[Music]
I'm Robert Wagner and I'm going to be
talking to you a bit about overcoming
the cyber security poverty
line uh just a quick introduction so
Robert Wagner uh Mr minion on the
failing twitters and and whatever else
might be trying to replace it um I've
been an advisory ciso for quite a long
time uh now um so that means I'm usually
advising clients um on their Security
Programs not so much uh working on my
own company's security I'm a Founder for
hack for kids it's a charity that
teaches kids about uh security safety
and ethics we're actually going to have
a kids village here at the conference
tomorrow so um if you brought your kids
are going to have a great time uh I'm a
uh a board member of the Chicago chapter
of the Issa uh and as you can see I love
all things dogs and motorcycle scuba as
well but uh that was my dog can you see
it yeah uh that was my dog rocket he
rode with me for 14 years and thought he
was the fastest dog in the world uh so
um but getting on to this talk so what
and I wrote this talk uh for executives
in particular do we have many execs
actually in the audience awesome great
to thank you for coming um and I wrote
it because as many clients as I've
worked with I keep
seeing especially new to the industry or
new in a managerial role Security
leaders making the same mistakes over
and over and over again and and I don't
know why I did
that
there we
go
no percussive maintenance
Perhaps it
is it's it's just a hard angle to
get it's on
the
and it's on the little screen on the red
box there we go all
right uh so uh and what I've noticed is
a lot of execs don't go to conferences
like this right where do they go like
RSA who who remembers data connectors
when it was around yeah and what's wrong
with those conferences I mean they're
not the worst thing in the world but
there's one thing in particular that I
notice when I so you usually get on the
list to go to those conferences for free
the moment you sign up for like security
magazine or security weekly or uh or
ciso uh uh magazine or something like
that when what anybody been to one of
those conferences before data connector
stuff like that yeah no all right so yes
so uh what did you hate about data
connectors uh too many vendors yeah
exactly it was almost all vendor talks
now some of the vendors I love because
they were great in that they gave usable
information and that was fantastic uh
but a lot of times um they didn't and it
was just a pitch for their their stuff
right um and that doesn't help anybody
uh it was only when I got to go to my
first hacker conon that I was like oh
yeah there's actually a lot of good
information out there um so uh but cesos
um other Security leaders often don't
come to things like this so they don't
know the things that many of us know so
I wrote this for them um if you're super
deep in infosec and you've had a lot of
experience you're not going to get a ton
out of this talk I do have a few gems in
there hopefully for everybody uh but um
but it is it is meant for those just
starting off in their career um and it's
because I think there's a better way for
every everything and so I'm going to try
and hopefully teach uh those those folks
that are just starting off for that so
um I keed in on the cyber security
poverty line uh which uh was a a phrase
coined by Wendy nather if you don't know
Wendy nather you need to get to know
Wendy nether read her writings she is
just phenomenal are we still okay or no
yeah all
right should I keep going or wait okay
um
Wendy n wrote about this back in 2010
and it was because she was realizing
that while most of the large
corporations out there at least had the
budget to do security there's a bunch of
organizations that don't have enough
budget to even do the basic hygiene of
security and that's ridiculous they're
fighting a losing War they it's not even
possible to win and while this talk
isn't going to be able to um be a silver
bullet that will raise you above and
you'll be fine no problems at all
hopefully it will give you some ideas on
how to sort of stitch together things
until you can get perhaps more budget to
even prove your point um and proving
your point is important Wendy breaks
things down into four primary categories
or hurdles why a lot of organizations
are below that poverty line it's not all
just money so money is certainly a big
part of it getting the budget isn't
always easy especially at smaller
organiz ations but it's also things like
not having the expertise not having the
capability and by capability she
literally means not being able to
actually do the implementation of
whatever is you're trying to do for
whatever reason maybe you don't have
control of the assets that need patching
for instance or something along those
lines um and really one of the big ones
is influence a lot of managers senior
leaders in
invos maybe came up through the
technical ranks and they don't really
know how to communicate in terms of
business that will get them the
resources that they need so we'll talk
about that as well um but let's
understand what impact this is having on
small to medium Enterprise in the first
place um uh a attacks to small and
medium uh Enterprises make up about 46%
of all attacks out there and for good
reason they're easy targets right um
people have been moving in this
direction for quite some time especially
as larger organizations get more and
more hardened they're finding it's easy
enough to get what they need out of
going for small to medium Enterprise so
that's become the target um and while
that talk May that uh breach May cost
them an average of 200,000 which for a
large organization isn't that big of a
deal it's a rounding eror right it
causes 60% of the victims out there to
go out of business um I I I think only
CO's been worse on putting people out of
business right over the last couple
years so this is a serious
problem um so in an effort to fix things
you know we always look at our our great
Tri who here hates this diagram I hate
this diagram right um yeah so way
overused but it's I bring it up because
it's important and it's and I hate it by
the way because it never freaking looks
like this right we never have this
