what's up everybody my name is Michaela
flateau unicorn collector with defense
unicorns hi and I'm calling andreaki I'm
a cyber defense uh Mission manager at
defense unicorns thanks for choosing to
spend this time with us and also for the
five of you that connected to our
pineapple Wi-Fi
no I'm just kidding she was a joke just
make it your world it's right before
lunch so we really do appreciate you all
coming in
um and hopefully you're here to learn
about cyber security education if not
we're going to be closing the door soon
so we're sorry you're stuck with us
until we're going to be locked and
they're getting out now
but uh we're gonna go ahead and start
with a quick video on a growing attack
trend
all right so this new trend uh
my corgis uh definitely try to to fish
me out of my chewy credential logins
chat GPT is uh changing the game it's
lowering the barriers for cyber attacks
to the point that my Corey almost
succeeded I almost fell for it
but uh I uh I'm curious uh when you
think about some of the strategies that
you all use when you go to look to see
if you're getting fished
um think about some of those strategies
for me personally some of the quick got
checks that I do right is there are
things felt wrong or is there bad
grammar uh you know capitalization and
weird spots right those are like the
quick go-to's typicals right
um as you can see in in this email right
that was sent to me uh those don't work
and it took a little bit more effort for
me to realize like this may not be a
legitimate email so with that in mind it
got me kind of thinking like dang if
they can do that with chat GPT what can
they do with fishing and schmiching
right like when I get that phone call
are they going to have a better script
than they used to with text messages
sometimes those can be harder if they
get more advanced with their text
messages am I going to be able to tell
if it's actually like my bank talking to
me or is it right it's going to get a
little bit harder and finally is the
social engineering aspect uh
they get you where it hurts they do and
so with Technologies like chat gbt and
things like that it gets a little bit
harder to think all right uh I love my
Corgi he got me where it hurt right
taking care of him giving him his treats
uh but Michaela they're going to begin
calling you about things other than your
extended car warranty so things that I
actually care about it's that social
engineering and adding that emotional
portion to it to hit you where you know
you start to think maybe I should click
on this because
so
all of this example really to just kind
of hit home Technologies are lowering
the barriers for cyber attacks it's
changing very rapidly it's really quick
on how these things are changing and
it's expensive to keep up right so it
kind of leads us to the first part of
our title the pretty penny right cyber
security or just cyber in general is its
own economy in its of itself
you have a Cyber attack and you've read
the headlines right yeah it can cost in
the millions more and more expensive it
is getting more and more expensive to
the point that a research group felt
that they had enough evidence to write a
report going ahead and saying that if
you take all the cyber security damages
and you put them together that that
amount is actually comparable to Global
economies and it would rank third uh
that's crazy this talk luckily is not to
nitpick the validity of how they came up
with their numbers or things of that but
just taking the quick acknowledgment
that somebody felt that they had enough
evidence to make that claim is kind of
scary in and of itself
um normally when you get attacked and
things like that you kind of think what
about insurance right there are
insurances for cyber security attacks
that is becoming an area where some
insurance companies are thinking I don't
know if I'm I'm crunching the numbers
and they're not in my favor it's very
unstable I'm not sure that there's going
to continue to be insurance for cyber
attacks
um that's kind of scary on the flip side
of the economy where there maybe isn't
as much reporting as kind of the idea
and the drive of well why are these
cyber attacks still happening there is a
whole nother side of the market on you
know like a black market if you will of
selling of malware zero days access
stolen credentials are really hot right
now
um
and so they're selling these things
actually on my way here Michaela you
said you're a recruiter I'm sorry uh
they're cutting into your talent pool I
saw an article I didn't go in and
reading it as much as I should have but
it was stating that cyber criminals are
recruiting six-figure jobs PTO
oh oh you know so I didn't read it so I
don't know if there's like health
benefits or you know 401K Investments
but uh the point is the pretty Penny's
not going anywhere cyber attacks aren't
going anywhere
um and it's kind of scary if the
insurance is begin pulling away from
that area well then the ownership really
becomes on all of us and on our
companies uh to how are you going to
prevent cyber attacks and that's why we
continue to cease cyber education to be
such an important part and an important
topic to share like what we're seeing
works and what doesn't work
um and then as you the challenge is kind
of daunting right the scope of how
quickly it's changing how much
technology there is how many topics
there are that's a lot uh so what we
would really like to spend most of our
talk staying uh with you all today is to
kind of talk about what we truly believe
was going to help you manage cyber uh
security education and that's
integrating it into your workplace
culture
so
how do you integrate cyber security into
your culture I feel like that's easier
said than done a lot of people think
that culture is kind of like a fluffy
thing but it actually takes a lot of
work
one of the biggest things the most
important thing in my opinion is making
your culture a safe place to admit
mistakes I know I don't know about y'all
but I know that if I thought my job was
on the line AKA you know the way I make
money aka the way I put food on the
table I'm not going to go forward and
