Transcript: Engaging Employees in Security Appreciation with Robert Siciliano
0:00 Robert And so when employees appreciate how security protects their own lives, behavior changes permanently.
0:23 Brad All right.
0:24 Brad Welcome, everybody, to another episode of the How Many CTOs Does It Take podcast.
0:27 Brad I'm Brad Hefta-Gaub,
0:28 Brad and our regular co-host, Scott Porat, is not here with us today, but we have an exciting guest,
0:34 Brad Robert Cigiliano.
0:36 Brad Hope I got that right,
0:37 Robert You
0:37 Brad Robert.
0:37 Robert did.
0:38 Robert You did.
0:39 Brad And welcome to the podcast.
0:41 Brad Maybe introduce yourself a little bit, talk a little bit about your background,
0:44 Brad and then let's get into the conversation about security.
0:48 Brad security theater versus real security.
0:51 Robert Awesome. Thank you. So me,
0:54 Robert I am a Boston-based father of two 17-year-old and 20-year-old girls, married 25 years.
1:03 Robert I've never parked a car in Harvard Yard ever.
1:07 Robert just
1:07 Brad Ha, ha, ha, ha.
1:07 Robert you know yeah and i've been doing what i do since i was a teen like professionally for about 30 years and truly for about 40 you know i speak for a living i get in front of you know ctos colleagues and employees and so forth and and talk about security awareness which i don't really talk about security awareness i talk about security appreciation which is a little bit different it's actually a higher level
1:34 Robert level which is better like when i get off the platform you know people always ask me you know so how did you get into this like what are you former fbi cia secret service like are you law enforcement military like how do you know what you know and i tell them literally i am from the streets of boston that's how i got here literally
1:51 Brad Yeah,
1:52 Robert and
1:52 Brad there you go.
1:53 Robert um like for me it all started off when i was like 12 i got mugged in downtown boston
1:59 Robert That opened me up to predators.
2:01 Robert At 13,
2:02 Robert I met a girl who I was, you know, fond of and she was fond of me and she confided in me one day that her mother's boyfriend assaulted her.
2:11 Robert I didn't know what that meant.
2:12 Robert I go home and I asked my dad.
2:14 Robert He explains sexual assault and the birds and the bees in the same conversation when I was 13.
2:19 Robert Kind of had a profound effect in the way I viewed the world.
2:23 Robert From that point on, I just kind of embraced.
2:26 Robert security and what it meant to me and others and what was necessary for people to understand it.
2:33 Robert And so I gravitated towards professions revolving around security.
2:39 Robert In
2:40 Brad Yeah.
2:40 Robert my mid-20s, I was teaching real estate agents self-defense because in the U.S.
2:47 Robert Realtors are murdered.
2:48 Robert I've been doing that ever since.
2:49 Robert And in the mid 90s to manage my business,
2:53 Robert I got my first computer in 95,
2:56 Robert which was an IBM PS1 consultant,
3:00 Robert which
3:00 Brad There you
3:00 Robert was go. the make and model of a Windows 3.0 with 150 megabyte hard drive.
3:07 Robert And I had to buy an additional card so I could connect to AOL for dial up.
3:13 Robert And
3:13 Brad Good
3:14 Robert right,
3:14 Brad times.
3:14 Robert exactly.
3:15 Robert My machine was a point of sale, you know, as well as, you know, to manage my business.
3:20 Robert And I got hacked like within the first month of owning that device.
3:25 Robert And what that meant was I lost thousands of dollars via credit card fraud, you know, and I didn't know what the heck happened to me.
3:33 Robert You know, I contacted my bank and credit card company. They explained to me.
3:38 Robert It was a relatively new thing for them too.
3:41 Robert My business at the time was personal security as it relates to violence and theft prevention in the physical world.
3:47 Brad Yeah, right,
3:48 Robert I was stolen from via my computer over dial-up internet via AOL.
3:55 Robert I didn't
3:55 Brad right.
3:56 Robert know that that was a thing.
3:57 Robert And so at the time and still today,
4:00 Robert my thing has always been reverse engineering the bad guy's motivations.
4:04 Robert how they choose their victims you know and basically exposing the the predator's motivations right and so when that happened to me I was like devastated because it was thousands of dollars but at the same time I was intrigued like what they did was awful but it was awesome Yeah, and
4:24 Brad a new frontier.
4:25 Robert so I started to explain that to the Realtors you know and who also handle sensitive information
4:31 Robert And I've been doing that now for 30 plus years.
4:35 Robert Obviously,
4:36 Robert it's evolved.
4:37 Robert I've evolved.
4:38 Robert The fraud has evolved.
4:39 Robert But you know what hasn't evolved?
4:41 Robert The consumer's understanding of risk.
4:45 Brad You're out.
4:45 Robert The employees today are no more advanced today,
4:50 Robert arguably, than they were 30 years ago. The most common questions that I get today when I'm on the platform,
4:56 Robert the CTOs.
4:58 Robert co-workers is
5:01 Robert How do I know what link is okay to click when I
5:04 Brad Yeah.
5:04 Robert do a Google search?
5:05 Brad Yeah,
5:06 Brad totally.
5:06 Robert That's where they're at.
