:09:43,450 --> 00:09:46,540 need to transfer you I need to transfer 251 00:09:45,070 --> 00:09:48,580 you I need to transfer you you don't 252 00:09:46,540 --> 00:09:51,849 like it do you wash it your end-users 253 00:09:48,580 --> 00:09:53,980 like it what about the outgoing messages 254 00:09:51,850 --> 00:09:55,720 what do you say what kind of impression 255 00:09:53,980 --> 00:09:58,090 do you give and I'm going to give you an 256 00:09:55,720 --> 00:10:01,330 example so we dealt with the phishing 257 00:09:58,090 --> 00:10:02,500 emails and if people submitted an email 258 00:10:01,330 --> 00:10:04,540 and it was deemed to be a fish they 259 00:10:02,500 --> 00:10:08,920 would get this message or saying yep 260 00:10:04,540 --> 00:10:12,339 that was malicious and that was it and I 261 00:10:08,920 --> 00:10:15,160 spoke up I was like um can we give them 262 00:10:12,340 --> 00:10:17,890 some steps to take or some things to do 263 00:10:15,160 --> 00:10:19,569 so I managed to work with some other 264 00:10:17,890 --> 00:10:22,300 people in security department and then 265 00:10:19,570 --> 00:10:24,040 we crafted this outgoing message of you 266 00:10:22,300 --> 00:10:27,310 know yes thank you for reporting that 267 00:10:24,040 --> 00:10:30,040 email it was malicious if you clicked on 268 00:10:27,310 --> 00:10:32,140 it if you open something here are some 269 00:10:30,040 --> 00:10:34,480 steps we need you to take change your 270 00:10:32,140 --> 00:10:36,760 password bla bla bla bla if you have any 271 00:10:34,480 --> 00:10:39,880 questions or concerns contact us at this 272 00:10:36,760 --> 00:10:42,250 and you know what change I saw I would 273 00:10:39,880 --> 00:10:44,410 see end users just emailing us in 274 00:10:42,250 --> 00:10:47,410 response going yep just want to let you 275 00:10:44,410 --> 00:10:50,079 know it changed my password that went up 276 00:10:47,410 --> 00:10:52,390 exponentially and I was thrilled so that 277 00:10:50,080 --> 00:10:54,430 means what they read the email and they 278 00:10:52,390 --> 00:10:56,530 did it and then they took the time to 279 00:10:54,430 --> 00:10:58,120 let us know so whenever I saw those 280 00:10:56,530 --> 00:11:00,010 responses come back I'd be like great 281 00:10:58,120 --> 00:11:02,860 job thank you so much for letting us 282 00:11:00,010 --> 00:11:04,900 know and I really feel like that made us 283 00:11:02,860 --> 00:11:06,070 more approachable because then they 284 00:11:04,900 --> 00:11:07,750 could just let us know that they did 285 00:11:06,070 --> 00:11:09,640 things and we gave them information 286 00:11:07,750 --> 00:11:12,220 so what are your outgoing messages say 287 00:11:09,640 --> 00:11:13,810 to people and what's your tone if you 288 00:11:12,220 --> 00:11:15,100 have ever worked any sort of phone job 289 00:11:13,810 --> 00:11:16,540 they always tell you to smile when 290 00:11:15,100 --> 00:11:18,760 you're talking because it helps the tone 291 00:11:16,540 --> 00:11:21,880 and I can hear some eyes rolling in the 292 00:11:18,760 --> 00:11:24,880 back I can hear you it but it does help 293 00:11:21,880 --> 00:11:27,250 it's kind of hard to be to be nasty if 294 00:11:24,880 --> 00:11:28,870 you're smiling in your pleasant but just 295 00:11:27,250 --> 00:11:32,410 be mindful what is your tone and I know 296 00:11:28,870 --> 00:11:34,750 we all have bad days but do your best to 297 00:11:32,410 --> 00:11:39,719 try and rein it in and remember you want 298 00:11:34,750 --> 00:11:44,320 to be approachable sprechen zie Deutsch 299 00:11:39,720 --> 00:11:46,240 powerful se habla espanol you may not 300 00:11:44,320 --> 00:11:48,760 speak another language but to your users 301 00:11:46,240 --> 00:11:51,450 I work for a multinational company we 302 00:11:48,760 --> 00:11:53,980 would get emails in another language and 303 00:11:51,450 --> 00:11:58,030 some of my co-workers would get angry 304 00:11:53,980 --> 00:11:59,770 about that and I said this it's our job 305 00:11:58,030 --> 00:12:01,240 as customer service to figure out what 306 00:11:59,770 --> 00:12:03,760 they're saying and to reply so what I 307 00:12:01,240 --> 00:12:07,030 used to do was I would reply in their 308 00:12:03,760 --> 00:12:09,880 language using an online translator with 309 00:12:07,030 --> 00:12:12,970 my first sentence being I am using an 310 00:12:09,880 --> 00:12:14,860 online translator why because they're 311 00:12:12,970 --> 00:12:17,740 not perfect right so I don't want to 312 00:12:14,860 --> 00:12:19,930 offend someone or confuse someone with 313 00:12:17,740 --> 00:12:22,150 the choppy translation so your first 314 00:12:19,930 --> 00:12:23,620 response should be you know I am using 315 00:12:22,150 --> 00:12:26,709 an online translator and then your 316 00:12:23,620 --> 00:12:29,800 message and then below that I put what I 317 00:12:26,710 --> 00:12:31,180 was saying in English why because some 318 00:12:29,800 --> 00:12:33,459 people who are multilingual 319 00:12:31,180 --> 00:12:36,219 may have better skills reading English 320 00:12:33,460 --> 00:12:39,190 than they do writing it okay so to make 321 00:12:36,220 --> 00:12:41,110 sure that the message gets through put 322 00:12:39,190 --> 00:12:42,880 it in two different ways and then this 323 00:12:41,110 --> 00:12:45,400 also goes for awareness or any other 324 00:12:42,880 --> 00:12:47,290 material do you have security 325 00:12:45,400 --> 00:12:49,240 instructions in other languages for 326 00:12:47,290 --> 00:12:51,400 people whose native language is in 327 00:12:49,240 --> 00:12:53,110 English if you know that maybe your 328 00:12:51,400 --> 00:12:55,870 South American offices are having 329 00:12:53,110 --> 00:12:58,000 particular problems with phishing do you 330 00:12:55,870 --> 00:13:00,130 have Portuguese and Spanish material for 331 00:12:58,000 --> 00:13:02,740 them are you expecting them to read 332 00:13:00,130 --> 00:13:04,000 English and understand what you're 333 00:13:02,740 --> 00:13:05,850 trying to get through so think about 334 00:13:04,000 --> 00:13:10,090 that 335 00:13:05,850 --> 00:13:11,440 reputation when were I said about 336 00:13:10,090 --> 00:13:14,380 checking yourself before you wreck it 337 00:13:11,440 --> 00:13:16,510 for everybody else try to determine what 338 00:13:14,380 --> 00:13:19,150 your security department's reputation is 339 00:13:16,510 --> 00:13:21,150 within your organization now some of you 340 00:13:19,150 --> 00:13:24,029 may be too young to remember this but 341 00:13:21,150 --> 00:13:27,069 you know about what nineteen years ago 342 00:13:24,029 --> 00:13:31,000 Jimmy Fallon you know Tonight Show fame 343 00:13:27,070 --> 00:13:32,380 or infamy depending on her opinion he 344 00:13:31,000 --> 00:13:36,010 had this sketch when sorry Night Live 345 00:13:32,380 --> 00:13:38,740 where he's Nick burns the computer guy 346 00:13:36,010 --> 00:13:40,540 and I put the the lyrics to the the 347 00:13:38,740 --> 00:13:42,010 jingle there and that was the whole 348 00:13:40,540 --> 00:13:43,719 sketch is that people would have a 349 00:13:42,010 --> 00:13:46,870 computer problem and he come and be like 350 00:13:43,720 --> 00:13:49,300 move and be really arrogant and mean 351 00:13:46,870 --> 00:13:51,670 about it is that what your users think 352 00:13:49,300 --> 00:13:54,579 of security do they think you're Nick 353 00:13:51,670 --> 00:13:57,490 burns so first of all take an assessment 354 00:13:54,580 --> 00:13:58,990 and you can maybe ask around or just how 355 00:13:57,490 --> 00:14:00,910 people interact with you if you call 356 00:13:58,990 --> 00:14:04,150 someone and say hi this is you know 357 00:14:00,910 --> 00:14:07,089 Tracy from security do people recoil do 358 00:14:04,150 --> 00:14:08,740 they get scared so try to figure out 359 00:14:07,089 --> 00:14:13,089 what your cut your reputation is of the 360 00:14:08,740 --> 00:14:14,530 security department and I feel seen it's 361 00:14:13,089 --> 00:14:16,720 usually a negative thing I want you to 362 00:14:14,530 --> 00:14:19,060 feel seen in a positive way so what I 363 00:14:16,720 --> 00:14:20,650 used to do when I was in the the law 364 00:14:19,060 --> 00:14:22,449 firm library is I would get involved in 365 00:14:20,650 --> 00:14:24,250 activities now for you that might be 366 00:14:22,450 --> 00:14:25,690 even just like a softball team or 367 00:14:24,250 --> 00:14:27,010 something like that I was involved in 368 00:14:25,690 --> 00:14:28,630 the diversity inclusion committee 369 00:14:27,010 --> 00:14:30,760 because I wanted to be able to go to 370 00:14:28,630 --> 