so hi my name is Royce Regina I am the
digital security coordinator at an NGO
based in Berlin that means that I do a
certain amount of internal support I
provide workshops for some of our
partner organizations and I write and
maintain external facing security
education resources and I'm here to talk
a little bit about social engineering
improving security behaviors of people
around you and how some of the skills
that you can use from one are or aren't
applicable to the other so social
engineering getting people to change
what they do it's kind of just
manipulating folks to like do what you
want them to do sort of sort of or not
so there are a few major differences so
when we're talking about social
engineering you normally think of the
person who is doing the social
engineering being very much in control
whereas when you're talking about
teaching we really want to have the
learner sort of driving everything so
just backing up a moment like what do we
mean by social engineering because
there's this huge huge broad category of
stuff that falls into that bucket and so
that includes like fishing and fishing
and smishing and and all of that but it
also includes a lot of the stuff that
generally gets talked about in terms of
like physical penetration testing when
you're not talking about lock-picking
but instead you're talking about how do
you walk in places but it can also just
include this whole general category of
things that I tend to think of this fun
high jinks
we're basically what you're doing is
you're you're you're basically figuring
out how to set someone up to have a
specific emotional journey so that they
more or less do what your hope
the filter and then when we're talking
about education in this context we're
really talking about education for
behavior change so this is not like
memorizer times table or like learn what
the like what any specific framework is
about instead we're talking about how do
you get people to have better passwords
how do you get people to log out of
accounts that they're not using things
look more along those lines so so that's
what I mean what I'm talking about these
two general topics
so aside from who's in control or who's
empowered in the situation there's also
a pretty major difference between
whether you're aiming for trust or
whether you're just aiming for rapport
the timeframe for doing some social
engineering very different than like
trying to teach your colleagues how to
keep themselves safe how to protect your
company whatever your context is even if
it's like your parents or your
housemates or anyone that you are
desperately trying to give security
advice to okay sorry about that and then
the other thing is the way that you use
emotions in social engineering should be
very different than the way that you're
using emotions in any kind of
educational process so part of this is
in terms of who's in control we have
this idea called self-efficacy it comes
from alfred bandura who's a psychologist
and basically it's the idea that someone
believes in their ability to do a
specific thing and this ends up being
really important when you're teaching
someone to do something because
basically if they believe that they can
do it you're going to have a much easier
time supporting them in doing it because
when you're talking about social
engineering you're generally talking
about like how do I get someone to do a
thing
but when you're talking
about digital security education
interventions you're generally talking
about how do I get someone to get
themselves to do a thing and part of
that kind of relies and part of why
there's this difference is when you're
talking about social engineering you're
generally talking about like just
building rapport like how do I just get
someone to like me so rapport is about
just like having this connection that
you can kind of joke with someone you
probably also have rapport with like
your colleagues which you should and and
it's generally helpful like having a
nice rapport with someone is going to
help you regardless of what your goal is
but when you're dealing with like trying
to actually get someone to learn and
change their behavior what you probably
need is actually trust what you probably
need is not just someone to be like oh
yeah that person I am you know they seem
friendly I'd like to have a beer with
them but probably what you need is for
someone to believe the things that
you're saying and to believe that
they're accurate and to believe that you
have their best interests at heart or
that it's like close enough that they're
willing to roll with it so the other
thing in terms of like trust versus
rapport is like you can find all sorts
of excellent and excellent guides to how
to quickly build rapport trust tends to
take a lot more time you can also break
rapport and Trust fairly quickly but
Trust is what you really need to like
build in in your relationships so just
like trust and rapport take different
amounts of time to establish when you're
dealing with social engineering you're
almost always only needing to like keep
stuff together until you get out like if
you're doing some kind of like
face-to-face thing you just have to make
sure that they believe you as long as
they're looking at you or as long as
they're less likely to call someone
who's going to get you in trouble like
that's all you need the glamour to last
but when you're dealing with any kind of
behavior change education what you
really need is something that's going to