5:07 Robert So that's me.
5:09 Robert That's where I come from.
5:10 Robert That's my background.
5:11 Robert And we'll also tell a bit about my perspective as we go on.
5:14 Brad Yeah.
5:15 Brad I mean, it's obviously a very interesting kind of the path that you led to get here. It makes sense that you were kind of like, as you said, you know, formed on the mean streets of Boston.
5:25 Brad I don't know, you might not have said the means.
5:26 Brad mean streets
5:26 Robert Main
5:27 Brad but i add
5:27 Robert streets
5:27 Brad i
5:27 Robert of Boston.
5:28 Brad might add it that part so
5:30 Robert Nope, it's yeah
5:32 Brad one of the things that as a cto obviously a lot of times you're like oh you know what's your latest you know what is your organization's sock2 compliant what are you are you you know are you HIPAA compliant um and this notion of like you know kind of having our you know employees do some training watch some videos click some button
5:53 Brad buttons and do some quizzes and then and force them to do that every year if we haven't grown in you know over the 30 years of your career you're it sounds like you're saying like our awareness of what risk really looks like hasn't evolved much what's the point of all this training
6:12 Robert So you said it, you said it best,
6:14 Robert force them to take this training,
6:16 Robert but I don't think it needs to be forced.
6:19 Robert If you do it properly and that's not being done at all, as you and I know it,
6:27 Robert cybersecurity is what,
6:29 Robert 30 years old?
6:32 Robert Like when did John McAfee do his thing back in the day, late 90s, mid 90s, if that,
6:38 Robert you know, and 30 years maybe. And so our understanding of.
6:46 Robert security awareness training today is based on those who figured out how to sell and market phishing simulation training about 15 maybe 20 years ago phish me being one of the first companies and
6:58 Brad Yeah.
6:58 Robert they hit the nail on the head they sold no before came about with you know Mitnick in the background or as a you know spokesperson so to speak partner and that's all good it's necessary but
7:11 Robert It's only solving the problem of phishing. It doesn't really move the needle regarding true human behavior and their worries and their fears and their concerns.
7:21 Robert And I know this because this is what I do and we can talk about all that.
7:24 Robert And what's happening right now is what I consider security fatigue,
7:28 Robert which is caused by the compliance trap.
7:31 Robert You know, it's bombarding employees with complex and personal rules that trigger security aversion.
7:37 Robert You know, the
7:38 Brad Yeah
7:38 Robert compliance trap is like this false sense of security felt by meeting the regulatory requirements while the actual human behavior remains unchanged and vulnerable.
7:48 Robert This is what I see every day.
7:50 Robert I'm called by the CTOs and CISOs that say, hey, listen,
7:53 Robert all we want is for our people to care about security.
7:57 Robert We just want them to care.
7:58 Robert And that begins with making security personal.
8:03 Brad Hmm.
8:04 Robert to the employee.
8:05 Robert So my core belief is that all security is personal.
8:09 Robert So personal security is essentially violence prevention and theft prevention,
8:14 Robert protecting your person.
8:15 Robert But what's more personal than protecting your identity,
8:19 Robert protecting your child's digital footprint,
8:22 Robert and the core belief that people protect what they love. By teaching someone to secure their child's digital footprint.
8:28 Robert And their own identity,
8:30 Robert their own data and dollars,
8:32 Robert you create more secure employees at work,
8:35 Robert right?
8:36 Robert Like that makes total sense to me and it makes total sense to my audiences.
8:40 Robert When I walk in the room after I am, you know, introduced,
8:44 Robert I walk into a room of, you know, 100,
8:48 Robert 200,
8:48 Robert 500 people doing this. And for those of you who are just listening,
8:51 Robert I'm crossing my arms.
8:53 Brad Shut down.
8:54 Robert yeah they're looking at me with a scowl on their face okay security guy what are you going to tell me that i don't already know i
9:00 Brad Yeah.
9:01 Robert got to get back to work yeah
9:02 Brad Why do I got to listen to this again?
9:03 Robert and this guy who is he you know he's italian he's playing mafia anyways right and so
9:11 Robert What happens is like I start asking them questions. I engage in a dialogue,
9:16 Robert which all security training today is a monologue. It's being told what to do. It's do this.
9:24 Robert Or else, right?
9:26 Brad Yeah.
9:26 Robert And so as I'm asking them questions,
9:29 Robert like I'm asking very basic questions like, so how many of you like can honestly say that you use a different passcode across all your critical accounts?
9:39 Robert If I get 15% of the room to raise their hand,
9:43 Robert that's a lot.
9:44 Robert Okay.
9:44 Brad Yeah.
9:44 Robert And this is in a corporate setting.
9:45 Robert Okay.
9:46 Robert So in their personal lives, they're using all the same passcodes, 85% or more. Right.
9:52 Robert And studies show that as many as 94% of all passwords are basically the same,
9:56 Robert you know.
9:57 Robert And then the next question is like, how many of you are using two-factor authentication in both your personal and professional email and in all your critical accounts?
10:06 Robert If I get 20%, it's usually a little bit more because it's required more often.
10:10 Robert That's a lot.
10:12 Robert So that means 80% are not using two-factor authentication.
