Rago all right well hello everyone
thanks for standing by while we figure
out how to get the projector to work
HDMI is a is a process so today I'm
going to be talking about building a
culture of security in your organization
and so you know if you've ever gone
through one of these trainings and I saw
there a few of you who've worked in a
healthcare saying before what does that
look like you go into a portal right
typing your credentials
I aim team just provision than all your
credentials for you and they say you
need to do your HIPAA training you need
to do your security training and then
you go through about three hours
non-stop where your supervisor says you
need to finish this within 48 hours or
you're in violation of your contract and
so you're speeding through and it slides
that are packed with so much information
none of it makes sense they're talking
you've never done anything technical
before in your life or maybe you have
but you've never really you know got
your feet wet with security and they're
talking about encrypting things at rest
and in transit and do this and don't do
that by the time you're done with the
first section they've told you not to do
so many things they've told you to do so
many other things you're starting to get
them confused what should i do what
should I not do and what what ends up
happening well you start making mistakes
and you have no idea what's going on and
you haven't really learned anything and
so most programs are just doing the
thing you know having a program up and
saying this person completed it it was
signed this time at this date it was
come these modules were completed
they're in accordance with HIPAA or
whatever and they're good to go you're
now a fully qualified security
professional and it just doesn't work
like that and so today I'm just going to
be talking about how can you make it
more meaningful how can you increase the
impact of your
of your awareness program and how can
you get people really caring about
actually keeping things secure and doing
the right thing a little bit about me
I've worked primarily in the with
startups and small companies for the
better part of the past 10 years my
focus has always been on healthcare but
I've sort of been all over from the
security ends I care a lot about EHR
security I've worked on a lot of data
platforms data registry so orthopaedic
data registries cardio data registries
Insurance data registries dental why if
you've gone to your doctor recently
probably seen that they have a web
portal you log in you see all your test
results and all that and so I work a lot
on those to work a little bit with
medical devices and all that from the
compliance ends I work across the entire
spectrum of health care compliance and
so it's not just HIPAA if any of you
have been involved with SMS especially
in the use in the healthcare use case
you have TCPA which is like the HIPAA of
SMS and then I also go into insurance
quality programs and so if any of you
work in that realm
I'm talking like MIPS dealing with APM's
B CPI advanced if that means anything to
you I'm sort of in that world I'm on
those calls with CMS do a little bit ISO
standards with medical devices 1 3 4 5
if any of you have worked with that
before currently heading security and
compliance that come in called Co
technology we collect patient data and
then do analytics against it and we help
submit for a bunch of these quality
programs from insurance companies and
all that before that I worked at u.s.
startup that was part a branch of an
international company we did a lot of
IOT stuff and so I worked a lot on the
hardware security and compliance of it
and so if you've ever worked with
Hardware before think working with
wireless carriers getting FCC certified
PTC RB certification the whole lot and
then obviously ISO behind the menu
factoring guns actually started off my
security career in McDonald's when I was
really young my older brother he told me
about how the power grid was vulnerable
and that the attackers are coming and
that we should all be concerned and so
this was you know I'm probably in the
first grade when this is happening and
so I go to McDonald's and I want to be
cool and there's this girl I really have
a crush on and I want to be impressive
and so you know here's first grade me
and I start telling her about attacks
against the power grid and so I got
interested in that way and you'd be
happy to know that under a my brother
who told me about these power grid
issues when he was in the third or
fourth grade is now doing network
security and so it worked out for
everyone just like probably many of you
started off playing around with web apps
and game security back in 2004 this is
when I finally got 56k dial-up if any of
you remember that there's that
transition from like 36 or whatever it
was 256 and I'm like I can finally go on
and do stuff now yeah and then ADSL
happens and beyond just you know
splitting my idea cell lines I could now
actually load web pages and you know
look at requests and do things over the
network without being charged 500 euros
a month which was really nice so thanks
ADSL and thank you
punkbuster for making it really easy if
any of you are gamers and have played
around with that Thank You phpMyAdmin
for all the fun times and I don't know
if anyone remembers PHP nuke it's was
the PHP or the CMS for pretty much
everyone so brief agenda going to talk a
little bit about the risks that we
actually face today as just sort of an
average company that isn't you know
fortune 500 or fortune you know 50
building a security culture how do you
do it what does that mean you know and