stick with people and that's going to be
long-lasting
so it's not just like
while I am standing there with my
coworker get them to do the one thing
I'm asking them to do this one time
while I'm looking over their shoulder
but can I set them up so that they're
gonna do this thing that I've asked them
to do and shown them how to do
repeatedly over time and as long as
we're talking about timeframes it's
really good to remember that everything
fades over time so when you're thinking
about education and when you're thinking
about like teaching or training people
around you it's good to remember that
they will probably need blake little
refreshers and to just plan on that and
it doesn't mean that you've failed and
it definitely doesn't mean that they've
failed if they need a little bit of a
reminder from time to time so another
area where there's this huge huge gap
but a certain amount of shared shared
skills is when we talk about the role of
fear especially in social engineering
and education so like when you're doing
social engineering if you get someone a
little scared it's generally good
because people who are scared don't
really respond the way they probably
should so if you're trying to like get
someone to do something that they're not
technically supposed to getting them a
little bit scared can mean that they
don't have the presence of mind and they
can't Center themselves well enough to
really like think through what they're
supposed to be doing however when you're
doing something that is about teaching
that's the opposite of what you want and
you generally have a situation where
when you're teaching someone if they get
scared they're going to zone out they're
going to tune out they're just going to
like shut down a little bit and some of
that is because just like you can get
really really successful or some people
can get really successful with like
creating fear and then immediately
offering a solution like the classic is
you have a virus install this software
to remove it all that's doing is
creating fear and then offering a
pathway to release or relief from it and
so when you're talking about education
the pathway for relief tends to be
shutting down and ignoring you so if you
if you if you're hitting that fear
button a whole bunch it may be great
when you're trying to manipulate people
but it's going to be very
counterproductive when you're actually
trying to get people to understand and
internalize what you're talking about
so the other thing that's worth
mentioning is like yes you may talk
about scary topics depending on what
your work is and depending on what kinds
of trainings you may need to talk to
your colleagues about some of them are
scary but if you can figure out ways of
reducing the height of the fear that
they're experiencing or the the height
of whatever emotions they're
experiencing you're much less likely to
have that whole search for relief and
avoidance of the topic so basically
feelings matter feelings matter a whole
lot and they matter not just for the
people your training or teaching but
they also matter for yourself so there
are a few really counterproductive
effects of using like standard social
engineering where you're just like I
know how to manipulate some folks I know
how to get places I'm not supposed to go
I know how to get a free cup of coffee
like all of that if you're using that on
your co-workers there's a really good
chance that you might be normalizing
certain types of risky behaviors so that
can include like getting them to
override security controls instead of
really talking them through it can be
getting information from them because
it's easier to just get it from them
than until I go through the right
pathways just all of that your you're
training them into being vulnerable to
the kinds of techniques that you or some
actual bad guy might be using or mom so
the other really major problem with a
lot of social engineering techniques
especially in a work place is kind of
inherently when you go in and you try to
manipulate people you are being a creepy
creeper like it's just not nice and so
sometimes you're totally successful and
you get away with it and you have the
problems I mentioned on the last slide
but
sometimes you have a colleague who's a
little bit more sensitive and who has
maybe like gone through some of that
training and instead what you're doing
is you're you're pushing the bad guy
buttons and this can potentially set off
their spidey sense and have them just
immediately categorize you as sort of a
bad actor and that means that you end up
alienating the people who are best
positioned to help you you it means that
you are alienating the people who have
the sensitivity to this stuff and could
be bringing it to your attention when it
shows up instead you're making yourself
someone that those people specifically
do not want to approach and that just
generally drives people away and it can
also really feed into shadow IT type
problems so this is a pretty good
example of things that go wrong when you
think that social engineering is the
appropriate way to approach everyone in
your mind so I've talked a bunch about
like the disconnects and what doesn't
work but there are a whole bunch of
skills from social engineering that do
work really well when you're doing
educational interventions with both of
them you need to handle someone else's
emotions and you should create this nice
journey that takes them along the path