10:15 Robert Okay.
10:16 Robert So 80 to 90% of employees are engaged in the worst of the worst, not using two-factor authentication,
10:24 Robert using the same passcode across multiple accounts.
10:26 Brad Yeah.
10:26 Robert Okay. And then I go on to show them, I show them, okay,
10:30 Robert 15 billion passwords,
10:32 Robert usernames.
10:33 Robert usernames and passcodes minimum passwords are on the dark web and show them the examples and i take them online and show them email addresses and how many people using one two three four five six as a passcode and they're and they see like millions and millions and millions of people using password as a password and they're like oh that's why i was supposed to change up our passcodes and i begin to drill it into their heads like this is the risks that we're all facing right now this is why
10:59 Robert We're so screwed,
11:00 Robert you know, and and they begin to see like for their own lives why this is now something that they want to deal with.
11:07 Robert OK,
11:08 Robert and what happens is as I'm explaining all this to them.
11:11 Robert The faces start to kind of loosen up. Their eyes begin to open wider a little bit, which shows me that they're interested in what I have to say. Now they're curious.
11:22 Robert And as the arms kind of go down by their side or by their lap,
11:28 Robert the hands begin to go up and now they have questions because now it's becoming interactive.
11:33 Robert Now they're like, oh, this is about me.
11:36 Robert This is about my security. This is about.
11:38 Robert This is about protecting my information.
11:40 Robert Oh,
11:40 Robert I didn't know it was going to be like this.
11:43 Robert Now I'm interested because I've never had an opportunity to talk to somebody who understands the stuff that I've always wondered about that no one's ever really explained to me,
11:50 Robert including.
11:52 Robert their CTO, including their CISO, who hasn't taken the time because they're just fatigued themselves.
11:58 Robert They're not getting the budgets they need.
12:00 Robert They're overwhelmed themselves. They're herding cats,
12:03 Robert you know, and they're really just not getting the respect they deserve,
12:07 Robert to be frank.
12:08 Robert And like in the end, like they don't have time to, you know, explain to the employee for the 100th time why that email that looks like it's coming from Amazon isn't coming from Amazon.
12:19 Robert I.
12:19 Robert I get that.
12:20 Robert But there's a way to go about it where you engage the human,
12:24 Robert the employee who's dealing with all of these issues that they don't have the answers to in a way that they begin to understand risk.
12:32 Brad It's so interesting.
12:33 Brad I mean, everything you're saying resonates,
12:36 Brad you know, it makes a ton of sense. And I part of me wonders if not just that there's security fatigue,
12:43 Brad but maybe almost like.
12:46 Brad security nihilism or something like every week I get some you know paper paper letter you know to the house that says there's been a security breach and your you know information was lost by a third-party data provider etc and I wonder are how do we how do we combat that notion that that some I think some people have of like
13:10 Brad Look,
13:10 Brad it's just,
13:11 Brad it's all going to get hacked anyway.
13:13 Brad Just deal with it.
13:14 Robert So that comes down to fatalism, right?
13:17 Brad Yep.
13:17 Robert But there's a few other factors that precede that.
13:21 Robert And so from,
13:23 Robert you know, your point of view, my point of view, that makes total sense. But there's other biological issues that humans have that where we resist security,
13:32 Robert okay?
13:33 Robert And security is truly resisted. And it's resisted due to the fact that it's not natural and it's not normal.
13:39 Robert And what does that actually mean?
13:40 Robert Okay,
13:40 Robert so over 30 plus years, 40 to be realistic,
13:44 Robert I've come to the conclusion that we all suffer from what I call, and I don't know if suffers the right word, but we all are engaged in what I call the human blind spot.
13:51 Brad Mm-hmm.
13:52 Robert The human blind spot is the psychological and truly biological instinct to trust what's familiar to us.
14:00 Brad Sure.
14:01 Robert And ultimately,
14:02 Robert it is that cognitive gap where biological trust overrides digital suspicion,
14:06 Robert leaving the door wide open to all kinds of fraud,
14:09 Robert AI-enhanced deception,
14:10 Robert whatever,
14:11 Robert right?
14:11 Robert The biological default to trust and psychological shortcuts are the heuristics that criminals use to bypass human logic,
14:19 Robert okay?
14:19 Brad Sure. Totally.
14:21 Robert Biological impulse versus intellectual understanding. It's that internal conflict between...
14:27 Robert between our evolved survival instincts and our modern knowledge or lack of knowledge of digital risk.
14:34 Robert And this is due to the fact that we are what is considered an interdependent species.
14:40 Brad Sure, totally.
14:41 Robert Okay, and what does that mean?
14:42 Robert It means that we are dependent upon each other for our survival.
14:45 Robert We would not survive without each other at all.
14:48 Robert We require each other at a minimum to procreate.
14:52 Robert Okay,
14:52 Robert and the basis of that.
14:54 Robert is that we need to trust each other.
14:56 Brad Yeah.
14:56 Robert That is our foundation. That is fundamental to being a human being.
14:59 Robert I need to trust. You need to trust me.
15:03 Brad Okay. Totally.