we talk a lot about empowerment
more often than not it's a buzzword how
do you make it not a buzzword I'll talk
about business buying and so I exist
sort of between the developers and just
regular people and the exec and so I
spend a lot of time in this realm and
this is something we don't often talk
about is if you want to get a program
approved how do you do it and then I'll
talk about the Google Docs fishing
incident how many of you remember that I
think it was May 2017 how many of you
weren't affected by it okay only one so
that's good that's good it was pretty
bad
modern risks and threats so what whoa
let's create a baseline and talk about
what what are things that are actually
impacting us causing data breaches
probably the best place to look in
general is the Verizon
DBI are the data breach investigation
report and in the executive summary
there is a really great quote that stuck
out to me and I really take this to
heart whenever I'm approaching security
and says ignore the stereotype of
sophisticated cyber criminals targeting
billion-dollar businesses most attacks
are opportunistic and target not the
wealthy or famous but the unprepared and
so whether you're Salesforce Microsoft
Amazon Co technology you know random
company X you're a small dental clinic
what people are motivated by is cold
hard cash and they want to make money
they want to get your data they want to
make money or they want to wreak havoc
as I'm sure some of us used to do when
we were younger and so even if it's a
nation-state attack there are levels to
it not everyone is this super advanced
you know Pro criminal wearing the dark
hoodie and the sunglasses you know
furiously typing they're going through
three keyboards a day right you know
often times it's just regular people who
are just kind of running scans and they
have an nmap script and then they're you
know seeing if you have open pores sort
of you know they you they can watch an
SMB exploit or something and that's it
right and so whether you're an
enterprise or a small company if you're
unprepared you're going to be targeted
I don't know if you can see this too
well this is from the DVI or this is a
huge report I don't have time to go
through everything it's broken down by
industry and really detailed report if
you haven't seen it before I really
highly recommend it it's a great
resource but the point of this slide is
that you know what what are our risks
and the answer is all the things you
know you have hacking people improperly
disposing of things people publishing
things they don't don't really need to
be publishing you remember Sony for
example with their private key you know
malware theft phishing everything right
people
internal actors and so it's it's a wide
array of thing so I did if you look at
per industry let's use healthcare as an
example you can dig deeper and you can
say ok well half or more of the risks
you face are internal threats where
people don't know what they're doing
they're making mistakes they don't have
you know a process that guides them
through it and so they send patient
health information to the wrong person
or they upload patient files to you know
and open to the public internet ftp
server but the threats are it's
everything because healthcare is sort of
my world I think it's always useful to
to look at the office for civil rights
at data and so the HITECH Act pass in
2019 they say that if you have a data
breach you're a healthcare company right
and the data breach affects 500 and more
people you have to post this data you
have to report it to them and then it
gets put on this website and so the if
you just google OCR data breach portal
you can find it and so I pulled the data
from 2016 January 1st through yesterday
right so I think that was June 1st and
these these numbers are pretty startling
it and so hacking IT incidents accounted
for 12 million four hundred thirty
thousand 601 individuals affected by
data breaches in healthcare alone this
is in two years right unauthorized
access this is this is a person problem
right it's a training
it's doing the right thing problem two
million four hundred forty thousand five
hundred fifty six theft almost a million
losing things you're just the losing
things right that's fifty thousand
eighty seven improper disposal forty
thousand and so when you compare let's
say improper disposal with hacking and
IT the number is small but thinking
about it like this this is nearly 40,000
real people just like URI who go home at
the end of every day and they're
focusing on the real problems that are
real people with real struggles and they
just want to get through the day provide
for their families but because of
improper disposal they get a letter in
the mail saying hey we don't know what
happened with your data you know we
didn't dispose of it properly
the the truck the door flew open and all
the papers fell out and so if you've
been around health care for a while you
know this happens all the time
one note about this though this does not
include the breaches that are actively
being investigated which go back all the
way to 2016 which probably adds millions
more to this after they're done and so
this number will constantly change but
this doesn't include that it also
doesn't include breaches affecting under
five hundred people and it doesn't
include the breaches that were never
reported so if you've worked in health
care there's this problem where nothing
is a data breach because some nuance in
the law or some interpretation says it's
not really a data breach I did a I did a
risk assessment and it's totally cool
don't worry about it so I live in the
greater Seattle area geographically it's
