house
[Music]
who's excited
one person seven people
thirty percent of the room
okay cool
well my name is Jeremy Bauer I'm the
senior director of information security
at Molson Coors beer
beer some of you are like yeah well I
like my craft okay I get it no uh I
I'm here representing myself not the
company so hopefully well you don't take
it too seriously uh it should be a fun
fun time
I've been doing security for a long time
I've educated I've
practiced and now I'm responsible in
some way for a bunch of goons that are
running around here somewhere so we'll
do our best
so I was told I could have slides which
is really important because I need
slides I don't know how to actually put
two sentences together without slides
you learn this once you get to a level
of director and management you can't
talk without slides
some people know all right cool
so we're here because there's so many
things you could do from a hacking
Community from security from penetrating
things you can do all sorts of wonderful
things you're in the Locking Village
you're doing all sorts of crazy stuff
but leaders don't know any of that and
most of them don't care they're there to
operate and grow a business
right that's their goal that's their job
what's our goal well we got to do
security right it's kind of a cost
center it's a thing that's going to cost
us a ton of money and nobody really
wants to do it so a long time they just
didn't
right they just didn't invest money in
security you did your best to scrape by
maybe you got yourself your firewall
maybe you got yourself some other kind
of EDR investment because someone said I
guess we have to do this somebody said
compliance and some law came into place
and I guess we got to do that too now
right so it's usually a cost
sometimes you can find a product out
there that maybe you can add security as
a value to that product because you're
gonna it's maybe help sell that thing a
little bit more
but it usually is a cost center
okay so what does leadership actually
want from us in the security department
no risk
zero risk
no risk at all get rid of all the risk
your job is to get rid of all the bad
so know what we do
we give them zero trust
no risk if you don't have any trusts so
there you go now we got a bunch of zero
trust out there and of course
there's about a thousand people to sell
you some zero trust
well I don't want I don't want to do
zero trust from a perspective of like we
got to trust something business has to
operate
so what do we really need to do
we want to protect the business right
okay so what does that mean get good
right that's our problem problem solved
no okay get lucky how about that well
that might be more fun but
okay so here's where I think a security
department needs to kind of fill the
right gaps between the things but we
have to protect what counts
so that bad things happen but within an
acceptable rate because we can't stop
everything bad things are still going to
happen
let's keep them down to a low rate for
an acceptable cost
we don't have billions of dollars to
spend on security we don't spend zero we
spend something that's acceptable that's
a job well done that means that you will
have hacks you will have breaches you
will have losers clicking on phishing
emails and you can still go to home and
be happy that you did a good job
right I don't know how many of you have
like tirelessly worked all day long
trying to protect your organization to
have something bad happen and be like oh
I just didn't do my job today
it's not your job job is to do it within
the rate that the business is willing to
accept
how many times do we communicate
what is acceptable and get that back
from our leadership that's what this
talk is about today is to how to fill
that gap between those two things I need
to protect everything so I need to
protect stuff within the rate that
you're going to pay us to do
right
so leaders make risk decisions
we actually hope that they make
decisions because sometimes they don't
make decisions so they make decisions
about decisions and they have a meeting
about a meeting
but sometimes they make decisions and
that's scary
because how many of them are informed
decisions right they're running around
making some decision about something for
whatever value that they think they need
to have
you need to influence their decision
making
we obviously want to be clear on setting
priorities on what matters
so we can reduce the rate of those
things occurring and the impact when
they do occur again it's I'm here to
tell you if you haven't figured this out
shit's gonna happen right
how do we make sure that it doesn't
happen as often or when it does it
doesn't blow up the hole company
so why do we do that
because we actually want to increase
business opportunities I don't know
about you but I think they pay us
they pay us more generally if we have
more money to pay right we want to grow
the business that's our job
but we also want to be clear on the
expectations and the outcomes for what
they're willing to spend on security
and we need to be efficient with that
cost right if why why you spend a
million dollars on this thing if it's
only going to actually produce a small
amount of protection
if I could spend that same million
dollars on something else
that does a lot more protection
or if maybe I shouldn't invest in that
thing at all and I should actually use
that to grow the business somewhere
because I can deal with the risk with
some other means whether that be
insurance or something else
that is not a decision to not do
security
that is an investment decision on what