15:04 Robert And so with that,
15:06 Robert the people that we correspond with in person,
15:08 Robert the phone calls, emails,
15:10 Robert and text message we get,
15:11 Robert we want to believe that the person on the other end is worthy of our trust, that they have our best interests.
15:16 Robert And so throughout the day, week,
15:18 Robert month, our lives, we give.
15:20 Robert Give the benefit of the doubt.
15:21 Robert And
15:21 Brad Totally.
15:22 Robert so if we're trusting all day, every day, and we're saying once a year,
15:26 Robert okay,
15:27 Robert this is what phishing looks like.
15:28 Brad Right.
15:28 Brad Totally.
15:29 Robert Pay attention to this. Therefore, you will be good. And if you don't pass, you are fired.
15:33 Robert That's not how you train security.
15:35 Brad Yeah.
15:36 Robert You train on explaining,
15:38 Robert listen,
15:39 Robert we trust by default.
15:40 Robert Let's start with that.
15:41 Robert Here's why security goes against our core beliefs because we trust by default.
15:45 Robert fault.
15:45 Robert And then there's other issues,
15:48 Robert myths,
15:49 Robert cultural myths on top of this that have been built over a lifetime.
15:54 Robert So as I'm asking the questions,
15:56 Robert passwords,
15:57 Robert two-factor authentication,
15:58 Robert next question is,
15:59 Robert how many of you lock the doors to your home?
16:02 Brad Yeah.
16:02 Robert If I get 60%, 70%, that's a lot.
16:07 Robert Most
16:07 Brad Oh, interesting.
16:08 Robert of the time it's a lot less than that depending on the part of the country that I'm in,
16:11 Robert right?
16:11 Brad Yeah,
16:12 Brad yeah, totally.
16:12 Brad I think that's a, I've always noticed that as sort of like a urban rural divide kind of and a generational divide.
16:19 Robert Totally,
16:20 Robert totally, 100%, right?
16:21 Robert I talk to Realtors all the time and they say we have often we sell houses the homeowner doesn't even know where the keys are.
16:28 Robert They haven't locked the door since they own the house.
16:30 Brad Oh, I lock my front door every day.
16:32 Brad But I do have a key underneath the welcome mat.
16:35 Robert Yeah.
16:36 Robert Yeah.
16:37 Robert And so as I'm asking these questions,
16:39 Robert I say, well,
16:39 Robert did you know that like every year in the US there's between 1.5 and 2 million homes that are burglarized, which means like in the next decade,
16:47 Robert that's like 15 to 20 million homes burglarized in the next 10 years.
16:51 Robert Right.
16:51 Robert And then I go on to say, like, I ask questions like,
16:53 Robert okay,
16:54 Robert so how many of you have a home security system?
16:58 Robert And if I get 15% of the room to raise their hand,
17:01 Robert that's a lot.
17:02 Robert Okay.
17:02 Brad Yeah.
17:03 Robert And then I say, okay, so why don't you have a home security system? Like, give me some reasons why, like, what's your, what's your rationale?
17:09 Robert And so the common answers are,
17:11 Robert well,
17:11 Robert we don't have a home security system because we have insurance,
17:15 Robert as if insurance is going to protect you from a predator at 3 a.m., you know, not
17:19 Brad Right. Or,
17:20 Robert well not well thought out.
17:21 Brad yeah.
17:21 Robert Right.
17:21 Robert And then the next answer is, oh,
17:23 Robert well,
17:23 Robert we don't have a home security system because my husband says if they're going to break in, they're going to break in. There's not much we can do to prevent it.
17:30 Brad Yeah,
17:30 Brad I think that's a common,
17:31 Brad that's a common belief,
17:32 Brad right?
17:33 Brad Like, and even in the digital space, I would think that's a common.
17:35 Brad common belief.
17:36 Robert Yeah.
17:36 Brad That's essentially the fatalism I just mentioned earlier.
17:38 Robert Fatalism, man. Fatalism sucks.
17:40 Robert Okay.
17:40 Brad Yeah.
17:40 Robert But it's a human trait that people grab onto.
17:44 Robert And you know why they grab onto it?
17:46 Robert Because it justifies why I don't need security in their lives.
17:50 Robert Okay.
17:51 Brad Yeah.
17:51 Robert It's awful what it does.
17:53 Robert But here's the clincher.
17:55 Robert I asked them, okay, so tell me again,
17:57 Robert like what other reasons do you not have a home security system?
18:01 Robert The most common answer,
18:02 Robert we don't have a home security system because I don't want to live like that.
18:08 Brad Yeah,
18:09 Brad interesting.
18:09 Robert And I say, well, what does that actually mean? What does that truly mean?
18:13 Robert And they say,
18:14 Robert well, I don't want this constant reminder.
18:17 Robert That my house can be broken into I just want to I just I don't want to have to worry I just want to be free of all of that
18:24 Brad So these are some pretty fun.
18:25 Brad Like, I agree with you, Robert,
18:27 Brad that there's some fundamental aspects of human beings like we're interdependent as a species.
18:32 Brad We also have these heuristic biases that we easily fall into,
18:36 Brad you know, where,
18:37 Brad you know, like confirmation bias,
18:39 Brad et cetera, you know, so easy.
