your exit doors are here here here and
here thank you so much for joining me
today I know this is the long haul into
the end of the talk so I am Tracy Meili
if I'm also known as InfoSec Sherpa on
the Twitter's and sorry it is very dark
up here what this talk is about I'm good
at this but just the brief overview in
case some of you are confused I'm just
going to talk about some ways to better
interact with end users and by end users
I don't mean just the you know maybe
admin assistants or the bank vice
presidents I wasn't mean other
departments you know even other tech
departments that you may work with
anybody who you are relying upon
executing security you need to treat
them as your customers so that is what
this talk is about based on my
experience as a librarian because I know
I never tweet about it but yeah I used
to be a library okay so first off yep
there we go I also worked at a law firm
for 10 years so I know about disclaimers
my opinion strong or otherwise or mine
in my own and not that of any group with
which I am affiliated if you take issue
with something that I say please invite
me to the bar and buy me a drink and I
will gladly discuss our differences with
you over a cocktail hashtag gymflow SEC
so I'd like to take a moment to manage
your expectations what this talk is
which I just said a second ago I am
going to show you some key library
science principles and how they pertain
to information security dealing with
with end users what this talk is not I'm
not trying to sell you anything this is
not a cure-all some of these situations
may not you know pertain to your
environment and that's fine but I do
have one expectation of all of you if I
may if you can at least please just take
one thing no matter how small out of my
talk and implement it back in your work
or personal life then I will consider
this talk a success so that those are
the expectations
and how am I going to do that I'm going
to do this through storytelling I'm
gonna tell you stories about my work
life as a librarian also as a sake
analyst and as you see the storyteller
is sitting I may be sitting at some
points I have a chair up here I have a
wonky knee and if my knee gets wonky I'm
sitting down it is not that I just
respect my audience it's that I don't
want to be in pain and I want to finish
the talk so if you see me disappear out
of sight it's because I'm sitting down
so thank you so now you're like okay
lady why should we listen to you so
here's my street cred so that's me and
the University of Pittsburgh mask up
before a basketball game I have a
master's degree allow any pit I'll beat
myself up later to the University of
Pittsburgh and I have a master's degree
in library information science I also
have undergraduate degrees from Temple
and Penn State but I spent 15 years
working as a librarian mostly in
academic corporate and law firm
environments corporate yes as in QVC
like that QVC I was a librarian at QVC
and I also worked in different colleges
but mostly in law firms so no offense
any lawyers in the room but I know what
it's like to work with difficult patrons
so I've been in the trenches y'all I've
seen some things I can I can talk from
experience but I also spent two years as
a stock analyst I'm currently changing
jobs which I cannot divulge at this time
but all will be revealed soon enough I
spent two years as a stock analyst for a
large multinational corporation so I
have experience there and I also have a
jisuk I just want to put that in there
so I do know a thing or two about a
thing or two so that is part one of my
street cred part two so what the last
law firm I was at for about eight years
every year the law firm had a customer
satisfaction survey that they sent out
to the entire law firm and every year
that I was there the library which was
the department where I worked ranked
number one in customer satisfaction now
before you think I'm full of myself I am
not trying to say that was because of me
I mentioned this because again further
to my street cred I know what it's like
to be on a high-performing team in a
difficult environment in a high-pressure
environment so I know what success looks
like so this is why I want to share this
with you because I've been through this
so hopefully you understand why I feel
that I'm qualified to speak about this
and why the Derby con CFP committee how
that has come I to speak about this so
before we go any further I also want to
clarify something everything is not
sympathy sometimes people use them
interchangeably they're different and
that hotlink therefore merriam-webster
hotlink I'm one might like 85 I don't
know where that came from
sorry Benjamin buttoning myself up here
okay anyway um the link up there goes to
a really good page on merriam-webster
and great detail explaining the
difference I don't want you to feel
sorry for your end users I want you to
understand what it's like to be in their
shoes okay I want you to understand what
it's like to be scared of security to be
scared of Technology to be confused know
and things like that because that's
really important I don't know what you
feel sorry for them I want you to know
what what they might be feeling because
that's going to help you better assist
them
and why do I care about this so if you
have a hat I suggest you hold on to it
if you are wearing a pearl necklace I
suggest that you clutch it and be
prepared to gasp because I'm gonna drop
a drop a big one on you here ready
information security is a service
industry job thank you can I get an amen
yes preach it preach it
hashtag truth bomb I hide the reason why
this talk came about is when I made my
career change from library science into
