[Music]
morning
everyone happy day two of St con um
great to see so very many of you um
there's a lot of you here and there's
most definitely no way that any of you
are jerks so I have nothing to teach you
presentation done see you so
um Hello thank you welcome thank you for
coming uh
I I I I mean that sincerely I I think
there's just way too many of you here uh
but please stay there's lots of seats I
most definitely just wasn't expecting
there to be so many people wanting to
see this so thank you very much for
coming my name is Chris Honda uh we are
talking about making security happen
with a without being a jerk at least
that's what my submission was and up
until last Friday when I had the genius
idea of redoing my deck don't do that
cannot Rec recommend against that
strongly enough um we we're actually
going to be talking about how to make
security happen and be a jerk at the
same time so here's an instruction
manual should you should most you should
most definitely Never
follow um I'm also professional goober
right I didn't I don't know if I
mentioned that I work at wistic I do
security stuff sometimes uh but mostly I
just kind of exist there
so before we start um we're going to say
some things things will be said
um these do not represent anyone's or
anything's views other than mine right
most of these are going to be jokes um
the standard disclaimer of this is
satire uh this is not advice by no means
should you do anything that we're about
to talk about for at least the first
half of this
presentation and if you do decide to
leave if you take away anything before
we actually get to the end um the tldr
is please be a good
person um there will be memes that's
actually most of the content content
because most of what I have to say is
not that really revolutionary or that
insightful more of an admonition to do
good things so uh if you say past year
you're really just going to get memes
and that's about it so and you're
welcome for the pixels not all of them
are great quality but so you're welcome
in advance so about me uh I'm still
trying to figure out what I'm want to be
when I grow up that'll probably never
happen but you know what I got to keep
trying uh studied a lot of different
things try to do a lot of different
things had a lot of jobs most of which I
was incredibly bad at um and not to say
that I'm good at my job now but I found
a place that I like being so
uh yeah that's that's about as
interesting as it gets um my my greatest
accomplishment so far as a security
professional is that I am the reigning
cahoot trivia Champion um so again about
as interesting as it gets and and cool
fact about me I don't know if it's
really cool but um if we get to cool fun
questions afterwards some of you know me
as the um as a teriyaki
chicken lover uh the cool fact is I grew
up in the garlic capital of the world
for a little while and that is actually
one of the secrets to making good
teriyaki chicken you're
welcome all right so let's dive in um
right this is the how to be a jerk guide
um five let's let's call them five basic
rules of how to be a jerk and uh thrive
in a security profession right you want
to make yourself look good at all costs
doesn't matter what you got to do make
sure that you are the one looking good
uh you don't want to teach anyone
anything for many many different reasons
right you got to hoard that
knowledge uh put out fires only if
they're big right so uh one kind of
revolving theme about this is that
you're a hero you should only do things
if it makes you look like a bigger hero
and heroes only put up big five
uh you're a pro you know best don't let
anyone tell you otherwise and uh when
mistakes happen CU they do inevitably
happen uh it's not your fault remember
mistakes are never your fault all right
so let's dive in
who thought that the hero in the office
was anyone but
Kevin right Kevin is the epitome of
Kevin from the office Kevin Malone is
the epitome of a hero right can't really
say what he did but we're we're putting
that out right he he he is a hero he
said so himself so uh some things that
you want to do to make sure that you are
that that you look the that you look the
part of the heroes anytime there's
credit to be had you take it right your
boss did something great it was actually
you cooworker in a totally different
team did something great again totally
you um if there's ever any if there's
ever a downturn mistakes are made right
mistakes happen just not for you um you
got to shove that off to someone else uh
the way I like to put it is there's
always someone else you can throw under
the bus um actually that's my go-to
right someone made a mistake you made a
mistake no one needs to
know right find the bus throw someone
else under it if you have an intern
great they're they're great for doing
that right
Corey see did it to Cory all the time
love you
dude um
right so take all the credit none of the
blame you are never to blame mistakes
are never your fault nor should you have
to clean them up nor should you have to
clean up after them remember that you're
a hero that's that's a better way to put
this instead of thinking instead of
saying you need to make yourself look
good at any cost remember you're the
hero uh rule number two don't teach
anyone anything as dangerous move you
know why because you worked hard for
your knowledge right Homer is smart he's
spelling smart definitely his own way
and uh there's there's a lot of benefit
to that he's he's he's
a what's the word he's revolutionizing
how we spell things um follow Homer's
example same thing with Joey right um I
wouldn't be a Chris Honda talk if we
didn't talk about food at least a little
bit don't share your