00:14:32,920 those meetings and say hi I'm Tracy from 371 00:14:30,760 --> 00:14:34,900 the library I wanted to be a physical 372 00:14:32,920 --> 00:14:36,939 representation of the department I'm in 373 00:14:34,900 --> 00:14:38,860 and why is this important because when I 374 00:14:36,940 --> 00:14:41,740 first started as a sock analyst I 375 00:14:38,860 --> 00:14:44,050 replied to a user's email and her 376 00:14:41,740 --> 00:14:47,050 response to me was oh I didn't know 377 00:14:44,050 --> 00:14:50,680 there were humans in security and I'm 378 00:14:47,050 --> 00:14:53,680 like what and she said oh I just thought 379 00:14:50,680 --> 00:14:55,540 it was all computers and automate I 380 00:14:53,680 --> 00:14:57,640 didn't think any people actually worked 381 00:14:55,540 --> 00:14:59,079 in our security department and I turned 382 00:14:57,640 --> 00:15:01,810 to my boss I showed them email and I'm 383 00:14:59,080 --> 00:15:04,779 like don't you people ever talk to the 384 00:15:01,810 --> 00:15:07,810 end users he's like yeah not early I was 385 00:15:04,779 --> 00:15:11,770 like oh boy like wow you you people need 386 00:15:07,810 --> 00:15:13,930 me in four seconds so and I know this 387 00:15:11,770 --> 00:15:15,939 isn't everyone's cup of tea I know some 388 00:15:13,930 --> 00:15:19,630 of you are like oh screw that I am NOT 389 00:15:15,940 --> 00:15:21,880 becoming seen one I'm gonna say about 390 00:15:19,630 --> 00:15:24,970 that is things like this are skill they 391 00:15:21,880 --> 00:15:26,290 can be learned and they can be honed and 392 00:15:24,970 --> 00:15:27,820 also remember I said I wanted you to 393 00:15:26,290 --> 00:15:29,829 take one thing away from this maybe this 394 00:15:27,820 --> 00:15:31,600 isn't the thing you take away but for 395 00:15:29,830 --> 00:15:33,940 those of you who are more inclined to 396 00:15:31,600 --> 00:15:36,760 get involved in stuff it's amazing if 397 00:15:33,940 --> 00:15:39,160 you go out into your company and be the 398 00:15:36,760 --> 00:15:40,540 you know a physical face that people can 399 00:15:39,160 --> 00:15:42,370 talk to you now sometimes it turned into 400 00:15:40,540 --> 00:15:44,560 me feeling like a preset of confessional 401 00:15:42,370 --> 00:15:46,000 I would go to events in another building 402 00:15:44,560 --> 00:15:47,739 and I would say this from security and 403 00:15:46,000 --> 00:15:49,420 people would start telling me all the 404 00:15:47,740 --> 00:15:51,490 links they clicked on or all the secure 405 00:15:49,420 --> 00:15:52,930 or all the security things that they 406 00:15:51,490 --> 00:15:55,540 have in place like I have a really good 407 00:15:52,930 --> 00:15:59,349 password I'm like yay thanks hi I'm 408 00:15:55,540 --> 00:16:01,329 Tracy hi but sometimes it's funny and 409 00:15:59,350 --> 00:16:02,980 you know what it helps reinforce that 410 00:16:01,329 --> 00:16:05,560 you are a real person working on a real 411 00:16:02,980 --> 00:16:06,780 problem and again approachability makes 412 00:16:05,560 --> 00:16:08,640 you feel seen 413 00:16:06,780 --> 00:16:11,160 all right so let's move on to point 414 00:16:08,640 --> 00:16:12,870 number two interest I want you to be 415 00:16:11,160 --> 00:16:13,319 interested in solving the problem at 416 00:16:12,870 --> 00:16:16,320 hand 417 00:16:13,320 --> 00:16:18,300 aka do your damn job now I know that 418 00:16:16,320 --> 00:16:21,330 burnout is a very real thing and that is 419 00:16:18,300 --> 00:16:24,599 a different talk but if you are not yet 420 00:16:21,330 --> 00:16:26,490 jaded or burned-out you know do your job 421 00:16:24,600 --> 00:16:27,900 be interested in solving this because 422 00:16:26,490 --> 00:16:30,360 ultimately you know this is your job 423 00:16:27,900 --> 00:16:32,670 security is protecting your organization 424 00:16:30,360 --> 00:16:34,890 and I hate hot potato are you familiar 425 00:16:32,670 --> 00:16:36,209 with hot potato of you know bouncing 426 00:16:34,890 --> 00:16:37,560 things around this ought not it not it 427 00:16:36,210 --> 00:16:39,510 not mine not mine passing around 428 00:16:37,560 --> 00:16:41,579 sometimes you just need to suck it up 429 00:16:39,510 --> 00:16:43,530 and listen to what the end users asking 430 00:16:41,580 --> 00:16:45,690 sure there are times when you know what 431 00:16:43,530 --> 00:16:47,430 you'll say you know there's a different 432 00:16:45,690 --> 00:16:49,740 department that is really better suited 433 00:16:47,430 --> 00:16:51,810 to answer your question I'm going to 434 00:16:49,740 --> 00:16:54,150 email them to you know email them on 435 00:16:51,810 --> 00:16:56,040 your behalf I will copy you and I will 436 00:16:54,150 --> 00:16:58,230 describe the problem you don't blind 437 00:16:56,040 --> 00:17:01,110 transfer someone on a phone you don't 438 00:16:58,230 --> 00:17:03,000 blind forward emails you take the moment 439 00:17:01,110 --> 00:17:05,939 to be courteous to your fellow 440 00:17:03,000 --> 00:17:07,800 professionals explain the situation and 441 00:17:05,939 --> 00:17:09,839 you copy the person on it so that they 442 00:17:07,800 --> 00:17:10,770 can be in the loop of what's going on so 443 00:17:09,839 --> 00:17:12,810 don't hot potato 444 00:17:10,770 --> 00:17:16,439 gently hand over that potato and with 445 00:17:12,810 --> 00:17:19,139 some chives and sour cream and just in 446 00:17:16,439 --> 00:17:21,660 general I can't stress this enough don't 447 00:17:19,140 --> 00:17:23,760 belittle or mock or be condescending I 448 00:17:21,660 --> 00:17:25,949 know what I know things that can be hard 449 00:17:23,760 --> 00:17:27,300 and try and believe me my last week of 450 00:17:25,949 --> 00:17:28,890 work at my last job 451 00:17:27,300 --> 00:17:31,649 there were times and I was looking up 452 00:17:28,890 --> 00:17:34,130 going Lord they are testing me and I'm 453 00:17:31,650 --> 00:17:38,880 Jewish and I'm still like Jesus help me 454 00:17:34,130 --> 00:17:41,250 I I know it can be trying it can be 455 00:17:38,880 --> 00:17:44,430 trying but you know what you just take a 456 00:17:41,250 --> 00:17:46,590 deep breath empathy as a service and you 457 00:17:44,430 --> 00:17:50,070 work through it 458 00:17:46,590 --> 00:17:51,720 so it doesn't matter how many search you 459 00:17:50,070 --> 00:17:54,360 have what your Drake grade point average 460 00:17:51,720 --> 00:17:57,690 was how many degrees you have your end 461 00:17:54,360 --> 00:18:00,418 users are not going to care what a leet 462 00:17:57,690 --> 00:18:03,000 hacker you are unless you care about 463 00:18:00,419 --> 00:18:05,460 helping them so keep that in mind 464 00:18:03,000 --> 00:18:08,400 you can be the best hacker in your 465 00:18:05,460 --> 00:18:10,049 company and that's fantastic for you but 466 00:18:08,400 --> 00:18:11,130 your end users don't care unless you're 467 00:18:10,049 --> 00:18:13,260 going to take an interest in helping 468 00:18:11,130 --> 00:18:15,480 them 469 00:18:13,260 --> 00:18:18,720 so you can also do this by creating a 470 00:18:15,480 --> 00:18:20,429 safe space and then one of them is just 471 00:18:18,720 --> 00:18:21,809 giving us users full attention how many 472 00:18:20,429 --> 00:18:23,880 times have you ever called a call center 473 00:18:21,809 --> 00:18:25,168 and you hear a lot of like laughing and 474 00:18:23,880 --> 00:18:26,700 joking in the background and then the 475 00:18:25,169 --> 00:18:28,799 person you're talking to you hear them 476 00:18:26,700 --> 00:18:30,570 like stifle laugh or you like hear 477 00:18:28,799 --> 00:18:33,000 yourself go on mute and stuff and I'm 478 00:18:30,570 --> 00:18:35,428 like hey attention like pay attention to 479 00:18:33,000 --> 00:18:37,470 me so be mindful of that there are times 480 00:18:35,429 --> 00:18:40,020 when I would leave the sock to take a 481 00:18:37,470 --> 00:18:41,640 phone call to talk to an end user 482 00:18:40,020 --> 00:18:43,350 because I knew there was too much going 483 00:18:41,640 --> 00:18:45,030 on there was too much background noise I 484 00:18:43,350 --> 00:18:46,740 wanted that person to know that I was 485 00:18:45,030 --> 00:18:49,350 paying attention and I was focused on 486 00:18:46,740 --> 00:18:51,360 them I would just want to tell you a 487 00:18:49,350 --> 00:18:54,270 quick story time here cold medicine Carl 488 00:18:51,360 --> 00:18:56,129 not his real name we get a name email 489 00:18:54,270 --> 00:18:58,200 one day at the Salk and he's like I'm 490 00:18:56,130 --> 00:19:01,169 working from home I'm really sick I'm on 491 00:18:58,200 --> 00:19:04,169 