[00:41.620 --> 00:42.960]  No, I hope not.
[00:43.720 --> 00:44.980]  Hopefully not my career.
[00:55.610 --> 00:56.500]  All right.
[00:56.700 --> 00:57.320]  Hello, everyone.
[00:57.720 --> 00:59.020]  Another talk here.
[00:59.140 --> 01:00.280]  How's the conference going?
[01:01.280 --> 01:03.020]  Still excited is when you started?
[01:03.740 --> 01:04.630]  All right.
[01:05.380 --> 01:07.660]  So repeating the same messages.
[01:08.560 --> 01:17.500]  The last talk of the night here in this room has changed from social steganography, which is tomorrow morning now, to medical devices, security, and privacy issues.
[01:17.560 --> 01:18.240]  He's dead, Jim.
[01:18.470 --> 01:19.190]  Not really.
[01:19.840 --> 01:21.240]  So stay if you can.
[01:21.460 --> 01:22.340]  I'm sure it will be a great talk.
[01:23.570 --> 01:24.920]  Volunteer workshops, please.
[01:25.070 --> 01:25.840]  We need help tomorrow.
[01:26.220 --> 01:27.320]  Volunteers for the workshops.
[01:27.320 --> 01:30.100]  Go to the info desk and check in and see how you can help.
[01:32.300 --> 01:34.900]  Hackers Got Talent is starting now.
[01:35.180 --> 01:38.940]  So hopefully you get the chance to, after this talk, go visit or not.
[01:39.720 --> 01:41.420]  With that, we'll just jump straight in.
[01:41.820 --> 01:44.060]  The talk now is don't get tangled up in your cape.
[01:44.200 --> 01:47.980]  Hero culture is a negative force in cybersecurity with George Sanford.
[01:48.220 --> 01:48.780]  Welcome, George.
[01:49.060 --> 01:49.480]  Thank you, sir.
[01:50.160 --> 01:50.540]  Good evening.
[01:50.660 --> 01:51.180]  Thanks for coming.
[01:53.820 --> 01:58.560]  I appreciate that everyone decided to drop in here instead of Hackers Got Talent.
[01:58.700 --> 02:02.850]  I promise you I will try my best to be entertaining, but there will be no karaoke.
[02:03.070 --> 02:07.060]  But I do have prizes and a lovely assistant that will be handing that out.
[02:07.380 --> 02:12.230]  So first off, question for you, and we'll dive right in.
[02:12.350 --> 02:17.000]  So I thought it was appropriate for a conversation around capes to show up in a cape.
[02:17.380 --> 02:25.900]  And I'm going to start with the complimentary thing that I've been told is supposed to work in helping build your confidence before you start a talk.
[02:26.120 --> 02:27.460]  So does anybody know what this is?
[02:28.950 --> 02:30.060]  Who got it?
[02:30.280 --> 02:30.880]  Somebody got it.
[02:32.560 --> 02:33.980]  Somebody got it a second ago.
[02:35.660 --> 02:36.540]  Superman pose.
[02:36.790 --> 02:37.820]  Can you... Excellent.
[02:38.100 --> 02:38.400]  Excellent.
[02:40.480 --> 02:40.960]  Fabulous.
[02:41.180 --> 02:42.220]  So I'm going to dispose of the cape.
[02:42.460 --> 02:43.290]  Thank you very much.
[02:43.500 --> 02:45.900]  So how many people are familiar with the Superman pose?
[02:47.320 --> 02:47.800]  Outstanding.
[02:47.960 --> 02:48.780]  Has it worked for everybody?
[02:50.240 --> 02:50.720]  Outstanding.
[02:51.140 --> 02:52.140]  We'll see how that goes.
[02:52.610 --> 02:53.020]  Okay.
[02:53.340 --> 02:58.440]  So let me start off by saying that this is not going to be a deeply technical talk.
[02:58.600 --> 03:04.540]  I'm not going to be introducing new code, showing you new exploits, or popping shells.
[03:04.680 --> 03:05.280]  I'd love to.
[03:06.260 --> 03:07.660]  But I'm not going to be doing that.
[03:09.060 --> 03:13.180]  I want to talk a little bit about how I got to this talk and then we'll dive in.
[03:13.500 --> 03:15.080]  Just some quick background on me.
[03:15.340 --> 03:16.320]  Again, my name is George.
[03:18.360 --> 03:29.340]  I've been pretty much unprofessionally, at an amateur level, breaking things since, ironically enough, a movie came out by the same title as the conference.
[03:29.760 --> 03:32.120]  If that helps anybody date that, a new hope.
[03:32.840 --> 03:45.440]  So beyond that, professionally, I've been working in IT and information security for over 20, 25 years, give or take, in a variety of different roles at a variety of different enterprises.
[03:46.040 --> 03:48.940]  Did a little consulting, did a little this, did a little that.
[03:49.580 --> 03:56.620]  So I came to a crossroads a few years back and it really came down to this.
[03:56.780 --> 04:09.180]  It's either get much better on the hands-on keyboard functions or start working and dealing with the managerial and leadership, the team building aspects of that.
[04:09.340 --> 04:12.840]  And I spent a lot of time thinking about what did I really like?
[04:13.060 --> 04:17.820]  You know, what drove me, what got me excited and woke up in the morning and thrilled to go to work.
[04:17.910 --> 04:19.880]  And it was some of the team building aspects of it.
[04:20.590 --> 04:24.020]  And have had the opportunity to lead a bunch of different teams.
[04:24.650 --> 04:32.150]  Currently, I'm leading the customer success, technical success team, security team at Gigamon.
[04:32.960 --> 04:39.650]  And really driven by what does it take to build an excellent team?
[04:40.330 --> 04:45.360]  What does it take to build exceptional practitioners in information security?
[04:45.760 --> 04:51.970]  And as I started thinking about it, realized that something had kind of gotten stuck in my head.
[04:51.970 --> 04:55.900]  And there were some pretty critical challenges that we're looking at.
[04:56.140 --> 05:04.640]  We're going to talk a little bit tonight about the scarcity, the number of empty analyst chairs that has been reported.
[05:04.820 --> 05:06.590]  So think job security.
[05:06.790 --> 05:11.790]  But we'll talk about those empty chairs and how we start thinking about the thinking about filling them and why those chairs are empty.
[05:12.290 --> 05:14.400]  Because that number hasn't changed in a couple of years.
[05:15.150 --> 05:23.830]  So something got stuck in my head at a talk at DEFCON probably six years ago, seven years ago.
[05:24.830 --> 05:27.730]  So I'm a little fuzzy on some of the particulars.
[05:27.730 --> 05:31.080]  If those of you that have attended DEFCON may be familiar with that mindset.
[05:31.720 --> 05:38.550]  It was either DDTECT or Ken Shoto during a talk about what made good CTF teams.
[05:38.880 --> 05:47.540]  And went into the talk thinking it's going to be different skill sets on, you know, oh, you need to have Python, you need to have Ruby, you need to have people that can do this and that.
[05:47.900 --> 05:53.960]  The thing that stuck in my head as they started breaking down what made successful teams was this comment.
[05:54.110 --> 05:57.170]  That you needed to have someone that was willing to go get pizza.
[05:57.170 --> 05:59.960]  And of course, everybody kind of laughed.
[06:00.100 --> 06:01.640]  But I started really thinking about it.
[06:01.720 --> 06:19.730]  And it's like, you know, as a practitioner and as a leader, oftentimes, if you don't have someone that's willing to walk away from the problem and go get food, if you don't have someone that's willing to maybe not have the spotlight, if you will, so you end up sitting there and getting stuck.
[06:19.730 --> 06:34.170]  They even talked about the fact that they would build things, flags into the CTF that were particularly attractive to rock stars that would get them kind of stuck on that particular piece that they were working on and basically take them out of the game.
[06:35.170 --> 06:58.730]  So, thinking a little bit about that and thinking about what it would take to build a real-world effective team, a small group within that, and thinking about the challenges that we have, the evolving threat landscape, the skills gap, how hard it is, how apparently hard it is to gain the skills that you need to become proficient in the role.
[07:00.440 --> 07:13.020]  I started looking around at people that were obviously crushing it, people that were leading, people that were doing really, really well on a technical level, on a professional level, and asking myself and then starting to ask them, how'd you get there?
[07:13.420 --> 07:14.220]  What did you do?
[07:14.440 --> 07:17.960]  How do you know evil when you see it?
[07:18.110 --> 07:21.880]  And what do you think the most popular answer that I got back was?
[07:26.780 --> 07:29.800]  Can you give her a coin?
[07:29.900 --> 07:30.580]  That's a good answer.
[07:32.340 --> 07:33.140]  So, nice.
