but it is a todos that's a carries comer
all that our sir Rosalind every way in
Peru Lokar that Allah first of all I'd
like to thank the routine Organization
for allowing me to be here talking a
little bit but what I know is a real
pleasure to be here
I can actually
t-carr one of the things I wanted to do
before I die
but she's presenting uprooted senior
project manager is to group oh and
sometimes I'm also happiness manager and
I think there are some of my clients
basically we we just kick the back of
system is our anchors we do for a second
Alice's and we are 100% blue but we're
going to talk about other things
this presentation was a base diffuse and
you know this is sound familiar
is it Gauss Bell a normal distribution
and then email think okay where am i art
it is crazy guy statistics probability
for the subjects are university that we
love so much while these gone down
spells are so interesting because nobody
Sabine allows us to do the graphics
artists and to share our tributes in a
certain and truthful way for example
this is aficionados well-regarded bad
news you know it's giving example if
house yes does not like commercial
doesn't more or less 68% of all of us
here should imagine as a high charge of
age between 116 180 centimeters
sigmund team pons is 6% will be between
180 ml 90 please raise your hand if
there's you can smaller
2.1% will be the people who are really
tall with the mark that is more than
more than 90 centimeters between 100 and
200 other anyone one person is that very
tall out of the scale those are the
people higher than 200 centimeters is
there anyone here okay so more or less
these girls Bali is useful tomorrow do
not lack of use that skill set of
abilities allow us to develop the
talents can adapt this ability for
cybersecurity beginning of
representations of Voodoo
these are massive algorithm model to
find more delays excellent is our
security but I would like to know about
3 skills basic you capabilities your
attitude your goodness and passion for
learning and your experience because
eventually the devil you know is more
for being out of being the devil we have
a personal question is to be known or
the capability if your sample security
well you aren't
Novato being or being the amazing hubs
or work students are you here here here
in fact this is a tricky question this
is the basis of my whole presentation
kind of twelve you are in way because
one question is not at were you aren't
brother what do you think you are and
what's problem here the other assess
plate separation between the ability to
perceive the beauty how good you think
you are
what we are and the real and ability
that is how good we really are if we
find these we see a problem which is a
deviation they have some value without
reference a reference is higher than
zero and this one will suit from
autumn's the value is higher the higher
values that we 1230 separately because
it's a very different cases and what
others is hot due to the so called
cognitive bias which is basically where
did you brain receives correctly the
information you know but because it's
not convenient interprets it so your
brain is strong in you draw ourselves
let's see what happens yeah so first
case you think that you are here
you think that a man I'm okay when in
fact you're a really kind of a little
person what is the basis for this basic
face in fact it's not really cute yes I
usually say he's a very brave job you
know well you need to know being good in
internal pentesting reversing 30,000
sobriety system your database is program
yum yum butoh currency is regulation
language is a bit of everything really
you need to have a wide range of
abilities some of this is just not
enough to know a little bit to have some
foundations you need to know a lot about
many things what happens here are these
truths if you work in cybersecurity
Carson Donald 18 working lifetime as a
bond when you're happy with yourself
either go and say okay I'm in a good
place now and then one day you open
Twitter and you realize a lot of sorrow
for something or cyber security company
okay
80 people it's amazing okay I'm not good
enough
piece of basically and that's what
we call the imposter zero that is you
are someone quite competent well you
think you unless you actually are which
is quite common in cybersecurity
a survey of Twitter don't louse am out
of a hundred and thirteen votes not just
for people he's got a good sample a
third of the people thought that there
were posters on a daily basis on a
constant
that happens but means that you are
connected because you believe that
I'm not good enough and that generates
two more things stress because it is
impossible today to be good everything
to do with cybersecurity I compare that
with medicine you asked and I expert to
know a lot about the ophthalmology but
it's but you wouldn't ask her and after
biologists to do you know hard transport
or even to say if this my conscious is
caused by a or b so people are under
stress they work everything they can
that leads to burnout
always a few years behind the United
States but in the United States were
beginning to see how in conferences on
the mental health of security people