a ton of cold medicine and I clicked on 492 00:19:01,169 --> 00:19:05,640 a malicious link help so I'm not gonna 493 00:19:04,169 --> 00:19:07,230 get into the remediation part cuz I 494 00:19:05,640 --> 00:19:09,000 thought what this talk is about but long 495 00:19:07,230 --> 00:19:10,860 story short I finally get him on the 496 00:19:09,000 --> 00:19:13,350 phone to talk to him I can hear he's 497 00:19:10,860 --> 00:19:16,199 sick I can hear his raspy breathing I 498 00:19:13,350 --> 00:19:18,899 can also hear how stressed he is I can 499 00:19:16,200 --> 00:19:20,700 hear he's so completely stressed so long 500 00:19:18,900 --> 00:19:23,460 story short is it turned out to be you 501 00:19:20,700 --> 00:19:25,410 know nothing the this link that he 502 00:19:23,460 --> 00:19:27,299 clicked on actually was taken down by 503 00:19:25,410 --> 00:19:28,770 the blog provider so it was actually 504 00:19:27,299 --> 00:19:31,379 just one of those like that pages in 505 00:19:28,770 --> 00:19:32,790 here so dodged a bullet but I did 506 00:19:31,380 --> 00:19:35,400 something a little sneaky though I was 507 00:19:32,790 --> 00:19:37,020 like let's engage your antivirus and I'm 508 00:19:35,400 --> 00:19:39,860 like this is gonna take like an hour to 509 00:19:37,020 --> 00:19:43,889 run so I want you to go lay down and 510 00:19:39,860 --> 00:19:45,330 rest and let this run its course now you 511 00:19:43,890 --> 00:19:47,520 and I all know you can still use your 512 00:19:45,330 --> 00:19:49,678 laptop all the antivirus is running but 513 00:19:47,520 --> 00:19:51,750 I was taking some empathy this guy I 514 00:19:49,679 --> 00:19:54,030 could finally hear him calm down 515 00:19:51,750 --> 00:19:55,530 I got his stress level away but he was 516 00:19:54,030 --> 00:19:58,020 still sick and he's still on cold 517 00:19:55,530 --> 00:19:59,940 medicine so I made a snap decision of 518 00:19:58,020 --> 00:20:03,840 like I'm gonna tell a little white lie 519 00:19:59,940 --> 00:20:06,120 to get him away from the computer so he 520 00:20:03,840 --> 00:20:07,500 doesn't click on anything else I'm gonna 521 00:20:06,120 --> 00:20:10,320 tell him to go take a nap for an hour 522 00:20:07,500 --> 00:20:12,210 and he he was like oh no okay you're 523 00:20:10,320 --> 00:20:13,740 right yeah I'll let this run I'll go 524 00:20:12,210 --> 00:20:15,450 step away from the computer and I'll do 525 00:20:13,740 --> 00:20:17,190 that no harm no foul and it honestly 526 00:20:15,450 --> 00:20:18,960 probably took me longer to tell you that 527 00:20:17,190 --> 00:20:20,760 story than it did for me to interact 528 00:20:18,960 --> 00:20:22,110 with him because a lot of people say to 529 00:20:20,760 --> 00:20:24,900 me well I don't have time in my day to 530 00:20:22,110 --> 00:20:25,830 talk to all these people if you do it 531 00:20:24,900 --> 00:20:27,539 right 532 00:20:25,830 --> 00:20:30,658 takes quicker to help them than it does 533 00:20:27,539 --> 00:20:33,539 for you to tell the story and what's 534 00:20:30,659 --> 00:20:36,120 another way you can show interest okay 535 00:20:33,539 --> 00:20:41,760 you are not eating x' use punctuation 536 00:20:36,120 --> 00:20:44,158 and use sentence case okay write an 537 00:20:41,760 --> 00:20:47,340 actual letter thank you to the liberal 538 00:20:44,159 --> 00:20:49,019 arts majors who got that reference so 539 00:20:47,340 --> 00:20:50,490 there is a structure that you take to a 540 00:20:49,019 --> 00:20:53,100 letter and email there's the salutation 541 00:20:50,490 --> 00:20:55,380 so I just picked Robert dear Robert we 542 00:20:53,100 --> 00:20:59,010 have the body of the message in two 543 00:20:55,380 --> 00:21:00,899 sentences to I was able to convey four 544 00:20:59,010 --> 00:21:03,360 points of information I will break it 545 00:21:00,899 --> 00:21:05,760 down for you thank you for contacting 546 00:21:03,360 --> 00:21:08,639 the security team about the phishing 547 00:21:05,760 --> 00:21:10,590 email you received we will investigate 548 00:21:08,639 --> 00:21:13,740 and get back to you within a business 549 00:21:10,590 --> 00:21:15,539 day you think the user for contacting 550 00:21:13,740 --> 00:21:16,919 you why I was going to do a traumatic 551 00:21:15,539 --> 00:21:20,129 Handclap here but I can't with this 552 00:21:16,919 --> 00:21:23,429 microphone they didn't have to contact 553 00:21:20,130 --> 00:21:25,200 you they could have let it go they 554 00:21:23,429 --> 00:21:27,360 didn't have to contact you you thanked 555 00:21:25,200 --> 00:21:30,360 your end-users for contacting you and 556 00:21:27,360 --> 00:21:32,490 then you reiterate why they contacted 557 00:21:30,360 --> 00:21:34,830 you so the end user knows okay they 558 00:21:32,490 --> 00:21:36,500 understand why I contacted them rather 559 00:21:34,830 --> 00:21:40,199 some just like thank you for your email 560 00:21:36,500 --> 00:21:42,240 well no why are you why do they contact 561 00:21:40,200 --> 00:21:43,679 you and then we will investigate you 562 00:21:42,240 --> 00:21:46,350 tell them what action you're gonna take 563 00:21:43,679 --> 00:21:47,880 and then within a business day you give 564 00:21:46,350 --> 00:21:49,590 them some sort of reasonable timeframe 565 00:21:47,880 --> 00:21:52,559 of when they can expect to hear back 566 00:21:49,590 --> 00:21:54,240 from you two short sentences four very 567 00:21:52,559 --> 00:21:56,908 important pieces of information that 568 00:21:54,240 --> 00:21:58,620 that user can feel seen feel heard and 569 00:21:56,909 --> 00:22:01,440 feel like their problem is being worked 570 00:21:58,620 --> 00:22:04,500 on and then a close best regards regards 571 00:22:01,440 --> 00:22:06,539 sincerely Cheers is often one that 572 00:22:04,500 --> 00:22:08,519 people use and then your signature I 573 00:22:06,539 --> 00:22:11,070 know a lot of people have sig files but 574 00:22:08,519 --> 00:22:12,960 just who are you who are you on the team 575 00:22:11,070 --> 00:22:14,789 are you a manager are you an analyst in 576 00:22:12,960 --> 00:22:18,419 this case I was the security team Sherpa 577 00:22:14,789 --> 00:22:20,490 but who are you so this is such a short 578 00:22:18,419 --> 00:22:21,779 email to write and it's clear it's 579 00:22:20,490 --> 00:22:24,960 concise it can phase a lot of 580 00:22:21,779 --> 00:22:26,220 information another way you can show 581 00:22:24,960 --> 00:22:29,309 interest is have what I call an 582 00:22:26,220 --> 00:22:31,409 intrapreneurial spirit and you know 583 00:22:29,309 --> 00:22:33,899 entrepreneur but this is intrapreneur 584 00:22:31,409 --> 00:22:36,809 this is having that drive and go get it 585 00:22:33,899 --> 00:22:38,699 attitude that an entrepreneur have but 586 00:22:36,809 --> 00:22:39,330 within your organization so an example 587 00:22:38,700 --> 00:22:40,620 of this 588 00:22:39,330 --> 00:22:42,960 was this was long before I even realized 589 00:22:40,620 --> 00:22:44,969 I was gonna get into security I saw that 590 00:22:42,960 --> 00:22:46,620 the CEO of the law firm had a brand 591 00:22:44,970 --> 00:22:48,930 spanking new Apple watch when they very 592 00:22:46,620 --> 00:22:50,520 first came out and because he was busy 593 00:22:48,930 --> 00:22:52,680 showing everybody around that's how I 594 00:22:50,520 --> 00:22:55,139 noticed but I was in the elevator with 595 00:22:52,680 --> 00:22:57,570 him one day and I said Oh Charles I see 596 00:22:55,140 --> 00:22:59,400 that you have that new fangled Apple 597 00:22:57,570 --> 00:23:01,169 watch that came out I just saw that 598 00:22:59,400 --> 00:23:03,240 there were some security update about it 599 00:23:01,170 --> 00:23:05,880 I will email you the article when I get 600 00:23:03,240 --> 00:23:08,730 back to my office he sent a note to my 601 00:23:05,880 --> 00:23:11,850 boss complimenting me on being proactive 602 00:23:08,730 --> 00:23:14,340 and being observant to help solve a 603 00:23:11,850 --> 00:23:16,949 problem that wasn't even in my area of 604 00:23:14,340 --> 00:23:18,899 interest so have an intrapreneurial 605 00:23:16,950 --> 00:23:20,190 spirit or just hi I'm Tracy from the 606 00:23:18,900 --> 00:23:22,350 library I know you work in the 607 00:23:20,190 --> 00:23:24,450 healthcare law department we just got a 608 00:23:22,350 --> 00:23:25,740 bunch of law you know health books you 609 00:23:24,450 --> 00:23:27,690 know I can send you a list when I get 610 00:23:25,740 --> 00:23:30,180 back you know just maybe a quick thing 611 00:23:27,690 --> 00:23:32,400 about yourself or about your department 612 00:23:30,180 --> 