[Music]
thank you
[Music]
all right
foreign
I am a certified rescue scuba diver and
I also work in information security it
turns out that these fields have a lot
in common
primarily that there there's just
inherent risk in what we do in order to
reap the benefits we have to understand
and assume a certain level of risk
secondly Panic makes everything worse in
both situations when you panic you're
going to compound all of your problems
and the third thing that I find that
they have in common is that our Natural
Instincts are often wrong and so we do
have to learn how to train our minds and
train our bodies to respond in a way
that is going to be productive and
helpful for the situation and to help us
get to the best outcome
um
so a little bit of background on myself
just so you have a sense of where I'm
coming from and kind of how I developed
my perspective I am the founder and CEO
of a Communications consultancy called
discernible and we focus exclusively on
helping cyber security teams privacy
teams and risk teams and how to
communicate to other stakeholders so
whether that's their Executives and
business teams their employees their
customers sometimes media and the public
I'm talking about Security in in privacy
and in really productive and easy to
understand ways for all of those
different stakeholders prior to starting
this company I led security privacy and
Engineering Communications at Uber as
well as security Communications at
Facebook and ATT and before that I was a
consultant at another company working
with a bunch of other companies on
exactly the same thing so I have gone
very very deep in one particular area of
cyber security
I started my undergraduate studies in
Marine Biology that's actually where the
scuba diving started in my life
also probably why you're going to see a
lot of shark photos in this presentation
but I ended up getting a master's in
corporate Communications and So I
Married those two
um
experiences into a career in cyber
security because it turns out that
sharks and hackers have a lot in common
in communicating about them depends on a
lot of the same principles in terms of
how do we talk about things that that do
have inherent risk but that we can't
completely avoid in order for our lives
to be productive I'm also a co-organizer
and the Press Department lead at Defcon
so if any of you are familiar with that
um
uh event I'm involved in that and as I
mentioned at the beginning I'm also a
certified rescue scuba diver are there
any other
certified divers here in the room
amazing if you're already certified I
highly recommend looking into Paddy's
psychological diver course it's only a
couple years old but it is amazing and
I'm going to touch on a lot of the
principles from that course throughout
this presentation
thank you
does anybody know what the number one
cause of diving emergencies is water
filthy
it's poor judgment
and you want to know what causes poor
judgment
Panic is one of them
um but also sometimes we do we make poor
choices even before the emergency
happens that leads to the emergency
right how many times have we been in a
security incident that should have been
very small and should have been easy to
mitigate but then our CES is something
really stupid on the news and now it's
like a full-blown Incident That's
impacting stock price right
um so we want you to think as we go
through this today think about
um
where where are we making decisions and
where does poor judgment come into play
throughout the entire incident response
process because when I focus
particularly on Executives and I'll get
to this later on they have a very
important and critical role in incident
response particularly as it relates to
judgment and if they are distracted with
other things
or if they are panicked
their decision-making abilities are
going to be impacted as well and so it's
something that we can do as the security
team to actually Focus their attention
on the right things make sure that
they're not being overtaken by Panic so
that the things that they are
responsible for where we need them to
make a decision they're actually
optimized and perform
so I'm going to start a little bit just
with the background about what Panic is
and how it impacts us so Panic
essentially when we feel like that that
sense of anxiety or Panic it triggers
our primitive brain so the amygdala is
located
um the back of your brain
uh and it's responsible for uh your
fight flight or freeze response phrases
happen all the time to panicked divers
they just go limit
um sometimes they will also
um as I mentioned sometimes our Natural
Instincts aren't always the right thing
to do when you're underwater and you're
under pressure and something goes wrong
um you know a lot of times our natural
instinct is I just need to get to the
surface where I can breathe
and I've seen Panic divers shoot to the
surface despite having everything that
they needed to breathe underwater they
still had air their equipment was
functioning just fine but they get
scared and they race to the surface and
this is particularly dangerous in scuba
diving because as you get closer to the
surface
of the the pressure around you decreases
and so the air inside you expands and
it's really easy to blow Along by
shooting to the surface too quickly
into
at the same time in our primitive brain
