house
[Music]
hello everyone
thank you for coming my friend Nick in
the back is going to keep me honest I
could eat sleep and breathe this topic
and I'm glad that all of you joined me
today so my name is Andy Kittleson I am
an expert in patching the human
operating system and today I'm going to
share with you some really quick easy
ways for you to starting today
incorporate some jazz into a security
awareness program
I have a wide background I
started and pioneered freighter and the
Medical College of Wisconsin's very
first cyber security awareness program
and I'm really proud of that once that
was up and running it was then that
Rockwell Automation stole me shamelessly
away and said hey Andy we see you come
on over here and work on a global basis
and so for five years I managed Rockwell
automations cyber security awareness
program globally 28 000 ish employees
um just a year ago I decided
um you know it seems like once my
programs are up and running I get a
little bored I'm like what's next for me
so a year ago I transitioned from it to
OT and while the itot uh trans
Crossroads are real there is a real
learning curve and I'm enjoying every
moment of it so I manage the security
awareness program at Rockwell Automation
on the OT side managing our products
um it's been a wild ride but my passion
is in the human training and awareness
side the human operating system as I
like to coin it in my spare time I'm on
several advisory boards
um University Wisconsin Stout and Marine
Park Technical College I founded the
security awareness professionals
Community which started here in
Wisconsin and then it went to the
Midwest and now we are nationwide a
group of experts so if you're sitting
there and you manage your own security
awareness program for your company and
you think hey I want to be a part of the
community of other experts so I don't
have to reinvent the whale and start
from scratch reach out to me or if you
are the leader and you have someone at
your company who is managing the
security awareness program reach out to
me and um you know we're always looking
for new experts to join our community
and we uh are across all different
Industries
uh let's see what else do I do my
masters is in Career and Technical adult
education and I and I thought that's
important for you to know like why
should we be listening to her
um I always find it fascinating when I
talk with other experts about their
security awareness programs and they say
yeah we we train you know we have a CBT
computer-based training we do it once a
year and that should be good but let me
ask you how long did it take you to get
your degree for what you do every day
the majority of our employees did not go
to school for I.T or they certainly may
not have gone to school for security and
yet we give them a mind-blowing
30-minute training that they have to sit
through and plug through
um we say we're good we'll see you in
364 days which is the worst thing if
there's nothing that you take away from
my my talk today it's that cyber
security training cannot and should not
be a one and done and so what I'm going
to do today is show you what I've done
at Rockwall Automation and how we
elevated the program and if if you are
not managing a security awareness
program and you're just here for some
entertainment we have 25 minutes of a
wild ride for us so
I'm going to talk with you about how to
create a layered approach and you could
pretty much adapt these theories in your
personal life if you're not managing a
security awareness program
but stop drop and roll by show of hands
who here has ever been on fire and had
to stop drop and roll
not one not one person yet from Little
on we are trained diligently that if you
catch on fire stop drop and roll yet no
one in here has ever caught on fire
yeah we know what to do it's easy it's
simple it's basic right did you know
that in 1971 or 72 up the fact check
Andy Kittleson
um it was called learn not to burn
now learn not to burn while you know
it's interesting it is not a One-Stop
shop I have to go somewhere else and do
more research or learn not to burn in
order not to burn they changed it from
learn not to burn to stop drop and roll
because it's a One-Stop shop anybody can
comprehend what stop drop and roll means
now what does that have to do with
security
we make our security awareness programs
far too complicated and I'm going to
show you today how you can make your
security awareness training as easy as
stop drop and roll
so my challenge for you is to at least
take two things that you can use in your
professional or personal life
and start using them immediately
oops here we go
so you need to make it easy for your for
your leaders if you're a leader I
imagine the amount of emails that come
flying into your inbox and you know you
pick and choose which ones are important
to you at Rockwell animation our
leadership really truly stands behind
its people and so I'm going to show you
this first example of how I got
leadership buy-in to support my cyber
security awareness month which is in
October October Is My Jam it's my
birthday month cyber security awareness
month they just go hand in hand but I
realized I needed to get other people as
excited about it as I was and those
people had to be the leaders because it
comes from top down
so for cyber security awareness month I
went to my uh CEO I worked with my CSO
and I said hey we need to get Blake
Moret on board we need to get Blake
talking about cyber security awareness
month because if he talks about it
everyone else will talk about it
so I got together with my CSO our chief
information security officer and I said
hey I just need five minutes of Blake's
time and by golly she got me five
minutes of Blake Moretz time and I
talked with him about what our plans
were for cyber security awareness month
and I got him to shoot a video I said I
need nothing fancy I have no budget
I need you to take your phone and take a
video of yourself a minute or two tell
me why people should care about cyber
security awareness at Rockwell
Automation and just email it over to me
I'll take care of the rest
so I he did that our CEO took time and
sent me a video if you ask