knowledge Joey doesn't share food you
don't share knowledge so you learn all
these things you worked really hard to
be good at what you do and it would be a
disservice to you be service to your
team to your customers uh to all those
around you to just give that knowledge
away freely so you know what someone's
asking for how you would do something
asking how you learned n figure it
out right Google's your friend that's
how we all learned right Google
University instead of making that path a
little easier for people to actually get
to get good things out of just say hey
you can figure it out I believe you I
believe in you uh and as we all know
right the more that you hold on for
yourself the more that you pack into
that big brain of yours the more
valuable you're going to be the better
you're going to be at the at your job
the better you're going to the better
retention chance you're going to have
right your boss can't get rid of you if
you know all the stuff why share why
make anyone's life better when you can
keep it all for yourself all right uh Mr
Ron Swanson has that guidance right if
anyone asks you for something ask for a
favor
asks shut them down just say no lower
that enthusiasm people are too
enthusiastic about doing good things
these days shut that
down rule number three all right we only
put out big fires because rule number
one
was oh come on guys
rule there we go yeah you are a hero and
heroes only put out big fires right if
it's a small fire you can wait that's a
fun game I like to play right you wait
until the problem makes itself bigger or
if you're feeling creative make it
bigger yourself right um these poor
firef Fighters had a uh had a fun
exercise in that someone else tries to
put out the fire while it's still small
again tune that nonsense out we don't do
that here right you look good you look
good because you put out big fires let
that fire get
big um I nothing nothing really to say
from here right enjoy the memes enjoy
the memes you don't have time to put out
fires you don't have time to put out
other people's fires so if it's someone
else's problem let them figure out a way
to deal with it if it is your problem or
someone makes your problem wait till it
gets big so again you're the
hero um you are the pro right um also if
you couldn't tell at this point in
making the slides uh my daughter was
watching a specific movie and I thought
this was a great moment so I'm sharing
it all with you as well you're welcome
so everything is about you right you're
the pro your knowledge your security
program your risk program you're the
compliance person right you are the
go-to person um make it all about about
you right that's how you became a hero
in the first place is you took the time
to develop the skills develop the
knowledge everything therefore in your
program should re revolve around the way
that you think it should be done if
someone says otherwise why don't they
just do it themselves why are they
asking you to do it right so number four
continued
um if if if if to reiterate if you
didn't have an answer why would someone
come in and do that make sure that you
give them that attitude too right like
hey look this is my thing this is my
deal I'm over this program I got this
covered right one and doubt this is my
favorite again Cory can probably attest
to this uh one in doubt call someone
names scream at them a little bit you
know really really healthy Outlet um uh
HR thanks you for that as well so
um right fry is my favorite example for
this right call call those names we're
being creative in that in that way
again right um for those of you don't
don't have kids uh this is Bluey a a
childhood favorite for pretty much
everyone that is under the age of eight
right now so um when I was working on
this slide blue was on in my house um
mistakes aren't your fault again we've
said this before but you can't hit on
that enough right you can't do wrong
because you're just that good at your
job it is unacceptable for mistakes to
happen under your watch and it's even
worse for people to assume that mistakes
happen because of you right no Reg
threats when other people mess up you
got to make sure that everyone knows
that it was their fault you couldn't
have possibly made that mistake make
sure that people know that it displeases
you when mistakes are made and it costs
you time Focus effort in other areas
right so kick that trash can punch the
drywall don't do that again HR
violations Andy's a Andy is a terrible
example please don't do that
um right so please please please please
my friends don't do any of these things
um right it's I I I I mentioned that
this is kind of a guide for things that
we'd never ever want to do so want to
harp on that again before we get into
the actual um how not to be a jerk part
so how do we make security happen
without being a jerk um I I wish I had a
simple answer um right what what's
what's our go-to in this industry when
someone asks a question right usually
it's it depends right uh this the CL
that I could get to an answer that
wasn't as infuriating as that
is just don't be a jerk right um but I I
feel like getting into that topic in
seriousness is a bit philosophical for
what we have time for or really is more
of the Spirit of St con right um this
this is kind of more of an Afterparty
discussion from uh so I I I I couldn't
tell you but what I have learned and
what I hope to share with you and
encourage you to do as you
as you go back to work I know a lot of
you are working I know I'm working
during this conference as well that
things that you take back as As Leaders
as as co-workers as as as friends um we
spend a lot of time at work I'd like to
think that most that most of us are