is being triggered by this Panic this
alarm Bell in our mind it's also
inhibiting the more evolved parts of our
brain so you know things in your frontal
cortex like uh verbal thought judgment
and planning so not only is panic in
incredibly uncomfortable experience to
just to just go through it actually
makes it so much harder for us to
um
actually execute those higher level
cognitive functions that we need in
something like in underwater emergency
or security incident
and two when problems occur whether it's
a security incident or you know a diving
emergency our responses can either help
us lead us to a fix of the situation or
it can make it worse right it's one of
the reasons why we train over and over
and over again not just as rescue divers
but as incident response professionals
so that a lot of what we need to do in
that moment is muscle memory for us
I can identify an emergency underwater
very quickly so that I know what to do
to mitigate that situation right but the
more stress that we feel the more likely
we are to actually we're going to lose
the ability to remove that source of
stress right if I'm with a diver who is
panicked because
um maybe they got a cramp in their leg
or they're having
um pain in their ears because they have
an equalized properly The more stress
they get the harder it's going to be for
me to tell them the right things that
they need to do which is why as rescue
divers we are trying on how to do things
regardless of the panic diver would want
us to be doing uh there's even scenarios
that we have to practice where if they
are panicked we can go behind their tank
where they can't reach us so they can't
pull on our Regulators or our tubes or
anything and we can safely you know get
them to the surface where help is
waiting but it's important to keep in
mind that again The more stress we get
the worse it's going to be right so
those of us that are involved in
incident response all the time it's
helpful for us to you know develop these
skills on our own but also to think
about the other stakeholders and those
Executives who are in this situation
with us as well
yeah
so to top that off uh perceived threats
are enough to trigger our Panic response
right so even if you're not actually in
danger and I took this photo by the way
not in danger
when you're actually in uh just the
thought of being in danger is enough to
trigger your amygdala and activate that
limbic system which leads to that Panic
response and this this is um a positive
feedback loop between the physiological
response and how our brain responds
right so if any of you were in The
Meditation session this morning that was
in this room they went through a
breathing exercise
which I use a lot not only in scuba
diving but also in incident response
coaching because I need both your body
and your brain to understand that you're
not in danger
or they could you know negatively impact
um each other right so if your heart is
racing that actually sends a signal to
your brain that there's a threat and
then it's this positive feedback loop
and they feed off of each other so we
have to learn how to interrupt that
process in order to convince our brains
not to panic right
and so the number one rule we have in uh
rescue diving which is probably going to
seem very familiar to Security
Professionals as well is that the best
way to deal with an emergency is to stop
it before it starts right and I'm not
only talking about like our technical
defenses sure we wish we could stop all
like security incidents that's not a
reality
um but it doesn't have to be an
emergency we decide whether or not it's
an emergency by the way that we respond
to it
and so in diving we have a little bit of
a checklist that we'll go through before
we get in the water right just to make
sure let's make sure that everything is
working properly and that we've set
expectations before we get into that
situation of risk right so I look at all
of the divers that are in our group is
anybody nervous are they anxious are
they anti- are they tired did they get
enough to eat is anybody seasick right
motion sickness can have a um have a
huge impact on our mental abilities
while we're diving as well so I'm
looking at all of those things about my
diver to understand what is their state
of mind
um and how are they feeling in in that
moment before we even get into the water
right I do the same thing with
Executives from day one I am scanning
these people to understand what makes
them tick what motivates them how do
they respond to stress right cyber
security is not the only risk or the
only issue that Executives have to deal
with right and so I want to understand
how do they deal with other types of
risk and other stressful situations
I'm also thinking about the environment
when we're going to a specific dive site
I'm thinking are there is there an
overhead environment where I live in
Mexico we have a lot of underwater caves
and you know getting hit in the head
with stalactite is not ideal so I'm
thinking about what is the environment
like not only so that I can prepare but
so that I can communicate to the other
divers what to expect right because
nobody really likes surprises underwater
unless it's a really amazing uh you know
encounter with an eagle ray
the next thing that we do is we go
through a dive plan we brief all of the