it's in county called King County and so
you have Seattle on one side and then
you have you know water and then you
have Bellevue which is where Expedia is
Redmond where Microsoft is a lot of tech
companies everyone's there Google
Facebook startups everyone you can
imagine is in Kent County there are a
lot of people there and so King County
Sheriff's Office is more of the rural
areas they also you know patrol some
cities they do a contract and so I
thought okay we always talk about theft
and laptops being lost and stolen
so what do
that actually look like when you get the
data and so this is this is one agency
one agency out of many in a pretty tiny
area you can drive all around it in
about an hour
unless there's traffic which is most of
the time if you're from Washington you
know this very well they just closed
down i-5 by the way really bad 997
laptops were stolen almost all of them
were car thefts and almost all of them
more residential robbers right or and so
if you look at your threat model is
stolen laptops in there if it's not it
should be because the idea that people
are just going to keep it safe don't
worry I have it on my back it's in my
home it's safe that's not reality you
can see by the numbers these are people
calling the police
saying somebody just robbed my home and
your laptop is stolen and now whether
it's you know advanced nation state
attack getting fifty thousand patient
records or it's somebody stealing your
laptop these numbers by the way include
many many instances where the laptop was
just stolen it's still a data breach and
this is real people's data being being
stolen and so the risks out of glance
are everything happens all the time
but there's there's one thing that that
keeps coming up almost all of the
threats and risks that you face can be
mitigated by having people who are aware
who are trained and actually have the
tools to do the right thing and to
report phishing emails and to get in
contact with you as soon as their laptop
is stolen there are things you can do
but almost never do people do report it
because they're scared of being
reprimanded they don't care they don't
know who do I report it to you know am I
going to lose my job right and so when
you're talking about building a security
culture you're talking about solving for
those problems the dbi are includes an
interesting section of phishing emails
and almost all of them go unreported
even when quit a tiny tiny percentage
things like seven percent end up
reporting it and the
reports on average the fastest report is
20 minutes after somebody clicked on
something right but more often than not
you know they report it okay nothing
really happens or they don't report it
or they don't know how to report it and
so nothing ever happens this is from the
2018 health information management
system society at hims cybersecurity
survey and so I'm focusing a lot on
healthcare this kind of applies to
everyone in some way or another but it's
it's it's kind of like the DB IR for
health care and so these numbers are
interesting because in the top left you
know what what percentage of your
organization's IT budget goes to
cybersecurity not your organization's
budget your organization's already small
cyber C or the IT budget right almost
all of them are 1 to 6 percent that's
tiny
that's almost nothing and if you've
worked in security for a while you know
that this is nothing between the tooling
and the people if you work somewhere you
know like Seattle or San Francisco the
salaries are just way too high you know
this means that there are too few people
there are too few resources there's too
little time to actually implement
anything some do a pretty good job some
don't know about 15 percent don't don't
even know there's no specific thing
which probably means you go to your boss
and you say hey I need this and they're
like write a business case in your own
you just say actually this probably
isn't that important I think we've all
been there at one point or another and
then the bottom left the change of
resources
yeah it's increased it's increasing
every year if you go back and look at
the hem survey for 2016 to 2018 it's
increasing almost every single year
which should be a great thing right but
11% now it's kind of it's not really
increasing or staying at the baseline
for some it's going up or going down a
little bit but when you look at the
section on security awareness and
training we're spending more on
cybersecurity we're hiring more people
we're getting really cool too
and all this cool stuff and like
zero-day advanced protection and you're
making under 20 million dollars a year
of revenue and you're not in healthcare
or finance and like you got this really
cool tool but when you look at educating
your workforce
almost nobody does it daily weekly or
bimonthly almost everybody does a
monthly training or a quarterly training
or biannual training some people have no
idea and so MUC that this service is
taken by cybersecurity leaders so people
who are leading their organization
they're just like I don't really know
all right and so it's it's not a
priority and the frequency is low and so
what happens well let's go back how many
of you remember you know the details of
that training that you took three years
ago in that portal that looks like it
was designed back into the 2000s and you
checked the box and you've really took
it to heart now you care about your
company's cybersecurity posture is there
no and that's the point and you know
where cyber security people were
professionals at this and even we were
just like yeah whatever we'll just go
with our skills but that's not the way