18:42 Brad Once you're raising the awareness,
18:45 Brad you're engaging with your customers in this notion of like I'm going to really I'm not that regular security guy.
18:51 Brad I'm here to talk to you about to really connect with you about so you can understand this.
18:55 Brad How once you got their attention,
18:57 Brad how do you help them break through these these kind of innate characteristics of the way that we operate as humans? I mean,
19:06 Brad it sounds like a pretty big hill to climb.
19:09 Robert So it's actually pretty easy.
19:11 Robert But the biggest hill to climb to get over is the fact that when I ask them that question about,
19:19 Robert well,
19:20 Robert you know, why don't you have that home security system? And they say, I want to live like that.
19:25 Robert My next question to them is,
19:26 Robert okay,
19:27 Robert so I'm a guy and this is actually true that has.
19:32 Robert 20 security cameras 20 plus security cameras in my home like outside and inside in total I've got 20 plus security cameras and and here's the clincher right and I said so so what does that say about what what might you think about me as a human like if you don't really know what I do for a living let's just say like you hit this guy's got 20 plus security cameras what might that say about my disposition my outlook like my world view you
19:57 Robert you like I wake up every day 22
19:59 Robert security cameras this guy must be what paranoid
20:01 Brad Paranoid. Yeah.
20:04 Robert so so now we're getting somewhere okay and when I ask that question the whole room goes paranoid and they laugh like it's funny right and here's the issue with that we as a culture as a society we directly correlate security in paranoia
20:25 Brad Oh, interesting.
20:26 Brad What is paranoia?
20:28 Brad Paranoia is a mental health disease.
20:31 Brad It is the false belief that people are out to get you.
20:35 Brad Right.
20:35 Robert That you truly believe that people are bugging your house, that the government is putting cameras inside of you or whatever.
20:43 Robert They've implanted a chip in your body.
20:44 Robert I have a first cousin who suffers from this disease.
20:48 Robert She
20:48 Brad Yeah.
20:48 Robert truly believes that the government has planted a chip inside of her.
20:53 Robert She's currently,
20:54 Robert I believe,
20:54 Robert living in her car because it's the only place that she feels safe.
20:57 Robert Do you understand?
20:58 Brad Yeah.
20:59 Robert That's what paranoia is.
21:01 Brad We as a culture correlate paranoia, I don't want to live like that.
21:06 Brad I want to be free.
21:07 Brad I don't want to have to worry as security, as paranoia.
21:12 Robert Yeah.
21:12 Brad You've got to break down the employees' cultural views of what security is and isn't before you can get them to drink the Kool-Aid of what security actually truly is.
21:26 Brad And Yeah.
21:27 Robert that's an easy thing to do once we're all on the same page.
21:32 Robert But the page that we're on right now is that security is a bad thing.
21:37 Brad Yeah, right.
21:38 Brad So I mean, when I think about the difference between being security minded and being paranoid,
21:44 Brad you sort of said the definition of paranoia is this belief that, you know, everyone's out to get you, right,
21:49 Brad or something like that.
21:51 Brad And I get is part of the answer here to say,
21:54 Brad well,
21:54 Brad it's not that everyone is out to get you. Most of us are trusting people and trustworthy people. But there's enough people out there that are out to get you.
22:03 Brad That you need to you need to you need to be aware of it
22:06 Robert Exactly. And fishing simulation training doesn't do any of that stuff.
22:09 Robert And so what I explain is, first and foremost,
22:13 Robert like the likelihood of something bad ever happening to you is actually kind of slim,
22:16 Robert but there's a chance. And like similarly to like the fact that you put a seatbelt on because it's the smart thing to do.
22:24 Brad Right.
22:24 Robert You don't like put a seatbelt on because you're afraid or you worry or that you're paranoid.
22:29 Robert You put it on because it's a tool.
22:31 Brad that gives you control and
22:33 Robert Yeah
22:33 Brad all of these various tools that we have at our fingertips that are available to us are just about that about you know having one up on the bad guy becoming a tougher target doing some very basic things that make you a harder target and once they start to understand what security actually is versus what it isn't it's actually not a very difficult hill to climb
22:56 Robert but you've got to get to that point first and foremost and no security training at all does that other
23:05 Brad Yeah.
23:05 Robert than mine to be frankly with
23:07 Brad i Yeah.
23:07 Robert mean to be honest nobody
23:09 Brad Yeah. Right.
23:09 Robert does that nobody does that and primarily due to the fact that they don't come from a personal security background
23:18 Brad Yeah, right.
23:19 Robert Everybody teaching it is coming from a tech background and they're speaking tech.
23:23 Robert Do this, don't do that or else.
23:25 Robert It's all compliance based. It's not personal security based.
23:29 Robert And if you're coming from that perspective,
23:31 Robert like I come from a perspective that I got a 17 year old and 20 year old girls.
23:35 Robert How many times do you think that I've sat them down and talked about sexual assault and these are the uncomfortable conversations that I don't know that many people have with their daughter.
23:43 Robert And I think that's a conversation that you need to have with your daughter and with your son who
23:49 Brad Yeah, totally.
23:49 Robert perpetrates the crime, right?
23:52 Robert And these are uncomfortable conversations that we should be having in our lives with the people that we love.