diverse before we get in the water what
to expect what is our anticipated death
right you have a finite amount of air in
your tank and you have a finite amount
of nitrogen that your body can't absorb
when you're under pressure right and so
we have a plan for every diet and we
talk about that as a group
uh in fact
uh the same that we have is plan your
dive and dive your plan now this is
going to come into play a little bit
later when we get into some of the
security incident specifics but I often
hear people say oh yeah we have an
incident response plan but we don't
follow it because it you know it it
drives me crazy when people say you have
to have a plan but you know nobody ever
really used to say I'm going to tell you
why there's two problems with that
one is that if your plan doesn't work
change it because you need to have a
plan you have to you don't know if your
best most experience incident response
team members
are going to come to work that day
or are going to be
um you know able to participate that day
maybe they're out sick maybe they're
having a family emergency you have to
have a plan that other people can follow
not just the people who have done this a
million times before the second thing is
that if you go through a really serious
incident that gets public exposure or
requires a regulatory reporting
obligation The Regulators are going to
come check and look at your plan and
whether or not you followed it it is
worse to have a plan that you didn't
follow because The Regulators will want
to know why you deviated from your plan
and if you have a lot of deviations from
your plan
then you didn't really have a plan
to
and I'll talk about this a little bit
later it's important to practice your
plan over and over and over again as
many times as you can through your daily
operations
so that your plan is something that you
can't actually follow that you can trust
and that you have confidence in and not
just you as a security team but your
executive team as well your Executives
will jump in the middle of your process
if they don't trust it if they need if
they're having this you know they need
to have this cathartic experience to do
something because believe me they did
not get to where they were by sitting
still
right and uh so we need to give them
specific things to focus on and we need
to give them a plan that they understand
that they believe in and that they trust
so that they will follow it
and then the last thing we do with our
diverse uh is that we check all of their
gear right
um are your Regulators working so that
you can breathe that's important scuba
divers have two Regulators we have an
extra in case we need to share air with
a buddy uh in case they run out of there
or in case there's a malfunction in our
primary regulator we also need to make
sure that all of the equipment we have
for buoyancy which is you know whether
or not you're floating uh in the water
if you're more dense or less dense than
the water that you're in we need to make
sure that all of that equipment is
working as well I was actually talking
to a fellow diver earlier today who's
talking about
um how he had increased or decreased his
air consumption which is a huge uh
achievement for any scuba divers to use
the least amount of air as possible
because then your dive can last longer
um and you know the easiest way to to
improve your air consist consumption is
to improve your buoyancy right being
able to just float and Coast through the
water with very little effort and so we
want to make sure that all of that is
working if you're too heavy or if you
don't have enough weight in the water
you will struggle the whole time and not
only will you go through air faster but
it also especially for new divers can be
an incredibly triggering experience to
not feel like you have control
and so in both scuba diving and
um in cyber security we need to
understand the challenges that we might
face during an incident and we need to
ensure that everyone including our
Executives have the proper skills and
tools to deal with those challenges
[Music]
so when it comes to Executives as I
mentioned I'm constantly monitoring
um their their state of mind I'm
constantly monitoring their abilities
what are they good at what are they not
good at what are their blind spots
um and this isn't necessarily because
I'm going to tell them how to fix it
again depending on their personality but
I may need to compensate for that right
when we dive with with newly certified
divers we have extra weights with us we
will bring extra masks with us just in
case they have an issue with their math
we have to be prepared to kind of cover
the blind spots and the weaknesses of
the folks that that we're working with
and a lot of that just has to do with
with their experience
um as well as their temperament
we also need to be mindful of the tools
that the executives have right in terms
of how are they getting information what
things do they have access to does RCA
have access to a Twitter account that we
don't know about that's going to cause
an issue with policy right those types
of things matter
um and also when I think about tools I
also think about like channels of
information who are the resources and
who are the people that the this CEO is
going to call before they call me or ask