they've dealt with in conferences it's a
job with a lot of pressure and there is
a certain cost about the mental health
of people working here so how do we
detect it
the main you say is this feeling of you
feel your frog bones too hard and any
day now they're gonna notice that I'm
not good enough and I'm gonna be fine
when I do something right I say well I
was lucky today
when I have these colleagues who will
really help me out or anything else so
success it's never ours it's always
things that have happened for some other
reason and because I am fro how am I
going out of dare to do all your stuff
if I leave my comfort zone it's obvious
that I'm a fraud so what happens with
this this is a considerable professional
obstacle why if you have these three
fear doing new stuff then you'll make
less progress you won't leave that
comfort area and you won't make progress
and from a more selfish viewpoint the
fraud syndrome is the dream of the
company owners you have great people
that if you put a bit more pressure on
them you can pay less for because they
don't if they don't realize how good
they are so we're gonna move forward a
bit reality is that we have our
knowledge everybody has some knowledge
and things are not the way
they look it's not that everybody else
has knows a lot more is that we have our
spirit of knowledge and other people all
have a different sphere of knowledge but
did that alum knowledge may be very
similar so that's the first case we're
going to look at the second one what
happens when we believe that we are here
and we're actually there what's the name
for this this is a more academic name
it's what we call the dunning-kruger
effect that was anybody sorry when this
guy finally found out it was somebody
happy when they say great you you you
deserve what happens is that people that
this is the case when somebody feels
they are much better than they are for
instance I am world experts in in my
work reversing introduced in PLC
industrial applications in Siemens 4.21
I am the boss here so what happens with
this is his way to detect it yes they're
very clear symptoms muscles in this area
because you're always doing this gesture
saying I am the boss I am the one who
knows nobody knows more than I do know
about this boss I'm always right and I
am surrounded by people who are not as
good as me I put up with them because
they don't go to Google or to Facebook
because I'm not interested so what
happens we have two problems here these
people are actually less
Abell than they believe they often
compensate for that I other people
nearby so they are not good to work with
and they are terrible bosses because
they are always right so you're always
wrong and that actually is another
obstacle another professional obstacle
because I keep on sort of getting more
and more responsibilities people will
notice that you pretend that you're the
boss but you are not so good and people
will realize I'm not going to work with
you and the world of cybersecurity it's
very large but it's also very small
everybody knows somebody who knows
somebody who knows something
how could we fight against this syndrome
the Kreuger is to know that all that you
know is just one speck in the Hall of
knowledge and I am NOT going to talk
about PhDs but these applies very well
to the security world so we would like
for this standard deviation to be zero
or to approach zero ok and how do we do
that we do it like engineers we have
this we apply this feedback look we have
this input that you analyze and then you
have some outputs and with them you
rectify and you correct the signal to
try to minimize mistake in sort of in
our normal language that means sincere
an owner self-assessment and how do we
do that well the first thing we have is
to try to collect data rather than
impressions like
I I think or I feel this is banana you
you have to use data in if possible
whenever possible external sources and
it's better if you have different inputs
rather than one or two and this is a
process and our going process that you
have to iterate and this is the
philosophy that's a philosophy of the
feedback loop loop you don't do it once
but all the time
advice recommendation which there are a
few that I think that I recommend write
a book that may sound silly I know
nothing that's not true
I have solved hundreds of difficult
problems thanks to the fact that
somebody somewhere wrote in a blog
something that happened to them so it's
very frustrating in internet that you
have a incredibly rare problem who asked
about the problem didn't you know right
the answer if you write you have to
think to work and to be aware that
because this is going to be read by a
lot of people than you take them you
feel that you have to generate a quality
content and and that actually encourages
or enhances your self-confidence another
option is to participate in projects
that are maybe
thousands of open projects open cold
projects and that you can participate in
and I hate when people say I hate it
when people say my code is not good so I
won't cooperate what your maybe your
code can be improved but the first class
in the network's subject I was thrown a