to do with the money
and we have to get that right on our
side
and be okay with it
so making decisions how to make
decisions made
this is what I call just making it up as
we go along
so often decisions are made with
incomplete information previous
experience which is probably biased and
wrong and biased expectations of what
the results going to be of course we
won't have any issues we put ten dollars
in this and we're going to make a
million
and then the results from that thing are
often not measured completely if they're
measured at all they're not controlled
for any external factors that could have
influenced that decision so they're
really not attributable to the original
decision to begin with so this is going
really well we're going to inform these
decision makers so they can do nothing
and have results made so they're going
to be judged on the outcomes whether
they be good or bad and they're going to
make decisions that lead to bad outcomes
and not think it's them
right so what that means is you can go
you can be wrong completely still get a
good result
you can be right
still get a bad result
and of course you're going to draw the
wrong conclusion from that and I know
this from a wonderful land of psychology
because we can look at how humans make
so many errors in Risk decision making
so here's the top five I stole these
from Bruce Schneider if you're aware of
the security mind that he is but it's
these wonderful things that go wrong
with humans we expect exaggerate
spectacularly rare risks and downplay
common risks the most common risk you
probably all took today was some sort of
travel to get here
for those of you that didn't travel
today maybe it was going by all those
construction workers probably one of the
most dangerous things you probably did
today
right but you don't even think about it
you probably just walked here got in
your car drove on the freeway not an
issue
some people be afraid to fly on a plane
even though it's a far safer form of
transportation because of that
exaggeration
unknown and being perceived riskier than
the familiar so your neighborhood safe
because you know it that neighborhood is
not safe because you don't live there
you don't know what's right
I hate this one so we insecure we love
to do little names for the latest
malware attacks so obviously wannacry
was huge right it's so important because
it said want to cry on it or log4 shell
that's so cool oh my gosh it was such a
big attack supply chain issues
but it when we say it's cve 2021 44228
obviously you should know which one that
one was
anyone know what that one is
no one no one remembers the cves by
heart that's good
I think so it is Vlog for shella it's
one of the three that it had
I'm pretty sure I don't know I looked it
up once
uh we underestimators for us over right
overestimate risks for others because
obviously others being scary and and we
obviously estimate chance based on how
fast we can remember it I don't remember
anybody near me ever winning the lottery
therefore no one wins the lottery or you
know that person won the scratch-offs a
bunch of times therefore if I do it I'm
gonna win two right that's not how we
actually manage statistics or risk or
anything like that but that's how people
react in the world
so what's the result people don't take
risks seriously because they don't know
how to really make a model we can count
one two three we can't count one in a
million we just don't understand that as
a human being and you never will it's
just how we are made it's our nature
so what do we end up doing to
communicate these risks to our leaders
that need to make their bias risk
decisions
we use red yellow green we get red Amber
green whatever you want to call it stuff
we put phishing emails out we do crazy
charts and stuff and we say hey this is
this is this is the risk we got to do
all this stuff
I've made all of these mistakes these
are examples of things that I've done
they're not exact examples right they're
just examples of what the things that
I've done right so I've communicated to
our board of directors with a uh here is
our maturity rating chart with the red
yellow green on it obviously we need to
do more with the Reds right and they're
like what do we need to do next
right and they invested in me
immediately and gave me everything I
ever wanted and that's why I'm here
today
no they say stuff like uh well are we
actually doing enough is that okay uh
well you're a crying wolf you're being
crazy these risks don't actually occur
because they can't think of any this
doesn't feel right there's that gut feel
thing I don't know something doesn't
quite feel right or I need more data I
don't really know if this is right I
need more data it's called the data guy
up and get some more analytics on this
one in other words get out of my office
so leaders don't take the communication
seriously they don't take you seriously
you get laughed out of the room and if
you're not laughed out of the room they
don't call you back often you go like I
guess I have to do it as much as
regulatory requirements suggest
I don't want to be laughed out of the
room because I failed to communicate
I want to be a partner in that room to
help them achieve whatever their
objective is which may mean not doing
the security thing
so it's hard to communicate risk
it's even harder to know of what you're
communicating actually has an effect
right so we have to be able to measure
those things like I said we make a
decision there's some outcome do we know
that we affected that outcome
so or it's affect is it effect affect