friends with the people that we work
with um that these are some things that
you want to keep in mind um we win we
lose as a team right there's the there
are such things as rock stars but a
rockar a singular person is not a team
uh you want to be you do want to be
generous with things that you've learned
with your experience with your
perspective and and and your time and
your effort your
energy uh you want to be an ounce of
prevention right there's that phrase of
it's it's better to have an ounce of
prevention than it is to buy a pound of
cure be the ounce of pre that ounce of
pre
prevention
uh it it don't wait for the fires to get
big yell fighting fires is hard and it's
exhausting so get get get the fires
where they're small you want to stay
humble
stay learning keep learning there's
always something to learn different
something new a different way to do
something a better way to do something
and keeping that in the back of your
mind is going to keep you in the right
mindset the right um the right keep you
in the right perspective to keep doing
good things and you want to hold
yourself accountable this can mean a lot
of different things to a lot of people
everyone's going to have a little bit
different interpretations so what I want
to say for this is keeping it balanced
right I know um a lot of people are
going to have similar perspective to
mine where I like to take on the burden
of this is my fault I'm an over
apologizer and I know a lot of you
probably are too what we do want to
avoid is the other side right that the
jokes about nothing's ever your fault
that is the perspective that we want to
avoid
so um looking back to our friends in
parks and rck right Andy is a reasonably
decent athlete I wouldn't know what
that's like I've never been a good
athlete um except for a good eater uh
that's not unfortunately a sport though
so uh Ben is trying he's trying his best
Tom has given I don't know if it's
possible but he gives probably negative
effort right as as a team they're not
going to succeed and it's not any one
person's fault it's the team right so
this is something that we want to keep
in perspective we win we lose as a team
no matter how awesome one or most of the
people on your team are you got to lift
each other up you got to support each
other and make sure that everyone has
the resources to be successful be
engaged be focused on on the mission be
focused on the goals um right mentioned
rock stars I think you're all rock stars
as a disclaimer right there's nothing
wrong with being a rockstar I think
where the problems start coming in is
where we think we're a rockstar
therefore we're immune to criticism
we're immune to mistakes we're immune to
having to work with other people and
change the way that we look at the world
look at our job look at problems and
solve those um I I I'm sure many of you
have experienced it when things go right
it's just so much better when you can
say we did this I did this just sounds
and feels so Hollow right so we did this
those winds are so much better when you
have people to share it with right even
if right the um yesterday there was a
talk where um we where the context was
small security teams right how actually
I'm curious how many of you are the only
security person in your organization go
ahead and raise your
hands I think there's a few of you my
vision is beyond terrible and I got
lights in my eyes but I see a few hands
um so obviously they went to more
interesting talks and I I I I encourage
you to all to do that if if if I'm not
if I'm not doing it for you I you won't
hurt my feelings and I appreciate you
being here um but right the the small
teams it's you feel good when you do the
things because you did have to do those
a lot of those tasks by yourself
realizing though that your role as the
singular security person helped to
support an organization and that you
didn't that you probably didn't do those
things in complete isolation right
whether it's supporting um customer
Trust sales enablement right um
developing marketing collateral working
with the engineering team right we don't
do our stuff in isolation security is as
has been said many times over the course
of this conference and many conferences
um over the years is that security is a
super
interdisciplinary area of work right we
don't do things in a vacuum we don't do
things in a bubble so share those wounds
where you can right we did this take
pride in that satisfaction of you can
work with other people and that people
have enjoyed working with you and
getting cool stuff done all right when
mistakes are made when when you when you
can't take that win and you get a lose
bless you um when when you have to take
a loss it happens right that is part of
life and instead of moping we're having
this discussion with my daughter which
is why I'm bringing it up and it's fresh
in my mind right when things don't go
your way when when when there's no
better way to put it when things don't
go your way you know what you learn from
it you can pout feel bad for a second
right there's nothing wrong with doing
that we're human that is a human emotion
and you should take the time to ingest
that process that and accept that you
know what this this has happened we
can't go back and fix that but then you
learn from it you lift each other up
that's an opportunity to grow closer as
people right I I like to say and lots of
other people like to say that security
is a business of people and and I I
think that that's one of the best
aspects of that when we do have an
incident when we do get breach knock on
wood I'm hoping none of that happens for
any of you anytime soon um it it happens
but that's a good opportunity for us to