[07:33.880 --> 07:36.400]  So, beyond I am evil, which is a phenomenal answer.
[07:36.800 --> 07:40.860]  So, yeah, I know it when I see it.
[07:41.180 --> 07:43.560]  So, which is, well, okay, how do we train for that?
[07:43.700 --> 07:49.200]  How do we pass that along to next people without that huge wealth of experience?
[07:50.830 --> 07:53.500]  So, it really kind of started begging that question to me.
[07:53.600 --> 07:54.400]  What's the secret sauce?
[07:54.600 --> 07:55.460]  How do we build this?
[07:55.520 --> 07:56.620]  How do I drive it into teams?
[07:56.620 --> 08:03.460]  So, around this time, sorry, technical glitch.
[08:04.600 --> 08:17.620]  Around this time, I also had the opportunity at a different conference to listen to a leader, literally an individual that was part of the team that wrote the book on incident response.
[08:17.620 --> 08:22.440]  And their conversation on stage at this conference.
[08:22.620 --> 08:30.320]  And I think they were thinking about business use cases and not so much thinking expansively about the response.
[08:30.500 --> 08:36.520]  But they half-jokingly said, they measure success by the number of analysts that were sleeping on data center floors.
[08:37.120 --> 08:38.720]  Now, I was a leader in this company.
[08:38.840 --> 08:39.810]  I was a manager in this company.
[08:40.000 --> 08:49.840]  And I was thinking about the fact that if I had my people sleeping on data center floors overnight, that this is in some ways a reflection on me and a reflection of failure on my part.
[08:50.100 --> 08:52.070]  Now, I know this individual is probably joking.
[08:52.180 --> 08:58.790]  And I mean, this is an individual that's often rolled up their sleeves and really, you know, committed to doing the work.
[08:58.790 --> 09:04.420]  But at a point, I started thinking about the culture in the environment that I was working in.
[09:04.580 --> 09:07.660]  And all of the different things that were there.
[09:08.330 --> 09:15.900]  So that comment was meant to be funny in some ways.
[09:16.380 --> 09:27.920]  But it, for me, started me thinking down this path of what does the culture look like that says it's acceptable for someone to be sleeping on a data center floor?
[09:27.920 --> 09:30.620]  Now, I think, you know, has anybody done that?
[09:30.740 --> 09:34.140]  Has anybody worked overnight on a project, not walked away?
[09:34.770 --> 09:36.340]  So more than a couple of nights.
[09:36.830 --> 09:39.380]  So giving up weekends, et cetera.
[09:40.070 --> 09:43.810]  So did you feel that that was part of success in that role?
[09:45.420 --> 09:45.860]  Yeah.
[09:46.050 --> 09:47.220]  So I had the same conclusion.
[09:47.570 --> 09:53.220]  Success in this role is me giving up all of these other things in order to be successful in this role.
[09:53.220 --> 09:55.340]  And I started thinking about, well, where does that come from?
[09:56.100 --> 09:58.510]  Where does that drive come from?
[09:58.700 --> 10:01.880]  And more so, where is that being reinforced from?
[10:02.940 --> 10:05.120]  So I started kind of noodling on that.
[10:05.200 --> 10:07.030]  And that's where this part of this talk comes from.
[10:13.650 --> 10:15.830]  So we're going to be talking about hero culture.
[10:15.890 --> 10:18.270]  And I want to make some clear distinctions here.
[10:18.370 --> 10:19.890]  I'm not talking about heroism.
[10:20.710 --> 10:21.190]  Okay.
[10:22.650 --> 10:25.150]  Did everybody see Sophie's talk earlier today?
[10:25.330 --> 10:26.430]  Did anybody miss that?
[10:26.690 --> 10:29.250]  So if you haven't seen it, phenomenal talk.
[10:29.350 --> 10:32.710]  I encourage you to go back and look at that talk and listen to it.
[10:32.790 --> 10:34.530]  Because there's a lot of really great stuff there.
[10:34.970 --> 10:36.390]  That's heroic action.
[10:36.510 --> 10:37.650]  That's heroism in my mind.
[10:37.750 --> 10:38.730]  You may disagree with me.
[10:38.730 --> 10:42.130]  But there is a necessity for heroism.
[10:42.230 --> 10:43.690]  And that's not what we're talking about.
[10:43.790 --> 10:48.350]  We're going to be talking about the culture, heroic culture, not heroic action.
[10:48.970 --> 10:57.050]  When the culture itself becomes standard operating procedure, it necessitates heroic action over and over and over again.
[10:57.050 --> 10:57.890]  Okay.
[10:58.190 --> 10:59.730]  There certainly is a role for heroism.
[10:59.910 --> 11:02.050]  There certainly is an opposition.
[11:02.350 --> 11:06.930]  There certainly is evil in the world that we are more than aware of.
[11:07.190 --> 11:07.670]  Right?
[11:08.170 --> 11:10.530]  So there is a need for that kind of thing.
[11:10.670 --> 11:20.210]  But as a culture working within this industry, so I think oftentimes we've adopted this culture without really questioning why.
[11:21.510 --> 11:28.250]  So for example, and again, I'm going to apologize and I apologize in advance.
[11:28.250 --> 11:30.550]  I'm going to poke a couple of bears this evening.
[11:31.190 --> 11:33.090]  I am not singling anybody out.
[11:33.290 --> 11:35.410]  I don't want to step on anybody's work.
[11:35.630 --> 11:47.070]  But since we live in social media, since we live in spaces together, I've done a little archeology, a little anthropology, and pulled some of these together as examples.
[11:47.070 --> 11:57.350]  So I'm going to ask you to take these just as references, but not use these to action anything in particular, not stop using people, not stop using vendors.
[11:57.910 --> 12:00.970]  But, so, just some examples.
[12:00.970 --> 12:18.670]  This is just a real quick example of some of the advertising, some of the media for not only consumer programs or different enterprises or training courses or professional development within here.
[12:18.990 --> 12:23.870]  So does hero culture lend itself to our industry?
[12:24.050 --> 12:24.490]  Absolutely.
[12:24.490 --> 12:28.470]  When we think hero culture, we think late nights, we think insane development.
[12:28.470 --> 12:29.330]  What do we think about?
[12:29.430 --> 12:33.050]  What type of development cycle are we looking at?
[12:33.270 --> 12:34.370]  We're talking about startups.
[12:34.810 --> 12:35.250]  Right?
[12:35.350 --> 12:38.210]  We're talking about that in a garage moment.
[12:39.290 --> 12:42.450]  So, long hours, lots of effort, et cetera.
[12:42.710 --> 12:44.490]  So, of course, it lends itself to it.
[12:44.530 --> 12:46.330]  And marketing has done a great job.
[12:46.370 --> 12:48.990]  And we've embraced some of that in a lot of ways.
[12:50.590 --> 12:56.130]  So, I kind of want to do, like, just a real quick pulse and tell me if any of these resonate for you.
[12:56.410 --> 13:03.970]  So, who here has unlimited time off through their organization, through their professional organization, through PTO?
[13:04.150 --> 13:04.710]  Just a show of hands.
[13:05.410 --> 13:05.650]  Okay.
[13:05.650 --> 13:06.250]  We've got a couple.
[13:07.110 --> 13:11.970]  How many of these phrases have you heard in the last week or two in your organization?
[13:11.970 --> 13:20.010]  Working around the clock, so-and-so went above and beyond, last-minute firefighting, we have a crisis, blah, blah, blah.
[13:20.850 --> 13:30.430]  So, how many of you work for organizations that, when they recognize and bonus people, that these are the type of things that you see called out in those bonus structures?
[13:30.810 --> 13:34.390]  This team worked all weekend on this project to get this in under the wire.
[13:36.510 --> 13:36.970]  Good.
[13:37.510 --> 13:37.950]  Awesome.
[13:37.950 --> 13:42.270]  So, how many of you think of that as a management failure?
[13:44.050 --> 13:44.570]  Absolutely.
[13:45.990 --> 13:46.510]  Excellent.
[13:46.730 --> 13:47.650]  So, we're on the same page.
[13:47.870 --> 13:50.270]  So, these are the sort of things that I started hearing.
[13:50.410 --> 13:54.710]  I started seeing in lots of these bonus structures and lots of reviews.
[13:55.350 --> 14:02.770]  Lots of nine box, lots of different ways that we evaluate our teams in who's willing to go the extra mile.
[14:03.910 --> 14:05.070]  Not just doing the job.
[14:06.630 --> 14:08.010]  So, we're going to play a little game.
[14:08.230 --> 14:09.650]  We're going to call it Spot the Superhero.
[14:09.770 --> 14:16.090]  And here, I'm going to tie back into kind of the superhero imagery that we're used to.