23:58 Robert And these are the types of conversations that we need to be having with our co-workers.
24:02 Robert who we're responsible for who need to be part of the solution versus part of the problem and
24:07 Brad Right.
24:07 Robert nobody's doing that because they don't know how to
24:09 Brad If I could kind of play this back,
24:12 Brad what I hear you saying is there's also this sort of like because we're built to trust, because we're an interdependent species,
24:19 Brad because we have these typical heuristic traps that we fall into with our thinking and one of those heuristic traps is.
24:27 Brad We are built to avoid difficult conversations,
24:30 Brad right?
24:31 Brad This is this is like humans,
24:33 Brad humans, you know, would prefer to ignore the existence of the potential risk than to actually confront it and talk about it.
24:42 Brad And that's just kind of, again,
24:44 Brad like to your point, that's kind of how we're built.
24:46 Brad Yeah. And so.
24:47 Brad I think what I hear you saying is a big part of this is get out of the security theater,
24:53 Brad the compliance theater,
24:54 Brad get out of that mode of just checking the box and get into the mode of having a real conversation about the potential risks that come,
25:03 Brad whether those be physical or digital,
25:05 Brad but certainly when you're a CTO or a CISO and you're trying to protect a tech oriented company.
25:11 Robert You know, you have both those things, you have both physical and digital risk factors involved.
25:17 Robert And just even having that conversation is hard for leaders to do.
25:22 Brad Yeah.
25:23 Brad Look at you kind of said it like in so many words that humans move away from pain.
25:30 Brad Yeah, And we move towards pleasure,
25:31 Brad which
25:32 Robert or avoiding pain for sure.
25:35 Brad is a form of denial,
25:37 Robert okay? Yeah, totally.
25:38 Brad You know, like when you are watching the six o'clock news and something tragic happens in a neighborhood somewhere,
25:43 Brad something bad happens to the neighbors,
25:45 Brad right?
25:46 Brad And the local news team comes in with a camera man,
25:50 Brad a reporter,
25:50 Brad and they grab the neighbor and they knock on her door and she comes out and they start asking questions.
25:56 Brad What does the neighbor always say about what happened?
25:58 Robert Oh, this doesn't ever happen in our neighborhood or something like
26:01 Brad Yeah,
26:01 Robert that.
26:01 Brad yeah,
26:02 Brad they're going to say it tonight somewhere.
26:04 Brad Every night,
26:05 Brad every single night, they all say the same
26:07 Robert thing. So surprised it happened in
26:08 Brad my Yeah,
26:08 Robert neighborhood.
26:09 Brad they're always so surprised because nobody ever wants to think or believe that these things can happen here.
26:14 Brad Nobody ever does.
26:16 Brad And because that's what we prefer.
26:18 Brad Look,
26:19 Brad denial is wonderful.
26:21 Brad Yeah.
26:21 Brad It allows us to function in a world that is on fire.
26:26 Brad It allows us to get along and avoid threats and stress and anxiety.
26:33 Brad It's great.
26:34 Brad It's our comfort,
26:36 Brad but it's not effective.
26:40 Robert When it comes to security at all,
26:42 Brad One of the things you've already kind of mentioned is this notion of these kind of these heuristic traps that we have as humans. And I assume that one of the things you were going to mention, but I'm kind of curious if I'm reading this correctly,
26:55 Brad is that perpetrators or predators,
26:57 Brad attackers are also know how we as humans, you know, respond to things. And
27:03 Robert they're
27:03 Brad so
27:03 Robert experts.
27:03 Brad they're
27:04 Robert They're experts.
27:04 Brad experts at it.
27:05 Brad at the what's what's one of the classic phishing scams is the spoofed email header to be from a figure authority figure that is your you know your boss right so now you're getting an email that comes from your boss or it looks like it's coming from your boss and it's the quick you know conversational oh hey can you just help me out real quick I left my laptop you know in the office can you go ahead and log into the bank account and
27:30 Brad quickly you know wire me a thousand bucks or whatever you know these types of common traps i think most of us aren't aware of the heuristic traps that that we are running by default so
27:43 Robert Right.
27:43 Brad do you how do you do you once you've got the attention once you've got people saying yes i want to think about security differently do you also feel like you need to teach kind of people what the what the traps we all fall for are or or
27:57 Robert Or sort of the cognitive traps that we have.
28:00 Brad Of course, yeah.
28:02 Brad And that becomes much easier once again,
28:06 Brad we're all drinking the security Kool-Aid.
28:08 Brad Once we're all on the same page, once we agree that security is a good thing, that yeah, it can happen to me, it's unlikely to happen to me, but if and when it does,
28:16 Brad I become,
28:17 Brad I have a level of awareness now of security appreciation that I can kind of see it coming.
28:23 Brad Right.
28:23 Brad And in this process, talking about those predators,
28:28 Brad essentially, I explain right prior to getting to the do this, don't do that.
28:33 Brad These are all the methodologies of the bad actors. As I explain how that 97% of all the people they're ever going to meet in the course of your life, 97% are good.