say oh I clicked on that link or yeah I
I sent I sent gift cards to that text
message and I shared my password here
there I'm not going to do it because I'm
like I'm not going to put myself at risk
and ruin this opportunity for myself so
I'm gonna zip it
what would make me more comfortable with
admitting to that mistake is having
psychological safety are you guys all
familiar with that term I'm not going to
do the whole like raise your hands if
you feel familiar with that term if
you're not familiar with that term
though
basically it means that you are
providing an environment that makes
people feel safe
and they're not going to be humiliated
and they're not going to be punished for
sharing ideas admitting mistakes
bringing up concerns or anything of that
nature so
there is there is something that's very
important to distinguish though is that
are people genuinely making mistakes
versus
you know there's a genuine their lack of
understanding they're not following
policies and procedures and it is truly
on them so
before we show you some good examples
that Colin and I put together of
strategies on how to integrate cyber
security into your culture I do want to
touch on what I consider a bad example
Okay so
cyber security should matter to everyone
it does not matter if you are a
secretary or a cyber analyst or the CEO
if you're touching Tech then it matters
to you and I believe that this training
didn't really do a good job of making
people care enough to you know really
invest time and energy into
understanding it
uh I don't know how many of you have
been integrated in the Department of
Defense in any way but if you have then
you have been subject to this god-awful
training called Department of Defense
cyber awareness challenge it was so bad
that PewDiePie made a video of it and if
you want to subject yourself to that
torture you can go on YouTube and look
it up and myself and all the comments on
that video agree that some of the ways
that this training went wrong was that
it wasn't it was a yearly requirement
meaning that people were not thinking
about this until they the dreaded
training came up and they you know
clicked through it as fast as they
possibly could because they didn't care
they just wanted to get it done and get
it out of the way
um
I know since then the dod has updated
their training but for years for years
the training was always the same even
though cyber and these types of attacks
were evolving they were still teaching
us like hey if Tina comes to you with
this floppy disk and says put it into
your computer and you're supposed to say
no that's a bad idea you're like okay
that's a little bit outdated
um
the point I want to touch on with this
slide is the things that went wrong were
that it was not frequent
it wasn't ingrained in Daily habits it
was turned into this you know I don't
want to say torture device but people
just hated doing it
they weren't thinking about it
frequently and something was that when
you got that email saying you're due for
your training there's a punishment
attached if you don't do this training
you are going to lose your access and
you're not going to be able to do your
job
because we're cutting your access to
your computer done
when you associate a punishment with the
training you're automatically making it
not a safe environment and you're not
making it fun or easily digestible or
anything like that
and obviously I mean I feel bad saying
this because clearly we're using a
PowerPoint here but any trainings that
are Death by PowerPoint
just don't hit the mark they just don't
so I do want to transition to a strategy
that we believe works
um
man what am I saying here
strategy one
encourage open sharing so something we
do at defense unicorns is that most of
our communication is in slack so let's
integrate incident reporting into slack
that's where everyone is anyways it's
easy to access it's open and when people
report incidents
it's openly shared to all of us this
example right here
might be our record holder for the
quickest Audrey has only been here for
two weeks she's a new employee she
barely started and she already received
the text message from our CEO Rob saying
Audrey available
and this happens so frequently to us
that we consider it kind of a rite of
passage once you get the text message
you're you are now an official employee
of Defense unicorns but
we we are consistently updating that
thread every day of hey I got this text
message I received this email so Audrey
was able to identify that and
obviously avoid it because she knew that
it was not legitimate
now imagine you have a new employee who
doesn't have access to this information
and they get that text message and
they're sitting there thinking
themselves oh crap
the CEO is reaching out to me like I I
just started I don't want to mess up
this opportunity I should respond
and then bam of course we joke about it
because it typically follows up with a
I'm stuck in a conference room and I
need you to go to the store and buy me a
bunch of gift cards because that makes
sense right because it totally makes
sense but clearly you can see that open
sharing putting it in a forum where we
all regularly access it and kind of
turning it into a humorous situation
everybody feels comfortable posting in
there everybody feels comfortable
reporting and honestly there have been
times where people have posted and said
hey is this suspect and people will look
at it and be like actually no that's
that's legitimate you can click on it
all good
so good and bad examples are both in
there
now
we like to joke and have a lot of fun
but in some scenarios
it calls for a more serious tone
especially when there's been a bigger
breach so
next slide
um
leadership setting the tone and leading
by example
is huge in creating this culture and if
leadership is not bought into this and
they don't follow it it's the culture is
not going to survive that integrating
that cyber security into the culture is
not going to work
so leadership setting the tone I have
two examples
from back in the day previous workplaces
I won't name but
one bad example and one good example bad