[14:16.410 --> 14:16.630]  Right?
[14:17.110 --> 14:18.770]  So, what do superheroes have?
[14:19.050 --> 14:20.390]  Typically, extraordinary powers.
[14:20.990 --> 14:23.810]  So, in some cases, maybe they worked hard to get them.
[14:23.810 --> 14:25.050]  Maybe they fell into a vat.
[14:25.190 --> 14:26.590]  Maybe they got bit by a spider.
[14:26.910 --> 14:31.950]  Maybe they were born with them and shot in a satellite from another planet, etc.
[14:32.530 --> 14:35.030]  But, typically, extraordinary powers that go, what?
[14:35.170 --> 14:37.010]  Above and beyond almost everybody else.
[14:37.850 --> 14:39.530]  So, what do they use those powers for?
[14:39.690 --> 14:40.810]  Well, they get shit done.
[14:41.190 --> 14:41.470]  Right?
[14:41.930 --> 14:44.170]  So, often unapologetically.
[14:44.350 --> 14:45.770]  They just are taking action.
[14:45.950 --> 14:47.410]  There's definitely a bias to action.
[14:47.510 --> 14:48.970]  They're not sitting there waiting for things.
[14:49.110 --> 14:52.410]  They don't have to do a whole lot of evaluation of what their impacts are.
[14:52.410 --> 14:53.730]  They just go and get shit done.
[14:54.790 --> 14:59.870]  Often cases, they have limited vulnerability, which is to say, you can only take them out with what?
[15:01.230 --> 15:05.210]  Kryptonite, silver, silver bullet, water, stuff like that.
[15:05.650 --> 15:07.030]  So, limited vulnerability.
[15:07.070 --> 15:08.690]  We'll get into why that's a problem.
[15:08.850 --> 15:10.110]  They're often bigger than life.
[15:10.150 --> 15:12.910]  And when I say bigger than life, they're often bigger than life personalities.
[15:13.530 --> 15:20.810]  They're often personalities that, in other places, would stand out so much that you can't possibly turn away from that person.
[15:20.810 --> 15:23.070]  So, they're often worshipped and adored.
[15:23.230 --> 15:25.690]  They're often elevated above everybody else.
[15:25.790 --> 15:27.410]  There are statues created for them.
[15:27.690 --> 15:29.810]  So, they're often masked.
[15:30.050 --> 15:31.970]  They often operate in obscurity.
[15:32.170 --> 15:35.210]  We don't get to see their other identity within there.
[15:35.350 --> 15:36.790]  They operate in a secret lair.
[15:37.170 --> 15:41.710]  So, they don't go into an office, typically, as their hero self.
[15:42.230 --> 15:42.750]  Right?
[15:42.750 --> 15:45.090]  And there's often a traumatic origin story.
[15:45.390 --> 15:48.250]  There's often something that is compelling them and driving them.
[15:49.650 --> 15:53.570]  Now, extraordinary powers, there's often different rules.
[15:54.450 --> 16:00.590]  So, if, again, let's think about any of the cinematic universes that you choose to exist in.
[16:00.890 --> 16:05.830]  Think about if you went and tore down buildings, trying to take out a bad person, taking out evil.
[16:05.830 --> 16:08.970]  So, this is not the sort of thing that would typically be acceptable.
[16:09.230 --> 16:09.290]  Right?
[16:10.050 --> 16:11.970]  So, there's typically a lack of accountability.
[16:12.370 --> 16:12.770]  Why?
[16:12.870 --> 16:13.690]  Because you're getting shit done.
[16:14.130 --> 16:15.130]  Somebody had to do it.
[16:15.510 --> 16:15.610]  Right?
[16:17.030 --> 16:22.330]  The benefit of their action typically outweighs the means to them doing the action.
[16:23.670 --> 16:26.310]  With limited vulnerability, there's limited risk.
[16:26.430 --> 16:28.250]  There's no need for risk evaluation.
[16:28.650 --> 16:30.730]  Some of these superheroes don't think about, oh, my God.
[16:30.850 --> 16:32.770]  What happens if I don't come home from work?
[16:33.790 --> 16:34.970]  They just walk in.
[16:36.250 --> 16:40.510]  That bigger than life personality can also, in some cases, be a toxic personality.
[16:41.950 --> 16:44.470]  So, that worshiped, adored mindset.
[16:44.810 --> 16:48.550]  Often, we idealize the behavior of these people and we do what?
[16:48.550 --> 16:52.370]  We ignore some of the things that they do that we may not agree with.
[16:52.510 --> 16:54.810]  Again, because they get shit done.
[16:56.130 --> 17:07.270]  Think about the amount of time that superheroes, and again, we're talking spend on their secret identity and their true identity.
[17:07.550 --> 17:14.590]  What I'm saying is the, for example, mild-mannered reporter, world beater.
[17:15.970 --> 17:16.570]  Okay?
[17:17.150 --> 17:18.770]  Costume is mild-mannered reporter.
[17:19.030 --> 17:19.830]  Haircut and glasses.
[17:21.030 --> 17:21.630]  Right?
[17:22.130 --> 17:24.890]  Not the cape and boots and the whole bit.
[17:25.450 --> 17:27.970]  So, secret lair, isolated from the community.
[17:28.070 --> 17:28.790]  Where do they operate?
[17:29.010 --> 17:30.410]  They typically operate on an edge.
[17:30.790 --> 17:33.250]  So, shadow IT to the nth degree.
[17:33.830 --> 17:38.350]  And that traumatic origin story often helps us exclude them from the norms.
[17:38.350 --> 17:41.570]  We forgive them in lots of ways.
[17:43.030 --> 17:44.490]  So, why is this a problem?
[17:45.830 --> 17:48.730]  Well, first off, who wouldn't want to be a hero?
[17:49.970 --> 17:51.150]  So, it's kind of great.
[17:51.270 --> 17:58.750]  You get to do pretty much whatever you want, whenever you want, to whomever you want, without any accountability, and you get praised for it.
[17:59.390 --> 18:01.150]  So, what happens with that praise?
[18:01.690 --> 18:02.790]  Who doesn't like praise?
[18:02.990 --> 18:03.470]  Raise your hand.
[18:04.390 --> 18:05.450]  Who doesn't like recognition?
[18:05.810 --> 18:06.250]  Anybody?
[18:08.070 --> 18:12.370]  So, it's no accident, and this is where we get into the social media piece of this.
[18:12.610 --> 18:17.350]  So, it's no accident that as human beings, we enjoy praise.
[18:17.670 --> 18:23.750]  So, anybody familiar with the Olds and Milner experience with rats?
[18:25.830 --> 18:42.510]  So, Olds and Milner did an experiment, somewhat controversial now, where they wired rats' pleasure centers and put a lever in a box, okay, where the rat had the opportunity to hit the lever for its pleasure center or to get food and sleep and drink.
[18:42.770 --> 18:45.290]  Anybody want to guess what happened to the rats for a coin?
[18:46.890 --> 18:48.990]  They kept pressing the button until they killed themselves.
[18:48.990 --> 18:49.610]  There you go.
[18:50.190 --> 18:50.510]  Come up.
[18:50.750 --> 18:51.030]  Exactly.
[18:51.410 --> 18:53.010]  They kept pressing the button until they killed themselves.
[18:53.390 --> 18:54.350]  That pleasure center.
[18:54.790 --> 18:58.870]  Believe it or not, as social animals, as human beings, we do a lot of the same.
[18:59.070 --> 19:09.310]  That heroic action, that heroic response, that cultural elevation, in many ways, lights up the same centers of our brain as those pleasure centers.
[19:09.890 --> 19:11.410]  So, who wouldn't want to be a hero?
[19:13.350 --> 19:24.490]  So, we're going to dig in a little bit, and I want to break these down into a couple of things, and really, I'm going to try to get you to think about some of this, and then I'm going to give you, hopefully, some strategies that are going to work to help us move beyond this.
[19:25.550 --> 19:28.690]  So, first, essentially, heroes need villains.
[19:29.430 --> 19:30.950]  So, here's the trick question.
[19:31.090 --> 19:31.570]  Here's the trap.
[19:32.210 --> 19:32.890]  You ready for it?
[19:33.610 --> 19:34.310]  Who's the villain?
[19:37.850 --> 19:38.230]  Anybody?
[19:38.730 --> 19:39.110]  Management.
[19:39.710 --> 19:40.090]  Management.
[19:41.130 --> 19:41.510]  Good.
[19:42.030 --> 19:43.410]  So, point for that gentleman.
[19:43.410 --> 19:43.990]  Yeah.
[19:44.230 --> 19:47.270]  In most cases, you'd think it's APT.
[19:47.410 --> 19:48.030]  It's fin groups.