the worst thing that can happen is that
they'll say no and I'll tell you when I
propose this is my sister she was like
I'm not asking Blake Moret to do a video
and I said I'll do it I'll ask him
um
my CSO also gave me a quote and shot a
video and I said oh and then I got
hungry I was like okay I got the CEO I
got my CSO how can I get the other
senior Executives involved because I
know that they meet quarterly with their
teams they have all hand meetings and I
want them talking about how and why
people should be involved in cyber
security awareness month so back to the
emails you know we wake up there's three
400 emails you're like how am I going to
get through these all today
so I told my CSO please take this video
send it to the senior Executives tell
them that right away in the morning when
they grab that cup of coffee or tea or
pop or whatever it is hit play sit back
and just you know start their day with
it that's all that they'll have to do
and so this
is exactly what got sent to all the the
senior Executives within Rockwell
Automation
[Music]
thank you
foreign
[Music]
Detroit
[Music]
he took the midnight train going
air
[Music]
into smoking room
[Music]
s
[Music]
knows
[Music]
everybody
[Music]
foreign
[Music]
foreign
[Music]
anybody
[Music]
so the Rockwell band exists and they are
out on YouTube check them out I did not
know that rock ball automation had a
band called rock wall but how awesome is
that you just might have a bandwidth in
your own company too maybe your kids are
in a band maybe get the high school
local band involved there are so many
different creative things happening on
your own roof and I just happen to fall
Upon Our Rockwell band on our Yammer
Channel when kovitz shut down I thought
well now what am I gonna do and I know a
lot of you are pulling out your phone so
here is a screenshot of my cyber
security Awareness Month feel free to
snag a picture of it
um
but I thought well how am I going to get
people's attention and I loved all the
people that were on the hallway during
Journeys Don't stop believing that came
in to join us so welcome
um I can't blame you and I also I've
already challenged you once today by
your second challenge
I you know really triple dog dare you
not to get that song stuck in your head
and every time you hear Journeys Don't
Stop Believing you're gonna think of
Andy kittelson's cyber security
awareness problem I or problem that's
not a problem that's a good thing
program
um I tell you I did this a few years ago
and I still get random people at
Rockwell that will email me and say just
her Journeys Don't Stop Believing
thought of your security program I'm
like yeah I don't know who you are but I
like you so you know you gotta hit
people on a level that they care about
people came in here they heard a song
like I don't know what's going on there
I'm gonna listen what she's got to say
maybe like I hate Journey what the
hell's going on in there I'm gonna go
see what's happening either way I got
attention
um you know a lot of things were planned
out on a weekly basis throughout cyber
security awareness month now earlier I
told you don't do a one and done right
we don't do one training and be done
with it so um cyber security awareness
month I do it big and there's something
every week but you need to be talking to
your employees on a regular Cadence and
you need to have a face for your cyber
security awareness program why well did
you know that employees forget their
cyber training after one day seventy
percent so all that time all that money
all the translations all the validation
all the testing they're gonna forget it
after one day ninety percent
we'll forget it after a week so this is
why we need to have regular
conversations regular connection regular
touch base with our employees
so this is my way of incorporating
sensory into my program and and I'm
doing this now on the OT side so I'm
taking my own advice sharing with you
what worked for me in the IT world so
how did I incorporate Sight and Sound
into my program if you don't already
have a logo for your security program it
should be your number one thing people
recognize stuff think of your own own
life you know think of your logos your
Pepsi Coca-Cola instantly you saw the
colors you saw the imagery right YouTube
Instagram whatever your thing is you
know what that logo looks like so think
about your company think about the
culture and try to make sure that the
logo is part of the family you don't
want it to be the second cousin three
times removed and then you're like where
did where did this come from so make it
look like it's part of the family and
then push it have it in your email
signature have your team member put it
in their signature that stuff's free if
you're saying Andy I don't have a budget
that stuff's free so logo your com a
brand your security awareness program
we had been using co-fence
um we've transitioned now to a different
vendor but when we did have co-fence we
loved to say when in doubt click the
trout and we had fish trouts for people
who were the fastest reporters and we
rewarded the program
then when we rolled out reporter for
mobile people were like I don't know how
to report from my phone and our sales
crew was always on their phone so you
got to make it easy so here's a little
video on which Ellipsis to click
so easy that they will do it
um in November we have automation fair
and so folks were going to be going to
automation fair and that is our biggest
company-wide event and I said I want to
get cyber security involved so one way I
did that
was through a game
so I took our security manager physical
security manager he's in the middle
there I'm on the bottom
the gal on the top just happened to be
the most well-followed person on Yammer
at Rockwell Automation I had not known
her never carried a conversation with
her I simply went on Yammer and I said
who is the most liked person who's
looking at all of their stuff and I
found my friend Grace and I said Grace
I've got a project for you we're gonna
play security Feud and we gave tips on
how to be safe when you were down at
automation Fair
uh the the thing that I'm most proud