wonderfully balanced Zen diagram instead
it looks like this in most organizations
right right um when it that's usually
the answer that most small companies go
well we'll just buy a widget we'll buy a
blinky box whatever and unfortunately
when you only focus on technology a
Mickey Mouse organization is really what
you're going to end up with so we're
going to try to avoid that I'll have
some technical tips as well um but we're
going to start with people um it is the
most important place to start and
there's a lot of things that can be done
here right so the first big problem that
most small orgs complain about is Talent
is really hard to find is it really
though let's let's talk about ways that
we can get around this mindset of talent
is hard to find one of the first ways is
not every small org needs a full-fledged
ciso but they may need someone with a
little bit of knowledge some leadership
skills and the ability to talk business
to get things communicated correctly and
to even understand the whole compliance
um landscape right a lot of companies
that have to deal with compliance that
don't have a good leader take the wrong
approach to compliance every audit is a
negotiation that is the first thing you
need to learn when you're doing
compliance when you're having to answer
compliance Auditors is everything is a
negotiation everything and a good leader
will understand what things can be
negotiated what things are more set in
stone and be able to deal with an
auditor and if you if you seen a lot of
Auditors they're just trying get the
boxes checked off right A lot of them
don't even understand why it is that you
have to comply with the thing that
they're saying you have to comply with
it's just they know that they're
supposed to do it if you can come back
with a good argument saying well I've
got some mitigating controls let me show
you them a lot of Auditors if you
explain it to them well enough will
relent and and uh change their tune uh
to allow for mitigating controls but an
inexperience infos team and A lot of
times an in experience expen infotech
team really means it people that have
been tasked with doing the security
stuff right yeah you've got a lot of it
people at small manufacturing firms
who've been told um we need to be
compliant we need to be secure can you
do that too because they have lots of
free time as we all know right um so
what you want to look for in a virtual
ceso first of all they need to speak in
business terms and the first thing they
need to know in business terms is how
your business works if they show an
aptitude for that if that's some the
first questions they're asking when
you're interviewing them you're on a
good path um but they should also be
have some experience with incident
response um in particular s cyber
security in general but that goes
without saying right they should
understand compliance and then they need
to create realistic objectives and
vulnerability objectives because we all
know vulnerability patching is the bane
of our existence uh you can't patch
everything but you can patch what's
important right and and and a good
leader will be able to kind of weed
through things and go okay I see what's
going on here I see what's important to
the business let's target that first
we'll talk a little bit about vulnerabil
but the second thing you need so get a
good leader in place doesn't need to be
a virtual ceso can be you know manager
it could be an IT manager whatever it is
but you need to have a manager that's
going to be very strategic they need to
focus on empathy and mentorship and and
by the way the reason I say stop chasing
un orns is because at that level first
of all you probably can't afford the
unicorn but just as importantly how many
folks do you how many unicorns do you
know that are complete right I
mean they yeah they know their but
do they cooperate with anybody no do
they even Mentor anybody no they'd
rather not um sometimes it's not because
they they may be neurod Divergent too
and then they're not an they
just don't know how to play the other
reindeer G games right but for whatever
reason um they're not really up on the
kind of mentorship that you need in a
small team and this is key I I I knew a
small office a large office supply um
company here in Chicago uh that had a
osic team of six people right they had a
great leader and that leader saw it as
his job to lift his people up more than
he lifted himself up right he made sure
that his team looked awesome and in and
and then encouraged that team to sharpen
each other steel Sharp and steel this
team did nothing but show each other how
to hack how to write code how to
automate how to create rules um and they
did it with such Joy because their boss
made their job so easy they didn't have
to worry about negotiating all the
political that you have to in
business right he made sure that his
team was seen as valuable and they got
to do so much there right I mean
literally to the point of one guy was so
good at coding that he wrote his own um
uh sort of ring zero piece of code for
the point of sales things to fool
malware when malware got in situation
give it the wrong registry addresses so
that that malware couldn't affect the uh
the the point of sale devices so
freaking clever now he was a bit of a
unicorn but he was the kind of unicorn
that showed all of his peers what he was
doing and it was fantastic so so with a
couple of good leaders good empathetic
leaders in place um you then create an
army of folks that you can afford right
so that could be interns it could be
temp to hires great ways to get started
because what you're looking for is not a
laundry list of all these technical
skills I I mean how many of us are sick
of seeing job wrecks right now that are
like oh yeah you need like 20 years of
experience in a tech that only started
three years ago right um it's ridiculous
it's a a big problem because HR people
don't understand what the infosec people
are asking for so they write these job
wrecks that are just freaking ridiculous
what you're looking for are people that
are eager that want to dive in something
and have a bit of that aptitude to do