information security I was dumbfounded
that the way that contempt and the
hatred and the the attitude towards end
users that a lot of infoset people had
and you know you have to understand
before I was a librarian I was a travel
agent before that I also did a lot of
customer service facing jobs so my
entire professional career has been
customer facing I am very well aware
that those customers the reasons why I
had a job so when I come into security
I'm like you know that we have jobs
because we're servicing their security
needs right like so this is kind of how
this talk came about so information
security is a service industry job
because customer service is it's an
attitude or as we say in Philadelphia
attitude it is an attitude it's not a
separate department it's not someone
else's job it's all of our jobs no
matter what department you're in it is
an attitude and with apologies the
IceCube check yourself before you wreck
it for everybody else ok get yourself in
line so I'm gonna give you a little
exercise here to try and help get you
into that empathetic mindset here
remember a time when you were a noob did
you ever have learn how to play an
instrument I did I had a mean music
teacher who used to yell at me for not
knowing my scales and every good boy
deserves fudge and all that I still grew
up to be a respected member of society
mr. Bratton so there you know so that
was scary right I didn't understand how
to read music and I was trying to do
that
what about Dungeons and Dragons did you
ever have alright did you ever have a
mean Dungeon Master who got mad at you
because you didn't know how to cast a
spell on an elf or don't at me whatever
I don't know what I'm saying
but anyway that just sounded right in my
head so I'm just gonna go with it but in
order to understand empathy think about
back to when you were new at something
because this is what your end users feel
like they don't deal with you know they
don't necessarily deal with the high
tech everyday or or they don't deal with
security every day so it's kind of
intimidating and scary and you need to
kind of have an empathetic ear in mind
and I to better service them for
customer service so let's get to the
meat and potatoes use my Philly accent
so this is the reference interview so I
told you I went to university Pittsburgh
for masters library information science
degree I also call that library school
so in library school this was drummed
into us this is a well-known principal
and library science called the reference
interview and I'm not going to read the
slides because you were all capable of
reading I believe unless somebody yells
out they want me to read it to them
these are the seven steps so what I'm
gonna do is I'm going to go through
these steps I'm going to explain through
storytelling and examples of how I've
been able to take these steps and apply
it
- life in InfoSec specifically as a
stock analyst now I admit this print
here is really tiny so this I'm going to
read out we have a little play going on
here the person on the Left says I
clicked on a phishing link exclamation
point
and the info set professional on the
right says I can help with an
exclamation point so let's dig in
approachability how easily is it for
your end users to contact you does your
department have maybe security at
company comm or is it all individuals
does someone know how to get in touch
with you and you know and a lot of
people like oh I don't want anybody
contacted me directly get over it it's
your job okay but make it easy for the
end users do they know who to contact
you know do you like it if you call some
company you get bounced around like oh I
need to transfer you I need to transfer
you I need to transfer you you don't
like it do you wash it your end-users
like it what about the outgoing messages
what do you say what kind of impression
do you give and I'm going to give you an
example so we dealt with the phishing
emails and if people submitted an email
and it was deemed to be a fish they
would get this message or saying yep
that was malicious and that was it and I
spoke up I was like um can we give them
some steps to take or some things to do
so I managed to work with some other
people in security department and then
we crafted this outgoing message of you
know yes thank you for reporting that
email it was malicious if you clicked on
it if you open something here are some
steps we need you to take change your
password bla bla bla bla if you have any
questions or concerns contact us at this
and you know what change I saw I would
see end users just emailing us in
response going yep just want to let you
know it changed my password that went up
exponentially and I was thrilled so that
means what they read the email and they
did it and then they took the time to
let us know so whenever I saw those
responses come back I'd be like great
job thank you so much for letting us
know and I really feel like that made us
more approachable because then they
could just let us know that they did
things and we gave them information
so what are your outgoing messages say
to people and what's your tone if you
have ever worked any sort of phone job
they always tell you to smile when
you're talking because it helps the tone
and I can hear some eyes rolling in the
back I can hear you it but it does help
it's kind of hard to be to be nasty if
you're smiling in your pleasant but just
be mindful what is your tone and I know
we all have bad days but do your best to
try and rein it in and remember you want
to be approachable sprechen zie Deutsch
powerful se habla espanol you may not
speak another language but to your users
I work for a multinational company we
would get emails in another language and