00:23:34,200 is this entrepreneurial spirit just a 613 00:23:32,400 --> 00:23:36,120 little elevator pitch of who you are or 614 00:23:34,200 --> 00:23:38,850 what your department does to again be 615 00:23:36,120 --> 00:23:40,379 seen to be approachable to have people 616 00:23:38,850 --> 00:23:43,949 invested in security and know that 617 00:23:40,380 --> 00:23:45,300 there's humans behind it and listening I 618 00:23:43,950 --> 00:23:46,560 know it's really easy if you hear 619 00:23:45,300 --> 00:23:48,600 something like a yeah yeah I know where 620 00:23:46,560 --> 00:23:49,710 this is going and you jump in you need 621 00:23:48,600 --> 00:23:52,560 to listen to the whole story because 622 00:23:49,710 --> 00:23:53,940 there might be plot twists there might 623 00:23:52,560 --> 00:23:56,429 be things that come up that you weren't 624 00:23:53,940 --> 00:23:58,410 anticipating and another skill that you 625 00:23:56,430 --> 00:24:00,210 can try to have is pay attention to what 626 00:23:58,410 --> 00:24:02,190 the user doesn't say and I'll give you 627 00:24:00,210 --> 00:24:05,760 an example the users say well I clicked 628 00:24:02,190 --> 00:24:07,860 on a link the page opened up I close the 629 00:24:05,760 --> 00:24:10,530 browser and then I called you I'm like 630 00:24:07,860 --> 00:24:12,330 okay let's start go back there what 631 00:24:10,530 --> 00:24:15,120 happened from the time that the page 632 00:24:12,330 --> 00:24:16,710 opened before you closed it sometimes 633 00:24:15,120 --> 00:24:18,209 the answer is oh well I entered my 634 00:24:16,710 --> 00:24:19,860 username and password and nothing 635 00:24:18,210 --> 00:24:21,930 happens so then I closed it and then I 636 00:24:19,860 --> 00:24:24,780 called you like wow that's information I 637 00:24:21,930 --> 00:24:26,610 could have used a second ago so an easy 638 00:24:24,780 --> 00:24:28,879 way this is a skill you have to learn 639 00:24:26,610 --> 00:24:30,870 but a tip for this is when you're a 640 00:24:28,880 --> 00:24:32,100 problem-solving or you know doing an 641 00:24:30,870 --> 00:24:34,320 incident response or some sort of 642 00:24:32,100 --> 00:24:36,510 remediation you know what the steps are 643 00:24:34,320 --> 00:24:38,070 to fix the problem in your head so use 644 00:24:36,510 --> 00:24:40,500 that as a checklist if someone is 645 00:24:38,070 --> 00:24:42,600 telling you a story does this match is 646 00:24:40,500 --> 00:24:43,800 this oh wait we have a gap here now 647 00:24:42,600 --> 00:24:45,750 don't interrupt them because remember 648 00:24:43,800 --> 00:24:47,730 there might be a plot twist later either 649 00:24:45,750 --> 00:24:48,170 write it down or just remember it and 650 00:24:47,730 --> 00:24:49,730 then 651 00:24:48,170 --> 00:24:51,680 well back because that also shows your 652 00:24:49,730 --> 00:24:54,950 listening skills but I cannot tell you 653 00:24:51,680 --> 00:24:56,810 how many times I have zoomed back in on 654 00:24:54,950 --> 00:24:59,390 something that they didn't say and that 655 00:24:56,810 --> 00:25:01,340 was the issue usually enter user name 656 00:24:59,390 --> 00:25:03,590 and password they can Vina Lee leave 657 00:25:01,340 --> 00:25:08,780 that information out so sometimes you 658 00:25:03,590 --> 00:25:11,570 need to ask directly and again to be 659 00:25:08,780 --> 00:25:12,710 kind is more important to be right many 660 00:25:11,570 --> 00:25:15,620 times what people need is not a 661 00:25:12,710 --> 00:25:17,030 brilliant mind that speaks but a special 662 00:25:15,620 --> 00:25:18,590 heart that listens and I know that 663 00:25:17,030 --> 00:25:20,510 sounds all really touchy-feely and I can 664 00:25:18,590 --> 00:25:20,990 hear eyes rolling again but you get the 665 00:25:20,510 --> 00:25:24,500 point 666 00:25:20,990 --> 00:25:26,360 you know you you need to be kind and not 667 00:25:24,500 --> 00:25:28,160 you know tell some user I told you so I 668 00:25:26,360 --> 00:25:31,040 told her that was a luscious eye that 669 00:25:28,160 --> 00:25:32,480 doesn't help anybody need be kind so 670 00:25:31,040 --> 00:25:34,190 let's move to the interviewing step I 671 00:25:32,480 --> 00:25:37,430 already talked about what does the user 672 00:25:34,190 --> 00:25:38,810 not say another thing you can do is you 673 00:25:37,430 --> 00:25:41,750 have to be careful how you ask some of 674 00:25:38,810 --> 00:25:43,310 these questions what did you do that's 675 00:25:41,750 --> 00:25:46,160 kind of hard to say in a nice way right 676 00:25:43,310 --> 00:25:49,310 so I like to say things what action did 677 00:25:46,160 --> 00:25:52,070 you take okay Bob you clicked on that 678 00:25:49,310 --> 00:25:53,389 link what action did you take next and 679 00:25:52,070 --> 00:25:56,120 he'll be like oh well then I looked at 680 00:25:53,390 --> 00:25:59,660 the site and I saw it was the office 365 681 00:25:56,120 --> 00:26:01,669 login ok what action did you take next 682 00:25:59,660 --> 00:26:03,380 or what did this thingy that oh you know 683 00:26:01,670 --> 00:26:05,480 what action did you take what hat you 684 00:26:03,380 --> 00:26:07,430 know what happened next I have found 685 00:26:05,480 --> 00:26:09,530 trying to avoid the phrase what did you 686 00:26:07,430 --> 00:26:12,230 do because it just sounds it sounds less 687 00:26:09,530 --> 00:26:13,730 accusatory and again you these people 688 00:26:12,230 --> 00:26:15,470 are usually scared sometimes they think 689 00:26:13,730 --> 00:26:16,160 they're going to lose their jobs so you 690 00:26:15,470 --> 00:26:18,440 want to make them feel comfortable 691 00:26:16,160 --> 00:26:21,020 remember create a safe space so just 692 00:26:18,440 --> 00:26:23,380 find other creative ways to maybe ask 693 00:26:21,020 --> 00:26:28,010 things about what transpired transpired 694 00:26:23,380 --> 00:26:29,120 to use now let's get to the next or 695 00:26:28,010 --> 00:26:31,850 maybe you're trying to search into 696 00:26:29,120 --> 00:26:33,560 things is there a time when maybe your 697 00:26:31,850 --> 00:26:35,000 security failed the end user 698 00:26:33,560 --> 00:26:37,370 maybe it wasn't their fault maybe 699 00:26:35,000 --> 00:26:40,250 something malfunctioned you know there 700 00:26:37,370 --> 00:26:42,080 was you know maybe something didn't work 701 00:26:40,250 --> 00:26:43,970 right and it wasn't really their fault 702 00:26:42,080 --> 00:26:45,710 another time helped them connect the 703 00:26:43,970 --> 00:26:48,170 dots of things and I'll give you an 704 00:26:45,710 --> 00:26:50,860 example I have story time accounts 705 00:26:48,170 --> 00:26:54,560 receivable Rhonda so Rhonda contacted 706 00:26:50,860 --> 00:26:56,810 security and got me and she said I have 707 00:26:54,560 --> 00:26:58,879 a brand new task with my job I have to 708 00:26:56,810 --> 00:27:00,230 pay invoices and I've been doing it for 709 00:26:58,880 --> 00:27:02,900 a short time 710 00:27:00,230 --> 00:27:05,419 but this one vendor that I've already 711 00:27:02,900 --> 00:27:07,190 paid an invoice for now the invoice 712 00:27:05,419 --> 00:27:08,750 looks different and it's been sent to me 713 00:27:07,190 --> 00:27:10,669 in a different way so immediately like 714 00:27:08,750 --> 00:27:12,770 I'm on it this sounds great 715 00:27:10,669 --> 00:27:17,419 so it turns out it was one of those like 716 00:27:12,770 --> 00:27:20,830 DocuSign links and I used my you know my 717 00:27:17,419 --> 00:27:23,120 lab desktop you know to investigate and 718 00:27:20,830 --> 00:27:25,100 honestly everything kind of looked on 719 00:27:23,120 --> 00:27:26,870 the up-and-up I was doing all kind again 720 00:27:25,100 --> 00:27:28,370 this talk isn't about remediation but I 721 00:27:26,870 --> 00:27:31,250 was doing all kinds of things so I 722 00:27:28,370 --> 00:27:33,379 called Rhonda back and I was like listen 723 00:27:31,250 --> 00:27:35,809 I'm like I can't determine with any 724 00:27:33,380 --> 00:27:38,090 certainty that this is or isn't correct 725 00:27:35,809 --> 00:27:40,940 but let's do this I said do you have a 726 00:27:38,090 --> 00:27:43,250 phone number for someone at that company 727 00:27:40,940 --> 00:27:44,660 she said oh yeah Joanne I talked to 728 00:27:43,250 --> 00:27:46,700 Joanne all the time and she said I have 729 00:27:44,660 --> 00:27:48,320 her email address and that's when I 730 00:27:46,700 --> 00:27:51,620 helped her on to connect the dots I said 731 00:27:48,320 --> 00:27:54,080 but Rhonda if this company's email is 732 00:27:51,620 --> 00:27:57,020 compromised you could be emailing the 733 00:27:54,080 --> 