[19:48.250 --> 19:49.250]  It's evil.
[19:49.450 --> 19:50.330]  But it's not.
[19:50.550 --> 19:51.130]  It's management.
[19:51.610 --> 19:52.810]  It's our users.
[19:53.430 --> 20:05.830]  The people that we are asked to protect and to educate and defend are the people that actually become the villains for our arguments and our conversations.
[20:06.130 --> 20:08.110]  We set ourselves against them.
[20:08.110 --> 20:11.270]  And by doing so, we isolate ourselves.
[20:11.470 --> 20:12.530]  We set ourselves apart.
[20:12.710 --> 20:19.070]  In fact, I'll ask you to be honest here, who thinks you're smarter than the people that you work for?
[20:20.530 --> 20:21.330]  There you go.
[20:21.490 --> 20:21.890]  Well done.
[20:22.150 --> 20:24.090]  So, in many cases, I'm not saying intellectually.
[20:24.350 --> 20:24.890]  Maybe we're not.
[20:24.970 --> 20:25.470]  Maybe we are.
[20:25.850 --> 20:29.350]  But we separate ourselves from the essential business processes.
[20:29.710 --> 20:30.710]  So, what do we do?
[20:30.830 --> 20:36.790]  Become people that don't typically get invited to the table unless it's a really uncomfortable moment.
[20:36.790 --> 20:43.350]  We separate ourselves from the people that we need to work with that we actually are trying to drive positive change for.
[20:45.890 --> 20:50.470]  So, it not only makes us, in some ways, feel superior.
[20:50.650 --> 20:51.870]  Again, think of the rats and the lever.
[20:52.470 --> 20:52.950]  Okay?
[20:53.150 --> 20:55.170]  But it belittles those that we're protecting.
[20:55.670 --> 20:56.550]  And does what?
[20:57.490 --> 21:04.290]  Drives a degree of resentment for them, further causing us to separate ourselves, to crawl back into our layers.
[21:07.960 --> 21:09.220]  And it's pretty pervasive.
[21:11.640 --> 21:13.060]  Which takes us to...
[21:13.060 --> 21:15.340]  We crawl back into our layers and we do what?
[21:15.540 --> 21:16.680]  We build silos.
[21:17.380 --> 21:20.620]  When I'm talking about silos, I'm talking about knowledge silos.
[21:20.780 --> 21:22.080]  I'm talking about control silos.
[21:22.080 --> 21:32.300]  In order to maintain our superiority, our elevation, our different part, we build silos of knowledge.
[21:32.540 --> 21:35.000]  We build silos of control of these systems.
[21:35.180 --> 21:36.800]  We don't let that control go.
[21:36.800 --> 21:38.780]  Now, look, this is really easy in security.
[21:38.900 --> 21:42.120]  Because, essentially, we do have to protect people from themselves.
[21:42.240 --> 21:43.720]  And we do have to protect these systems.
[21:44.080 --> 21:47.900]  But in a lot of cases, we do it almost unconsciously.
[21:48.700 --> 21:49.720]  So, here's the question.
[21:50.000 --> 21:53.860]  How many of you have ever struggled with documentation after an incident?
[21:56.300 --> 22:01.420]  How many of you have picked up after somebody else has done work and said, what the hell happened here?
[22:01.500 --> 22:02.620]  And it's like, oh, I got it all up here.
[22:03.280 --> 22:03.860]  There you go.
[22:04.120 --> 22:05.460]  So, we build silos.
[22:05.640 --> 22:06.820]  We separate ourselves.
[22:07.200 --> 22:11.500]  And we convince ourselves that we're the only ones that can do a job.
[22:13.000 --> 22:14.540]  When, in fact, what are we doing?
[22:14.700 --> 22:18.160]  We're making it impossible for anybody else to do our job, to help us.
[22:21.500 --> 22:23.080]  And, again, build that resentment.
[22:25.600 --> 22:28.300]  Which then helps us mask deeper problems.
[22:28.340 --> 22:29.300]  And what are we talking about here?
[22:29.300 --> 22:35.480]  So, we get the recognition for diving in at the last minute.
[22:36.800 --> 22:37.740]  Solving a crisis.
[22:38.200 --> 22:39.220]  Putting out fires.
[22:40.140 --> 22:40.560]  Okay?
[22:40.660 --> 22:41.780]  I'd like you to think about something.
[22:41.980 --> 22:46.560]  So, we'll take that same caped superhero from another planet.
[22:47.340 --> 22:49.560]  So, I'm trying to avoid anybody suing me here.
[22:50.180 --> 22:51.860]  That superhero from another planet.
[22:52.000 --> 22:55.620]  Well, imagine you live in a city where that superhero is working all the time.
[22:56.300 --> 22:58.940]  How much budget do you think the fire department gets in that city?
[22:59.560 --> 23:01.820]  What's your expectation when your building catches fire?
[23:02.020 --> 23:03.820]  Oh, XYZ will come in and save me.
[23:03.960 --> 23:04.680]  Not the fire department.
[23:04.820 --> 23:08.920]  What happens when that person, that superhero, stops responding?
[23:09.880 --> 23:10.640]  People die.
[23:11.480 --> 23:12.280]  Things get broken.
[23:12.280 --> 23:12.360]  Things get broken.
[23:13.340 --> 23:17.860]  We spend our time, in many cases, going crisis to crisis to crisis.
[23:18.540 --> 23:24.220]  And we convince ourselves that the essential reason that happens is we are handling crises.
[23:24.540 --> 23:26.120]  We're dealing with software.
[23:26.400 --> 23:27.680]  We're dealing with zero days.
[23:27.860 --> 23:31.160]  We're dealing with breaches and complexity.
[23:31.900 --> 23:37.720]  When really what we're doing is we're not spending time solving for those problems that we know is there.
[23:37.720 --> 23:39.780]  We talk about ransomware a lot lately.
[23:39.960 --> 23:41.780]  And what are most of the fixes for ransomware?
[23:42.200 --> 23:43.400]  Basic blocking and tackling.
[23:43.560 --> 23:44.980]  Things we've been talking about for years.
[23:45.400 --> 23:48.160]  So have we been effective at driving that change?
[23:48.300 --> 23:48.480]  No.
[23:48.600 --> 23:48.800]  Why?
[23:48.940 --> 23:52.840]  Because in one case, we dive in and we save the day, which is somewhat self-serving.
[23:53.460 --> 23:55.960]  And then say, well, we can't do all the basic stuff.
[23:56.060 --> 23:57.400]  We can't do network segmentation.
[23:57.520 --> 23:59.780]  We can't do patching and updating and that kind of stuff.
[24:00.180 --> 24:01.700]  Because we're busy saving the day.
[24:02.440 --> 24:08.100]  We build this self-replicating, defeating system for our organizations.
[24:09.800 --> 24:10.440]  All right.
[24:10.580 --> 24:11.200]  With me so far?
[24:11.760 --> 24:12.260]  Okay.
[24:12.540 --> 24:14.320]  Here's the really scary and nasty stuff.
[24:14.560 --> 24:19.680]  That's kind of the systematic, systemic problems that we're seeing.
[24:19.900 --> 24:21.560]  This is the stuff that really kind of bugs me.
[24:22.520 --> 24:23.920]  Not everybody can be a hero.
[24:24.860 --> 24:28.160]  So just show of hands, who's new to information security?
[24:28.160 --> 24:31.040]  Who's, like, less than a year into the...
[24:31.040 --> 24:31.620]  Excellent.
[24:32.100 --> 24:35.160]  Who's been doing it, say, one to three years?
[24:36.720 --> 24:37.400]  All right.
[24:37.620 --> 24:38.500]  Three to six?
[24:40.520 --> 24:41.460]  Six to ten?
[24:42.560 --> 24:43.400]  Longer than ten.
[24:44.760 --> 24:45.420]  All right.
[24:45.560 --> 24:46.220]  Longer than tens.
[24:46.660 --> 24:47.060]  Okay.
[24:47.580 --> 24:48.500]  Everybody saw you.
[24:48.740 --> 24:49.900]  I'm going to put you on the spot.
[24:50.600 --> 24:51.120]  Anybody...
[24:51.120 --> 24:54.000]  Is anybody willing to answer an interview question?
[24:54.760 --> 24:55.820]  Cold and in the room?
[24:59.020 --> 24:59.540]  Anybody?
[25:00.940 --> 25:01.460]  All right.
[25:01.660 --> 25:01.920]  Excellent.
[25:02.280 --> 25:02.440]  All right.
[25:02.600 --> 25:10.340]  Now, before I ask you the question, okay, I have the answer written out on these five pages in detail.
[25:10.780 --> 25:12.200]  Still willing to answer the question?
[25:13.980 --> 25:14.360]  Excellent.