about that is there were
6945 views that was by far my highest
work related post so I was pretty pumped
about that
when Colbert shut down people were
wearing masks and I started to thank
anybody with hearing impairment would
have an issue
uh or a harder time hearing seeing
things so one of my security ambassadors
in mere conversation said oh yeah I know
sign language and I said all right well
shoot me a little video and she did
wash your hands and stay healthy
details folks it's all about the details
and people remember this stuff they
appreciate it let's talk about sight and
touch so we do capture the flags and our
partner is immersive Labs I think that
immersive Labs does a really nice job of
Capture the Flag I'm gonna check out the
capture the flag that's here
um our capture of the flag was a
week-long event we do Rockwell
Automation Nationwide so you cast that
net and anybody looking for open
positions on your team to get filled
guess what you do a capture the flag you
open it up house wide and you're gonna
find people who have been working at
your company for umpteen years and
they're looking for a change why are you
taking a capture's leg and you're
crushing it if there's no security in
your title might want to touch base with
that person hey you're looking for a
career change
um another thing about sight sound and
touch so uh two years ago we had
excruciating cold winter and it went
across the country so
um our we have a lot of business over in
Poland so uh those folks knew what cold
was there were other areas obviously in
the world that do not understand what
cold is but we did our first ever ice
fishing tournament and I've yet to talk
with anybody who's done an ice fishing
tournament that strikes conversations
all kinds of conversations you hear do
you guys really go on the lake and drill
a hole and sit on it nice fish and I say
darn right we do we bring our shanties
out our snowmobiles and maybe play
little sheep's head wait for the tip-ops
to go we have a ball but then you're
talking about fishing and then you embed
the pH ish ing in there so um we also
partner with a company called aware
Force so that is another one of my
vendors aware force and I have their
information on another slide they put
together this video I said hey we're
we're going to be doing an ice fishing
campaign and he and Richard the owner
said ice fishing campaign I'm definitely
interested and I want to do a video for
you so this was our promo video
[Applause]
foreign
and there's our logo
aware force is excellent if you are not
working with them I would check them out
um this is what they do for us on a
monthly basis so every other week
we push out a newsletter and we
encourage our employees to share the
newsletter with their family and friends
so they can be the CSO at home
if you encourage and build your
employees to be competent csos at home
they're going to bring that same uh
ethic and personality and and security
mindset into the workplace
none of the newspaper or newsletters are
proprietary and so that is why the
partnership with the where force is so
great
um I really rely on him I was a party of
one managing a 28 000 global company
security awareness program so aware
Force really set me up for Success
because as stuff happened in the wild
they would come to me and say hey Andy I
know that we have this newsletter set up
to go out next week but we're pulling it
and we've got a brand new one that is
current and up to date with what's
happening in the wild and I couldn't ask
for a stronger partner than that
they also have interactive things within
their newsletters crossword puzzles for
your read write Learners they have a
video almost in every issue that you've
seen and heard before
um so there's your audio visual read
write
and here is how we show the cues for a
simulated fishing so if there was a fish
that's out there where you should see
the red cues from
I am not paid by aware Force I just
really love the vendors that I'm sharing
with you all today
so I know what you're all thinking all
right she's talked about four of the
five senses how is she going to talk
about no three of the five how is she
gonna talk about smell and taste wait
for it
with a cookbook I mean come on y'all so
we did a call for recipes not security
related we said hey we're gonna put
together a cookbook and this was also
when covid was shut down we're all at
home and I said send us your family's
secret recipe or send us your favorite
recipe and we we had a global call we
had just shy of 150 recipes that came in
which was awesome and then we embedded
our security message
would you share great great great great
great grandmas
chocolate chip cookie recipe
you shouldn't share your password either
oh
you hit him on a personal level and
they're reading a cookbook and then bam
there's a security message or you're at
dinner and the kids say wow Mom this is
really good where'd this recipe come
from and you say
Rockwell automations Shield to Fork
security cookbook or they say Mom this
was terrible don't make this again yeah
I got it from the Rockwell Automation
security Shield of four cookbook either
way they're talking about my security
cookbook and all of you can check it out
there are some really awesome great
recipes on the shield support cookbook
so what I really want to just emphasize
in the last five minutes I've got here
and then open it up for any q a or if
you want to come up and chat with me
um we'll have a few minutes left but
remember life is a journey
pun intended
uh Don't Stop Believing it is not a one
size fits all you need to communicate on
a regular Cadence do not do a one and
done program and hopefully I've shown
you just a few detailed ways of how you
can incorporate sensory into your cyber
security awareness program and make it
so that is as easy retainable relatable
as stop drop and roll
again I'm Andy Kittleson please reach
out to me on LinkedIn if you want to
continue the conversation because
obviously I like it a little bit and you
know first off I I want to thank all of
you for your time and come on up if you
have any questions or want to talk to me
further about this topic thanks
everybody
foreign
[Music]