some of my co-workers would get angry
about that and I said this it's our job
as customer service to figure out what
they're saying and to reply so what I
used to do was I would reply in their
language using an online translator with
my first sentence being I am using an
online translator why because they're
not perfect right so I don't want to
offend someone or confuse someone with
the choppy translation so your first
response should be you know I am using
an online translator and then your
message and then below that I put what I
was saying in English why because some
people who are multilingual
may have better skills reading English
than they do writing it okay so to make
sure that the message gets through put
it in two different ways and then this
also goes for awareness or any other
material do you have security
instructions in other languages for
people whose native language is in
English if you know that maybe your
South American offices are having
particular problems with phishing do you
have Portuguese and Spanish material for
them are you expecting them to read
English and understand what you're
trying to get through so think about
that
reputation when were I said about
checking yourself before you wreck it
for everybody else try to determine what
your security department's reputation is
within your organization now some of you
may be too young to remember this but
you know about what nineteen years ago
Jimmy Fallon you know Tonight Show fame
or infamy depending on her opinion he
had this sketch when sorry Night Live
where he's Nick burns the computer guy
and I put the the lyrics to the the
jingle there and that was the whole
sketch is that people would have a
computer problem and he come and be like
move and be really arrogant and mean
about it is that what your users think
of security do they think you're Nick
burns so first of all take an assessment
and you can maybe ask around or just how
people interact with you if you call
someone and say hi this is you know
Tracy from security do people recoil do
they get scared so try to figure out
what your cut your reputation is of the
security department and I feel seen it's
usually a negative thing I want you to
feel seen in a positive way so what I
used to do when I was in the the law
firm library is I would get involved in
activities now for you that might be
even just like a softball team or
something like that I was involved in
the diversity inclusion committee
because I wanted to be able to go to
those meetings and say hi I'm Tracy from
the library I wanted to be a physical
representation of the department I'm in
and why is this important because when I
first started as a sock analyst I
replied to a user's email and her
response to me was oh I didn't know
there were humans in security and I'm
like what and she said oh I just thought
it was all computers and automate I
didn't think any people actually worked
in our security department and I turned
to my boss I showed them email and I'm
like don't you people ever talk to the
end users he's like yeah not early I was
like oh boy like wow you you people need
me in four seconds so and I know this
isn't everyone's cup of tea I know some
of you are like oh screw that I am NOT
becoming seen one I'm gonna say about
that is things like this are skill they
can be learned and they can be honed and
also remember I said I wanted you to
take one thing away from this maybe this
isn't the thing you take away but for
those of you who are more inclined to
get involved in stuff it's amazing if
you go out into your company and be the
you know a physical face that people can
talk to you now sometimes it turned into
me feeling like a preset of confessional
I would go to events in another building
and I would say this from security and
people would start telling me all the
links they clicked on or all the secure
or all the security things that they
have in place like I have a really good
password I'm like yay thanks hi I'm
Tracy hi but sometimes it's funny and
you know what it helps reinforce that
you are a real person working on a real
problem and again approachability makes
you feel seen
all right so let's move on to point
number two interest I want you to be
interested in solving the problem at
hand
aka do your damn job now I know that
burnout is a very real thing and that is
a different talk but if you are not yet
jaded or burned-out you know do your job
be interested in solving this because
ultimately you know this is your job
security is protecting your organization
and I hate hot potato are you familiar
with hot potato of you know bouncing
things around this ought not it not it
not mine not mine passing around
sometimes you just need to suck it up
and listen to what the end users asking
sure there are times when you know what
you'll say you know there's a different
department that is really better suited
to answer your question I'm going to
email them to you know email them on
your behalf I will copy you and I will
describe the problem you don't blind
transfer someone on a phone you don't
blind forward emails you take the moment
to be courteous to your fellow
professionals explain the situation and
you copy the person on it so that they
can be in the loop of what's going on so
don't hot potato
gently hand over that potato and with
some chives and sour cream and just in
general I can't stress this enough don't
belittle or mock or be condescending I
know what I know things that can be hard
and try and believe me my last week of
work at my last job
there were times and I was looking up
going Lord they are testing me and I'm
Jewish and I'm still like Jesus help me
I I know it can be trying it can be