[25:15.180 --> 25:16.440]  So can you give them a book?
[25:17.080 --> 25:17.640]  Thank you, Ward.
[25:18.300 --> 25:18.620]  Excellent.
[25:18.740 --> 25:20.160]  I'm not actually going to ask you the question.
[25:20.200 --> 25:21.960]  But I'm going to tell you what the question would be.
[25:22.160 --> 25:24.760]  How many people got asked, what happens when you Google?
[25:27.640 --> 25:28.000]  Anybody?
[25:29.040 --> 25:29.800]  Familiar with this?
[25:30.660 --> 25:31.020]  Excellent.
[25:31.480 --> 25:33.200]  Did everybody feel comfortable in their answer?
[25:35.480 --> 25:35.840]  Excellent.
[25:36.340 --> 25:37.400]  Here's an interesting thing.
[25:37.520 --> 25:38.240]  And I'm going to posit this.
[25:38.340 --> 25:41.400]  And a lot of people use this question and there's a lot of debate on it and there are a couple of threads.
[25:42.480 --> 25:47.560]  But for me, the only real positive answer to that is, how much detail do you want?
[25:48.560 --> 25:50.080]  But really, what am I asking?
[25:50.300 --> 25:53.180]  When I'm asking, what happens when you Google?
[25:53.180 --> 25:55.000]  So I'm not asking what you know.
[25:55.180 --> 25:59.680]  I'm asking you to tell me what you think I know.
[26:00.680 --> 26:04.960]  I'm looking for you to pare it back to me and answer that I find acceptable.
[26:05.120 --> 26:11.860]  Because look, you may know, you know, from pressing the key, electrical signal back to the motherboard, back to the...
[26:11.860 --> 26:17.860]  You may have it at that level of detail, but unless I hear what I want to hear, what I expect to hear from that, do you think you're getting the job?
[26:21.160 --> 26:33.700]  So, for my way of thinking, that kind of open-ended, broad question doesn't really help you understand someone's technical ability or their potential success in the job.
[26:35.600 --> 26:36.940]  Thank you for volunteering.
[26:37.900 --> 26:38.900]  So, I know that can be scary.
[26:39.080 --> 26:39.220]  Okay.
[26:39.620 --> 26:42.840]  So, for this, can you guys see this pretty clearly?
[26:43.120 --> 26:43.640]  I hope.
[26:44.420 --> 26:45.160]  Not really?
[26:45.580 --> 26:46.160]  All right.
[26:46.360 --> 26:47.180]  You may have to squint.
[26:47.180 --> 26:47.720]  I apologize.
[26:48.160 --> 26:49.540]  And I forgot my magnifier.
[26:50.400 --> 26:50.660]  All right.
[26:50.940 --> 27:00.140]  So, for those of you that can see this, okay, I want you to think in your heads, what level of a position is this posting for?
[27:00.260 --> 27:03.180]  Or, I'm sorry, these questions would pertain to.
[27:03.260 --> 27:03.920]  And I'm going to come back.
[27:05.120 --> 27:05.820]  How about this?
[27:05.920 --> 27:06.820]  A little bit easier to read?
[27:10.100 --> 27:21.200]  Anybody want to tell me, like, organizationally, L3, senior manager, director, IC, what level this is looking for?
[27:21.480 --> 27:22.260]  Entry level.
[27:22.980 --> 27:23.980]  Entry level.
[27:24.100 --> 27:24.700]  Entry level.
[27:24.700 --> 27:24.780]  Entry level.
[27:24.980 --> 27:25.160]  Entry level.
[27:25.160 --> 27:25.200]  Really?
[27:25.320 --> 27:25.720]  You think so?
[27:26.180 --> 27:26.560]  Really?
[27:26.780 --> 27:28.100]  Everybody agree with entry level?
[27:28.760 --> 27:29.660]  All of these?
[27:30.160 --> 27:30.280]  No.
[27:31.020 --> 27:31.360]  Define cryptography.
[27:31.960 --> 27:33.140]  Define cryptography?
[27:36.770 --> 27:37.230]  Okay.
[27:37.770 --> 27:38.970]  I was a little shocked.
[27:39.230 --> 27:41.490]  So, these are questions for an internship.
[27:43.330 --> 27:47.050]  Now, I read that, and I feel that's free work.
[27:47.190 --> 27:49.770]  And if this is what we're accustomed to as entry level.
[27:49.910 --> 27:55.590]  Now, I think, like, you know, all right, but I'll let you read through this.
[27:56.390 --> 28:03.950]  So, I think having a good technical background, I think having a great understanding of some of the basics is probably really solid.
[28:04.110 --> 28:12.450]  But for an internship, my understanding of internship is you're coming to me, coming to us, for us to kind of teach you how things work.
[28:12.830 --> 28:18.450]  Now, we've got to have a place to start, but some of the questions on there are a little bit more advanced.
[28:18.450 --> 28:23.230]  So, this guy is looking for candidates with master's degrees.
[28:23.770 --> 28:26.050]  There are three million empty seats, according to Ponemon.
[28:26.990 --> 28:28.590]  You think we're doing a little gatekeeping, maybe?
[28:30.510 --> 28:31.430]  How about this?
[28:32.910 --> 28:34.550]  Also, an internship job.
[28:35.810 --> 28:37.470]  Get system in Cobalt Strike.
[28:38.110 --> 28:38.350]  Okay.
[28:38.470 --> 28:39.050]  Now, look.
[28:39.330 --> 28:42.630]  Not the worst question, but look at the depth of answer.
[28:43.650 --> 28:46.710]  Pipes, impersonation, tokens, lateral movement, previous escalation.
[28:46.710 --> 28:51.810]  Is this a 45-minute, one-hour, two-hour, six-hour interview at an internal level?
[28:53.710 --> 28:59.030]  So, as we start cutting our teeth on this, I'm asking myself, I'm like, why is it hard to get people?
[28:59.170 --> 29:01.630]  Why is it hard to fill those three million empty chairs?
[29:02.990 --> 29:04.870]  Where do we gather that experience?
[29:05.090 --> 29:11.170]  How do we start bringing more people into this, into this fight, into this profession?
[29:11.710 --> 29:16.350]  So, and I look at it and I go, okay, even coming out, Comp Sci doesn't make you a SME.
[29:16.990 --> 29:18.430]  So, you're coming out with a degree.
[29:18.910 --> 29:22.750]  Maybe you can answer those questions, maybe you can't, but that doesn't make you a subject matter expert.
[29:23.030 --> 29:25.630]  Well, I mean, it seems a little defeatist to me.
[29:26.430 --> 29:28.870]  So, limiting value without a solid IT background.
[29:31.210 --> 29:32.590]  InfoSec's not an entry-level field.
[29:33.670 --> 29:37.130]  Now, look, I've worked in a lot of different roles in a lot of different industries.
[29:37.130 --> 29:38.270]  I've worked in a lot of kitchens.
[29:38.270 --> 29:41.570]  I've prepared food for thousands and thousands of people.
[29:41.930 --> 29:47.570]  So, there's an entry-level role that you can get to that builds you up for all those levels.
[29:48.150 --> 29:51.250]  Many roles you can come into and know very little and have what?
[29:51.410 --> 29:53.230]  Just a desire to learn.
[29:54.190 --> 29:55.050]  What are we doing?
[29:55.230 --> 29:57.090]  We're setting this bar this high.
[29:57.990 --> 29:58.710]  This high.
[29:59.430 --> 30:04.310]  By the time some people get through those interviews, they're probably not interested anymore because what are we doing?
[30:04.750 --> 30:05.770]  We're icing them out.
[30:05.910 --> 30:06.410]  We're gatekeeping.
[30:06.650 --> 30:19.070]  And in a lot of cases, we're gatekeeping in ways that is pretty terrible for anybody that's not coming from the same kind of backgrounds that we're coming for.
[30:19.250 --> 30:20.850]  And we'll talk a little bit about that in a second.
[30:21.750 --> 30:26.610]  So, or we're isolating people that are, you've got to really be into it.
[30:26.690 --> 30:27.910]  Maybe you're not just looking for the money.
[30:27.910 --> 30:30.570]  I'm sorry, does anybody work for not the money?
[30:30.750 --> 30:32.390]  I know it's not always about the money.
[30:32.510 --> 30:33.770]  I'm pretty mission-oriented myself.
[30:34.030 --> 30:37.770]  But money is kind of necessary for adults, right?
[30:40.370 --> 30:44.030]  So, even if you get the job, even if you get a role...
[30:44.030 --> 30:47.110]  So, suck it up if it's a toxic environment.
[30:47.470 --> 30:48.450]  Yeah, it's going to be terrible.