to call me I need to know who's in that
Circle and who's who has their ear
because that's going to again impact
their perception of fear and risk and
comfort with the entire situation
I also think about their experience
right and
everybody thinks they have more
experience than they do usually by the
time they become an executive
um but I'm I'm more
interested in the type of experience
they have more so than the quantity of
experience so for example uh we get lots
of diverse where I live in Mexico a lot
of tourists will come also I have 400
Dives but they're all in the ocean
you have a lot more space to safely mess
up in the wide open ocean and if you
come diving with us in the caves your
buoyancy has to be on point when you go
cave diving you just don't have a room
to go up and down you're not going to
make it through the narrow passages and
you're going to
um damage your body or your equipment if
you're constantly hitting the rock
formations and so when I'm thinking
about executive experience I'm not just
thinking about you know how many
incidents have they been through but
what types of incidents have they been
through what types of security
um uh experience and Leadership do they
have right it's very different if all
they've ever gone through is ransomware
compared to okay now we have a really
irate like bug Bounty researcher who's
you know on Twitter and and pulling a
lot of media attention towards us
and the last thing that I look at is the
executive's comfort with this subject
matter specifically and when I talk
about Comfort what I'm actually looking
for is is there public content from this
company about cyber security other than
you know we've had a breach do they talk
about security all the time are they
engaged in the security Community are
they at conferences are they sharing
best practices are they engaged in
standards bodies I've been looking for
evidence that this company is
comfortable talking about security
when they don't have to
that makes a big difference
so here's just a couple examples that I
um
um those on the left are blog posts
about specific incidents
um one is from clapboard the other one's
from GitHub it doesn't really matter the
company
um but this is a lot more information
than they had to share publicly but both
of these companies have a very long
history and a good reputation of doing
this on a regular basis that means that
when they have really serious security
incidents all of their Executives
already know their routine and they
already know that it's not the end of
the world to talk about when bad things
happen and in fact both of these
companies reputation
is increased by the fact that they are
this transparent about their security
experiences the information on the right
actually comes from Uber's ESG report
from 2021
um this is particularly important not
because of the numbers themselves but
because of how much bureaucracy it takes
to share this level of detail with your
investors right so when I'm thinking
about whether or not executives are
comfortable with the subject matter of
security in general I'm looking for
proof
that they're willing to talk about these
things when they don't have to and that
they understand the value in being
transparent and having nuanced
conversations with stakeholders
and so it's exactly the cross-functional
approvals and the risk whether real or
perceived where when I see these things
that tells me that this company under
the leadership of their Executives
because these executives are involved in
a lot of these um public facing content
creation that they're they're
comfortable with the subject matter they
can talk about it in a way that doesn't
make them feel like the house is on fire
just because they said the word cyber
right
and again keep in mind that even
perceived risk
has a lot to do with how Executives
react to the situation right
it's why we um I actually there were
um I had a number of people uh in my
network tell me about with with the OCTA
incident a couple months ago was it
months ago or weeks ago who knows what
days are anymore
um
but they you know the companies were too
scared to talk to their customers about
their exposure to the um the OCTA issue
even when their exposure was Zero I love
when our exposure is zero because we can
talk about it very safe
there is no risk in talking about a zero
exposure but the companies were
concerned that oh if we talk about
security it's going to incite panic it's
not actually we need to normalize
talking about Security on a regular
basis so that when real hits the
fan that's not the first introduction
that people have to our security team
our strategy or any of our defenses
right this needs to be something that
we're comfortable talking about all the
time just in the way that I need you
know scuba divers to be comfortable with
their Gear with the environment and with
the process and procedures that they've
been trained on
and so when we talk about specifically
preventing executive academic there's a
couple best practices that I've learned
throughout my career that I want to
share with you today
the first is have a really really good
response plan I mentioned this at the
beginning it's so important that your
plan is actually enhancing and playing
to the abilities of your executive team
if you have an executive who is a
terrible public speaker for God's sakes