lift each other up to support each other
to share knowledge to grow and develop
from that and you definitely don't go to
the bad place Michael's wrong here be
generous with your knowledge right the
more you know um I know some I know a
lot of you probably grew up with this if
you didn't sorry y'all y'all missed out
the more you know was a was was a great
after after TV after school TV special
part the English y'all that the words
are not coming today um I'm going to
also try and dissuade a lot of you from
getting into development if I haven't
already done that um so this is
definitely not code this is my very poor
attempt at bringing codel like text into
humor I know it's bad y'all um bear with
me though so be be generous with your
knowledge right you have knowledge
people around you want to learn right
there's lots of folks here that aren't
in the industry that want to be there's
lots of people that are in a role that
maybe they're not satisfied with or
they're just not quite at their dream
job and they want to be there's a really
good chance that you have a good
perspective on that share it that's
going to make the other person feel so
good and you're going to feel good in
turn when you know what like for example
I I I got a few friends that are looking
to get into instant response I mean
bless you for wanting to do that um I
think it I think it takes a special
person to want to do that
but in a good way I I think that if you
have had that kind of experience and you
share your perspective you share your
experience and then they end up being a
rock star in in that part of the
industry I think you had a hand in that
again not that you shouldn't necessarily
pat yourself on the back but you helped
make someone's you helped someone on the
career journey and I think that that
feels really good finding people more
enabled more knowledgeable more skillful
and able to provide for themselves their
families do good in the world right
we're we're all about doing good for
people doing good for the world uh it
sets the industry up for Success right
if you keep everything to yourself what
Good's going to come from that right you
you are one person and you're an awesome
person and you can do a lot of good
instead of keeping that all to yourself
share that love share that knowledge
share that passion that excitement share
the skills and that's going to make
things a lot better for everyone because
you just help replicate a key part of
yourself to improve things to make the
world a better place and I think maybe
the key one of the keys of this of my
entire very poorly packaged and poorly
delivered uh presentation is that you
want to show this shows gratitude to the
people that came before you and helped
you on your journey I can't think of
anything more ennobling than saying
thank you for showing me what I could
have done showing me that there was more
to this industry more to this life more
than being being a work and career
professional right I didn't know that
this was possible um it I I I'll promise
you right now that the people that you
say thank you to for showing you your
next steps for helping you on the way
being there to support you when you're
when you were
struggling just feels amazing and I hope
that you also remember this that when as
you share your knowledge that one day
when people do the same thing for you
that you feel that same way I know you
will um and my favorite Jason Jason is
my I don't know if he still is but was
my avatar on slack for a long time um
you this puts the squiggles on your
brain right people people help you
people help on your way and and and they
and they help put those those squiggles
in your brain that's
good share those squiggles share those
brain squiggles be an ounce of
prevention right um again terrible
metaphor but I I think considering we
started uh with the satirical please let
the fires get bigger right let's do the
opposite right instead of waiting until
things get really big really bag really
out of hand put put out the problems
early right takes five minutes or less
handle it now before it has to take a
whole team a half a day right
um it's it's just not fun putting out
fires it's not fun going through
emergency drills over and over and over
again it's exhausting it grats on you so
you know what and and some of you like
that no judgment I I think that there's
a lot of excitement that goes with that
but and also when you have other things
to do I think it's better to minimize
those emergencies and
instead get the problem other small nip
it in the bud I guess is another phrase
that you could put to it and then and
then you can spend more time doing the
fun cool building stuff right working on
the relationships working on new
architecture putting together new
program right those aren't fires and
those are fun that's what we that's what
a lot of the other
better talks happening here at s con are
all about is here's how you can do a
cool new thing right let's focus on
minimizing the time that we have to
spend an emergency in recovery mode and
get back to doing the cool stuff and
zoidberg's having a wonderful time I
hope you all are too St con is super
fun um Michael understands nothing um
again if we're taking it from a a bit of
a sarcastic standpoint right or a less
sarcastic standpoint you don't have to
feel like you understand nothing I know
impostor syndrome is a big thing if if
if you haven't felt it I I I envy you
first of all I'm standing up here and
talking to you about stuff that I know
most of you guys just know way better
about so imposter syndrome happens you
don't have to feel stuck in there so
instead of finding that one extreme
where hey look I just have nothing to