security with an intern or attempt to
hire you're going to know pretty quick
whether or not they're the kind of folks
that really want to play in this sort of
specialized way that I'm describing and
then we just need more entry-level
positions there is a ton of people out
there looking for infosec jobs they are
good talented people I meet them in the
community all the time but they can't
get that first freaking job to get
started so as a as a small commun you're
in the perfect position to higher entry
level positions and train them up you're
going to nurture them let's talk a
little bit about what that looks like so
nurturing Talent from inside and from
without so um from without right these
are these new people you're bringing
bringing in but you need to create this
culture of mentorship and sharing that I
just described with that one team and by
the way that one team of six people when
they merged with another office supply
organization that had over 30 infosec
people who did not collaborate in this
way who were basically just um push
button you know they were the mcse
equivalent of like infc people right
they they they knew how to run this tool
or that tool but they never really dug
into anything any deeper the way this
other smaller team did um and they
outperformed that team uh by factor of
10 at least it was amazing what that
collaborative team could do um now one
of the biggest complaints that I hear
from a lot of organizations is if I
train them up they're going to leave
yeah that's right they're going
to leave your job as a leader is to
treat them so well that they stay you're
still going to lose some anyway but what
you're going to do is you're going to
find a couple of team leads in that
thing that they'll be your hinge pins
right make sure that they're going to
stick around you're going to lose some
people you're a small to medium
Enterprise just deal with it
right because at the end of the day um
if you kind of keep this cycle of PE new
new talent coming in you'll find some
people that want to stick around you'll
find some people that will probably
become unicorns and they'll be paid
ton of money to go work somewhere else
and that's okay you got what you needed
for and by the way what you're feeding
back to the community is priceless um uh
one of your biggest jobs with them is
going to be to do what that one manager
told you is is to justify things to the
business and that's going to include
that training right a lot of tech people
just don't know how to communicate their
their need and desire desire for
training in business terms that make
sense you know what does chat GPT I had
actually gone to shukan and I I'd found
several friends that were like my boss
is asking me for justification to come
to hacker con they'll send me to RSA and
it's no problem but I need to write
justification for oh not again um for
justification to go to a hacker con so
I'm like oh I should be able to help you
with that and then he went hm
they both got to go to hacker cons based
on the Chad GPT yeah yeah it was easy
peasy so if Chad GPT can do it as a
leader you better be able to do
it because these people need you so
badly and they they just know how to
communicate that so what do you think
the first conference I ever went to was
hacker hacker conference I went to was
take a guess anybody shout it out yeah
right that's what I wanted it to be um I
was a brand new sock analyst third shift
I went to my boss and like boss I really
want to learn more can't I go to defc
con my B saidwhat that and I said it's a
hacker conference in Las Vegas it's so
cool it's
amazing
denied so I was frustrated I'm like I
got I got to get something and some one
of my friends said you should go to
shukan I heard about it last year it's
really cool it was shukan 3 so you could
still get tickets right
um and I I I I went boss can I go to
shukan for training can I spend my train
shukan he's like what's that I'm like it
is an information security conference in
Washington DC it's quite
good approved I me almost instantly
right I had to learn the hard way uh and
by the way my boss was great he just
kind of didn't know that space that well
once they are actually I was working for
a large bank at the time and once they
saw how much better the team was by
going to things like that they got it
and they supported us but I I kind of
had to break the mold first and get us
there um but at this point your your
your analysts your first tier folks they
shouldn't have to figure that stuff out
for themselves that's part of your job
as a leader is to show them how to put
their value in terms the business can
understand um and then there's also not
only do you need to encourage you need
to be enable um your folks to take part
in the infoset community as an Issa
board member I've asked many people in
my community hey I why don't you ever
come to is to say and most of the time
if if especially if they're newer in
their career they're like well it's at
300 p.m. my boss won't let me leave at 3
pm to go to an infos Meetup which is
just freaking ridiculous right um so
allowing them to participate in the
community and it's critical I've been a
blue teamer all my life I go to regular
meetups in Chicago where I know a lot of
red teamers and for the price of a beer
I've become a better Defender and by the
way all my red teamer friends are bored
out of their freaking Minds because they
pretty much get you know they fish their
way in they've got domain admin and
couple hours maybe a day or two it's the
same story they're bored out of their
minds but because I get to actually hear
about the tactics and techniques they're
using to get in I'm a better Defender
and I can advise other people on their
defense as well and then last but not
least don't be afraid to look for t i
you know I know some companies get a
little sore when you like steal an IT
person to come where for the the
security team but those employees are
probably one of your most valuable
assets they already know the uh the the
architecture they know the systems
recruiting a couple of those folks over
to the dark side we have cookies here in
infac right um recruiting a couple of