don't put them on TV okay
um it also needs to increase the Comfort
level of these Executives every time
they go through this plan with you
should make them more and more
comfortable not just with incident
response but with security in general
um and so you'll see later on when I
talk about why it's so important that we
use our response plans as often as we
possibly can even if it's a minor
incident
and then finally the plan needs to be
flexible it needs to be sustainable
right if the plan is so rigid that
you're constantly deviating from it your
plan sucks so there needs to be
flexibility built into the plan not
necessarily prescriptive
stocks at every turn I've had clients
say can we get a template for you know
would we need to make a public
announcement about a data break I'm like
no we definitely cannot because it will
be terrible it will sound like you used
a template it will sound like your
lawyer's roommate and it's not going to
have the empathy or the context of the
situation but what you can have is a
plan for who's going to decide what to
say and who else is going to contribute
to that and what is the SLA for all of
those contributors to make sure we can
get this out as quickly as possible
thank you
and so we mentioned this
um a little earlier about really
steering the executive attention towards
the things that are most important for a
successful incident response so uh
attention is a higher order process um
within our brain meaning that it
actually directs other processes right
it helps us assess the situation and
then it's actually going to allocate the
cognitive resources right it tells us
um what to be thinking about what
decisions need to be made and so it
really matters where we're focusing
people's attention during an incident
it also directs our perceptual processes
and influences how we receive the
information about the situation if
executives are focusing on the wrong
thing it's not going to matter how many
times you throw a fax at them about the
security investigation they are obsessed
with this other thing over here and
we've got to pull their attention off of
that thing that doesn't matter because
we need them to focus on the most
important tasks again
and attention is heavily impacted by our
thoughts right this is why I care so
much about monitoring and scanning
getting to know what makes all of these
Executives tick because their beliefs
and their expectations are going to
impact the way that they think about
what's going on and their emotional
state whether they are fearful or
anxious about what's happening is also
going to steer their attention towards
what they perceive to be the threats
right which may be something like a
media inquiry I have never seen a
company go through a breach that went
and then went out of business because of
a media statement the media can wait
that is not your number one priority
during an incident do you eventually
need to have that conversation and
publicly share the details yes of course
and I'm not suggesting that you ignore
um media questions
um but
every company I have ever encountered
can survive
a bumpy day in the news right a bumpy
day in the news is not going to take you
down
if you are not transparent when you do
communicate or if you try to minimize
what's happening when you communicate
that's what's really going to have an
impact
um long term for your business
and so why does all of this matter in
terms of the executive attention and
making sure that they're focused on the
right things it's because there's a
large range of important information
it's actually competing for executives
attention during an incident
and our response plans need to help them
focus on the most important tasks I
mentioned this at the very beginning
where we need Executives to be focused
on the decisions and the judgments that
only they can make because of the role
and Authority that they have within the
organization
and this is best achieved when spoiler
alert they're not hammocked we want them
to make smart decisions and to have the
best clearest judgment possible so
keeping our Executives out of a panic
mode helps us get to the best outcomes
from a security perspective as well
and so I want to introduce you to this
um concept of task loading this is
something that we talk about a lot
um in rescue diving uh because it has a
huge impact on diver panic and things
that could trigger diver Panic so
um as humans our capacity to process
information is limited our brains can
only do so much at once right
and new and unfamiliar tasks require a
significant amount of this limited
capacity so for a new diver if they are
using new equipment if they are diving
with a camera for the first time if they
have you know if their wetsuit doesn't
fit quite right and they're kind of
struggling with it these things take up
a lot of space in our minds and that
pulls that capacity away from other
things
um and as as new tasks build up or is
you know we're we're loaded with more
and more simultaneous tasks we're
actually going to tap out our capacity
to be able to accept new information or
to do additional tasks fortunately more
familiar tasks require less conscious
effort right this is why you know for
those of us that are trained as rescue
divers we can identify things quickly
and respond to them in a more calm and