that they need to go either to give you
something they shouldn't or to like get
to a point where they can get themselves
to have better security behaviors and
it's really about like orienting towards
someone else's needs there's a huge
benefit to being able to really respond
to emotional cues and elicit to a CA and
techniques are huge in both like being
able to ask good questions that either
help you get good information or help
steer other people to where they need to
be is incredibly powerful
um and with that just like know your own
strengths and weaknesses build on your
strengths figure out how to counteract
your weaknesses ideally not the other
way around so when you're dealing with
adults one thing that can be really
useful is this idea of adult learning
theory
and so it's this like whole area there
are many many books on it you could read
thoughts um or or not because it can
basically be summarized as it's not just
that the person is in the dot meaning
it's not just that they're over 18 it
has to do with being ready to learn and
open to what you're saying
so this is not about awareness-raising
this is not about getting someone to
recognize that security is a problem
when you're talking about actual
education and actual learning that part
has to already be addressed that's
actually somewhere where a rapport can
be really helpful if you're having a
little bit of a rough time meeting with
someone having a report can help them
open up a bit and be receptive to what
you're trying to teach them but the four
principles are basically you need to
have the people you're trying to teach
be involved and this can be asking them
about their concerns or just like asking
what things they want to learn
you should be drawing on their
experiences so like talk to them and ask
them what they have noticed that relates
to this or if they've ever gotten like a
spammy email or whatever it is so that
they're able to access and connect it to
things they already now make it relevant
people are generally not willing to like
spend lots of time learning stuff that
they don't see the point of and then try
to be problem centered instead of
content centered to teach them how to
address something but you know also
balance it out with like based knowledge
that that can be helpful for them more
broadly as you're learning how to get
better at teaching other people it's
really good to learn from others as well
so when you go to talks when you go to
presentations think about what people
have done that have worked really well
but when you do that just keep in mind
that different kinds of situations have
different goals in terms of what people
are learning sometimes it's just about
facts sometimes it's broad frameworks
sometimes it's about behaviors and habit
and you also have different kinds of
audiences some of them are more
technical some of them are less
technical how familiar you are or how
formal the setting it is I'll make a
difference so just be mindful if you see
something that works really well it may
only work really well for that kind of
learning or for that kind of audience so
hopefully either in a place if you're
doing this kind of like teaching to
others where you really want to support
them in being successful and some good
ways of making sure that you're really
supporting them and that they have a
much greater likelihood of succeeding
and you have a much greater likelihood
of not getting called to solve the same
problem that you've solved like 12 times
previously they may be a little sick of
is figure out how you're actively going
to support self-efficacy like be aware
of like what people say when they're
like oh I don't feel like I can do this
and actually address it and help them
figure out what is holding them back um
when something is hard like sometimes
learning is hard to validate it don't
say well I think it's easy one trick
that I use a lot is saying yes it is
absolutely hard now but once you've once
you've done it a couple of times it's
not going to feel hard like it's hard
now but it's not going to be and that
also helps set expectations because it
may be a situation where if it continues
to be hard for them they're doing
something wrong and so this can also be
a way of making sure that you're
catching people who might fall through
the cracks and it's also just generally
good to a providing encouragement like
we could all use a little encouragement
from time to time so basically social
engineering and education different
goals
don't don't normalize bad stuff don't be
creepy it really helps when you know
what you're trying to do so even if it's
just like writing down point by point
what your goals are what kind of things
you want to cover what success looks
like for you what success might look
like for them all that can help you
put together something that's more
likely to actually work and then just
like be decent to the people around you
it's not just about like being a nice
person it also really does help and it
really will make you more effective but
you should also just be decent to people
like it's not it's not that big an ass
so that's it I am happy to take
questions but I think I have like a
minute and a half before I'm done but
come find me afterwards I will be around
and you should all stick around because
the next clock looks really interesting
and that's about a hire machine learning
machine armor very different but clearly
no one has taught me balling up from the
newsroom is right now anyway thank you