those people over is another again quick
way to get some quick wins if you're
trying to build a security team up as as
a first-time security
leader um and then the other thing you
need to do is you need to figure
out how to leverage diversity hiring
right there are so many people both at
the leadership tier that you could be
recruiting but as as you know
entry-level analysts as well and we're
doing a really bad job in diversity
hiring right now right so investing a
little bit of money into some diversity
hire hiring training would be great um
and part of that's going to be learning
stupid ass things in language that we we
all do uh that a lot of um uh job wck
Writers Do
um to find out that things like
self-reliant or lead in your verbiage
just is coded Sig signal masculinity to
to sort of make um women feel like this
isn't the job for them isn't obvious you
don't understand this when it's been
part of your language for a long time um
words like energetic can deter older
people
which if you can get someone who's got
some experience but is looking to maybe
maybe head towards their um their
retirement and take it easy the last
couple years of their career you're
you're denying them even the thought of
applying for the job um and when it
comes to applying for jobs too e that
that laundry list that I talked about of
all those requirements is really holding
women back in a serious way
statistically men will apply for a job
if they think they've got about 60% of
the requirements on that laundry list
women will wait until they find one
where they fill
100% of the wrecks right um and it it
it's so we just got to get rid of those
um Alysa Miller gave a talk uh at bsides
Rochester her suggestion was brilliant
you know these ways uh these days if you
see the way a job wreck is written you
usually get a what you're going to be
doing for the company right um maybe
what your um you what your degree or
something uh or minimum level of uh
expertise should be but then you get all
these other things that you're supposed
to be experienced in she suggested just
cutting that out get rid of that stuff
it's it's not who here doesn't know how
to learn to use a new tool right
we that's why we're good at what we do
we know how to go oh this is a new tool
this is a new security scan okay yeah
okay I see that oh that's why'
they do that and the rest of this is
great right we know how to use tools
that's not what's important in your job
hiring so use specificity talk about
what the job will be doing not all the
little things that you you should have
experience in that are just
ridiculous um then do other smart things
evaluate those resumes blind get a
diverse panel both in the reviewing and
the processing uh and and the
interviewing process um and then have
very structured interviews and
scorecards that means don't let people
just wing it set them up so they're like
okay these are the things I'm supposed
to ask about and this is how I score the
things that I'm asking about give them
the guidance um there's a
there's actually AI out there now to
help with diversity hiring that will
check your job descriptions and if
necessary rewrite them for you to get
rid of that language now I was talking
uh to uh a a woman in the industry was
like who was like oh well I'm not sure
if I'm comfortable with that I don't
want to give the hiring managers the
easy way out right I don't want them to
go oh the AL write it and I'm still a
jackass right so so don't don't use it
that way use the tool to inform yourself
write write a job wreck run it through
the AI and see the changes they made and
understand why that's a great way to
really learn quickly how to adapt your
language to diversity higher and then
also consider some non-traditional
backgrounds I have know some of the most
amazing infos practitioners I've known
were also musicians were also artists
the musicians ones actually made a lot
of sense too uh because m music is math
right music is math and patterns so it's
not uh it's not too easy to understand
why they may be really good at uh at
intrusion detection or reverse
engineering but a lot of iron managers
will see that kind of background instead
of the traditional engineering computer
science background and go oh yeah what
can they possibly bring to the table
right but no these folks are amazing um
and you shouldn't be counting them out
just because they don't have a
traditional infos background um and in
fact Nanny's too so one of the most U
amazing practitioners in Chicago she
just got into the field um after working
as a nanny into her 30s she's a freaking
machine oh my God I can't believe how
good she is and she's only got like two
years of infosite experience at this
point just amazing so don't discount
those hires um and there's good and
there's other good reasons why too so in
business we see lots of quick gains from
diversity hires companies are doing
better financially um you know 36% uh uh
profiting other companies by 36% um 19%
higher Innovation revenues if they can
do that for the business side of the
business wouldn't that fresh perspective
do the exact same thing for the way we
think about defending our own
organizations um so to help level those
people up though here's some free
resources um to because we can't all
afford to go to sand certainly not any
oh man it's gotten really expensive
right I mean when I was going for $5,000
for Sands what's it up to now what's uh
what's the going rate at a lot of s
classes I've heard like eight six to
eight yeah I mean it's tough I mean
still if you can afford it still let him
go um when I was working for the bank PE
uh you know the boss would be like well
like three people can go this year and
three people can go next year so we'd
all have to queue up for uh for some of
that training it's good training but in
in the interim cisa has a really decent
toolkit um cyber Readiness Institute has
whole courses laid out for medium-sized
businesses to become cyber ready sanss
themselves have even given back to the
community love Sans um um and created a
a course and it's um it's it's geared
again towards um folks like vets uh
other underrepresented people um in the