example being there was a breach
handled behind closed doors swept under
the rug leadership was not transparent
about it and then when employees finally
did find out about it they were like
well
nobody told me how can I trust my
leadership when they're keeping these
things from us especially when it's
leaking
our personal data
so so wait you're saying that you found
out and it wasn't even anyone in your
company that told you all it was in the
news it was in the News That's How
employees found out about it
that's not a good feeling when you
figure out something about your company
through the news whereas a good example
from prior work experiences is
same scenario breach happened and
Leadership was upfront about it they
immediately came forward they owned it
they said we made a mistake here
we are owning it and here is what we're
doing to fix this problem and here are
paid paid resources to help you mitigate
any risk associated with what happened
another important part of the good
example is is that there's a two-way
street on communication meaning
leadership didn't just go up there and
say we made a mistake okay now nobody
asked any questions about it like we're
not going to
um you know respond there was
employees could ask whatever they needed
to to feel comfortable with the
situation that happened
now I I thought that was an amazing
response they were transparent they were
upfront they provided Solutions there
was no scapegoat like oh unnamed
employee did it I mean we're solving it
but pointing fingers no no pointing
fingers let's just get to solutioning
because that's what's most important
right
um so wrapping it up going to takeaways
these are the biggest things that we
hope that you learn from our session is
that number one cyber security should
matter to everybody and what is really
important about that is making sure that
you're putting it into a format that
everybody can understand
easy easy access to reporting easy
access to show what has been reported so
people know what examples to look for so
that if it happens to them
they already know
and um
you know that yearly requirement that
yearly reminder no it just doesn't work
we want cyber security to be so
ingrained in your culture that it's it's
not a second thought it's like looking
both ways to cross the street people
automatically know when I get that text
message or when I get an email
I'm going to screenshot it I'm gonna go
drop it in the slack Channel and then
within 10 minutes unicorns are going to
answer my question and say yeah that
that don't answer that or they're going
to say no that's a legitimate one and
you're good to go proceed
um
keeping it simple too if you put too
many barriers in that procedure to
report it makes people not want to do it
because they're like God I don't have
time for that I don't have time to do
all those steps so I'm just going to let
this simmer and then a week later
they're gonna forget and then
you know it goes from there
second step I feel like it just honestly
just
incorporated into what I was just saying
I feel like I didn't do a good job of
like separating those two that open
sharing is so important and everybody
needs to be on the same page whether
whatever role you play in the company if
you're touching Tech it matters to you
too
and then the last one
and honestly one of the most important
ones is that leadership needs needs
needs needs to
be there and it applies to them too they
admit mistakes they own it they report
and that provides a safe environment for
employees to do the same because they
realize they're not going to be
humiliated or you know something
happened to their job because of it
yeah and it's important to to know
because some of these things you may be
sitting and thinking like if I were
sitting there I'd be like well I'm not a
leader so I guess like you know I'm not
the CEO or I'm not the CTO right you
know fancy C and then letters right uh
so like some of these don't apply to me
but that's that's not the case
um
right that it should matter to everybody
because we're all touching things but
you have a personal investment right
because if they're going through you uh
you know your own personal dad is
important as well right some of the
breaches that Michaela talked about
right that's your data identity theft
does affect us all
um and so right we're all touching uh
technology but the encouraging open
sharing can be as simple as even if you
don't have a slack Channel or you're
you're a much larger organization it
could be as simple as asking your your
teammate hey uh I got this message did
did you get one too or do you know if
this is something like is this
legitimate or not it can be as simple as
having those conversations like Michaela
said we want it to be second nature the
reflux of crossing the street you don't
even think about it it's just a simple
double check that you do right you can
do that today uh you know no extra
effort really when you do things like
that but by doing that it spreads right
that idea that it spreads and you can
begin talking about it well if you're
talking about it chances are then other
people are going to be feeling okay that
they can come and they can begin asking
those questions it's like well you know
uh Michaela's super smart on these
things and if Michaela's asking it like
shoot I can ask it right like but that's
how it starts it's just little simple
things like that that anybody can do
um and then the setting the tone when we
think leaderships there's a vast
difference and there's been a lot of
Articles gosh linkedin's full of them
right leadership isn't a title right it
also goes down to the role you're
playing on your team it doesn't require
a title right there are those
influential people that I'm sure
everybody's worked with that you're like
dang this person really leads the team
and they make a difference and they do
these things and people just naturally
kind of Follow that person
um you may be one of those people
um and so everybody can set that tone
where there can be leadership in
different areas as well maybe you're
going to be the leader in making the