relaxed manner to actually mitigate the
emergency
and prevent product within ourselves
because these are familiar tasks for us
if you've been involved in incident
response probably a lot of the tests
that you do seem very familiar and very
routine to you the challenge that we
have during incident response when we
look company-wide is that not all of the
other stakeholders that engage with us
on those issues
are as familiar with not just our tasks
but their tasks they may again if
they're only talking about security when
they have to they're maybe talking about
it a couple times a year if that right
which means every time they're doing it
it's actually a new task for them they
have not developed the muscle memory or
the cognitive memory to be able to make
these rote tasks for them and so every
incident is using up a huge percentage
of their cognitive capacity
and so the more familiar a task or skill
becomes the less capacity it requires so
I want incident response to be something
that my Executives can do in their sleep
because if they don't do it often enough
then every time they do have to do it
it's like they're learning something new
all over again and they're not going to
have the capacity they need to make
those good decisions and to practice
sound judgment
and so how do we actually do this right
how do we actually get the executives to
focus on the right thing not like the
shiny object we assign tasks to them we
get them to agree to those tasks and we
practice like crazy all the time
so how many of you are familiar with the
racing model
okay perfect this is not something I
invented want to make that very clear
this is very popular in you know
business management and other types of
project management situations
essentially for those of you who are
familiar
um for each task you have a party or
team or perhaps a function within a
company who is responsible for that task
they initiate it and it is their job to
see it through to completion there is an
accountable party these are the people
who have to sign off they may not start
it but they have to give the okay before
it can be completed so in the case of
incident response maybe it's
um the pr team starts the public
statement but the legal team has to sign
off on it before it's actually sent out
externally from the company
uh third there is consulted parties
and there are informed parties
consultant parties are the folks that
may have to contribute so again if we go
back to that example of a public
statement about a data breach
I certainly hope although this is not
always true but I would certainly hope
that your security team has some input
on what is that publicly just to make
sure that I don't know it's actually
true
and then the informed parties are the
folks who make it the FYI or the memo or
you need to have visibility that this is
happening because you've got other tasks
going on you need to be aligned it's
really important to get
um buy-in and approval from the
stakeholders for these assignments
before an incident happens
um number one because they're not yet
panicked and so they are it is just a
far better conversation about who's
responsible for what uh when people are
not panicked and freaking out right
and number two because it is so helpful
to be able to show them all of the
things that need to happen in incident
response
that they don't want to be part of right
when
um I've done tabletop exercises with
companies when I ask who's responsible
for customer Communications I want four
different people raise the hand no no
you can't have four people responsible
for something you're either going to
duplicate your work or it's not going to
get done right we pick one person who's
responsible and everybody else who
thinks they need to have an opinion on
that thing can be a consulted party
right
but what I have found is that when we go
through the whole list of all these
things some of these auxiliary functions
like HR or like oh God please don't
include me in that unless you absolutely
have to because there's a list of 20
things and we only have two people on
our team
perfect fewer stakeholders we can go
faster right so it's really helpful to
actually help the executives visualize
everything that needs to happen
um because it forces them to select the
small number of things that they
actually want to be part of that we need
them to be part of
so obviously my focus is in
communication so when I do this with
clients the four areas that we focus on
most often are Communications that
happen during the investigation who's
going to be part of the communications
if we need to reach out to the AWS
security team or the GitHub security
team who's who's in charge of those
Communications any communication that is
leaving our environment is up for grabs
when it comes to you know potentially
making its way to the public but also
impacting our relationships with really
important Partners who could help us get
the answers that we need for an
investigation
second we're looking at notification
communication this is where we work most
closely with our legal colleagues to
make sure that we are meeting the
regulatory requirements but also so that
we make sure notifications don't suck
right nobody wants to get a notification
that sounds like my lawyer wrote it
nobody
[Music]