00:27:59,240 criminal she never considered that and I 734 00:27:57,020 --> 00:28:00,620 said so if you know what I said you know 735 00:27:59,240 --> 00:28:02,870 you've talked to Joanne before right she 736 00:28:00,620 --> 00:28:05,030 says oh yeah yeah I'm like okay call her 737 00:28:02,870 --> 00:28:06,979 ask her if they've changed the way that 738 00:28:05,030 --> 00:28:08,570 they've done their invoicing and we'll 739 00:28:06,980 --> 00:28:10,850 go from there so she calls me back like 740 00:28:08,570 --> 00:28:12,530 15 minutes later yes they have 741 00:28:10,850 --> 00:28:14,209 completely changed how they've done 742 00:28:12,530 --> 00:28:19,250 their invoicing I was like wow way to go 743 00:28:14,210 --> 00:28:20,630 company for a pump--ow but yes and she 744 00:28:19,250 --> 00:28:23,000 confirmed yes that was the invoice we 745 00:28:20,630 --> 00:28:24,620 sent everything was on the up and up and 746 00:28:23,000 --> 00:28:26,210 I've told these people this story to 747 00:28:24,620 --> 00:28:28,699 some people and they're just like well 748 00:28:26,210 --> 00:28:30,770 wasn't that Rhonda's job to looking at 749 00:28:28,700 --> 00:28:32,960 that job Rhonda's jobs on security 750 00:28:30,770 --> 00:28:35,389 Rhonda's job as the pay invoices and 751 00:28:32,960 --> 00:28:37,880 again I praised her for contacting 752 00:28:35,390 --> 00:28:41,419 security because this particular invoice 753 00:28:37,880 --> 00:28:42,830 was $1500 next time if it was a fake one 754 00:28:41,419 --> 00:28:45,260 it could have been twenty five thousand 755 00:28:42,830 --> 00:28:47,409 dollars or more if she had never stopped 756 00:28:45,260 --> 00:28:49,910 to think something doesn't look right 757 00:28:47,410 --> 00:28:53,450 then this could have just perpetuated 758 00:28:49,910 --> 00:28:55,220 into a whole B EC cut a stroppy but she 759 00:28:53,450 --> 00:28:57,110 was brave enough to speak up and say 760 00:28:55,220 --> 00:28:59,179 this doesn't look great I'm not really 761 00:28:57,110 --> 00:29:00,229 sure and then she kept apologizing to me 762 00:28:59,179 --> 00:29:03,470 because when everything turned out to be 763 00:29:00,230 --> 00:29:05,570 fine I said it's my job you know you did 764 00:29:03,470 --> 00:29:07,190 your job by raising the alert all right 765 00:29:05,570 --> 00:29:09,200 you know we work together to solve it 766 00:29:07,190 --> 00:29:11,320 you did your job and I said if you ever 767 00:29:09,200 --> 00:29:14,830 find invoices that look fishy to you oh 768 00:29:11,320 --> 00:29:14,830 sorry Fi 769 00:29:15,030 --> 00:29:21,399 um you know let us know so that was 770 00:29:18,190 --> 00:29:23,980 Rhonda and then when you answer them 771 00:29:21,400 --> 00:29:26,140 remember my pleasure to help they didn't 772 00:29:23,980 --> 00:29:27,490 have to contact you you don't say you're 773 00:29:26,140 --> 00:29:29,290 welcome you're not doing them a favor 774 00:29:27,490 --> 00:29:31,600 you're doing your job you know and you 775 00:29:29,290 --> 00:29:33,250 remind people you did a good thing a lot 776 00:29:31,600 --> 00:29:35,500 of times I talk to people who are so 777 00:29:33,250 --> 00:29:37,690 nervous and upset and I remind them you 778 00:29:35,500 --> 00:29:40,180 did a good thing by contacting security 779 00:29:37,690 --> 00:29:41,740 because what's the what what if they 780 00:29:40,180 --> 00:29:44,260 didn't this would blow out it out of 781 00:29:41,740 --> 00:29:46,690 proportion out of control another story 782 00:29:44,260 --> 00:29:49,570 time for you Mike in the wonky Mouse so 783 00:29:46,690 --> 00:29:52,330 I get a phone call mike is like so my 784 00:29:49,570 --> 00:29:54,850 mouse isn't working right and I let him 785 00:29:52,330 --> 00:29:56,949 finish and I just very nicely said 786 00:29:54,850 --> 00:29:59,530 thought maybe it was an error and I said 787 00:29:56,950 --> 00:30:01,600 okay Mike well you've contacted security 788 00:29:59,530 --> 00:30:03,610 did you mean to contact the helpdesk 789 00:30:01,600 --> 00:30:07,209 I'll be happy to transfer me and he goes 790 00:30:03,610 --> 00:30:09,010 well I just talked to them and you see I 791 00:30:07,210 --> 00:30:11,380 clicked on a phishing email last week 792 00:30:09,010 --> 00:30:14,770 and now this week my mouse is all wonky 793 00:30:11,380 --> 00:30:16,390 I was like well there we go listen now 794 00:30:14,770 --> 00:30:18,040 see what would have happened if I would 795 00:30:16,390 --> 00:30:19,840 have just been like nope not my problem 796 00:30:18,040 --> 00:30:21,129 hot potato back to the helpdesk 797 00:30:19,840 --> 00:30:23,560 this poor guy would have been in a 798 00:30:21,130 --> 00:30:24,760 circle going back and forth and how soon 799 00:30:23,560 --> 00:30:26,950 do you think he would have given up of 800 00:30:24,760 --> 00:30:29,020 like okay nobody wants to help me so I 801 00:30:26,950 --> 00:30:32,260 was like oh okay now we have a security 802 00:30:29,020 --> 00:30:34,090 issue look into this so I looked into 803 00:30:32,260 --> 00:30:36,040 the email and everything again you know 804 00:30:34,090 --> 00:30:38,020 looked at the logs talked to him did all 805 00:30:36,040 --> 00:30:40,450 this stuff couldn't find anything that 806 00:30:38,020 --> 00:30:41,650 could contribute to the mouse so I'm 807 00:30:40,450 --> 00:30:43,440 like you know I'm doing my best 808 00:30:41,650 --> 00:30:46,960 winnie-the-pooh I'm like think you think 809 00:30:43,440 --> 00:30:49,930 take a deep breath and I go do you have 810 00:30:46,960 --> 00:30:54,100 a cordless mouse and he goes you can see 811 00:30:49,930 --> 00:30:57,310 that I'm good like I'm not that good so 812 00:30:54,100 --> 00:30:59,469 um I said when was the last time you 813 00:30:57,310 --> 00:31:06,340 changed the battery in your mouse and he 814 00:30:59,470 --> 00:31:08,860 goes never I said do me a favor go get a 815 00:31:06,340 --> 00:31:11,470 battery try it out see if you can 816 00:31:08,860 --> 00:31:13,870 replicate the issue call me back 15 817 00:31:11,470 --> 00:31:16,390 minutes later he calls me back I am so 818 00:31:13,870 --> 00:31:18,489 sorry to bother you with this and I said 819 00:31:16,390 --> 00:31:22,300 it was no bother I said I apologize that 820 00:31:18,490 --> 00:31:24,460 the helpdesk couldn't resolve this for 821 00:31:22,300 --> 00:31:26,340 you I said but you did a good thing 822 00:31:24,460 --> 00:31:28,200 because this could have been 823 00:31:26,340 --> 00:31:31,350 a security issue I was thinking his 824 00:31:28,200 --> 00:31:32,760 laptop was compromised okay so he asked 825 00:31:31,350 --> 00:31:35,429 me again he was like how did you figure 826 00:31:32,760 --> 00:31:38,160 that out and like I I don't know I don't 827 00:31:35,430 --> 00:31:41,250 I took a deep breath and the info said 828 00:31:38,160 --> 00:31:44,910 God's just you know waved a wand and it 829 00:31:41,250 --> 00:31:46,290 just popped him to my head he exactly I 830 00:31:44,910 --> 00:31:50,070 don't know why but you know it doesn't 831 00:31:46,290 --> 00:31:52,080 matter so what I did though was I was 832 00:31:50,070 --> 00:31:53,520 like hey while I have you on the phone 833 00:31:52,080 --> 00:31:56,460 and you're thinking that I'm all great 834 00:31:53,520 --> 00:31:58,770 and stuff can I show you some red flags 835 00:31:56,460 --> 00:32:01,230 that that email you've clicked on that 836 00:31:58,770 --> 00:32:02,730 to avoid this in the future he's like 837 00:32:01,230 --> 00:32:07,470 well sure I'll stay on the phone with 838 00:32:02,730 --> 00:32:10,290 you so what I constantly had you know 839 00:32:07,470 --> 00:32:11,940 easily available to me were you know 840 00:32:10,290 --> 00:32:13,260 little mock-ups like this this is one 841 00:32:11,940 --> 00:32:18,020 from Queen's University in Kingston 842 00:32:13,260 --> 00:32:18,020 Ontario shout-out to my Canadian friends 843 00:32:19,220 --> 00:32:23,700 just just something to show people red 844 00:32:22,230 --> 00:32:25,440 flags I would have this on my desktop 845 00:32:23,700 --> 00:32:27,000 save so if I go let me quickly share my 846 00:32:25,440 --> 00:32:29,460 desktop and I'm gonna walk you through 847 00:32:27,000 --> 00:32:30,990 some red flags may I send this to you 848 00:32:29,460 --> 00:32:33,150 now so that you can keep it 849 00:32:30,990 --> 00:32:35,010 oh yeah so he was very patient he's like 850 00:32:33,150 --> 00:32:36,660 oh you know you're right I should be 851 00:32:35,010 --> 00:32:38,040 more careful like these are great tips 852 00:32:36,660 --> 00:32:40,200 this one I didn't know I didn't know 