to do it every organization is unique
every organization has their own things
their own workflows that you need to
accommodate for right and people just
aren't paying attention because it's
done just so casually it's nobody
spending money on it it's not a hot
talking point you know would you rather
get more ASAS which I'd argue maybe you
shouldn't use ASAS at all or would you
invest in workforce training which has
the biggest bang for the buck
why'd argue based off the data we saw
how almost everything is directly mapped
back to people being educated and being
able to you know confide in somebody hey
this happened being able to say yeah I
was compromised that focusing on
workforce education is probably a lot
more bang for the buck it's a lot
cheaper it's easy to do you can do it
with one person and it's very effective
and and this goes to the heart of what
we were talking about it is the the
actual program in almost every company
checks the box but it's not about doing
a training and signing a training saying
you you did it I've had people in the
past finish a HIPAA training and then
hours after they go and they've you pH I
out of curiosity one of my headers in
the training documents I make is do not
you pH out of curiosity and so this idea
that we're just gonna give people these
annual trainings or quarterly trainings
and everything's gonna be great it's
ridiculous it just doesn't work when you
care about something if any of you are
activists about anything you care
because you get this this feeling in
your gut you you it's the culture and
the attitude of the organization you're
supporting or the cause whether it's you
know gender equality or climate change
or whatever it is or maybe in
cybersecurity you or compliance you have
your own thing but it's that feeling you
get in your gut that you feel like what
you're doing matters that that you have
people that you can coordinate with to
actually do the thing but if you just go
and you check boxes and you say yeah I
did the training very little ever comes
of that and so let's say you're starting
security education and awareness program
or any sort of education awareness
program the first thing I tell people to
do if you're starting out of nowhere is
just do something put content out there
open the floodgates and have volume one
of the things that I like to do is I
like to send out a weekly newsletter or
or something that people will actually
read going through new and current
events and applying it to what we're
doing and here's why it's important and
here's what you can do about it and yes
we're talking about a nation-state
attack against us-based universities but
the world is not ending there's
something you can do about it right you
can pay attention to your emails you can
keep things updated these are tangible
things you know how to do that you can
do and I encourage you to do them post
interesting articles go on
you know if you're almost everyone here
is probably on Twitter go to a website
Malwarebytes blog right and just post
things to your deaf team to your admin
assistants everyone go on slack and just
post an article and say hey this this
this this might be relevant to you this
equifax thing hey let's talk a little
bit more about this it also tells tell
stories you know speak up in meetings
use your own experiences and talk about
how is this relevant to you and what are
the implications to you what can you do
about it right we have this tendency
almost to when what when we do things
like this is we just post the facts you
know most of us are engineers we think
in terms of facts but most people are
not like this even a lot of technical
people who are outside of security you
need to say okay this is bad but here's
what went wrong here's what we do that
would prevent this we have two factor
authentication so if this attack hit us
it would not work and people respond to
that because then they say now I
understand why I have to do this thing
every time I log in now they're going to
advocate for two-factor authentication
on Dropbox even though there's only
business information on all patient
information there all right and so get
get content out there be creative on how
you do it but always follow everything
up with this is this is why it matters
and it's going to be okay because we're
already doing things to stop this and
the things you do they actually make a
difference probably the most overlooked
aspect of security awareness training
building the culture of security is is
we think about it in terms of a security
program you have a program charter and
if any of you do project management it's
it's it's just this thing and it has
objectives and shareholder value in this
and we're gonna post the article and
then you know all of these great things
will happen and the ROI is going to be
great and yeah everything's awesome and
so to an executive that might sound fine
but in practice your goal is to protect
that data those 15 million individuals
that had their most sensitive
information breached in health care
alone since 2016 - now you're focused on
that and so you need to make it work and
part of that is realizing that at the
end of this conference at the end of
this call you know I'm gonna go on a
flight just like you all are and we're
gonna get home and we're gonna see our
loved ones or friends we're going to go
back to work you know socialize with the
people we usually socialize with take
the bus we're gonna deal with the
struggles that we that we all face and
you know we're gonna be distracted by
big events in our lives and so when
you're communicating to your your your
team when you're building out this