trying but you know what you just take a
deep breath empathy as a service and you
work through it
so it doesn't matter how many search you
have what your Drake grade point average
was how many degrees you have your end
users are not going to care what a leet
hacker you are unless you care about
helping them so keep that in mind
you can be the best hacker in your
company and that's fantastic for you but
your end users don't care unless you're
going to take an interest in helping
them
so you can also do this by creating a
safe space and then one of them is just
giving us users full attention how many
times have you ever called a call center
and you hear a lot of like laughing and
joking in the background and then the
person you're talking to you hear them
like stifle laugh or you like hear
yourself go on mute and stuff and I'm
like hey attention like pay attention to
me so be mindful of that there are times
when I would leave the sock to take a
phone call to talk to an end user
because I knew there was too much going
on there was too much background noise I
wanted that person to know that I was
paying attention and I was focused on
them I would just want to tell you a
quick story time here cold medicine Carl
not his real name we get a name email
one day at the Salk and he's like I'm
working from home I'm really sick I'm on
a ton of cold medicine and I clicked on
a malicious link help so I'm not gonna
get into the remediation part cuz I
thought what this talk is about but long
story short I finally get him on the
phone to talk to him I can hear he's
sick I can hear his raspy breathing I
can also hear how stressed he is I can
hear he's so completely stressed so long
story short is it turned out to be you
know nothing the this link that he
clicked on actually was taken down by
the blog provider so it was actually
just one of those like that pages in
here so dodged a bullet but I did
something a little sneaky though I was
like let's engage your antivirus and I'm
like this is gonna take like an hour to
run so I want you to go lay down and
rest and let this run its course now you
and I all know you can still use your
laptop all the antivirus is running but
I was taking some empathy this guy I
could finally hear him calm down
I got his stress level away but he was
still sick and he's still on cold
medicine so I made a snap decision of
like I'm gonna tell a little white lie
to get him away from the computer so he
doesn't click on anything else I'm gonna
tell him to go take a nap for an hour
and he he was like oh no okay you're
right yeah I'll let this run I'll go
step away from the computer and I'll do
that no harm no foul and it honestly
probably took me longer to tell you that
story than it did for me to interact
with him because a lot of people say to
me well I don't have time in my day to
talk to all these people if you do it
right
takes quicker to help them than it does
for you to tell the story and what's
another way you can show interest okay
you are not eating x' use punctuation
and use sentence case okay write an
actual letter thank you to the liberal
arts majors who got that reference so
there is a structure that you take to a
letter and email there's the salutation
so I just picked Robert dear Robert we
have the body of the message in two
sentences to I was able to convey four
points of information I will break it
down for you thank you for contacting
the security team about the phishing
email you received we will investigate
and get back to you within a business
day you think the user for contacting
you why I was going to do a traumatic
Handclap here but I can't with this
microphone they didn't have to contact
you they could have let it go they
didn't have to contact you you thanked
your end-users for contacting you and
then you reiterate why they contacted
you so the end user knows okay they
understand why I contacted them rather
some just like thank you for your email
well no why are you why do they contact
you and then we will investigate you
tell them what action you're gonna take
and then within a business day you give
them some sort of reasonable timeframe
of when they can expect to hear back
from you two short sentences four very
important pieces of information that
that user can feel seen feel heard and
feel like their problem is being worked
on and then a close best regards regards
sincerely Cheers is often one that
people use and then your signature I
know a lot of people have sig files but
just who are you who are you on the team
are you a manager are you an analyst in
this case I was the security team Sherpa
but who are you so this is such a short
email to write and it's clear it's
concise it can phase a lot of
information another way you can show
interest is have what I call an
intrapreneurial spirit and you know
entrepreneur but this is intrapreneur
this is having that drive and go get it
attitude that an entrepreneur have but
within your organization so an example
of this
was this was long before I even realized
I was gonna get into security I saw that
the CEO of the law firm had a brand
spanking new Apple watch when they very
first came out and because he was busy
showing everybody around that's how I
noticed but I was in the elevator with
him one day and I said Oh Charles I see
that you have that new fangled Apple
watch that came out I just saw that
there were some security update about it
I will email you the article when I get
back to my office he sent a note to my
boss complimenting me on being proactive
and being observant to help solve a
problem that wasn't even in my area of
interest so have an intrapreneurial
spirit or just hi I'm Tracy from the
library I know you work in the