something I don't remember does anybody
know does anybody actually have a
grammar on this I haven't figured this
out it's one of those two it's both of
them
there we go so it's it's definitely both
of them that's what I
[Laughter]
I knew there would be at least two
people that are like oh you gotta do
this
effect causes affect
I am affected
now which one is it
right so we want leadership to make
informed risk decisions so there are
business experts
we hope you know they they need to to
compare some kind of decision making and
they take an action they expect us to be
the Security Experts
so we fooled them we're in the room
right but
we've got to actually do something with
that so they're not expecting us to try
to explain to them as if they're a
security expert
they already know that we know what
we're doing they want to be able to have
it explained to them on their terms so
we need to do three things right we need
to provide the appropriate analysis and
models to actually say this is what risk
is
we need to be able to say that in a term
using measurements that can be actually
compared
in a context that the audience
understands
does that make sense I know I use more
English words so
we have to do the analytics that means
we're looking at all the risks we've
done all the modeling we've compared it
we now have things that they can compare
and make decisions on and in in the
context that they understand it
so first using measurements that can be
compared I did in the wrong order you
didn't check
that was the second one
okay nobody cares no nothing okay
I was hoping for the best on that one
let's just
right so what's risk
I use that because we have to measure
things in Risk so what do we measure
risk in well here's the other mistake
that all of us seem to be able to make
right we don't get our straight we
say it's probability your impact or
likelihood and consequence or find your
vulnerability times Threat all these
different things together and it creates
the 4x4 chart it's not four by four it's
five by five or some other kind of
wonderful color map you just put in Risk
analysis and put it on Google that's
what you get right there's a bunch of
garbage all of this is nearly useless
it's not completely useless just nearly
useless completely useless would be like
I don't know just picking all red for
everything
so
remember there's a flip side to this so
it's not just risk it's also
opportunities so people use it in the
opposite way right
glad you all read that too all right so
everything ends up being high risk if we
care about it it's going to be the Red
Corner it's going to be the high risk
high impact or maybe one of the two that
are right next to it but not a whole lot
that we can compare it to
so if we do a little bit more analysis
and do things like we can look at
different analysis models like risk or
sorry fair is a great one there's other
kinds of things that are out there like
that but we can break these things down
a little bit more into things like
vulnerability and threat is affecting
your frequency your loss magnitude is
your asset value and you kind of combine
those things up together and you're
going to get some idea or some
measurement of risk
understanding that you have to
understand the the strength of the
threat that you're facing or what threat
you're facing
you have to know how good your Defender
team is at spinning plates and I thought
that was wonderful that was my favorite
one
uh you know I know what kind of controls
you have against those vulnerabilities
and of course the actual
asset value that you're looking to
protect one of the guys I used to work
with some of these guys will know this
guy he used to call it the doodle server
do I care about anything on the right
the vulnerabilities the threats all the
different loss event frequencies if it's
the server that draws doodles
if your job is to protect the doodle
server and it's worth a million dollars
worth of I don't know generative AI art
or something like in the other room
maybe that's worth something
not so much worth something for me right
so the other thing is that risk number
it's not a number we can't just say risk
is a seven this is a seven it's like
CVSs scores does anybody who like those
you love them
why do you like CBS escorts everything's
a 10 if it's not a 10 it's a nine and
what's the difference between a nine and
a ten I don't know
you gotta you got to do something about
it that's what it sounds like to be
right
and of course what is a CVS of 10 on
site of a box that's inside of another
box that's not even put on the internet
should I do that one first or should I
do one of the sixes that are on the
internet I don't know
so risk is a range so using some of
those wonderful analytical models that
exist out there uh so fair is the one
that I kept going back to we can kind of
calculate some uh possibilities or
probability ranges like we think most
often that this is going to happen
between a thousand dollars and seven
million dollars and we can actually do
things like Monte Carlo simulations
there's a wonderful book called how to
measure anything or how to measure
anything in cyber risk particularly
that'll help you develop these things
but it gets us to a point where we can
say
this is what we think risk is as far as
a range we know that the risk is here
and now we can have the opportunity to
look at different options so okay cool
this risk has probably a five thousand
dollar impact most likely going to
happen but it has a very high
possibility of a top impact being seven
million dollars whereas your second