program when you're thinking about how
to word or message something you need to
think about the fact that things happen
good things happen bad things happen
people are distracted and if you catch
them out of bad moment when they're
struggling with something or something
really terrible happened to them you've
destroyed your relationship with them
and they're they're going to adjust the
in one ear out the other
and so it's absolutely critical and this
is something that's really hard to teach
is is have empathy and really keep an
open mind transcend security for a
moment transcend you know KPIs and
deliverables and all that fun stuff and
just think about like these are real
people that I'm talking to and yeah I'm
at work right now I'm supposed to be a
professional it doesn't matter
think about what a business actually is
right a business is in a state of
Washington or wherever I have a document
saying that I'm a registered business
but look around in the room with next
time you're in a meeting it's all just
people Jeff Bezos is just a person goes
home he likes to make cocktails I go
home I walk my dog you know I like to
run what we all have things and so
whether you're a massive enterprise or a
small company we're all just
individually people but when we go to
work we change almost and we like to
take all emotion out of everything
we do and we like to think of people as
resources whether it's intentional or
not if you do that when you're trying to
teach them something when when you're
trying to you know teach against their
better instincts when you want them to
do something really uncomfortable like
report that they got owned they're not
going to do it and so you need to
consider this the Las Vegas shooting
after that happened I didn't post
anything for about a month and a half
people were affected by that and I don't
know exactly who I know some people were
I don't know how you know people that
were indirectly affected but you have to
consider this you can't just go on on
regular schedule and say okay I'm going
to post all of this great content and
we're gonna talk about two-factor
authentication
after you know somebody may have lost
somebody or one of their family members
or friends the Boston Marathon bombing
same thing that I can whisk a vent after
event and now we're more connected than
ever that everyone feels the impact of
these things that happen and so you need
to be unusually aware of these things
and adjust what you're doing to that and
also give people a purpose and this goes
back to if you're an you know activist
for something you you want people to
feel like their contribution actually
matters so if you talk about politics
why do people not vote because my vote
doesn't matter okay but it really does
matter so now how do you convince
somebody that it does right you don't
want them to feel that way when they get
to that point where they feel like oh my
vote doesn't matter I'm just one person
out of 200 people in my company
okay well then they're just not going to
do anything they're just gonna they're
they're going to stop reading the things
you put out they're going to stop
reporting things they're not going to
secure their laptops they're not going
to take the threat seriously so they're
not going to try to mitigate against
them they'll leave their laptops in
their cars right they'll you know leave
their laptops out at Starbucks and so
what they don't see is what actually
happens so show them videos of that
incident in Starbucks where two people
were just having coffee right there with
their computer somebody went out and
snatched it
show them videos of dump trucks filled
with all of this stuff that needs to be
shredded confidential information
opening show them a video of zero days
actually being used at black hat or Def
Con and show them hate like that you're
owned right they need to see it and then
you need to tell them here are the
things that you can do to mitigate
against these threats and you can
actually do it right but be very very
conscious of the fact that they're real
people and you don't know what they're
going through next thing is is you need
to make everything simple and so outside
of the security team whether it's
developers or its administrative
assistants or it's an executive how do
you know somebody knows what phishing is
you know what phishing is I've known
what phishing is for the past you know
two three decades
okay well people probably don't I got
asked recently I made this mistake
what's phishing I just said okay I'm
gonna talk about phishing that didn't
work half the people didn't know what
phishing actually was so don't make
assumptions spell everything out for
them make it accessible as possible so
when you're talking about phishing what
is phishing how does that look like
structure your content around this idea
that people want to know but the only
way for them to know is to start at the
very beginning just because you know
you're ten twenty thirty years into your
career doesn't mean anybody's even
started and a lot of devs don't have a
security background they don't
necessarily know what sequel injection
is should they yeah okay well what's
your solution should have known about
sequel injection okay how's that going
to work they're just going to go and
they're going to learn about sequel
injection and they're gonna start
incorporating secure development
practices absolutely not I'm gonna say
well this guy's kind of an ass told me
to go warn sequel injection this is
important did you see our risk registry
it's a high or very high impacts very
high okay well is that really a strategy