healthcare law department we just got a
bunch of law you know health books you
know I can send you a list when I get
back you know just maybe a quick thing
about yourself or about your department
is this entrepreneurial spirit just a
little elevator pitch of who you are or
what your department does to again be
seen to be approachable to have people
invested in security and know that
there's humans behind it and listening I
know it's really easy if you hear
something like a yeah yeah I know where
this is going and you jump in you need
to listen to the whole story because
there might be plot twists there might
be things that come up that you weren't
anticipating and another skill that you
can try to have is pay attention to what
the user doesn't say and I'll give you
an example the users say well I clicked
on a link the page opened up I close the
browser and then I called you I'm like
okay let's start go back there what
happened from the time that the page
opened before you closed it sometimes
the answer is oh well I entered my
username and password and nothing
happens so then I closed it and then I
called you like wow that's information I
could have used a second ago so an easy
way this is a skill you have to learn
but a tip for this is when you're a
problem-solving or you know doing an
incident response or some sort of
remediation you know what the steps are
to fix the problem in your head so use
that as a checklist if someone is
telling you a story does this match is
this oh wait we have a gap here now
don't interrupt them because remember
there might be a plot twist later either
write it down or just remember it and
then
well back because that also shows your
listening skills but I cannot tell you
how many times I have zoomed back in on
something that they didn't say and that
was the issue usually enter user name
and password they can Vina Lee leave
that information out so sometimes you
need to ask directly and again to be
kind is more important to be right many
times what people need is not a
brilliant mind that speaks but a special
heart that listens and I know that
sounds all really touchy-feely and I can
hear eyes rolling again but you get the
point
you know you you need to be kind and not
you know tell some user I told you so I
told her that was a luscious eye that
doesn't help anybody need be kind so
let's move to the interviewing step I
already talked about what does the user
not say another thing you can do is you
have to be careful how you ask some of
these questions what did you do that's
kind of hard to say in a nice way right
so I like to say things what action did
you take okay Bob you clicked on that
link what action did you take next and
he'll be like oh well then I looked at
the site and I saw it was the office 365
login ok what action did you take next
or what did this thingy that oh you know
what action did you take what hat you
know what happened next I have found
trying to avoid the phrase what did you
do because it just sounds it sounds less
accusatory and again you these people
are usually scared sometimes they think
they're going to lose their jobs so you
want to make them feel comfortable
remember create a safe space so just
find other creative ways to maybe ask
things about what transpired transpired
to use now let's get to the next or
maybe you're trying to search into
things is there a time when maybe your
security failed the end user
maybe it wasn't their fault maybe
something malfunctioned you know there
was you know maybe something didn't work
right and it wasn't really their fault
another time helped them connect the
dots of things and I'll give you an
example I have story time accounts
receivable Rhonda so Rhonda contacted
security and got me and she said I have
a brand new task with my job I have to
pay invoices and I've been doing it for
a short time
but this one vendor that I've already
paid an invoice for now the invoice
looks different and it's been sent to me
in a different way so immediately like
I'm on it this sounds great
so it turns out it was one of those like
DocuSign links and I used my you know my
lab desktop you know to investigate and
honestly everything kind of looked on
the up-and-up I was doing all kind again
this talk isn't about remediation but I
was doing all kinds of things so I
called Rhonda back and I was like listen
I'm like I can't determine with any
certainty that this is or isn't correct
but let's do this I said do you have a
phone number for someone at that company
she said oh yeah Joanne I talked to
Joanne all the time and she said I have
her email address and that's when I
helped her on to connect the dots I said
but Rhonda if this company's email is
compromised you could be emailing the
criminal she never considered that and I
said so if you know what I said you know
you've talked to Joanne before right she
says oh yeah yeah I'm like okay call her
ask her if they've changed the way that
they've done their invoicing and we'll
go from there so she calls me back like
15 minutes later yes they have
completely changed how they've done
their invoicing I was like wow way to go
company for a pump--ow but yes and she
confirmed yes that was the invoice we
sent everything was on the up and up and
I've told these people this story to
some people and they're just like well
wasn't that Rhonda's job to looking at
that job Rhonda's jobs on security
Rhonda's job as the pay invoices and
again I praised her for contacting
security because this particular invoice
was $1500 next time if it was a fake one
it could have been twenty five thousand
dollars or more if she had never stopped
to think something doesn't look right
then this could have just perpetuated