choice more than likely when it gets hit
it's going to cost you 50k that's a lot
of money but it's top end is five it's
only 2 million
so which risk do you want to take
right those are the kinds of options you
can look at when you look at it as a
range and not just a single four by four
square
uh I'm going to skip this but if you
haven't ever seen this before it's a
fantastic thing all right so providing
appropriate analysis and models so going
back a step
so where's our sorry what was that
I just heard something in my ear never
mind
um security manager tools of the trade
so what do we have for our risk
assessment models so we got fear
uncertainty and doubt that's a great one
it's always fun right we have our
program maturity metrics and we also
have our control framework so we have to
hold on to because it's the only way we
know how to assess our programs so the
fun thing is useless first off it's now
actually a problem for people that are
my peers uh so we call actually a guy I
talked to the other day called it the
Apple news problem and that's when his
CEO calls him based on something he saw
on Apple news and says what about the
this we got to do something about that
AI we got to try we got to turn off the
chat GPT tomorrow because it's going to
take over our business or something I
don't know the Terminator is coming
so like these things happen but they
don't provide business context and
they're mostly just noise in the
background it doesn't provide any
business context as to risk to you or
your your company
so let me go into the assessment 101
stuff and that is your cmmi which is
your maturity model there on the left or
on the right you have the CSF or this
this cyber security framework those are
the things that hey we got to do some
kind of control framework analysis and
say this is what the controls that we
should have in our company you naturally
assess against all of them and find that
you aren't doing all of them effectively
so how much risk is there
it's almost it's all the risk you should
do all the risk so we end up doing stuff
like this so we look at access control
as a general item that's under the CSF
and I've totally done this uh we have a
three out of five maturity we obviously
want to get to a four and we have 86 of
147 controls implemented we should
Implement more of those we need to get
an IAM system that does that it's going
to enable 10 more controls and it's
going to increase the maturity right you
should buy three today
what do we get well it's kind of
promises first off whatever the
investment is that you're getting back
is probably not going to meet the
objective and even though we're
measuring something it's not consistent
so what do you get from that doing
everything everywhere all at once you
get back from your leadership well what
should we do what when are we going to
get there and how much does it cost and
you probably don't have a good answer to
any of those things at least one that
you can predictably say this is what's
going to happen
right there's a stock photo okay
so what do we have we have risk
assessments control assessments pen
tests program maturity like and all
these different things that we're doing
and I'm not saying don't do those
you need to do those things but they
inform you as a security team your
strategy for what you should focus on
for developing control options for
developing protections for actually
responding to things these are the ways
in which we as an internal I.T group
need to look at those things that is not
how the external environment the people
that are probably controlling the purse
and developing the strategy for your
company needed to look at it they can't
look at it that way there's just too
much information
so we need to provide something simpler
protection options with an understanding
of what the actual risk is or that
expected loss exposure for those options
and then they can kind of choose from
within that range
this is one of those things where it's
like it's one thing to say that hey I I
controlled your vote but it's more
easier to control who you can vote for
right I don't care who you vote for as
long as I control the options you ever
heard that
right
so here's some options
Executive Board member executive leader
right I want to say we're hackable for
30 days because we aren't patching
within 30 days we expect to lose forty
five thousand dollars a year because of
these patching issues
it's going to be one weekend outage per
month because we have to shut our
Systems off to patch them and it costs
you five hundred thousand dollars
annually for that amount of mitigation
I bet if you could actually say that in
just one sentence for anything that
you're doing in security you're already
a leg ahead for most programs
I doubt that most people can actually
take a tool that you have look at the
control that it produces and say what
amount of risk you're reducing
let alone give someone multiple sets of
options
can you imagine this like if I went to
the executive team and said hey uh
you're available for 30 days of hack to
be like oh what did we say we said zero
risk we're gonna go zero days a hack how
about that one well that's not possible
I can give you one day a hack for 20
million dollars where it could have cost
you 500K
would they sign up for that
I don't know
that's their choice
when you start presenting things in this
option they now have options to choose
from and they might say something you
know I see it's one and a half million
for 15 days
I really think that we only have like
750k in the budget but I want more than
30 days what can I get for 7.50