learn because I I know how I'm doing
things and it's worked I'm just going to
keep doing it um but also the other end
of spectrum where I don't know how to do
any of this I'm a fraud I'm someone's is
going to find me out and then I'm going
to be out of out of a job that there's a
great middle to be you know what realize
that you have something unique to
deliver something to bring to the table
there's always something from your
experience as a human as H in your other
jobs just being a person right being
alive you have to learn things that will
make you good at your job you just have
to find a way to do that and there's
always ways to improve upon that right
just cuz you found a solution doesn't
mean it's the solution it's not
inherently the best solution and be
proud in the effort and the time that
you took to learn what what you've done
to to learn what you do right it's
you've invested a lot of time and effort
to make the world a better place in this
very specific way so I'd encourage you
to keep that mindset of you can learn
but also be happy with the place that
you're at and lastly um right you can't
hear an image I I I hear this I hope you
all do too this is one of the best
scenes um keep yourself accountable a
little bit of Ben humor right when we're
talking about accountability again we're
looking for balance not the jerkish I
can do no wrong cuz no one likes working
with those kinds of people no one feels
good I'd imagine no one feels good being
that kind of person but also you don't
want to go with the route of everything
is my fault right there's a balance and
it doesn't have to be the blame game it
doesn't have to be finger pointing it's
hey look you know what things happened
this is my role and things not happening
as great as I liked it as I have liked
it to have been and then you learn you
grow from that and you share the
learnings right so you can you can
always learn you can always do better
right echoing our last concept right and
fight the urge to blow stuff up um right
you're going to have days sometimes if
you're having a bad day take a breath
drink some water please drink some water
stay hydrated stay healthy um and and
then we get back to it take the time
that you need and then then we get back
to it all right in summary um I said
none of these words at any point but if
I had to summarize this uh to and
explain it to a child uh this is kind of
how I would hit it and again this is
having a conversation with about certain
things with with my own kiddo um be kind
to people treat people the way that you
want to be treated but something that I
think that you should remember is you
should treat yourself the way that you
would hope other people would treat you
in a positive way right I think
sometimes we're extra hard on ourselves
we're own toughest critic right we hear
that a lot and I think you should be
kind to
yourself
um I wouldn't use these terms these
words with with with my kid but never
too early to start learning those multi-
slabic words right be proactive take
those steps Don't Wait For Life to
happen to you figure out what you want
to make happen and go make it happen the
best you can right we learn we react
when we have to but otherwise let's it's
good to put in the proactive effort to
make things happen the way that we want
it to be um say please and thank you
it's it's always good to have good
manners is another way that I put this
right it I I I've I've come into
scenarios where people said oh that's
the first time all day someone said
Thank you to me and that is painful to
me I'm not saying that we have to say
please and thank you after every
sentence I know I have that problem
sometimes but it it it's it's a really
small thing um so thank you everyone for
coming and and for for what you do to
make this world a better place do good
things because it's good um we we don't
want to do good things because we think
we're going to get something good out of
it that happens right I think karma is a
real thing so you do good things with
the expectation that
nothing is specifically going to come
from that just do the good things and
good will end up finding its way back
into your life and it's F to make
mistakes right um Joe GR in yesterday's
uh in yesterday's Kino was talking about
how this is hacker culture right hacker
has taken on a an increasingly negative
connotation over the years right and in
in the spirit of the opposite of of of
what Joe is saying it it's fine to make
mistakes right keep that part of the
hacker culture alive where you know what
we we're going to learn we're going to
learn by not doing things right the
first time a lot of the time and then we
pass that on later right Bob Ross is one
of the best examples from that there is
no such there's no real thing no such
thing as a true mistake right it's just
a happy accident that you happen to
learn from so before we get to questions
thank you all thank you for coming thank
you for what you do thank you for your
expertise for your kindness and for just
being awesome so thanks for making
security happen without being a
jerk
[Applause]
all
right thanks everyone um so I know
someone's going to ask this why so many
gifts gifs I'm not going into the
pronunciation no pleas please please get
up and leave if if you want this is I I
do want to have the time but um I know
the memes are bad just wanted to add
value where I could this is probably the
best way that I could do it if you want
a copy of oh not a copy of the slides
I'll get the copy of the slides on my
LinkedIn which is linked to this QR code
any
questions if you're raising your hand I
can't see it just shout it out but if
not thank you all have a good
day