into a whole B EC cut a stroppy but she
was brave enough to speak up and say
this doesn't look great I'm not really
sure and then she kept apologizing to me
because when everything turned out to be
fine I said it's my job you know you did
your job by raising the alert all right
you know we work together to solve it
you did your job and I said if you ever
find invoices that look fishy to you oh
sorry Fi
um you know let us know so that was
Rhonda and then when you answer them
remember my pleasure to help they didn't
have to contact you you don't say you're
welcome you're not doing them a favor
you're doing your job you know and you
remind people you did a good thing a lot
of times I talk to people who are so
nervous and upset and I remind them you
did a good thing by contacting security
because what's the what what if they
didn't this would blow out it out of
proportion out of control another story
time for you Mike in the wonky Mouse so
I get a phone call mike is like so my
mouse isn't working right and I let him
finish and I just very nicely said
thought maybe it was an error and I said
okay Mike well you've contacted security
did you mean to contact the helpdesk
I'll be happy to transfer me and he goes
well I just talked to them and you see I
clicked on a phishing email last week
and now this week my mouse is all wonky
I was like well there we go listen now
see what would have happened if I would
have just been like nope not my problem
hot potato back to the helpdesk
this poor guy would have been in a
circle going back and forth and how soon
do you think he would have given up of
like okay nobody wants to help me so I
was like oh okay now we have a security
issue look into this so I looked into
the email and everything again you know
looked at the logs talked to him did all
this stuff couldn't find anything that
could contribute to the mouse so I'm
like you know I'm doing my best
winnie-the-pooh I'm like think you think
take a deep breath and I go do you have
a cordless mouse and he goes you can see
that I'm good like I'm not that good so
um I said when was the last time you
changed the battery in your mouse and he
goes never I said do me a favor go get a
battery try it out see if you can
replicate the issue call me back 15
minutes later he calls me back I am so
sorry to bother you with this and I said
it was no bother I said I apologize that
the helpdesk couldn't resolve this for
you I said but you did a good thing
because this could have been
a security issue I was thinking his
laptop was compromised okay so he asked
me again he was like how did you figure
that out and like I I don't know I don't
I took a deep breath and the info said
God's just you know waved a wand and it
just popped him to my head he exactly I
don't know why but you know it doesn't
matter so what I did though was I was
like hey while I have you on the phone
and you're thinking that I'm all great
and stuff can I show you some red flags
that that email you've clicked on that
to avoid this in the future he's like
well sure I'll stay on the phone with
you so what I constantly had you know
easily available to me were you know
little mock-ups like this this is one
from Queen's University in Kingston
Ontario shout-out to my Canadian friends
just just something to show people red
flags I would have this on my desktop
save so if I go let me quickly share my
desktop and I'm gonna walk you through
some red flags may I send this to you
now so that you can keep it
oh yeah so he was very patient he's like
oh you know you're right I should be
more careful like these are great tips
this one I didn't know I didn't know
about hovering blah blah blah while you
have their attention have this at the
ready have something ready again it took
me longer to tell this story than it did
for me to help him cuz also while he was
off searching for a battery I was
working on another problem
so let's get you the follow-up now our
last one you know short on time some
things like I already told you have some
pre-canned language or some things you
can send out to people you know just
constantly come up with ways to improve
your user interaction figure out what
works what doesn't work you know
think of you know initiatives it is a
cybersecurity Awareness Month maybe talk
to your security awareness team if you
have one or just bring something up
think of ways that you can constantly
innovate because it makes things more
interesting for you and it gets your
your users engaged I also like to
perform random acts of security kindness
and I what I called the cyber cupcake
because keep in mind outside of our
community people think the word cyber is
cool and they're impressed by it so I
called this the cyber cupcake it was not
this particular cupcake but I would keep
a you know like a JPEG of a cupcake on
my desktop and whenever I saw an
end-user report a fish that was
particularly sophisticated you know cuz
sometimes you know just as a side note
sometimes you see these fish in there
like you have to be like wow like that
was actually a really skillful fish and
other times you look at some of these
emails I'm like criminals take some
pride in your work you know could you
like try a little harder you know here
but if you see one that's particularly
good and that the user you know flagged
it I would send them a cyber cupcake I
feel like good job Eagle I reward good
behavior and because I worked in this
multinational company I couldn't give
them a literal cupcake a physical
cupcake so I sent them a JPEG people
love that you would have thought I did
I've given them a giant check you know
like a big like oversized check people
loved it I got replies back you made my
day