what I just got was a 250 000 increase
to my budget
does that make sense
not amazingly different
so these things are called protection
focused like outcome driven metrics so
we can look at the level of protection
or the actual loss exposure that we have
the expected business impact which
includes friction like we're going to
start shutting stuff off people are
going to be pissed off at you or they're
going to change how their behavior is
and also what the costs are going to be
we put all those things together and we
kind of make an agreement with the
decision makers as to what they are
buying into and we can call those
protection level agreements we've done
service level agreements in I.T for
years there's nothing wrong with the
idea of a protection level agreement
with what we're actually trying to
attain here so we're going to spend five
hundred thousand dollars if that hack
comes in on day 15 for a zero day
I said at patch in 30 days we're taking
on the hit right that was our agreement
that's what you invested in
if it happens on day 31 fire me
because I didn't do it within the
agreement
it's pretty straightforward now I can go
to sleep at night
so now I have to do it in the context
that the audience can understand
I've been looking for understanding and
most of you are looking at me with blank
faces so you're looking just like my
leadership team this is working well
that means I've done a poor job at
communicating
so it's okay to be basic
right so we we go back to basics
security can be boiled down to the CIA
this confidentiality Integrity
availability
anybody gone through security and
understood that the CIA Triad right is
anybody clueless to that it is that
basic because when we communicate that
in business terms it's data breach
it's the business process reliability or
some kind of safety concern because your
data is being manipulated
or it's business process failure it's
not available it's that simple they
understand those things they understand
that there's a cost to a data breach in
the trust that it loses they understand
their process and what it means to I
don't know poison the water supply
because you didn't appropriately protect
your water filtration system
right they know what shutting down the
packaging line means
they also know what happens when if I
say hey guess what all your private
emails are posted online now sorry
right that's a confidentiality thing
everyone understands these things we
just need to turn it in language they
understand
so it's not technical so let's go back
to our log4j example obviously it's it's
a couple years older now but it's a good
one because I think it was pretty
impactful most of us had to do some kind
of crazy running around to try to solve
that one as a big zero day
so I'm going to go into the room and I
want them to understand the risk so they
can make some decisions what do I want
them to do I don't know Choose Your Own
Adventure maybe I want them to approve
downtime in the service or maybe I'll
need them to approve a new control that
could have dynamically blocked it I had
some fancy laugh I wanted to buy maybe I
just needed a team member or something
else right I want you to lobby for an
s-bomb because I could have known where
all my stuff is then well whatever the
thing is that you want them to do you
have to influence the decision so of
course you walk into the room and this
is what you do there's a crazy new
attack and what we got is here well you
know it's part of the components of the
analysis of the tool and we can't tell
which ones they are and some of the web
services are they got a problem and we
got to disable the log 4J piece or maybe
we've got a patch it we're not quite
sure if we can take the town so we got
this other thing you know like
we start going into the whole technical
details of why this attack happens and
you get
what right that everyone understands no
one can understand that stuff from a
business perspective
so what we could have done
so we have a primary sales portal that
is vulnerable and at risk of immediate
compromise due to a discovered
vulnerability that is already being
attacked what does that say that gives
us our event frequency we know what's
happening now
and it's on something that we think High
matters cool
realizing this risk will disable our
ability to take orders for weeks it's
probably going to breach our customer
contact data risk further incursion into
our Network and cost probably load
single digit Millions
oh that's a pretty big magnitude
let's put that together
okay what's the other business contact
of the asset well we know that this
portal currently takes in order Account
Processing of about 400 000 a day it has
about 10 000 customers in it more impact
stuff we also know that maybe we can
only survive without it for about five
days before we no longer have orders to
process so more asset value more impact
information that helps them make context
as to what is at risk for the business
so then we have to give them options and
we can give them some impacts decisions
on the options too right so they think
that this is gonna this recommended
action is going to cost you fifteen
thousand dollars plan downtime at 24
hours which you can interpret as that
means four hundred thousand dollars in
orders are not getting taken tomorrow
right put it back in business contact
terms now we have to give them more
options than that we don't want to just
say hey we can take it down we could
also see well we could invest in this
tool and that could do some Dynamic
patching or maybe we can disable this