853 00:32:38,040 --> 00:32:41,700 about hovering blah blah blah while you 854 00:32:40,200 --> 00:32:44,970 have their attention have this at the 855 00:32:41,700 --> 00:32:46,770 ready have something ready again it took 856 00:32:44,970 --> 00:32:49,800 me longer to tell this story than it did 857 00:32:46,770 --> 00:32:51,030 for me to help him cuz also while he was 858 00:32:49,800 --> 00:32:53,649 off searching for a battery I was 859 00:32:51,030 --> 00:32:55,750 working on another problem 860 00:32:53,650 --> 00:32:59,320 so let's get you the follow-up now our 861 00:32:55,750 --> 00:33:00,820 last one you know short on time some 862 00:32:59,320 --> 00:33:03,399 things like I already told you have some 863 00:33:00,820 --> 00:33:05,350 pre-canned language or some things you 864 00:33:03,400 --> 00:33:07,600 can send out to people you know just 865 00:33:05,350 --> 00:33:09,790 constantly come up with ways to improve 866 00:33:07,600 --> 00:33:13,709 your user interaction figure out what 867 00:33:09,790 --> 00:33:13,710 works what doesn't work you know 868 00:33:16,940 --> 00:33:22,320 think of you know initiatives it is a 869 00:33:20,220 --> 00:33:23,850 cybersecurity Awareness Month maybe talk 870 00:33:22,320 --> 00:33:25,649 to your security awareness team if you 871 00:33:23,850 --> 00:33:27,120 have one or just bring something up 872 00:33:25,650 --> 00:33:28,830 think of ways that you can constantly 873 00:33:27,120 --> 00:33:30,629 innovate because it makes things more 874 00:33:28,830 --> 00:33:35,040 interesting for you and it gets your 875 00:33:30,630 --> 00:33:37,380 your users engaged I also like to 876 00:33:35,040 --> 00:33:39,960 perform random acts of security kindness 877 00:33:37,380 --> 00:33:41,549 and I what I called the cyber cupcake 878 00:33:39,960 --> 00:33:43,290 because keep in mind outside of our 879 00:33:41,549 --> 00:33:47,790 community people think the word cyber is 880 00:33:43,290 --> 00:33:49,590 cool and they're impressed by it so I 881 00:33:47,790 --> 00:33:51,780 called this the cyber cupcake it was not 882 00:33:49,590 --> 00:33:55,470 this particular cupcake but I would keep 883 00:33:51,780 --> 00:33:58,020 a you know like a JPEG of a cupcake on 884 00:33:55,470 --> 00:34:00,780 my desktop and whenever I saw an 885 00:33:58,020 --> 00:34:03,389 end-user report a fish that was 886 00:34:00,780 --> 00:34:04,620 particularly sophisticated you know cuz 887 00:34:03,390 --> 00:34:06,000 sometimes you know just as a side note 888 00:34:04,620 --> 00:34:08,250 sometimes you see these fish in there 889 00:34:06,000 --> 00:34:10,168 like you have to be like wow like that 890 00:34:08,250 --> 00:34:11,310 was actually a really skillful fish and 891 00:34:10,168 --> 00:34:13,500 other times you look at some of these 892 00:34:11,310 --> 00:34:14,879 emails I'm like criminals take some 893 00:34:13,500 --> 00:34:17,668 pride in your work you know could you 894 00:34:14,879 --> 00:34:19,290 like try a little harder you know here 895 00:34:17,668 --> 00:34:22,379 but if you see one that's particularly 896 00:34:19,290 --> 00:34:24,869 good and that the user you know flagged 897 00:34:22,379 --> 00:34:27,750 it I would send them a cyber cupcake I 898 00:34:24,869 --> 00:34:29,879 feel like good job Eagle I reward good 899 00:34:27,750 --> 00:34:31,980 behavior and because I worked in this 900 00:34:29,879 --> 00:34:34,020 multinational company I couldn't give 901 00:34:31,980 --> 00:34:36,780 them a literal cupcake a physical 902 00:34:34,020 --> 00:34:38,429 cupcake so I sent them a JPEG people 903 00:34:36,780 --> 00:34:40,770 love that you would have thought I did 904 00:34:38,429 --> 00:34:43,290 I've given them a giant check you know 905 00:34:40,770 --> 00:34:45,869 like a big like oversized check people 906 00:34:43,290 --> 00:34:46,259 loved it I got replies back you made my 907 00:34:45,869 --> 00:34:49,350 day 908 00:34:46,260 --> 00:34:51,330 you made my week I was unsure about that 909 00:34:49,350 --> 00:34:55,049 email I was scared to submit it in case 910 00:34:51,330 --> 00:34:57,060 I was wrong nothing ever bad happened 911 00:34:55,050 --> 00:34:57,780 for me sending someone a cyber cupcake 912 00:34:57,060 --> 00:34:59,580 okay 913 00:34:57,780 --> 00:35:01,380 it was all good and it was super quick 914 00:34:59,580 --> 00:35:03,810 because it was on my desktop it took me 915 00:35:01,380 --> 00:35:07,730 two seconds out of my life and people 916 00:35:03,810 --> 00:35:07,730 loved it so reward good behavior 917 00:35:08,280 --> 00:35:13,410 kindness as a currency and a return on 918 00:35:10,950 --> 00:35:15,930 investment two different ways one story 919 00:35:13,410 --> 00:35:17,879 I'll tell you what snacks every year 920 00:35:15,930 --> 00:35:19,950 around Christmastime and when I was in 921 00:35:17,880 --> 00:35:22,530 the law firm library the librarians and 922 00:35:19,950 --> 00:35:23,790 I would all bake cookies and cakes and 923 00:35:22,530 --> 00:35:24,900 if you've ever follow me on Twitter you 924 00:35:23,790 --> 00:35:28,020 know this is my wheelhouse 925 00:35:24,900 --> 00:35:29,520 we could bake a lot of things and then 926 00:35:28,020 --> 00:35:30,840 we would come in and we would package 927 00:35:29,520 --> 00:35:32,759 them up and we would make these big 928 00:35:30,840 --> 00:35:34,290 cookie trays and then we would march 929 00:35:32,760 --> 00:35:36,390 through the law firm and we would give 930 00:35:34,290 --> 00:35:38,910 them to the help desk give them to 931 00:35:36,390 --> 00:35:40,830 accounting give them to facilities give 932 00:35:38,910 --> 00:35:42,930 them to the mailroom all the other 933 00:35:40,830 --> 00:35:45,390 departments in our law firm that we 934 00:35:42,930 --> 00:35:47,149 interacted with we gave them you know a 935 00:35:45,390 --> 00:35:51,450 gift as a thank-you 936 00:35:47,150 --> 00:35:53,820 kindness as a as a currency months later 937 00:35:51,450 --> 00:35:55,470 there would be some some problem that we 938 00:35:53,820 --> 00:35:57,120 would need a lot of help solving and 939 00:35:55,470 --> 00:36:00,089 somebody would go above and beyond 940 00:35:57,120 --> 00:36:02,100 because we constantly showed kindness 941 00:36:00,090 --> 00:36:04,440 and I don't mean kindness as a currency 942 00:36:02,100 --> 00:36:06,810 like a bribe but I mean it's you get a 943 00:36:04,440 --> 00:36:08,250 return on investment also if we ever had 944 00:36:06,810 --> 00:36:09,660 lunches you know a lot of vendors would 945 00:36:08,250 --> 00:36:11,130 like to bring in food to the library we 946 00:36:09,660 --> 00:36:12,750 would call other two parts we call the 947 00:36:11,130 --> 00:36:15,360 mailroom guys they're like we got 948 00:36:12,750 --> 00:36:17,670 sandwiches leftover sandwiches come get 949 00:36:15,360 --> 00:36:20,160 it those acts of kindness that we didn't 950 00:36:17,670 --> 00:36:21,630 have to do would come back in ways that 951 00:36:20,160 --> 00:36:23,490 we wouldn't even expect because somebody 952 00:36:21,630 --> 00:36:26,430 would go way above and beyond to help us 953 00:36:23,490 --> 00:36:27,959 for something so it's a it's a currency 954 00:36:26,430 --> 00:36:29,819 so again think about your end users if 955 00:36:27,960 --> 00:36:32,220 you show kindness towards them they're 956 00:36:29,820 --> 00:36:34,020 going to be more apps you want to get 957 00:36:32,220 --> 00:36:35,189 involved in and be a part of security 958 00:36:34,020 --> 00:36:36,660 because they're gonna they're gonna 959 00:36:35,190 --> 00:36:38,430 listen want to listen to you because you 960 00:36:36,660 --> 00:36:41,310 were nice to them and then there's the 961 00:36:38,430 --> 00:36:42,899 luncheon learns you know these these can 962 00:36:41,310 --> 00:36:45,000 also just be brown-bag things if you 963 00:36:42,900 --> 00:36:47,250 don't have any budget but it helps to 964 00:36:45,000 --> 00:36:48,810 even just provide like you know soda and 965 00:36:47,250 --> 00:36:51,180 cookies if people bring their own and 966 00:36:48,810 --> 00:36:53,130 you can do presentations but you can 967 00:36:51,180 --> 00:36:55,529 also do this with other departments 968 00:36:53,130 --> 00:36:58,530 within your organization you know talk 969 00:36:55,530 --> 00:37:00,900 to another tech department what are they 970 00:36:58,530 --> 00:37:03,300 doing what are you doing how do your 971 00:37:00,900 --> 00:37:05,880 paths intersect because you you also 972 00:37:03,300 --> 00:37:07,890 want the kindness of your fellow tech 973 00:37:05,880 --> 00:37:09,600 people right the security touches 974 