you made my week I was unsure about that
email I was scared to submit it in case
I was wrong nothing ever bad happened
for me sending someone a cyber cupcake
okay
it was all good and it was super quick
because it was on my desktop it took me
two seconds out of my life and people
loved it so reward good behavior
kindness as a currency and a return on
investment two different ways one story
I'll tell you what snacks every year
around Christmastime and when I was in
the law firm library the librarians and
I would all bake cookies and cakes and
if you've ever follow me on Twitter you
know this is my wheelhouse
we could bake a lot of things and then
we would come in and we would package
them up and we would make these big
cookie trays and then we would march
through the law firm and we would give
them to the help desk give them to
accounting give them to facilities give
them to the mailroom all the other
departments in our law firm that we
interacted with we gave them you know a
gift as a thank-you
kindness as a as a currency months later
there would be some some problem that we
would need a lot of help solving and
somebody would go above and beyond
because we constantly showed kindness
and I don't mean kindness as a currency
like a bribe but I mean it's you get a
return on investment also if we ever had
lunches you know a lot of vendors would
like to bring in food to the library we
would call other two parts we call the
mailroom guys they're like we got
sandwiches leftover sandwiches come get
it those acts of kindness that we didn't
have to do would come back in ways that
we wouldn't even expect because somebody
would go way above and beyond to help us
for something so it's a it's a currency
so again think about your end users if
you show kindness towards them they're
going to be more apps you want to get
involved in and be a part of security
because they're gonna they're gonna
listen want to listen to you because you
were nice to them and then there's the
luncheon learns you know these these can
also just be brown-bag things if you
don't have any budget but it helps to
even just provide like you know soda and
cookies if people bring their own and
you can do presentations but you can
also do this with other departments
within your organization you know talk
to another tech department what are they
doing what are you doing how do your
paths intersect because you you also
want the kindness of your fellow tech
people right the security touches
everything whether the other departments
believe it or not you you know do things
to bring them together and this kindness
is you know you're gonna have a return
on investment of this kindness
so I saw this article and the second if
you replace the word vaccinations with
security
I feel like this rings true when it
comes to security I think we have this
optimistic belief that just by telling
people facts you can change their
behavior that sound true does that sound
you need this this isn't really audience
participation there's a rhetorical
question so you've heard and show and
tell so instead I want you to tell then
show it's one thing to say to someone
you need to use a password manager and
then walk away and think I am an awesome
infoset professional I have just
dispensed and pixie dust unto the world
and it will happen you need to go a
little bit further and sometimes you may
not have time for that and I get it but
here's a little tip of something you can
do PC Magazine has a great article where
they compare password managers side by
side maybe ten or twelve of them you can
just say to someone especially if you're
just like out in public and trying to be
like helpful info SEC Nancy you know
spreading pixie dust hey you know what
if you Google PC Mag password managers
2019 you're going to get this article
where they list them all side by side
take a moment to read and see which one
will work for you isn't that better than
just saying you need to use a password
manager you know or gtfo you know that's
you know you need to just kind of show
some people the way if you have more
time if it's specially internal maybe
have one of those lunch and learns of
this is how you set up a password
manager that is going to go a long way
than just saying you need to set up a
password manager and then remember I
told you how the woman was surprised
that there was a human and security I
know we all love automation automation
is is amazing but have you automated
things so much that people don't think
there's humans behind it so double check
or you know again that goes back to do
people know how to contact you because
is everything so automated they don't
even know how to get a hold of a human
all right wrap it up let's wrap this up
okay so originally when I started this
out remember it was called the reference
interview I have rebranded this for you
for the information security community
you're welcome
I Gail now give you the seven point plan
for the empathetic InfoSec practitioner
it's the same seven bullet points but
rebranded for your enjoyment to make
sure that it it pertains to your world
so let's let's check in on our little
play here so the person on the left our
end user says I understand phishing now
exclamation point and the infamous
InfoSec professional on the right says
my pleasure to help now let's go back
for a second remember I told you these
are some of my parting thoughts I told
you that people are gonna work your
nerves right for dinner I get it I get
it sometimes this is difficult to try
and be empathetic and approachable I
want you to have a mantra I always got
upset in the sock when when my
co-workers would effing users this and
expletive expletive that I would take a