coming under Richard and and they said
at the end of the course you need to
program this and in a lot well I'm not a
great program it but I have a very
documented code so if my programming is
not good maybe it's not but my analysis
of the whole problem I can give it to
you and you can improve it and once
you've improved my code I can also use
it and that's a win-win situation there
is a refrain that's as if you know you
work and if you don't you teach I I
tried not to share when I'm even talks
but if you're teaching and you're really
teaching then you have to need a lot of
trust in yourself to confident to face
20 30 40 experts and to teach them
something and be open to all of the
questions that they are going to to deal
with it's a great way of really knowing
very thoroughly a subject and also to
gain trust and your confidence
I also recommend to be mentoring
mentoring is very white rain in the
United States but is not so common here
in Spain people with more years
experience should take junior people and
teach them I
if you like this try these stools even
like this so you have to take people by
hand and that's very interesting because
I've always said and cybersecurity
really experience is a great health I've
always thought that we are in a pathway
and those of us who've made more
progress have to help those coming
behind and say there is a stone there
there's a there's water over there and
this is a great place to eat and it's
good because it also helps to help you
learn because people come in behind you
or have less experience but they're not
I have learned a lot from the people I'm
mentoring as you can do here which is
also very interesting I don't know if
you know but all of you why engineers or
have a degree you can see the end of the
degree studies or and and you can
actually collaborate with the university
you can contribute in interesting
projects but I am no longer the
University there are other I tried to
lead one project at least because in
many universities a end of the degree
work is it's just something that the
teacher can use for their PhD or for
projectors are involved in but if you're
able to lead projects or ideas that
you're giving people at the end of their
studies so to take a step into the world
of cyber security with something else
than just a degree is on top or else can
we do
assessment at some jobs to earn you half
every year a session about how well
you've done things how and that I has an
impact on your partners and so on but in
in other cases you don't but if you have
a good relationship with your boss that
it would be a great idea to check with
them how am i doing what do I do well
what can i improve and sometimes they
don't have the exact information but
they will certainly often will give you
an input that it will be valuable for
instance your you need to improve the
your reports you're very good in
phonetics something else send proposals
to conferences now I'm very bad this is
all interested for anybody you summer
know a while ago I almost took a train
to a city that's not your PI to track
physically somebody who was bigger than
me to make a presentation at a
conference I have a telegram
conversation which is no no come on do
make that presentation come on do it you
gotta be very selective of what you're
doing is great so he presented it it was
accepted and he it was a great success
so sometimes you're like in trust them
if you prepare a talk and you document
it properly well maybe you won't get it
but the that's the worst that can happen
something as recruitment processes
recruitment process for their third
companies is a perverse wave of having a
self-assessment
why because you need a you you have a
third person a third party that's
completely objective it was as you and I
have I know somebody who does a
recruitment process is just as a sport
I won't name him because there are many
companies here but he probably has done
a recruitment process with one of your
companies and people accept him because
he's very good and he does it when his
morals are low so he says no and he
confirms how good he is think of those
processes as something positive for you
that you can't get something out of one
of my mentor guys did when sort of asked
for a job in Facebook and and he had he
had made it to the third interview and
there the recruiter said ah but you have
experience this is very you have no
experience we asked for two or three
years of experience so it was great that
he made it to the third interview in
Facebook and actually they said we like
your CV you don't have the experience we
need but in two years time to approach
us and he was very his confidence was
really by this what else can you do
brain is funny and with this cognitive
biases if you did have you named good
things in a part one what do you keep in
mind the part one so what should you
learn to do what you have to assess or
value your achievements months ago there
was a guy writing who told me he wrote
down all his successes every time the
boss said you've done very well or
somebody he took a picture and he had a
little file but he introduced all of his
achievements and when one day he was
feeling lower then he take a look