how about you just have a conversation
with them and say hey cool I did this
really cool thing you want to see me
actually do a sequel injection and then
they see it and they go out and they
take a class about it this has happened
to me before give them resources to
learn say you know hey this you know
person on YouTube this is really cool
stuff let's do a demonstration show them
like how you actually look for these
vulnerabilities in your network just
bring somebody along and say you know
hey you want to see something really
cool because at the end of the day we're
just people and we do you separate into
silos but ultimately we do want to be
part of something bigger than us but we
need a way in have any of you ever done
a ride-along with a police department
once how have you ever shadowed a
physician in a hospital or clinic have
you ever have you ever been an intern no
interns have you ever done anything
where you feel like you really want to
do some or you're in a high-pressure
situation with somebody you don't know
and they tell you to do something and
you try to do it and you just fumble I
think everyone's sort of being in that
position that's how people feel when
they're interacting with you you're the
security team right you're the technical
guys you do this black magic wizardry
and you know you have a hoodie on and
your sunglasses and you have 10 monitors
up and like you're not even using an
Intel i7 you're using an AI 15 you know
that's what people are thinking about
though it's true it really is you know
they don't know this stuff at all and
you get you have to give them the
opening and explicitly tell them this is
what you do and when you give them those
instructions you have to you absolutely
have to make it as simple as possible
don't assume anything
when you think if you have to think if
it's simple enough it's not simple
enough and use verbiage that they can
use so for example in the keynote speak
there is you know kind of a
a little thing of the word cyber cyber
security do I like the word probably not
all the time but that's what people use
and so when I'm training my team I'm
training an executive that is definitely
vulnerable to a whole host of things and
if their own really bad things will
happen when they go to the conference
and they hear about cybersecurity they
need to the skills they have are going
to enhance that experience and for that
to happen they need to know what
everyone else is talking about so in
healthcare I need to know that you know
Hospital CISOs are going out and using
this verbiage so I'm going to
incorporate that into my program keep
that in mind you know what are they
being exposed to what do I want them to
see in here and what words are they
using and then copy those words so it's
familiar to them it's not perfect it's
not the ideal solution but it's also not
ideal to have 15 million patients
between 2016 and yesterday have their pH
I patient health information breached
because of things that could have been
completely avoided by having one person
doing this you know two three four hours
a week spell everything out again people
approach this almost like they're
infants not in a bad way but they don't
know what to do you have to tell them
when you get a phishing email send it to
here here's a document here's where you
can find it send it to here when I tell
people you know if something happens you
lose your laptop and all of my trainings
and all of my talks I tell them the same
thing if it's 3:00 a.m. and I'm in PTO
and I'm in a foreign country call me
text me you know do whatever you need to
do to make sure that I have eyes on it
and it is okay I will take care of it
and you're not gonna get in trouble for
it you need to spell it out for people
because even if they know even if you're
a seasoned pro just because you know
something doesn't mean you feel
something and you need to get them to
feel the the camaraderie and and and to
to build this muscle memory where
they're just
everything to you and so in an ideal
world people are sending you these
things all the time but they will only
ever do it if you spell it out for them
you have to spell it out word for word
this is how you do it for every simple
thing and so if you ask most people in
an organization how do you report
fishing when should you report fishing
what is fishing nine out of ten times I
don't know
I t-handles it okay it's that an
effective strategy probably not what
what is more effective that you have a
place where people can report it they
know how to report in they actually
report it right and so then you can act
on it the last thing is you know tell
people it's not their fault you know
it's you know we've created this culture
where it's almost like if you do these
things it's a bad thing and so now
you're a bad person but the reality is
again their experience is complicated
they're doing things other than what you
do full-time and because they exported
the wrong things stored it on their
computer doesn't mean that they're bad
or they're bad person than they should
be penalized problem is your system
sucks and you you didn't create a
solution that would prevent them from
doing them if they click on the link
well yeah will you go into this job
knowing they're going to click on the
link and so are we going to get angry at
them and tell them what you did was
really bad and you know it's completely
your fault but don't worry we can fix
you that's the conversation that's
happening across most organizations
today and it doesn't work we've seen it
hasn't worked for you know since the
internet was was invented it just
doesn't work right and so if if I go to