[30:48.450 --> 30:49.210]  You're going to hate it.
[30:49.290 --> 30:49.990]  You're going to burn it out.
[30:50.350 --> 30:51.550]  You're just going to hate your life.
[30:51.630 --> 30:51.970]  But you know what?
[30:52.010 --> 30:54.290]  Suck it up to get the experience so you can move on.
[30:54.370 --> 30:56.950]  And this is the kind of advice that we're giving people coming into the field.
[30:59.070 --> 31:00.210]  So, this one...
[31:02.490 --> 31:04.830]  This one kind of bugs me and I'm going to call it out.
[31:04.930 --> 31:09.930]  And I apologize to the individual that's called out in this particular hot take, if you will.
[31:10.430 --> 31:12.830]  But I wanted to kind of use it to illustrate a point.
[31:14.110 --> 31:18.090]  Does anybody know what Peiter Zatko studied in college?
[31:18.350 --> 31:19.450]  Is Peiter Zatko in the room?
[31:20.450 --> 31:23.190]  Peiter is not a friend of mine, although I admire Peiter.
[31:24.110 --> 31:25.890]  Anybody tell me what Peiter studied in college?
[31:28.430 --> 31:28.910]  Peiter...
[31:28.910 --> 31:29.470]  Sorry?
[31:29.810 --> 31:30.670]  Did he drop out?
[31:30.670 --> 31:31.130]  No.
[31:31.530 --> 31:31.630]  No.
[31:31.630 --> 31:31.770]  Didn't.
[31:32.410 --> 31:40.010]  Peiter went on to work with L0pht and Cult of the Dead Cow and DARPA.
[31:40.570 --> 31:44.150]  So, some pretty slacker, nonstellar organizations.
[31:44.610 --> 31:46.170]  Peiter is better known as Mudge.
[31:46.970 --> 31:49.910]  Peiter was a music major at the Berkeley College of Music.
[31:49.910 --> 31:49.950]  Peiter.
[31:55.670 --> 31:59.790]  So, thinking about this, anybody familiar with the...
[31:59.790 --> 32:02.570]  And forgive me if you've learned a different pronunciation.
[32:03.210 --> 32:10.310]  There is a tendency when we interview, when we try to look at people called homophily.
[32:11.110 --> 32:14.950]  Basically, we're looking and interviewing for someone that looks and sounds a lot like us.
[32:14.950 --> 32:18.250]  We're looking for that validation for that individual.
[32:18.850 --> 32:32.710]  There were a lot of studies that were done post 9-11, both in the FBI and the CIA, that identified a lot of what got in their way of being responsive organizations that maybe could have had different impacts on some of the things that we're seeing, some of the crime that we're seeing,
[32:32.730 --> 32:38.590]  if they had expanded beyond that hiring the same person over and over again.
[32:38.710 --> 32:40.950]  Basically, looking in the mirror and trying to hire that same person.
[32:40.950 --> 32:56.030]  And this really speaks to, in lots of ways, the lack of diversity, the lack of diversity of thought, the lack of, shall we say, gatekeeping and lack of appreciation for people trying to come into the field.
[32:57.510 --> 32:59.090]  So, here is Undermine Teams.
[32:59.610 --> 33:03.950]  So, and I'm going to try to be cognizant of time so we've got some time for questions.
[33:04.670 --> 33:06.250]  Who here has worked with a brilliant jerk?
[33:08.790 --> 33:09.550]  Who's... excellent.
[33:10.110 --> 33:11.730]  So, how did they make you feel?
[33:12.930 --> 33:14.610]  Everybody know what I mean when I say brilliant jerk?
[33:15.730 --> 33:16.110]  Excellent.
[33:16.370 --> 33:17.310]  How did they make you feel?
[33:17.430 --> 33:18.370]  Did you enjoy working with them?
[33:19.290 --> 33:23.350]  So, what was their general impact on any project they were working on?
[33:26.280 --> 33:27.840]  Yeah, they take credit for everything.
[33:27.840 --> 33:29.720]  And what do they do to the rest of the team?
[33:32.260 --> 33:33.000]  Ignore them.
[33:33.720 --> 33:35.040]  Or turn into a martyr.
[33:35.380 --> 33:35.660]  Yeah.
[33:35.820 --> 33:36.440]  Turn into a martyr.
[33:36.620 --> 33:37.580]  They tear down teams.
[33:37.980 --> 33:38.520]  Brilliant jerk.
[33:38.680 --> 33:42.520]  So, in a lot of cases, who are some of these people?
[33:44.260 --> 33:45.020]  There you go.
[33:45.520 --> 33:48.360]  They become... they become these icons.
[33:48.920 --> 33:51.740]  Again, think back to the traits of the superhero.
[33:51.740 --> 33:56.360]  They become these icons that eventually have to rely on who?
[33:56.540 --> 34:01.600]  They rely on teams to accomplish their goals and then basically piss all over their teams.
[34:02.920 --> 34:07.060]  Take the credit, demoralize their teams, and kind of move on.
[34:07.340 --> 34:09.550]  There's something there, though, when you think about it.
[34:09.550 --> 34:13.690]  They need teams in order to accomplish, accomplish to grow, right?
[34:14.110 --> 34:16.820]  But they don't work well with teams.
[34:16.820 --> 34:21.820]  And we've done a great job of protecting these individuals in information security.
[34:21.980 --> 34:25.340]  In fact, a lot of times we laud them and people are just like, oh, that's fine.
[34:25.460 --> 34:25.900]  They're okay.
[34:28.300 --> 34:32.900]  So, the more that we embrace that, the more that we allow that to happen.
[34:33.240 --> 34:37.240]  So, I think we've probably all worked with somebody that's like, hey, I can't put them in front of customers.
[34:37.240 --> 34:38.940]  Or no, please don't invite them to this meeting.
[34:39.070 --> 34:41.840]  Or certainly don't let them sit down with the C-suite or the board.
[34:42.360 --> 34:42.720]  Right?
[34:42.860 --> 34:43.630]  But they're brilliant.
[34:43.760 --> 34:44.650]  We build around them.
[34:44.860 --> 34:45.650]  They're essential.
[34:45.650 --> 34:49.090]  They have knowledge that only they have.
[34:49.280 --> 34:51.380]  They have a problem that only they can fix.
[34:54.470 --> 34:55.990]  So, this is pretty recent.
[34:56.190 --> 34:57.970]  So, pardon if this smarts for anybody.
[34:58.370 --> 35:03.250]  So, they put themselves, what, further apart and further above even us.
[35:03.250 --> 35:12.490]  So, even within information, even within the community, we see these brilliant jerks, these people elevating themselves well above even us.
[35:13.910 --> 35:18.930]  So, we're going to talk about the natural extension to the brilliant jerk.
[35:19.110 --> 35:21.010]  And we're going to talk about really bad behavior.
[35:21.350 --> 35:24.190]  And this is kind of a razor's edge here.
[35:24.190 --> 35:27.350]  So, regardless of how you feel about some of these incidents.
[35:27.510 --> 35:30.270]  And I think you're probably maybe tuning into what I'm talking about.
[35:30.770 --> 35:43.970]  Some highly public, some incidents that have happened in the last couple of years where people have acted out in very, very bad criminal type of ways.
[35:45.090 --> 35:52.410]  Hero culture makes it very hard to identify someone and then hold them accountable and call them to task for what they've done.
[35:53.230 --> 35:53.750]  Okay?
[35:53.930 --> 36:00.570]  This is when we have predators among us that are, look, everybody knows this person's doing bad.
[36:00.570 --> 36:04.750]  But nobody wants to say anything because they wrote a couple of really good books and they've done a lot for the community.
[36:05.510 --> 36:07.210]  They've done a lot for charities.
[36:07.730 --> 36:09.130]  They've done a lot for whatever.
[36:09.750 --> 36:10.130]  Okay?
[36:10.130 --> 36:13.190]  People that exceed even our personal code of conduct.
[36:13.890 --> 36:24.230]  So, this is really kind of problematic because it's very hard to then attack that person because we raise them up.
[36:24.350 --> 36:25.690]  They're statues to these individuals.
[36:25.990 --> 36:30.830]  What's worse is they take that, in many cases, they can take that status and do what?
[36:30.990 --> 36:32.230]  Create new victims.
[36:33.070 --> 36:34.490]  And this becomes what?
[36:34.670 --> 36:36.790]  This is acceptable behavior within the community.
[36:36.790 --> 36:40.050]  So, I'm not going to dive in and I'm not going to give you any examples of that.
[36:40.790 --> 36:53.230]  But I wanted to kind of tee it up and I thought we had to mention it because hero culture in organizations makes it very, very, very hard for us to hold these people accountable and do anything with them.