industry to kind of give them a leg up
in the field um and uh and then I don't
need to tell most of the people in this
room but for anybody watching the
recording bides is free or like a
nominal 20 bucks in and it's in almost
every major city except you know
Milwaukee which already has an off
awesome conference but um but you should
be encouraging your for the price of
less than a sand course you can usually
send your entire team to something like
bsides right and then there's some awes
actually really good vendor training out
there aws's Security Essentials on how
to secure AWS is really good um
investigating with spunk which I used to
teach is really good if I do say no it
was really good they there there's
vendors that are putting together good
training um qual a certification
training to get folks um who who may be
doing uh vulnerability scanning for the
first time these are all valid uh
classes that will teach you the stuff
you need to get going right it's not
going to make you into your unicorn but
it will get your team leveled
up um I also want to introduce a kind of
a especially for small teams like this
the concept of a fusion sock so how do
we usually if you can afford to have a
sock at all right but if you have a sock
how do we usually structure it we've got
tier one right those are the first level
analysts they're ripping through tickets
trying to get through as many as they
can they usually have over 100,000 in
the queue and they can get how how many
can an analyst get get to in one day I
think the average is like 10 10 ticket
10 10 where they actually have to do
some investigation right um the uh if
it's obviously a false posit or
something you can usually dismiss that
quickly but they can work about 10 real
tickets a day um and they've got 100,000
in the queue it's just ridiculous um so
now there's strategies for pairing down
your queue too but um but we're talking
about the people at this point so
instead of having a tier one tier two
tier three which does what to your tier
one analy by the way it burns them out
right it makes them not want to stay and
we want them to stay so instead of
making tier one tier two tier three
structure the jobs around tasks oh I
need you to investigate fishing stuff oh
I need you to do a little bit of threat
hunting oh I need you to do this let
them get good at it give them a few
months then rotate have the person that
was just doing it teach the next person
oh this is what I do when a when a
fishing ticket comes in and then they
get to learn something new and they get
to learn something new this is a quick
way to start leapfrogging your talent
level as each analyst helps teach the
next one um having them present at
conferences is another way to make them
really good teachers too so encourage
them to submit for things like this as
well but as you rinse and repeat you'll
quickly see not only better analysts but
happier analysts they won't be so burnt
out working fishing tickets oh over and
over and over again till they cry um and
I who's been there I mean who's actually
had to have a job like that right where
where it was just the same damn ticket
every you know pretty much day in and
day out it it
sucks um so uh so then as far as their
employees themselves it so we're still
looking at stats of 45 employees still
not receiving any sort of security
training from their employer at all in
this day and age um it's just ridiculous
and it's ridiculous because it's free
these days um
62% uh don't uh don't know uh do enough
security awareness training to actually
receive then any benefits so having
someone watch that stupid freaking
security awareness video right that we
that's so boring we'd rather rub eyes in
our GL glass in our eyes um is not
enough uh so not only they have to have
security training but they need to get
it regularly enough and it doesn't have
to always be the freaking videos um if
you're a security leader if you're a
leader in organization at all and you
get one of those little text message
that says hey I'm in a meeting and I
really need you to go and get some gift
cards and and then re right how many of
have you gotten that text message yeah
if your employees haven't seen that yet
copy that and say hey we're talking
about a small organization right copy
that and say hey folks I just got this
and I want to show you what kind of
things you should be on the lookout for
this is if if you're not doing fishing
on your own Folks at least show them
when you're getting fished and say this
is the kind of stuff that's going out in
the um in in in The Ether right now be
on lookout for it um so here's some free
awareness training resources um and I'm
so happy that back uh that black hills
information is here so their backd doors
and breaches is a free tabletop exercise
Dungeons and Dragons Style um with and
cards and they're here like the decks
are are right like right across the hall
so go get them before they run out um
but uh but if you want to do some free
tabletop exercises you don't have time
to create your own this is fantastic um
but there's more so Amazon does their
own security awareness training for
their employees they have made that
training free on Amazon Prime you all of
your employees can take free security
awareness training directly from Amazon
and it's the same same stuff they use
for themselves so you know they didn't
chint on it it's not bad and you know
it's still not the most exciting but how
do you make secur anywhere stram I don't
know um um but it's quality um Google
has similar um there's a mobile app
based one called Ed app um I I I think
they have a premium model so you get so
much free and then like if you want to
start scaling it or something like that
it might cost you curricula has one and
then um I love idea of gamifying
security awareness uh so um not not only
do we want to make security awareness
more personal and and I highly suggest
if you have people inhouse that can do
things like just teach people how to
secure their own wireless router do
other little things like that make it
personal to them they will pay much more
attention to the other security
awareness training that you're giving