28:47 Brad that they're essentially worthy of your trust that these are people that like essentially have a good heart right and occasionally like that 97 they lie occasionally occasionally they you know have bad intentions they deceive occasionally right but but in general they're good people and you can pretty much trust them and how like truly and you could do your own research and it's true that
29:07 Brad About 3% of women and as much as 6% of men,
29:10 Brad we're talking worldwide,
29:12 Brad medical communities would call them antisocial personality disorders,
29:16 Brad that these are truly the sociopaths and psychopaths in our lives.
29:23 Brad These are the men and women that...
29:25 Robert do not experience empathy sympathy guilt or remorse that they are the ones that truly have no shame and that they would be just as happy to see your mother or father homeless and they've taken all their money you
29:38 Brad Yeah.
29:38 Robert know and you know and people ask me all the time like you know you know like
29:43 Robert You know, like why is why how come these bad guys,
29:46 Robert like, why don't they just take what they know and they can cure cancer?
29:49 Robert And I'm like, they could care less about curing cancer.
29:53 Brad Yep.
29:53 Robert They don't care about anybody but themselves.
29:55 Robert They are the wolves.
29:57 Robert We are the rabbits.
29:58 Robert They are the lions.
29:59 Robert We are the gazelles.
30:00 Robert Right.
30:01 Robert And as and as they begin to kind of sit back in their chair and they begin to like realize,
30:06 Robert OK,
30:06 Robert like this is real and this is something like that I can actually do.
30:10 Brad This is something that's within my capacity.
30:12 Brad This is something that like I want to understand so I can protect myself and my loved ones, my
30:18 Robert Yeah.
30:18 Brad child's digital footprint and my identity and my data and my dollars.
30:22 Brad Okay,
30:22 Brad now what do I do?
30:25 Brad And that's when you begin to explain how the bad guys do what they do and how they choose their victims and all the different ruses that they use. And ultimately.
30:35 Brad The goal is to become what I call the strategic human firewall,
30:41 Brad right?
30:41 Brad So we all know what a firewall is,
30:43 Brad and you are already a strategic human firewall.
30:47 Brad I am already a strategic human firewall.
30:49 Brad We already recognize risk.
30:51 Brad We already look at phone calls and emails and text messages.
30:56 Brad We already deduce what's right and what's wrong,
30:59 Brad where the fraud is.
31:01 Brad is where the hook is. We already see all that stuff because we've been doing it for so long, it's second nature to us.
31:06 Brad But for most people, they want to know, again,
31:09 Brad what link is okay to click in Google,
31:12 Brad right?
31:12 Robert Right.
31:13 Brad And so the strategic human firewall is designed to block deception.
31:17 Brad You know, it's a proactive governance. It's a mindset that turns consumers, citizens,
31:23 Brad ultimately employees from
31:26 Brad passive targets which they all are into active detection layers we
31:32 Brad Right.
31:32 Brad see we see it coming we we recognize risk it's the shift from by default i just trust i trust what i see i give the benefit of the doubt to i verify everything you know and it leads to what i call security appreciation
31:52 Brad Okay.
31:53 Brad So it's the shift from awareness,
31:56 Brad which is so dead,
31:57 Brad which is knowing,
31:59 Brad you know, to appreciation,
32:01 Brad which is caring,
32:02 Brad Right.
32:02 Brad which is caring,
32:03 Brad right?
32:05 Brad And so when employees appreciate how security protects their own lives, behavior changes permanently.
32:12 Brad The security appreciation gap essentially is the chasm between an employee's intellectual understanding of risk, which is awareness,
32:22 Brad and
32:23 Robert Right.
32:23 Brad the emotional commitment to act on that knowledge,
32:26 Robert Yeah.
32:26 Brad which is appreciation.
32:29 Brad And I call this the kitchen table effect.
32:32 Brad It's the multiplier effect where successful training ends when the employee is teaching the concepts to their family at home,
32:42 Brad cementing those lessons for life.
32:44 Brad So essentially what we're doing is we are.
32:50 Brad The horse.
32:50 Brad This type of training is the horse.
32:53 Brad You know, the all security is personal is the horse.
32:58 Brad The
32:58 Robert Mm-hmm.
32:58 Brad cart is the fishing simulation training.
33:02 Robert Right.
33:02 Robert Right.
33:03 Brad The fishing simulation training comes afterwards.
33:06 Robert Right.
33:06 Robert Sure.
33:07 Brad Now, when they're taking the fishing simulation training,
33:10 Brad their mind has been rewired.
33:13 Robert They now appreciate the value in the information that they're consuming and they're looking at it as something that they want and know that they need to understand on a personal level first and then
33:24 Brad Yeah.
33:24 Robert they apply it in both their personal and professional lives.
33:29 Robert It's a whole different ballgame now.
33:32 Robert Now they begin to look at the email in a whole different light.
33:38 Robert Which is what security awareness training should be,
33:41 Robert but it's not at all.
33:43 Brad Right.
33:44 Robert It needs to be security appreciation training.
33:46 Brad Yeah,
33:47 Brad that makes a ton of sense. I like that. I like that differentiation in that language, you know, awareness.
33:53 Brad It just means you know about it.
33:55 Brad appreciation means you care about it yeah
33:56 Robert Yeah.