environment feel safe right you're
openly mitting hey I made this mistake I
want to learn for it from it and making
that environment okay to do the things
those are other things where you can
today be a leader without that title so
these are things that should that can
apply to everybody that you can begin
doing to slowly and Grading it into your
culture doing a little bit is much
better than doing nothing yeah and
that's one of the big things and the
idea of the hit home of integrating it
into your culture do a little bit at a
time versus it being something that
Giants you do think that you're eating
all at once taking a bite by bite
I
we realize that there are going to be
people in your organization that are
going to click on every link just
because just because this one might be
the one that's real and creating that
environment where they can come to and
admit those mistakes is so important
back to our title the pretty penny we
understand that the first thing that
people think about in cyber security
attacks is that's going to cost our
company a lot of money but here's the
deal and I'm just going to read it
straight off of here because the query
is saying it and I want it to solidify
with all of you cyber security is more
than just the pretty penny providing
your employees the knowledge to identify
cyber threats are going to save you
Millions on the back end and that's a
fact
all right
we are done so we purposely kept a
little bit shorter we are right before
lunch we wanted to be aware and
empathetic to that but um we'd love to
hear if you guys have any questions or
anybody has strategies that you guys
have been seeing that do or don't work
in the environments that I'm sure we all
can think of good and bad examples but
we're here to talk
um the QR code is legit to our website
it's legit we should have Rick Rolled
you with it but
we decided to just it links to the
defense unicorn's website if you want to
know more about like where we're from
but yep that's it y'all have any
questions
okay you can clap Josh
[Applause]
where are you guys going to go to lunch
yeah that's probably okay
yeah no please
oh no
not just the fear of getting fired but
the fear that the internet out to get me
oh wow
I'm
aware of doing more
hearty with
me our training is not set up for that
no that's that's really sad and I have
seen that as a common tactic
unfortunately of the to the point that
you get so paranoid that you don't want
to even uh there there's a joke that
with some of my colleagues that the more
and more I learned about cyber security
and breaches and attacks the less and
less I want to be on my technology like
that that is that is 100 real
um
but it's so in ingrained in everything
that you do today
um the successes that I've seen in that
area and if others have uh seen other
strategies please feel free to share and
I'll open it up in a second but it does
go with that safety of the idea of that
you're going to make a mistake it's not
a matter of if you're going to get
reached if there's going to be a cyber
compromise it's a matter of when and
then understanding and feeling
comfortable that you have resources you
know what to do afterwards you know that
you have a support network and that's
very hard when the culture unfortunately
has been set into a fear mentality but
that's where I've seen successes of you
take care of your fellow co-workers
right and you started on a very small
scale of let's talk about it making it
regular
um you know and just because that's the
message coming up there can be a lot of
goodness that's happening at the lower
levels of just being a good teammate for
each other and having those
conversations openly and that slowly
starts to make it feel safer and then it
slowly makes it and it gets contagious
and it kind of grows so they're they're
no matter what like one of the biggest
risks in cyber security is going to be
humans and if your leadership does not
understand that and prepare for that
then they're failing their employees and
they're failing their culture that's
like
why we put this together and why we feel
so passionate about this topic is
because
it doesn't it doesn't matter how much
training how much money you soak into
training if you're coming at it from a
fear perspective and like I said if I
think my job is on the line or I'm going
to be humiliated or feel stupid I'm not
going to say anything
um I'm not sure what your role is at the
company of you have influence on that I
do believe that leadership has a huge
part to play in that and if you can have
any influence on leadership or providing
that feedback like hey
this needs to be different whether it be
this annual training needs to be broken
out or we need to start this forum where
we can all come together even if it's if
it's physical and it's on a bulletin
board if that's where you know your
office is and you're posting things like
hey this is the most recent one this is
what the text message looks like this is
what the email looks like make sure but
having having that information in
heavily trafficked areas is extremely
important
and being able to share that I mean it
should if people are having to share it
anonymously to feel safe whatever but so
long as it's being shared and the
information is out there for others to
you know identify and say okay if that
happens to me now I know
yep
has anyone else seen successful thought
I mean
yes
I love it absolutely absolutely
I then those credentials are exposed for
longer for one but two then
yeah and that treat treating it as a
learning opportunity as well not only
for the person who made the mistake but
for everybody in a non-humiliating way
you know it's not like everybody look at
Michaela she made the mistake learn from
her because clearly she's not doing it
right
any other questions
and you guys might be going to lunch
early
well thank you all so much uh we'll be
roaming around and we in our unicorn
shirts if you guys want to come up and
talk later we're happy to talk with you
all but thank you so much for spending
time with us we we do really appreciate
it hopefully you guys took something
away
[Applause]