them but if you can gamify the security
awareness even better so uh there's a a
uh a practitioner uh who goes by the
handle benen and benen did a great video
on this at like Derby con like in 2014
2012 somewhere if you Google like benen
derbycon and uh and security awareness
you you should find it but he came with
up with a brilliant idea for his small
company he said hey small company you
know all those videos that you've been
seeing about security things that might
happen we're going to have a competition
and what's going to happen is you might
see some of those security things that
you're supposed to report or whatever uh
around the company the first person that
reports any single one of those things
gets a $10 gift certificate to Dunkin
Donut at the end of the week I'm going
to tally up all the points and the
leader is going to get a $200 Visa gift
card oh my God the way people reacted by
midweek they're like they're trash
talking at the water cooler like you're
going down I'm totally winning that
people were like reporting the CFO for
walking through without their badge on
cuz that's a security issue people were
reporting strange black boxes outside
the side door cuz that's a security
issue it was a rod and control box but
still they were actually reporting
things that they thought were
strange and the best one happened 15
minutes after he announced the
competition he said hey how we doing on
time he said uh someone called him and
said hey Ben Ben I see one of the things
he's like one of what things and she's
like I I I I see one of those things you
talked about the competition I I got a
thing he's like what are you seeing and
she said well this thing pops up on my
uh computer every once in a while it
says you know click here to authorize
access or something like that I I
clicked it it's gone
already and he said how long have you
been seeing these and she said oh like
six months now yeah yeah so 15 minutes
into the competition they had a real
security incident he had turned his
people into carbon-based intrusion
detection systems and it was beautiful
now I I will warn you I talked to one
company who thought it was also a great
idea and they ran with it uh they had
people starting to download nessus
because they wanted to find more
security things yeah and they started
scanning their own networks um now the
fact that they were able to download
Nexus and run it in the organization is
indicative of a bigger problem that we
have to fix right um I love the fact
that they were so into it and that was
great a little redirection I'm a really
good dog trainer and redirection is very
important a little redirection of that
energy into another space um and those
folks will probably do a great job for
him um so uh to to create this sort of
healthy culture that I've been
describing um here's a few things that
are red flags or things you want to be
checking um as you're trying to create
this culture so security awareness and
the training it it's never should be
used as a punishment never ever ever um
security awareness that fishing stuff
that you should do people should be
rewarded for doing the good things they
should never be punished for making a
mistake that's just freaking ridiculous
and it's also never applied fairly if
someone like gets reprimanded or or in
some way punished for clicking on a
fishing link do you think they do that
to the CEO like ever no CEO has ever
been punished or humiliated for clicking
on a fishing link um without that person
proba losing their job so we need to
have rules that get applied fairly and
if we're not going to do it to the CEO
and we shouldn't be doing it to the CEO
we also shouldn't be doing that for
entry-level positions within the
organization as well right make sure
everybody knows in a small organization
you we should be treating people and
they should realize that they are part
of the security team a small part right
they're only contributing a little bit
but those little bits will help and and
and have got a great example of how they
can help coming up um so uh regular
training and just figuring out what a
risk is you know any one of us could be
fished right you you create a fish good
enough we could probably all fall for it
under the right conditions you know
maybe been drinking at you know Cipher
con and we see an email right whatever
the right conditions the rightly worded
um fishing attempt could get just about
anybody um but helping those who don't
know infos that well uh and making them
an extended part of the team will pay
off in spades um asking for help when an
employees doesn't really know what's
going on with the the security thing
should act asking for help regularly
whether it's your own security team
whether it's people in the organization
uh again will pay off in Spades but they
need to know that it's safe to ask that
question they need to know that they
won't be laughed at or humiliated or you
know unicorn with our with our pompous
unicorn attitude um at the questions
that they ask um and then make it fun
and personal I've already given some
suggestions on you you can do that um so
and one of the tips I get so Insider
threat is pretty big for small companies
right most of them can't afford like
full-fledged threat intelligence um
they're not going to be doing that kind
of analysis but a small comp one of the
small company's greatest assets is that
everybody knows each other at a small
company you know if Bob and accounting
has been changing his behavior a little
bit if he's like always pissy right um
if if if he seems to be stressed out you
may even know that he's all all of a
sudden lost a huge amount of money as a
gambling debt or something of that
that's a risk until it turns into an
Insider threat so our job is to get
around that and get ahead of it so that
those folks don't turn into an Insider
threat it's not foolproof but so much
can be countered just by knowing our
people and having a safe way to for
people to go hey you know what I I think
Bob in accounting is having some
problems maybe maybe we could get him
some counseling something like that
right make it safe so that people can
come to you before it turns into an