we also look at corporate Communications
this is where the the pr team usually
comes into play or the marketing team
whoever is responsible for that function
and then finally we will look at
customer support Communications
[Music]
um
you know who who's going to reach out to
the customers not just if they need to
be notified but just to let them know
that we're looking into something right
for example if we go back to the the
OCTA example
um when somebody needs to tell the
customers that we're at least aware of
what's happening and you know we're not
like sitting on our thumbs we're looking
to to investigate our own environment
um so those are the four typical
categories that we look at and we will
list out all of the communication tasks
that need to happen in those buckets and
make sure that every single one of them
has a responsible party an accountable
party that we're Consulting the right
people and that the people who just need
to know but don't need to slow us down
they can get the FYI memo and then we
can talk about you know what is the
frequency of those Communications right
can I send it to you at the end of the
day rather than every minute because my
security team actually needs to be
focused on remediation
and so practice practice the more we can
use our incident response plans the
better we will be at executing them and
more importantly the better our
stakeholders and our Executives will be
executing their parts right so these are
just kind of
um some example categories that I talk
about
um a lot in our client work where you
know everybody kind of looks at that Top
Line where it's like the intrusion the
data like the big things that you read
in the headlines right
I want my security teams to be using our
incident response plan on everything
right there's a product vulnerability
follow the plan
right you don't have to go through every
level of escalation particularly if it's
a minor incident but we need to get our
stakeholders
normalized and familiar with all of the
different types of incidents that happen
so that they can use this plan over and
over and over again so that they are in
Tip-Top shape for when it matters the
most right so if your plan is too
cumbersome to be used on a daily basis
with these you know routine incidents
that we all have all the time it's not
it's probably not the right plan and
you're only going to be using it in
those big moments where again your
stakeholders are unfamiliar with this
task every time they're encountered with
it and they're not at you know the
optimal cognitive position to be able to
make the right kinds of decisions that
we hope that they would
and do a couple of closing thoughts
before I end
um just a couple of Boss mode tips for
folks I highly recommend that you commit
up front with your executive team that
you will use every incident to
strengthen your reputation I look at
security incidents as opportunities when
else is the entire world willing to
listen to you
that to talk about security use that to
point to the things that you have been
investing in that you have been building
and if you have been doing all of the
other things that we talked about in
terms of creating content engaging in
community discussions you will actually
have a history of contact information
that you can point back to right build a
library of credible content for yourself
second is that it's really not a crisis
until you make it one how you respond to
the incident matters a lot more than the
incident itself from your executive's
perspective your executives are
concerned about financial loss
reputation loss and Regulatory
investigations right how you respond to
the incident is what impacts those
things
and lastly take care of your IR team
one of the things that is most that I
have found most satisfactory doing this
work is knowing that the less panicked
the executives are the less pressure
there is on the IRT I can take better
care of ir teams and their mental health
and their well-being if I don't have
trigger happy Executives breathing down
their neck
yes so when you're talking about
practice uh do tabletop exercises help
with that can that kind of help people
get into that practice mode yeah I think
I recommend tabletop exercises as a
really good introduction especially for
stakeholders who have never been
involved in incidents before or have
never been involved in incidents at your
particular organization right when you
introduce them to like here's the new
process or here's the updated process
right I think it's important to have
those on a regular basis whether it's
you know biannually or quarterly or
whatever or it's your organization but
again you can imagine I mean you know
how many the resources it takes to pull
together something like that you can't
do that every Tuesday right right but
every Tuesday there's something
happening on your security team that
they're investigating right follow your
plan at least you know to the point of
escalation where it makes sense for that
particular scenario right so that by the
time something really big happens your
executive should be able to do stuff in
one three three with their eyes closed
any other questions
if you're ever in Tulum and you want to
go skuba diving let me know
all right thank you so much I appreciate
you coming enjoy the rest of your
conference
right here
[Music]