deep breath and channel my inner
Southern woman and now that we are here
in the South this is appropriate and if
they did something that we would call
stupid I would say bless their heart for
trying now don't get me wrong I am very
well aware that bless their heart isn't
exactly a nice thing to say
however it is a not nice thing to say
said in a nice way
remember I said about what did you do
kind of sounds accusatory and versus
what action did you take next this is
the what action did you take next
version of saying something else
negative about a user so I would just
take a deep breath bless their hearts
for trying and then just dig into it so
since we are here in the South I want
you all to dig deep channel your inner
southern woman on the count of three I
want you to say bless their hearts one
two three
excellent thank you you're halfway there
so now you might be like well why should
I care about a culture of security let
me tell you about the sugar-bowl
principle so you drop a sugar bowl say
on your kitchen floor the ceramic pieces
go everywhere the sugar goes everywhere
and you have two choices you can either
clean it up right away get everything
all spic and span like nothing ever
happened
or you can leave it and it can sit any
confessor and maybe people are cutting
themselves on the ceramics or the sugar
starting to get up underneath the tile
and you're getting ants and it's so
spread out it's a bigger mess what's
houses Carlita security I would rather
have an end user reach out to me at 1159
before I'm about to go to lunch and I
have to eat lunch at my desk to fix a
problem versus them saying nothing
and an alert going off at 4:59 on a
holiday weekend which and I have to stay
and fix something because nobody said
anything but if they had said something
or sooner because we were approachable
we could have been remediated it I can't
think of an easier way to explain why
having your users not fear you is better
I'm okay eating lunch at my desk I
usually did it anyway but it's a holiday
weekend I want to go I don't want to sit
there on a Friday night working on this
one Halloween I said in my driveway with
my laptop working on an issue and handed
out candy while I was remaining on the
other hand that wasn't so fun
I'd rather work through lunch so
sugar-bowl principle you want people to
feel comfortable you want to be
approachable to come to you to let you
know when things happen rather than be
surprised when nothing you know when
nobody says anything and then be
surprised when something goes chaos
chaotic on your network another reason
why I should care about a culture
security is security departments are a
cost center and if you're not familiar
with that term bless your heart it's the
opposite of a profit Center profit
Center makes a company money and usually
is kind of left alone but a security is
usually a cost center meaning you cost
money so one way that you want to kind
of endear yourself to a company is to be
better at these things
of customer service so that you can
prove your worth as a call center now
some of you may be looking at me and
going lady did she just tweet in June
that you got laid off and you've been
doing Hovis yes I did get laid off in
June however how was I able to get
another really cool job that I can't
talk about yet so quickly because I was
able to talk about all the innovations I
did all the initiatives I spearheaded
all the things I was able to do using
the 7 step principle all my interviews I
talked about it I was able to land on my
feet because of something out of my
control because of all these skills so
I'm not a hypocrite and again why should
you care about culture security kindness
is a currency and again I mean this in a
positive way things will come back to
you returns on investment it is in your
best interest as an individual and as a
department to exercise kindness and
empathy towards our end users because
it's going to go a long way to having a
culture security where people are
excited to report things I had some
users that were so eager to report
things all the time sometimes I'd be
like whoa slow down I don't care this
much nothing's wrong nothing bad is
going to happen from being kind and some
people might be like well you know
kindness is a is a weak thing that's
being weak Oh contraire tenderness and
kindness are not signs of weakness and
despair but manifestations of strength
and resolution so if you can get
anything out of this talk today I want
you to please go forth be kind be
empathetic and create a culture of
security within your organization
thank you
and my shameless plug for my newsletters
technically we have five minutes so if
anyone has any any stories or questions
I'm happy to entertain those nine
minutes
oh well then either you all can go or we
can sit and hang out but I see some
hands in the back you want to come up
and talk or
[Music]
I'm not sure if they're specifically the
question was asking if thank you see
this is why the front row got the candy
because they reminded me to repeat the
question so the question was are there
any good books that reference the 7 the
7 steps what I can do as you see my
medium blog there I can look into it and
post something and if you follow me on
Twitter I'll tweet it out off the top of
my head all I can think of are like
library science textbooks but let me see
if there's something more like and user
friendly for you but thank you for your
question
anybody else anybody know that score the
Eagles game you think I'm joking but
cool ok well I'll be up here for a few
minutes but yeah I mean I said
everything that I needed to say and I
appreciate you being here I know the
last day is a hard one too