[36:53.230 --> 37:06.010]  And really, you know, make them either aware of what they're doing, taking care of the victims of those behaviors, and sets us in a bad state.
[37:06.970 --> 37:08.870]  We're going to talk about other bad behaviors.
[37:08.870 --> 37:10.830]  And this is not kind of criminal behavior.
[37:10.990 --> 37:12.730]  This is not really hurting people.
[37:12.830 --> 37:15.570]  In a lot of cases, this is hurting ourselves.
[37:16.310 --> 37:17.570]  Everybody's familiar with this?
[37:18.490 --> 37:19.690]  So, how much sleep...
[37:19.690 --> 37:21.690]  How much sleep did everybody get last night?
[37:22.550 --> 37:23.670]  Anybody get eight hours?
[37:24.190 --> 37:24.970]  Not a lot.
[37:25.950 --> 37:34.330]  So, does anybody on your teams in Slack or Discord, any other chat, like, talk about the little bit of sleep that you get, the little bit of rest that you get?
[37:34.910 --> 37:37.250]  So, anybody not think that sleep's essential?
[37:38.770 --> 37:41.590]  What about, you know, all-night CTFs?
[37:42.250 --> 37:44.350]  No sleep until I get this understanding.
[37:44.610 --> 37:46.250]  We're constantly driving ourselves.
[37:46.410 --> 37:48.510]  The expectation that's set, I do this myself.
[37:48.670 --> 37:49.810]  I'm really bad with this.
[37:49.970 --> 37:51.590]  We're working all the time.
[37:52.170 --> 37:53.170]  All of the time.
[37:54.790 --> 37:56.350]  What kind of spare time do you have?
[37:56.470 --> 37:58.170]  How do you take care of your mental health?
[37:58.310 --> 37:59.990]  What do you do to get away from this?
[38:00.090 --> 38:02.170]  We work in exceptionally high-pressure situations.
[38:02.170 --> 38:02.970]  What do we do?
[38:05.250 --> 38:06.690]  So, we're irreplaceable.
[38:06.790 --> 38:07.630]  I can't take time off.
[38:07.710 --> 38:09.450]  I can't take time off.
[38:09.450 --> 38:11.430]  So, back to the UTO question.
[38:11.610 --> 38:13.130]  UTO is a trap.
[38:13.590 --> 38:15.930]  So, companies know that we're not going to take the time.
[38:16.370 --> 38:17.810]  So, we're just going to keep working.
[38:19.810 --> 38:22.050]  Beyond that, so, we don't rest.
[38:22.210 --> 38:23.130]  We don't take time off.
[38:23.250 --> 38:24.790]  We don't do things that are good for our mental health.
[38:24.890 --> 38:25.290]  What do we do?
[38:26.170 --> 38:26.850]  We drink.
[38:28.170 --> 38:28.970]  We imbibe.
[38:29.190 --> 38:30.270]  We work hard.
[38:30.450 --> 38:31.170]  We play hard.
[38:31.330 --> 38:32.070]  We play harder.
[38:32.950 --> 38:36.530]  So, this constant glorification of, I just need to numb myself.
[38:36.650 --> 38:37.850]  I need to unplug myself.
[38:37.850 --> 38:39.010]  And we accept this.
[38:39.010 --> 38:41.450]  And we encourage this in lots of ways.
[38:41.870 --> 38:42.870]  So, there are still talks.
[38:42.950 --> 38:44.370]  And I think most of them have gotten beyond this.
[38:44.430 --> 38:46.490]  But there are still talks that if it's your first talk, you do what?
[38:46.910 --> 38:47.810]  When you give the talk.
[38:48.550 --> 38:49.410]  You got to do a shot.
[38:52.450 --> 38:56.470]  So, now, there is the reality that, hey, when something happens, we've got to come in.
[38:56.690 --> 39:04.050]  But, with hero culture, as soon as somebody sees something in the news, my CFO sees something in the news and goes, what's this log4j thing?
[39:04.210 --> 39:05.470]  Everybody's got to come in and work all weekend.
[39:06.410 --> 39:11.350]  We create this mythology that sometimes is real, but most of the time isn't.
[39:12.050 --> 39:13.210]  So, that we've got to come in.
[39:13.290 --> 39:14.030]  We've got to be essential.
[39:14.170 --> 39:14.890]  We've got to get called.
[39:15.050 --> 39:17.750]  We've got to rally around these community production events.
[39:18.390 --> 39:20.690]  And we reinforce this for ourselves.
[39:21.550 --> 39:23.530]  As this is how you make your bones.
[39:23.670 --> 39:24.950]  This is how you gain experience.
[39:25.550 --> 39:29.650]  These are the stories that we tell each other when we get together and drink.
[39:31.310 --> 39:33.090]  So, which leads to burnout.
[39:36.130 --> 39:37.530]  So, moving right along.
[39:37.750 --> 39:38.030]  Sorry.
[39:38.570 --> 39:41.070]  So, I just want to juxtapose these two.
[39:41.310 --> 39:43.810]  Surveys that were done before pandemic.
[39:43.990 --> 39:44.930]  Surveys that were done after.
[39:45.490 --> 39:47.450]  Balance of power towards threat actors.
[39:47.690 --> 39:48.730]  I mean, that's pretty understandable.
[39:49.690 --> 39:52.650]  So, most organizations, most people feel...
[39:52.650 --> 39:53.630]  And this is a Panaman...
[39:53.630 --> 39:53.890]  I'm sorry.
[39:53.970 --> 39:55.450]  Threat Connect survey.
[39:56.530 --> 39:58.990]  Most organizations fall behind in providing training.
[39:59.010 --> 40:01.430]  So, you've got to kind of do it on your own, which means less sleep.
[40:03.030 --> 40:05.810]  Very few people feel they've got a defined career path.
[40:07.190 --> 40:09.530]  And high-pressure environment causes burnout.
[40:09.770 --> 40:10.570]  That's in 2018.
[40:10.570 --> 40:13.010]  So, fast-forward 2022.
[40:14.470 --> 40:18.710]  Out of the survey group, depression, anger, anxiety.
[40:19.110 --> 40:20.210]  Not enough talent on teams.
[40:20.490 --> 40:21.510]  Can't find enough professionals.
[40:22.710 --> 40:24.170]  Increased staff turnover.
[40:24.330 --> 40:25.990]  67% increased staff turnover.
[40:27.390 --> 40:29.450]  And most people feel like they're doing...
[40:29.450 --> 40:31.730]  Well, a percentage of people feel like they're doing work of three.
[40:32.370 --> 40:36.790]  32% and I saw a stat yesterday that said this is actually 41%.
[40:36.790 --> 40:37.550]  Consider...
[40:37.550 --> 40:39.670]  People are considering changing jobs in the next six months.
[40:40.790 --> 40:43.950]  That's an insane amount of turnover.
[40:45.850 --> 40:48.550]  Anybody experiencing any of these on any regular basis?
[40:49.850 --> 40:53.230]  Headaches, fatigue, sleeping difficulties, anxiety, depression, muscular tension.
[40:53.890 --> 40:56.390]  Feel like you're not being able to perform terribly well.
[40:56.530 --> 40:57.830]  Feeling overwhelmed and unable to cope.
[40:57.830 --> 40:59.490]  You are not alone.
[41:00.550 --> 41:01.090]  Okay?
[41:01.330 --> 41:02.090]  So, why?
[41:03.410 --> 41:05.550]  Well, what makes working in the SOC painful?
[41:06.330 --> 41:09.110]  We're going to expand SOC to think about security practice.
[41:09.670 --> 41:10.550]  Increased workload.
[41:10.750 --> 41:12.090]  Well, that's ticking up.
[41:12.210 --> 41:14.490]  This is a Panaman survey from 2019 and 2020.
[41:14.810 --> 41:16.970]  Increased workload being on call 24-7.
[41:17.210 --> 41:18.810]  Information overload, too many risks.
[41:18.810 --> 41:25.090]  We've got to work all the way down to 10 before we even talk about the enemy.
[41:26.010 --> 41:26.570]  Here.
[41:28.250 --> 41:36.130]  Anybody look at that list and tell me what those top nine things have in common in lots of ways and who's got control over them?
[41:40.310 --> 41:40.870]  Anybody?
[41:41.790 --> 41:42.930]  These are all manageable.
[41:42.930 --> 41:49.870]  These are all things that leadership probably has a way of defending, a way of addressing.
[41:50.070 --> 41:53.210]  Being on call 24-7, if we really wanted to shift that correctly.
[41:53.670 --> 41:55.790]  Too many alerts, lack of visibility.
[41:56.150 --> 41:58.450]  These are all things... these are all management failures as well.
[42:03.180 --> 42:04.720]  So, heroes need villains.