any one of you and I say you know one of
your talks if any of you guys are our
speakers and I come up to you and and I
just say well you're talking was kind of
sucky and everything you know is wrong
but don't worry we'll help you through
it you're not going to think of me as a
nice guy who wants to help you right
that is not going to happen the exact
opposite will happen so why is that
different for anything else in life
right so spell everything out
you need a reprimand policy that works
so show of hands again who's worked in a
healthcare environment in some capacity
or another so you you all may know that
there is in HIPAA a sanctions policy
it's codified into law it was passed by
Congress you need to have one have a
policy that is sane and makes sense what
do you get as a business or as a
cybersecurity team when somebody reports
they clicked on a link and then they're
possibly terminated you need to do away
with our KIAC the reprimand policies
that say everything you do is bad here's
the right thing to do if you do that
thing you're probably going to lose your
job or there's a something on your
record you're never going to be promoted
how is that going to work you know what
the result is the result is probably I
would guess that they're not going to
report anything to you and the dbi are
I'd encourage you all to go see the full
report of the section on a reporting
phishing you see exactly that and so
fear doesn't work it has never worked
when people get scared they pull back or
they fight back and so either you make
an adversary or you get somebody who's
never going to be present won't listen
to what you're doing and they won't ever
have that feeling like yes what I'm
doing is important and then business
buy-in we're running short on time so
I'll kind of cruise through this do it
out of small-scale post articles get
some data points on what works what
doesn't this is a process that you you
that develops over time you're not going
to get it right the first time find out
what your cadence can be how long it
takes you to put this stuff together
what's your time investment and then use
resources like the DB ir and the other
resources I had in the slide to sort of
get some data as to you know what are
the threats and what does it look like
and can this program mitigate them
whenever you're going to a manager or an
executive I know because I live in this
world this is all I do you need a
proposal in hand don't wait for
permission to get something started if
you have one or two hours that's more
than enough to write a justice
simple bare-bones proposal put it on
paper have answers for people you know
it's effective it's a low cost you want
to highlight the benefits that people
are gonna burn out less they're gonna
care more they're gonna make fewer
mistakes they're going to you know we're
going to increase interdepartmental
engagement and all that fun stuff
leverage your mission and values
especially in the c-suite senior
management people love talking about
their mission and values I say this kind
of blandly because to a point it is
people just want to hear what they want
to hear use that to your advantage to do
what really matters and so tie
everything back into your mission and
values make it the forefront of
everything you do and then bring it all
back to the bottom line how is this
going to help us about 60% of the
threats that we face can be solved by
this to some extent or another mitigated
and it's going to affect our bottom line
in this way average cost of a breach is
this we could probably decrease it by
this not everything needs a bonafide
source sometimes you can say well I
guess it's about 30% this is a proposal
you just want to get your foot in the
door so as somebody in the c-suite I see
that I'm like okay cool we can run with
this but if you make somebody who's
already doing a billion things have to
stop and ask you too many questions they
don't get it it's never going to happen
so come with a proposal and end I
strongly encourage you always Drive be
persistent and if it doesn't work the
first time keep trying and if that
doesn't work you really care about this
you want to get better at it you want to
improve your security do it anyway send
out articles what's your manager going
to do don't talk about cybersecurity in
the meeting right so just do it if you
care about it enough you will find a way
and so I don't really have time to talk
about this I'm you know probably a
minute left but essentially what
happened was we had a massive vendor
fortune 100 company has something to do
with sales and our representative for
this undisclosed sales organization that
may or may not have a cloud as a logo
they're our rep sends us an email one of
our it was our Salesforce manager who
clicked on it she realized right away
something was horribly wrong within one
to two minutes everyone was on slack
going crazy calling me texting me you
know I'm walking down the street this is
what Seattle looks like most of the time
there's construction this is this is
going towards Amazon the sea of blue
because everyone has the blue badges and
I was I was right here when my colleague
Brian he's one of the devs he gets a
message on his slack because
everything's on silent I'm getting lunch
man I'm gonna eat and he tells me this
happening and so within one minute we
had a report I was able to run up the
hill and we we got it contained no
patient data was breached if we didn't
have everything I just talked about if
they didn't trust me if they didn't have
the tools to know where to report and
how we would have been in a lot of
but we weren't and so that's the
presentation thank you
[Applause]