issue um but that's a that's often one
of the most effective ways that a small
org can deal with Insider threat when
and you know if you get kind of that
Intel too you can also start checking
things like logs you can start checking
to see if when was the last time Bob
who's very disgruntled right now had his
account audited to see what he has
access to because Bob wasn't always in
accounting Bob was in like five other
you know business units and has access
to all the stuff that right now Bob
doesn't need access to so while you
might not be able to fully audit every
account knowing that there's some
accounts of some folks that may be a
little unhappy or or have other reasons
that could potentially turn them into
Insider threat is a great way to at
least cover the auditing that you should
be
doing uh so so let's talk a little bit
about process so um the CIS 18 I I
almost said 20 again um I've noed is 20
forever 18 critical controls everybody
here familiar with 18 critical controls
yeah um so they've added a new feature
that I think is pretty cool they're
calling them in implementation groups
and they've done it because they realize
that not every org can Implement every
group for every control so these are
essentially levels of maturity and
guidance on how to get to stage one
maturity stage M two maturity and go up
so what that looks like um so here's
control number one and we see that those
first two subc controls of control
number one will get you to uh
implementation group one which is
defined as basic security hygiene this
is like the minimum viable product for
your security group so at least try to
get to those things if you can mature
beyond that freaking awesome but we want
to at least get to it so for each
control within the
CIS 18 critical controls this is
something to now strive for so you're
not overwhelmed so you're not stuck in
analysis paralysis where you're like oh
my God there's how many controls sub
controls under control one I I can't do
all of this I don't have the money to do
all this well maybe you can get the
first or second one out of the way and
oh by the way it's okay not to start
with control one right control one
everybody knows is important getting
control of your assets is supreme it
will lead to good security who here has
seen a perfectly done
cmdb yeah um I've I've never seen one
never ever um it's uh it's it's n
impossible I've seen really good ones
right but it's I've never seen anybody
get perfect control over their assets as
we move to the cloud theoretically we
should be able to but for now uh yeah
maybe not what you may want to start
with is controls um maybe control 9
maybe control 10 nine and 10 are where
most of the attacks that are hitting
small organizations are dealing with
right email web browsers and Mau itself
so maybe focusing on those controls
first and then maybe we try to get
control of our assets uh under one sorry
that cut that off but um uh yeah um
really do a little bit of a a threat
analysis you know it's G to be this kind
of threat analysis but understanding
where most orgs in your tier are getting
hit should uh should inform you on which
controls maybe you're going to get
started with first um and then we really
need better ways to describe risk right
so as as hard as we try this is usually
what it looks like when we try and get
in front of non-security people and
describe the risk that's going on we're
like oh my God it's crazy you we're
going to
die so um and and by the way I just
caught the stat today so 40% of global
risk and compliance decision makers are
improvising risk management what does
that mean means they're making up
pretty much as they go along right
they're building the plane while they're
flying it they're taking wild ass
guesses at risk and and by the way
taking wild ass guesses at risk is one
of the biggest problems that we have in
inos right now who here is still using
risk
matrices um risk matrices suck right
this is the way we're taught to do this
but in several studies dating back to
2008 we see that risk matrices can be
worse than useless that's pretty damning
and the reason why the wor uses is
because we're taking a wild ass guess at
what the risk might be and then we're
we're trying to somehow quantify that
risk based on this wildass guess so I
got this info from Douglas hubard he
wrote a book called How to measure
anything in cyber security risk if you
don't have grip around your risk check
him out he's got amazing free tools his
risk is based on marac Carlo simulations
so what he teaches in his book is to
take those stupid Matrix things and turn
them into probability estimations so it
goes something like this you go to your
board and say
hey what is your acceptance of risk of
us losing $100,000 this year
and the or might go okay
$100,000 maybe we can deal with that
we'll we'll accept like up to 80 90% uh
probability of that happening you're
like okay good how about if we lose a
million
dollars no maybe less than 20% um
how about $10 million yeah less than 1%
they have just told you now what their
risk appetite is and we tricked them
into it they they're they're giving you
hard numbers and then he actually has a
spreadsheet that will um run the monar
simulations against the probabilities
and you don't need that much data to
figure out the probabilities he's got a
couple of tools that will teach you how
to be a better estimator in one day for
free but it's amazing how little data
you need so to be statistically re
relevant how many data points you think
you need to be statistically relevant
when making an
estimation it's only nine only nine data
points you need to to become
statistically relevant it's really low
um and if you don't have the data like
what what's something you think would be
next to impossible to estimate most
people usually say oh well whether or
not we'll be breached this year right
sounds like a how could I possibly
estimate that with just a simple set of
data from either data either from your
own history or something like Varys
which has at least the data for your
vertical you can get a PR pretty good
probability of your likelihood being at
will it be perfect no will you be able