00:37:07,890 --> 00:37:12,390 everything whether the other departments 975 00:37:09,600 --> 00:37:14,339 believe it or not you you know do things 976 00:37:12,390 --> 00:37:15,930 to bring them together and this kindness 977 00:37:14,340 --> 00:37:18,900 is you know you're gonna have a return 978 00:37:15,930 --> 00:37:23,250 on investment of this kindness 979 00:37:18,900 --> 00:37:25,080 so I saw this article and the second if 980 00:37:23,250 --> 00:37:25,860 you replace the word vaccinations with 981 00:37:25,080 --> 00:37:28,560 security 982 00:37:25,860 --> 00:37:31,680 I feel like this rings true when it 983 00:37:28,560 --> 00:37:33,779 comes to security I think we have this 984 00:37:31,680 --> 00:37:36,270 optimistic belief that just by telling 985 00:37:33,780 --> 00:37:41,090 people facts you can change their 986 00:37:36,270 --> 00:37:41,090 behavior that sound true does that sound 987 00:37:42,620 --> 00:37:49,920 you need this this isn't really audience 988 00:37:46,560 --> 00:37:52,470 participation there's a rhetorical 989 00:37:49,920 --> 00:37:55,800 question so you've heard and show and 990 00:37:52,470 --> 00:37:58,140 tell so instead I want you to tell then 991 00:37:55,800 --> 00:37:59,970 show it's one thing to say to someone 992 00:37:58,140 --> 00:38:02,400 you need to use a password manager and 993 00:37:59,970 --> 00:38:04,500 then walk away and think I am an awesome 994 00:38:02,400 --> 00:38:06,480 infoset professional I have just 995 00:38:04,500 --> 00:38:09,780 dispensed and pixie dust unto the world 996 00:38:06,480 --> 00:38:12,270 and it will happen you need to go a 997 00:38:09,780 --> 00:38:14,910 little bit further and sometimes you may 998 00:38:12,270 --> 00:38:16,440 not have time for that and I get it but 999 00:38:14,910 --> 00:38:20,490 here's a little tip of something you can 1000 00:38:16,440 --> 00:38:22,470 do PC Magazine has a great article where 1001 00:38:20,490 --> 00:38:24,629 they compare password managers side by 1002 00:38:22,470 --> 00:38:26,129 side maybe ten or twelve of them you can 1003 00:38:24,630 --> 00:38:27,720 just say to someone especially if you're 1004 00:38:26,130 --> 00:38:29,730 just like out in public and trying to be 1005 00:38:27,720 --> 00:38:32,430 like helpful info SEC Nancy you know 1006 00:38:29,730 --> 00:38:35,160 spreading pixie dust hey you know what 1007 00:38:32,430 --> 00:38:37,890 if you Google PC Mag password managers 1008 00:38:35,160 --> 00:38:39,420 2019 you're going to get this article 1009 00:38:37,890 --> 00:38:41,819 where they list them all side by side 1010 00:38:39,420 --> 00:38:44,370 take a moment to read and see which one 1011 00:38:41,820 --> 00:38:45,930 will work for you isn't that better than 1012 00:38:44,370 --> 00:38:49,440 just saying you need to use a password 1013 00:38:45,930 --> 00:38:51,240 manager you know or gtfo you know that's 1014 00:38:49,440 --> 00:38:53,460 you know you need to just kind of show 1015 00:38:51,240 --> 00:38:55,140 some people the way if you have more 1016 00:38:53,460 --> 00:38:56,580 time if it's specially internal maybe 1017 00:38:55,140 --> 00:38:58,230 have one of those lunch and learns of 1018 00:38:56,580 --> 00:39:00,120 this is how you set up a password 1019 00:38:58,230 --> 00:39:01,530 manager that is going to go a long way 1020 00:39:00,120 --> 00:39:03,779 than just saying you need to set up a 1021 00:39:01,530 --> 00:39:04,980 password manager and then remember I 1022 00:39:03,780 --> 00:39:07,230 told you how the woman was surprised 1023 00:39:04,980 --> 00:39:09,630 that there was a human and security I 1024 00:39:07,230 --> 00:39:12,450 know we all love automation automation 1025 00:39:09,630 --> 00:39:14,160 is is amazing but have you automated 1026 00:39:12,450 --> 00:39:16,919 things so much that people don't think 1027 00:39:14,160 --> 00:39:19,290 there's humans behind it so double check 1028 00:39:16,920 --> 00:39:21,300 or you know again that goes back to do 1029 00:39:19,290 --> 00:39:22,860 people know how to contact you because 1030 00:39:21,300 --> 00:39:25,910 is everything so automated they don't 1031 00:39:22,860 --> 00:39:31,280 even know how to get a hold of a human 1032 00:39:25,910 --> 00:39:33,379 all right wrap it up let's wrap this up 1033 00:39:31,280 --> 00:39:35,330 okay so originally when I started this 1034 00:39:33,380 --> 00:39:38,210 out remember it was called the reference 1035 00:39:35,330 --> 00:39:40,100 interview I have rebranded this for you 1036 00:39:38,210 --> 00:39:40,880 for the information security community 1037 00:39:40,100 --> 00:39:43,069 you're welcome 1038 00:39:40,880 --> 00:39:45,020 I Gail now give you the seven point plan 1039 00:39:43,070 --> 00:39:47,860 for the empathetic InfoSec practitioner 1040 00:39:45,020 --> 00:39:50,509 it's the same seven bullet points but 1041 00:39:47,860 --> 00:39:53,060 rebranded for your enjoyment to make 1042 00:39:50,510 --> 00:39:54,710 sure that it it pertains to your world 1043 00:39:53,060 --> 00:39:57,049 so let's let's check in on our little 1044 00:39:54,710 --> 00:39:59,480 play here so the person on the left our 1045 00:39:57,050 --> 00:40:02,300 end user says I understand phishing now 1046 00:39:59,480 --> 00:40:04,250 exclamation point and the infamous 1047 00:40:02,300 --> 00:40:09,110 InfoSec professional on the right says 1048 00:40:04,250 --> 00:40:10,940 my pleasure to help now let's go back 1049 00:40:09,110 --> 00:40:13,070 for a second remember I told you these 1050 00:40:10,940 --> 00:40:14,120 are some of my parting thoughts I told 1051 00:40:13,070 --> 00:40:18,770 you that people are gonna work your 1052 00:40:14,120 --> 00:40:20,299 nerves right for dinner I get it I get 1053 00:40:18,770 --> 00:40:22,240 it sometimes this is difficult to try 1054 00:40:20,300 --> 00:40:25,070 and be empathetic and approachable I 1055 00:40:22,240 --> 00:40:26,839 want you to have a mantra I always got 1056 00:40:25,070 --> 00:40:30,110 upset in the sock when when my 1057 00:40:26,840 --> 00:40:33,290 co-workers would effing users this and 1058 00:40:30,110 --> 00:40:34,970 expletive expletive that I would take a 1059 00:40:33,290 --> 00:40:37,279 deep breath and channel my inner 1060 00:40:34,970 --> 00:40:39,799 Southern woman and now that we are here 1061 00:40:37,280 --> 00:40:41,420 in the South this is appropriate and if 1062 00:40:39,800 --> 00:40:44,330 they did something that we would call 1063 00:40:41,420 --> 00:40:47,570 stupid I would say bless their heart for 1064 00:40:44,330 --> 00:40:49,490 trying now don't get me wrong I am very 1065 00:40:47,570 --> 00:40:51,760 well aware that bless their heart isn't 1066 00:40:49,490 --> 00:40:55,580 exactly a nice thing to say 1067 00:40:51,760 --> 00:40:57,640 however it is a not nice thing to say 1068 00:40:55,580 --> 00:41:00,049 said in a nice way 1069 00:40:57,640 --> 00:41:02,210 remember I said about what did you do 1070 00:41:00,050 --> 00:41:04,910 kind of sounds accusatory and versus 1071 00:41:02,210 --> 00:41:06,770 what action did you take next this is 1072 00:41:04,910 --> 00:41:10,129 the what action did you take next 1073 00:41:06,770 --> 00:41:11,870 version of saying something else 1074 00:41:10,130 --> 00:41:14,270 negative about a user so I would just 1075 00:41:11,870 --> 00:41:16,640 take a deep breath bless their hearts 1076 00:41:14,270 --> 00:41:18,890 for trying and then just dig into it so 1077 00:41:16,640 --> 00:41:20,540 since we are here in the South I want 1078 00:41:18,890 --> 00:41:22,009 you all to dig deep channel your inner 1079 00:41:20,540 --> 00:41:23,900 southern woman on the count of three I 1080 00:41:22,010 --> 00:41:26,180 want you to say bless their hearts one 1081 00:41:23,900 --> 00:41:29,390 two three 1082 00:41:26,180 --> 00:41:31,440 excellent thank you you're halfway there 1083 00:41:29,390 --> 00:41:34,170 so now you might be like well why should 1084 00:41:31,440 --> 00:41:34,980 I care about a culture of security let 1085 00:41:34,170 --> 00:41:37,619 me tell you about the sugar-bowl 1086 00:41:34,980 --> 00:41:39,810 principle so you drop a sugar bowl say 1087 00:41:37,619 --> 00:41:41,730 on your kitchen floor the ceramic pieces 1088 00:41:39,810 --> 00:41:44,310 go everywhere the sugar goes everywhere 1089 00:41:41,730 --> 00:41:46,680 and you have two choices you can either 1090 00:41:44,310 --> 00:41:48,359 clean it up right away get everything 1091 00:41:46,680 --> 00:41:48,899 all spic and span like nothing ever 1092 00:41:48,359 --> 00:41:52,319 happened 1093 00:41:48,900 --> 00:41:54,060 or you can leave it and it can sit any 1094 00:41:52,319 --> 00:41:55,950 confessor and maybe people are cutting 1095 00:41:54,060 --> 00:41:57,569 themselves on the ceramics or the sugar 1096 00:41:55,950 --> 00:41:59,669 starting to get up underneath the tile 1097 00:41:57,569 --> 00:42:02,700 and you're getting ants and it's so 1098 00:41:59,670 --> 00:42:05,460 spread out it's a bigger mess what's 1099 00:42:02,700 --> 00:42:09,000 houses Carlita security I would rather 1100 00:42:05,460 --> 00:42:11,250 have an end user reach out to me at 1159 1101 00:42:09,000 --> 00:42:13,079 before I'm about to go to lunch and I 1102 00:42:11,250 --> 00:42:16,230 have to eat lunch at my desk to fix a 1103 00:42:13,079 --> 00:42:18,990 problem versus them saying nothing 1104 00:42:16,230 --> 00:42:22,020 and an alert going off at 4:59 on a 1105 00:42:18,990 --> 00:42:23,939 holiday weekend which and I have to stay 1106 00:42:22,020 --> 00:42:25,890 and fix something because nobody said 1107 00:42:23,940 --> 00:42:27,869 anything but if they had said something 1108 00:42:25,890 --> 00:42:30,839 or sooner because we were approachable 1109 00:42:27,869 --> 00:42:32,400 we could have been remediated it I can't 1110 00:42:30,839 --> 00:42:35,670 think of an easier way to explain why 1111 00:42:32,400 --> 00:42:38,040 having your users not fear you is better 1112 00:42:35,670 --> 00:42:40,440 I'm okay eating lunch at my desk I 1113 00:42:38,040 --> 00:42:42,810 usually did it anyway but it's a holiday 1114 00:42:40,440 --> 00:42:44,220 weekend I want to go I don't want to sit 1115 00:42:42,810 --> 00:42:46,680 there on a Friday night working on this 1116 00:42:44,220 --> 00:42:50,250 one Halloween I said in my driveway with 1117 00:42:46,680 --> 00:42:52,259 my laptop working on an issue and handed 1118 00:42:50,250 --> 00:42:54,569 out candy while I was remaining on the 1119 00:42:52,260 --> 00:42:56,690 other hand that wasn't so fun 1120 00:42:54,569 --> 00:42:58,950 I'd rather work through lunch so 1121 00:42:56,690 --> 00:43:00,270 sugar-bowl principle you want people to 1122 00:42:58,950 --> 00:43:01,859 feel comfortable you want to be 1123 00:43:00,270 --> 00:43:03,869 approachable to come to you to let you 1124 00:43:01,859 --> 00:43:05,730 know when things happen rather than be 1125 00:43:03,869 --> 00:43:06,960 surprised when nothing you know when 1126 00:43:05,730 --> 00:43:08,609 nobody says anything and then be 1127 00:43:06,960 --> 00:43:11,910 surprised when something goes chaos 1128 00:43:08,609 --> 00:43:12,839 chaotic on your network another reason 1129 00:43:11,910 --> 00:43:15,390 why I should care about a culture 1130 00:43:12,839 --> 00:43:17,310 security is security departments are a 1131 00:43:15,390 --> 00:43:21,000 cost center and if you're not familiar 1132 00:43:17,310 --> 00:43:22,950 with that term bless your heart it's the 1133 00:43:21,000 --> 00:43:25,589 opposite of a profit Center profit 1134 00:43:22,950 --> 00:43:28,828 Center makes a company money and usually 1135 00:43:25,589 --> 00:43:30,750 is kind of left alone but a security is 1136 00:43:28,829 --> 00:43:34,410 usually a cost center meaning you cost 1137 00:43:30,750 --> 00:43:36,900 money so one way that you want to kind 1138 00:43:34,410 --> 00:43:38,350 of endear yourself to a company is to be 1139 00:43:36,900 --> 00:43:40,060 better at these things 1140 00:43:38,350 --> 00:43:42,100 of customer service so that you can 1141 00:43:40,060 --> 00:43:43,509 prove your worth as a call center now 1142 00:43:42,100 --> 00:43:45,730 some of you may be looking at me and 1143 00:43:43,510 --> 00:43:47,230 going lady did she just tweet in June 1144 00:43:45,730 --> 00:43:49,990 that you got laid off and you've been 1145 00:43:47,230 --> 00:43:53,500 doing Hovis yes I did get laid off in 1146 00:43:49,990 --> 00:43:55,509 June however how was I able to get 1147 00:43:53,500 --> 00:43:58,450 another really cool job that I can't 1148 00:43:55,510 --> 00:44:00,370 talk about yet so quickly because I was 1149 00:43:58,450 --> 00:44:02,589 able to talk about all the innovations I 1150 00:44:00,370 --> 00:44:08,080 did all the initiatives I spearheaded 1151 00:44:02,590 --> 00:44:10,570 all the things I was able to do using 1152 00:44:08,080 --> 00:44:12,759 the 7 step principle all my interviews I 1153 00:44:10,570 --> 00:44:14,170 talked about it I was able to land on my 1154 00:44:12,760 --> 00:44:16,090 feet because of something out of my 1155 00:44:14,170 --> 00:44:21,190 control because of all these skills so 1156 00:44:16,090 --> 00:44:23,800 I'm not a hypocrite and again why should 1157 00:44:21,190 --> 00:44:25,780 you care about culture security kindness 1158 00:44:23,800 --> 00:44:27,760 is a currency and again I mean this in a 1159 00:44:25,780 --> 00:44:30,070 positive way things will come back to 1160 00:44:27,760 --> 00:44:31,990 you returns on investment it is in your 1161 00:44:30,070 --> 00:44:34,540 best interest as an individual and as a 1162 00:44:31,990 --> 00:44:36,580 department to exercise kindness and 1163 00:44:34,540 --> 00:44:39,190 empathy towards our end users because 1164 00:44:36,580 --> 00:44:40,840 it's going to go a long way to having a 1165 00:44:39,190 --> 00:44:43,030 culture security where people are 1166 00:44:40,840 --> 00:44:45,160 excited to report things I had some 1167 00:44:43,030 --> 00:44:46,420 users that were so eager to report 1168 00:44:45,160 --> 00:44:48,370 things all the time sometimes I'd be 1169 00:44:46,420 --> 00:44:52,900 like whoa slow down I don't care this 1170 00:44:48,370 --> 00:44:55,029 much nothing's wrong nothing bad is 1171 00:44:52,900 --> 00:44:56,920 going to happen from being kind and some 1172 00:44:55,030 --> 00:44:59,200 people might be like well you know 1173 00:44:56,920 --> 00:45:03,100 kindness is a is a weak thing that's 1174 00:44:59,200 --> 00:45:06,339 being weak Oh contraire tenderness and 1175 00:45:03,100 --> 00:45:09,790 kindness are not signs of weakness and 1176 00:45:06,340 --> 00:45:12,520 despair but manifestations of strength 1177 00:45:09,790 --> 00:45:14,259 and resolution so if you can get 1178 00:45:12,520 --> 00:45:17,500 anything out of this talk today I want 1179 00:45:14,260 --> 00:45:19,900 you to please go forth be kind be 1180 00:45:17,500 --> 00:45:21,610 empathetic and create a culture of 1181 00:45:19,900 --> 00:45:24,420 security within your organization 1182 00:45:21,610 --> 00:45:24,420 thank you 1183 00:45:31,380 --> 00:45:38,310 and my shameless plug for my newsletters 1184 00:45:36,140 --> 00:45:41,279 technically we have five minutes so if 1185 00:45:38,310 --> 00:45:44,279 anyone has any any stories or questions 1186 00:45:41,280 --> 00:45:44,790 I'm happy to entertain those nine 1187 00:45:44,280 --> 00:45:48,000 minutes 1188 00:45:44,790 --> 00:45:51,120 oh well then either you all can go or we 1189 00:45:48,000 --> 00:45:52,470 can sit and hang out but I see some 1190 00:45:51,120 --> 00:45:55,130 hands in the back you want to come up 1191 00:45:52,470 --> 00:45:55,129 and talk or 1192 00:45:56,150 --> 00:45:59,219 [Music] 1193 00:46:04,460 --> 00:46:09,859 I'm not sure if they're specifically the 1194 00:46:07,069 --> 00:46:11,599 question was asking if thank you see 1195 00:46:09,859 --> 00:46:13,520 this is why the front row got the candy 1196 00:46:11,599 --> 00:46:17,210 because they reminded me to repeat the 1197 00:46:13,520 --> 00:46:20,300 question so the question was are there 1198 00:46:17,210 --> 00:46:22,910 any good books that reference the 7 the 1199 00:46:20,300 --> 00:46:25,910 7 steps what I can do as you see my 1200 00:46:22,910 --> 00:46:27,799 medium blog there I can look into it and 1201 00:46:25,910 --> 00:46:29,930 post something and if you follow me on 1202 00:46:27,800 --> 00:46:31,660 Twitter I'll tweet it out off the top of 1203 00:46:29,930 --> 00:46:34,308 my head all I can think of are like 1204 00:46:31,660 --> 00:46:36,049 library science textbooks but let me see 1205 00:46:34,309 --> 00:46:37,910 if there's something more like and user 1206 00:46:36,050 --> 00:46:39,950 friendly for you but thank you for your 1207 00:46:37,910 --> 00:46:42,109 question 1208 00:46:39,950 --> 00:46:48,160 anybody else anybody know that score the 1209 00:46:42,109 --> 00:46:48,160 Eagles game you think I'm joking but 1210 00:46:49,420 --> 00:46:53,809 cool ok well I'll be up here for a few 1211 00:46:51,770 --> 00:46:55,190 minutes but yeah I mean I said 1212 00:46:53,809 --> 00:46:56,510 everything that I needed to say and I 1213 00:46:55,190 --> 00:47:00,069 appreciate you being here I know the 1214 00:46:56,510 --> 00:47:00,069 last day is a hard one too