[42:04.940 --> 42:10.280]  They build silos, create exclusion, mass deeper problems, disempower, and eventually burnout.
[42:12.460 --> 42:13.240]  Don't fear.
[42:13.680 --> 42:14.580]  There is hope.
[42:14.960 --> 42:15.480]  No pun.
[42:15.860 --> 42:17.020]  Well, pun absolutely intended.
[42:17.280 --> 42:17.860]  What can you do?
[42:18.380 --> 42:18.620]  All right.
[42:18.720 --> 42:27.720]  So, this is real short and I'm going to have more resources and links that are out on my LinkedIn and across in Twitter, because this is kind of ongoing for me.
[42:28.380 --> 42:31.320]  Understanding your culture and work in the community.
[42:31.500 --> 42:32.500]  So, look about it.
[42:32.660 --> 42:42.560]  I'm hoping that if you walk out of here with nothing else, you at least look at some of the things that you see going on around you and think about how the culture is driving some of those.
[42:43.400 --> 42:45.940]  I encourage you to update recruiting and hiring.
[42:47.140 --> 42:50.140]  To be a little less, one, confrontational.
[42:50.720 --> 42:58.040]  It should not be a contest back and forth between you, if you're interviewing, and the applicant, or the applicant back and forth.
[42:58.220 --> 42:59.460]  So, get to know each other.
[42:59.560 --> 43:00.980]  You eventually have to work together.
[43:01.100 --> 43:05.860]  And in a lot of ways, the skills that are going to make a difference beyond the technical skills.
[43:05.860 --> 43:07.720]  Of course, we're a technical industry.
[43:07.840 --> 43:09.420]  Of course, the technical skills are going to matter.
[43:09.600 --> 43:16.780]  But the more that we move towards being an identified business process, the technical skills, one, aren't going to get you there.
[43:16.900 --> 43:22.000]  So, maybe hire somebody that's got curiosity and integrity that you can teach the technical skills to.
[43:24.260 --> 43:26.980]  Transform heroic behavior into transformational opportunity.
[43:26.980 --> 43:30.220]  After every time we burn something to the ground.
[43:30.380 --> 43:31.860]  After every crisis.
[43:32.160 --> 43:33.080]  Use that.
[43:33.240 --> 43:36.580]  And don't let the crisis end until we've improved systems.
[43:36.940 --> 43:43.260]  Until we've looked at processes and said, why was it necessary for my entire team to work all weekend on this?
[43:44.600 --> 43:49.020]  So, eliminate or educate or eliminate brilliant jerks.
[43:49.300 --> 43:50.180]  Take them aside.
[43:50.180 --> 43:52.080]  I'm a big fan of radical candor.
[43:52.300 --> 43:53.660]  If anybody's read the Kim Scott.
[43:54.420 --> 43:56.100]  Try to educate and move people along.
[43:57.420 --> 44:00.000]  Build collaborative, diverse, and healthy teams.
[44:00.160 --> 44:03.940]  I believe that this alone can move the culture forward.
[44:04.300 --> 44:12.840]  Teams where you do not have one single thought process, thought background, a diversity of thought.
[44:12.840 --> 44:20.600]  People where there's a little bit of creative conflict that you can effectively manage and leverage to come up with better answers.
[44:20.680 --> 44:24.220]  I will tell you that the adversary is doing this.
[44:24.780 --> 44:25.340]  Okay?
[44:25.480 --> 44:33.840]  If you've got everybody that's coming from the same background, from the same training, the same mindset, the same certifications, there's a gap in your process.
[44:33.840 --> 44:40.700]  If I'm the adversary, I'm going to find it pretty quickly based just on who's in your organization.
[44:40.700 --> 44:43.760]  So, build social capital for everybody.
[44:44.320 --> 44:45.000]  Okay?
[44:45.260 --> 44:47.660]  Don't just allow heroes to rise.
[44:47.860 --> 44:48.680]  Rise everybody.
[44:49.000 --> 44:50.860]  You do speaking engagements, et cetera.
[44:51.000 --> 44:51.860]  Bring your whole team along.
[44:53.340 --> 45:02.540]  Implement diversity inclusion as a requirement in your hiring practices, not just for its sake, but make it a key indicator.
[45:03.440 --> 45:05.100]  Update recognition awards.
[45:05.100 --> 45:10.800]  Stop recognizing people for working crazy hours and crazy sprints.
[45:11.680 --> 45:18.960]  So, recognize things like collaboration, innovation, and act in the community.
[45:19.160 --> 45:21.300]  There's two things, and I've got a couple of books here.
[45:21.860 --> 45:28.540]  One, insist on code of conduct for organizations, for conferences, for places you go.
[45:29.260 --> 45:32.320]  So, and train yourself up.
[45:32.660 --> 45:34.480]  I'm a big fan of bystander intervention.
[45:34.820 --> 45:38.640]  Anybody previously worked with Hollaback or bystander intervention?
[45:39.040 --> 45:39.640]  The five D's?
[45:40.820 --> 45:41.160]  Okay.
[45:41.280 --> 45:41.700]  Outstanding.
[45:41.860 --> 45:46.480]  In a lot of cases, people are unsure of what they can do in a situation.
[45:46.660 --> 45:49.980]  And this is in the real world and digitally.
[45:49.980 --> 45:52.300]  So, how you can enter the space.
[45:54.280 --> 45:56.720]  Links on my LinkedIn to the five D's.
[45:57.360 --> 45:58.100]  Phenomenal stuff.
[45:58.400 --> 46:02.100]  And I've got a great book by Shawna Potter on making spaces safer.
[46:02.960 --> 46:04.660]  There are resources that will be available.
[46:05.320 --> 46:06.560]  And with that, any questions?
[46:10.340 --> 46:11.280]  No questions.
[46:11.600 --> 46:12.040]  Ah, there we go.
[46:12.700 --> 46:12.960]  Hit me.
[46:13.240 --> 46:15.740]  So, all of these things that you said are great.
[46:15.740 --> 46:25.980]  How do you deal with other parts of the organization, for example, between HR and another part of the business that says the bottom 20% has to go every year?
[46:26.180 --> 46:26.500]  Yeah.
[46:26.760 --> 46:28.580]  How do you build a team?
[46:31.850 --> 46:32.990]  Can't build a team within it.
[46:33.030 --> 46:33.770]  It's a great question.
[46:35.990 --> 46:37.530]  We almost have to take it back.
[46:37.670 --> 46:42.030]  And this is one of the reasons that I like the kind of the nexus of customer success and security space.
[46:43.130 --> 46:46.010]  Understanding what drives and what their motivators are.
[46:46.010 --> 46:48.350]  So, outline for them.
[46:48.550 --> 46:49.990]  Typically, that's a cost-cutting.
[46:50.050 --> 46:51.450]  Riffing people is a cost-cutting measure.
[46:51.690 --> 46:53.150]  Show them what the real costs are.
[46:53.270 --> 46:57.710]  How long does it take to train, to find, retain, hire people?
[46:57.970 --> 47:01.950]  Show them in dollar value what the impact of not having this team is there.
[47:02.330 --> 47:02.770]  Okay?
[47:02.970 --> 47:10.390]  Including things like, look, if we cut this, I'm going to lose half of my team in the next six months because they're going to go work somewhere where they're not getting buried.
[47:10.530 --> 47:12.350]  And that's going to cost you X.
[47:14.170 --> 47:17.350]  Understand what their measurement is, how they view the world.
[47:17.810 --> 47:18.990]  Understand their objectives.
[47:19.830 --> 47:25.690]  And then start framing your answers and your arguments in the language that they're using.
[47:26.350 --> 47:27.510]  So, great question.
[47:27.910 --> 47:29.730]  So, we can get into that a little bit more.
[47:29.850 --> 47:31.730]  There's some really good strategies on that.
[47:33.670 --> 47:34.490]  Anybody else?
[47:37.250 --> 47:37.730]  Outstanding.
[47:38.310 --> 47:38.930]  Appreciate it.
[47:39.010 --> 47:39.690]  Thank you so much.
[47:40.050 --> 47:40.830]  Have a great night.
[47:40.910 --> 47:41.590]  Enjoy the rest of hope.
[47:44.590 --> 47:45.070]  All right.
[47:45.190 --> 47:45.810]  Thank you for the talk.
[47:45.930 --> 47:48.650]  And thank you for the audience for attending and participating in the talk.
[47:49.290 --> 47:54.350]  So, we will have another talk here in about 10 minutes on medical devices, security and privacy issues.
[47:54.450 --> 47:55.410]  He's not dead, Jim.
[47:55.570 --> 47:55.970]  Not really.
[47:56.190 --> 47:58.650]  So, if you want to stay around, hang out.