feature we can go into the code and
disable the log4j option you know it's
gonna take some coders I need to go get
an emergency statement to work and you
can find thousand ways to go and solve
the problem that's your job you are the
Technical Resources of the world that
can go and get this done for a cheaper
amount but someone has to make a
decision we got to give them options
right more decision impacts
so lastly we have to know our audience
so let's see we're on time got four
minutes perfect so first most of this
has been centered around the executive
staff people making budgetary decisions
as well as people like board members if
you ever get to being in a public
company with a board
they have different needs but most of
their job is to take risks if you're an
executive team member and the board is
to monitor those risks that they take so
that they're not spending all of the
investors money unwisely right that's
their their call so they understand how
to make risk decisions because they make
them all the time you just need to give
it to them in their context and you're
going to be golden
that's not everybody else like the rest
of us plebs here right we're not trying
to make decisions like that we're just
trying to make things that get us done
through every day right what's the right
amount of work that I could do with the
right amount of laziness that's the way
I like to think about it because I don't
want to do work harder than I have to
so I don't want to talk too much about
security awareness training but
understanding that we're trying to
manipulate people's behavior when we are
doing risk uh communication so one of
these things if you've ever seen this
before add car it's a wonderful
wonderful tool for helping with
understanding where we're trying to
change behavior in a culture
so we have our wonderful fishing guy I'm
going to skip over that just running out
of time uh user communication you want
people to make change fire them
why does firing somebody work at some of
these bigger companies
anybody know
because no one wants to lose their job
how about that one right that suddenly
makes a big deal right so-and-so clicked
on a fishing email lost their job no one
wants to do this no one actually wants
to fire anybody for clicking on a
phishing email and it has been discussed
at other companies and I know other
companies do it I think this is stupid
but it's right about one thing and that
is people will make risk decisions based
on the context of themselves
if I know if I click on phishing emails
and I'm going to get fired and I need
this job I'm not going to click on
anything right
so what's I think is better is try to
provide more tools to inform people
about the decisions they make I don't
believe that people are intentionally
malicious I think they make mistakes we
need to give them tools to help them not
make more mistakes so we talked a little
bit about that in the last last topic so
I'll just leave that one alone
two other pieces to that notion uh and I
encourage people to go look at them and
it's about user motivation so we went
back from something like uh Kurt lewin's
an old psychologist from the early 1900s
talked about a force field analysis how
people make decisions based on what they
can see immediately around them they
called it like the the life space
so people don't have Infinite Experience
they take some training they may forget
it whatever they are doing they're doing
it based on what they can see around
them you need to make an environment
that says we don't click on stuff here
or we report stuff here or whatever you
want them to do it needs to be around
them all the time and lastly looking at
something like Daniel Pink's drive
around Mastery autonomy and purpose
people's intrinsic motivations are far
more powerful than an extrinsic
motivation like here's five bucks or
here's a cyber brick or some of the
other stuff that you try to do
so why do I say that because we need to
modify their behavior
we don't modify Behavior starting with
the person we start with the environment
the life space that they're in
if people around you are modeling the
right Behavior people follow that
behavior so that means communicating
with people managers and understanding
that they have an absolute
responsibility in managing risk and
understanding what their responsibility
is modeling that behavior communicating
with HR so they know how to
appropriately correct misbehavior when
identified and of course encouraging
those same executive leaders to
establish it from the top right so it
goes It goes all ways and lastly I think
because of that intrinsic motivation
this is the way I look at it let the
user do what they're going to do
that five-minute training that
everyone's required to take on fishing
is probably not going to do the trick
we need to think about all the
interactions that we have with them
every single day and modify them so that
they do the right thing because they
have the information in their hands or
because it's just easier to do it that
way
if we don't think about the users like
actual acceptance of whatever product or
tool or control that we have in place
we've probably done something wrong
right
hopefully that's that's useful so that
was my last little bits of stuff because
we can always turn off the internet
that's control one control two is email
is not a critical service all right
great thanks very much
[Applause]
so all right thank you very much
hopefully you didn't take this too
seriously
nobody did you're like yeah good because
now we can get prizes and stuff it's 4
30.
thank you
[Music]