to tweak it over time ABS fre lutely and
when you do that now you have the
board's risk appetite your inherent risk
and the residual risk if you're saying
to the board hey we need x amount of
money to get to the the acceptance that
you said you would accept the board
either has to change their mind or they
have to give you the money uh that you
that you are estimating will reduce that
risk right and if they don't then it
wasn't your fault was it you told them
um so basic hygiene I'm not going to run
through this most of you know it um the
most important thing about uh
assessments if you're going to do them
and you better be doing them is
that they should well a risk assessment
should precede the security assessment
but understand that they are one of your
best bargaining tools you should always
do a risk or security assessment with
your assessor with the intent of getting
more budget you want to prove that
there's a freaking problem don't just
say hey find out if anything's wrong
have some strategic goals I need budget
for this I know it's so I'm going
to use an assessor to actually prove my
case um use every assessment as a purple
team they the assessors should be
sitting in the room with your blue team
and they should be watching the attacks
as they happen so much can be learned on
that money that you're already paying
for that assessment um pick the right
freaking box when you do an assessment
you know the people talk about opaque
box transparent box and translucent box
a lot of inexperienced infos leaders
will go oh we're doing translucent box
we're I mean um uh opaque box we're not
going to give you any information you
got to break in on your own the only
thing that tests is whether or not your
assessor is good at what they do it's
not very helpful whereas if you go hey
you know we know people are getting now
there's some value to it it's not
completely useless testing your apis
that way is probably a good idea um but
for the most part you know people are
going to get in so give them the
freaking creds and let them go to town
they will be able to test the most
vectors in the shortest period of
time um so patch management you can read
it on the deck um gorilla trust TR zero
trust is not a freaking tool it's a
process you can do some really good
stuff by with MFA you got to give it to
everybody it can't just be the admins
and the exacts if there are people that
aren't using MFA in the org they will be
found you the attacker will get domain
admin like that um there's free and
lowcost MFA out there for you um uh do
things like jump boxes and secure
workstations real quick way to isolate
those privileged tasks hire someone
automation is not difficult you one of
your interns can probably learn how to
automate your processes really freaking
quickly um with uh technology um so
Cloud servfaces we know some of the
stuff that's good um I also uh Advocate
using chaos engineering as a defense a
lot of stuff is in Cloud right now and
and can be spawned up quickly so why not
create some really solid tight hardened
images and regularly rotate them even if
you don't need to even if the workload
doesn't call for it because then if it
gets
compromised the the attackers now lost
their foothold so you've just replaced
that workload space with a with a new uh
Docker image or whatever it is and
rotate them in not to the point where it
it hurts you know uh business flow but
to the point where you're frustrating
attackers at least in that space um
snipe it has a free Asset Management
tool so I I told you there'd be a little
bit of a free stuff out there it it
works damn well and if you host it
locally it's completely free if you want
to use a cloud service that's when you
start paying um deception tactics are
beautiful use deception tactics to get
that budget money as well um using
things like a honey file or a honey
account will usually turn up something
and then you can say I told you so we
need more budget we've already found
someone lurking in our networks um there
if you want to talk to me afterwards
about how some of these work I'd be
happy to to explain the concept to you
um and there's all the we learned
thank you very
[Laughter]
much H uh quick questions do they have
time for questions one question anybody
got a question I
yes yeah it's really
bad
okay oh
wow right
on like all the people crying in the
hallways because they
know right right the cone of shame um
right but for those you that can't hear
so she's saying that she's Works in an
organization where that does happen that
people get punished for
failing yeah oh they have to go to
security yeah it's it's like going to uh
driving school when you yeah right when
you got caught speeding y um so that's
tough obviously we do know that they do
need better security awareness I think
one way we could turn that around um is
to find ways to make that training fund
so that it's not a punishment right um
uh the other way to approach it's turn
it on its head is instead of punishing
those people start giving rewards to the
people that that don't fail the test
right um if you make it competitive
enough those people will probably go
well I I I want to get that prize the
next time not everybody will right
there's always people that just they
won't play um finding ways to make it
not a punishment but but something to
give them Focus or maybe even turn it
into something that they will benefit
from right like maybe some of the
security training to teach them how to
secure their phone how many people don't
want to secure their phone right and
that turns into maybe them being a
little more open to the
message uh questions
yeah right yeah
yeah right so so a good security VPN
with a jump box on the end of that could
be a great way to tle those privileged
credentials um and maybe you know I
haven't looked into it but I don't see
any reason why we couldn't create
something like that in the cloud to with
some sort of Bastion host in the cloud
that does that there there's probably a
gotcha there that I'm not aware of but
that's what I'd look into at least yep
okay and we got to cut it so yeah thank
you all um I'll be around if you have
[Applause]
questions he