and okay so it's it's silly but since
our brain units drawing us we should
also troll our brain and also fear of
failure in the Saxon culture if your
failure is not so present you can you
can fail but but at this you've tried it
worse here in Spain were very critical
with the failure he tried to do this and
it didn't work
there was one sentence that I thought
was of the the founder of them which is
I never lose either I get it right or I
already learned so we have to be brave
enough to take risks to leave our
comfort zone and also to learn from that
failure it's not bad to fail it's part
of the natural process of learning
what's important is don't fail twice at
the same thing so we have to learn and
we have to improve as a person and as a
professional let's assume that the cow
is round if you do not have one syndrome
or the other how can we help our
colleagues there's something that's
incredibly cheap and it works very well
we just like knowledge somebody else's
achievements
I don't know if in leadership teams this
is discussed but I people are not aware
how important that the pat on the back
has it's zero cost and it has a great
value my boss my name was fine that's a
great feeling make constructive
criticism our community is great
but we are a bit patrol really or maybe
a lot of a troll really in twitter is
like plague really so we have to learn
to do constructive criticism this is
wrong but you could approach it this way
how about doing that you have that tool
let's not be unnecessarily aggressive
but try to build so that when I
criticize because sometimes you are
giving and sometimes you're receiving so
if we can break this vicious circle
we're all going to be better and then
help out this is something that's not so
hard I think with the route is quite
well because there is a great feeling in
this community and I think most of the
time you find somebody to help out but I
also believe is very important is not to
accept certain things the fraud syndrome
and the doing Krueger's are opposite but
there is a particularly dangerous
combination of those what happens if in
a room full of people who have different
levels of the fraud syndrome you
introduce one doing in Kruger what's
gonna happen you can tell both syndromes
are going to feed to feed look feedback
with each other so the the fraud
syndrome people perhaps going to feel
even less competent in the face of the
surgeon in Kruger syndrome so what
should we do well if somebody is
overdoing it you should say what are you
to him so to be an active part to stop
this phenomenon
part of the solution and I like to use
this concept of the epidemiologist which
is the group immunity you see what the
idea is yes this is like a donor Krueger
the fraud system if we try to block the
effect of the dueling crooked and then
more people are on the what do you think
you're doing or what do you think you're
calling the impact of the agent included
on the population becomes very rare
that's great for everybody okay
very quick conclusions being here is
great being here is great and being here
is also good I have an important
criticism for a trend that says this is
full of media crap people being mediocre
or being average means that you're here
so being average is not a problem
because their work to get there and to
stay there it's very hard and so that's
fine
so being average is fine but we have
this feeling that either you are the
best rock star your and of course
people who are incredibly good in
cybersecurity fill any of you remember
about the aesthetic of bad distribution
but we are where most people are and
there's no problem with that as a is
quite an achievement what do we have to
do where we have to assess ourselves we
have to know with as much precision as
possible where we are and to work to be
a bit better at the end of the day we
have to take into account that you
cannot change your environment
you cannot make people smarter or
sillier
but you can make yourself better and
there is a sentence from like that says
you are only copied competing against
yourself you can certainly make sure
that you are a bit better and for that
what do we need to do
well basically in many cases we have to
leave the comfort area stop being afraid
and we tend to forget we also have to be
nice I'm incredibly happy with my boss
that's one of the reasons why I'm still
where am i where am i oh and one of the
things he's done is that he doesn't hire
great heights stupid guidance people are
nicer or not so nice but everybody is
reasonably nice and that's something
that makes the team that gives it him a
completely different feeling so the
final conclusion is that knowing
ourselves a bit better we're able to
know how to improve ourselves and the
techniques that I've mentioned if you
use the techniques I've mentioned here
you're going to generate knowledge will
improve the community and the philosophy
with which I want to finish is that if
we improve and we produce better content
we help everybody else improve and from
being a great community will be we will
move on to be just an astonishing
community thank you by the way there you
have the slides here if you want to use
them