33:57 Brad um i you know one of the phrases that i've heard um a lot i agree with this statement um i've seen this in the organizations i've gone through as you know an executive leader where um this notion of like the tone at the top is what
34:15 Brad really makes a huge difference.
34:16 Robert Yeah.
34:17 Brad If the C-suite doesn't have security appreciation,
34:21 Brad then it's pretty hard to get.
34:24 Brad You know, the employee, the rank and file to have appreciation.
34:27 Brad What's your solution to that problem?
34:29 Brad I mean, is it is it is it more of more of the same like get them get the C-suite to appreciate?
34:35 Robert I'm going to say something that's going to piss some people off.
34:37 Robert OK,
34:38 Robert I.
34:39 Brad Wait a second. Hold on a second. A guy raised on the mean streets of Boston is going to say something that might piss some people off.
34:47 Brad All right. Hold on.
34:49 Robert Go ahead.
34:49 Robert Just wanted to clear the air there.
34:51 Brad I don't think a lot of security leaders should be in security to begin with at all, because I don't think that they're congruent.
34:59 Brad I don't think that they truly believe in security.
35:02 Brad I don't think that many people that are in the business of security believe in security because and I'm going to say something controversial.
35:10 Brad OK, if you are a security leader and you don't have a credit freeze,
35:14 Brad I don't know that you should be in security.
35:17 Brad Yeah.
35:17 Robert If you're a security leader and you don't have a home security system,
35:20 Robert I don't know that you should be in security.
35:23 Brad Yeah.
35:23 Brad You're sort of saying it's a it's a life. It needs to be a life philosophy.
35:28 Robert I don't know that you can be in security and not truly live and breathe security. I consider myself a messenger.
35:41 Brad For the message,
35:42 Brad okay,
35:43 Brad Yeah.
35:43 Brad and I truly believe in security.
35:49 Brad And I don't know that you can teach security unless you truly engage in the process of security as a lifestyle.
35:59 Brad But let's say you OK,
36:00 Brad so I love that perspective that that makes a ton of sense. Let's say you OK,
36:04 Brad so we got some CTOs that listen to this this podcast and let's say they've got that perspective. They are they really are believers.
36:12 Brad They really appreciate.
36:13 Brad But their CEO.
36:14 Brad or the rest of their C-suite doesn't appreciate it.
36:18 Brad Do you have advice on how to convert the rest of your C-suite to be believers?
36:26 Brad It's easy.
36:27 Brad Every one of us has, you know, a family member.
36:32 Brad Let's just say a mom or a dad.
36:35 Brad or a sister or a brother or a child for that matter who reaches out to them on a regular basis regarding is this real what do i do here we all have somebody in our life that just can't figure out the whole password thing they can't stop clicking links they respond to frigging pop-ups thinking it's apple and it's not apple you
36:56 Brad Yeah.
36:56 Brad know like we all have these people in our lives
37:00 Brad And when I say all,
37:01 Brad like security leaders have all those people in their lives,
37:05 Brad all C-suite executives,
37:08 Brad including the CEO,
37:09 Brad has those same people in their lives.
37:13 Brad Every single employee that you have has those people in their lives.
37:18 Brad We all have the same problems.
37:21 Brad And when you speak to those same problems to the people responsible for your...
37:25 Robert for your budget,
37:26 Robert to those decision makers that are responsible for giving you the thumbs up and the green light to actually put the horse before the cart,
37:36 Robert right?
37:37 Robert You remind them of all the problems that you as a human face in regards to your own family and the stuff that they're doing, and you begin to tell that story because it's true.
37:49 Robert And now I just can't get my mom to stop, you know.
37:52 Brad buying things on late night TV that she vitamins that she doesn't need and my dad responds to every pop-up and my sister who's widowed is entangled in these romance scams and begin to tell your own story and tell it like reminding them I'm guessing you probably have the same things too and then explain that's our every single employee that we have that's what they're up against
38:17 Robert And
38:17 Brad Yeah.
38:18 Robert they look at security as a bad thing, as it's paranoia and begin to explain what security is and what security isn't and how the entire organization is up against cultural myths and misnomers that aren't moving the needle or the reason why we're having the problem.
38:39 Brad Yeah.
38:39 Robert You know, and the reality of it is like, I don't know that there's ever been a better time to do this or a worse time, depending on your perspective.
38:48 Brad Why do you say that?
38:49 Robert Well, because.
38:51 Brad Like right now with AI and deep fakes and voice cloning.
38:55 Brad It only took 40 minutes before we got to AI.
38:57 Brad Good job.
38:58 Brad We know we're going to get there eventually.
39:01 Brad So when I say the best time or the worst time,
39:04 Brad the worst time because frankly,
39:06 Brad I think I think you're all effed right now.
39:09 Brad Okay,
39:10 Brad because the fact that all you're training them on is fishing simulation training and maybe with like we might start introducing deep fakes.
39:17 Brad and voice cloning sure but like we're so not prepared to deal with risk as as is based on our aversion to security to begin with now with like voice cloning and the phone ringing and it's your daughter screaming in the background what human being is going to be able to overcome that if they don't believe in Yeah, security to begin
39:37 Brad totally.
39:37 Brad with okay so so there's that right but at the same time
39:42 Brad The good aspect of it is that like at least for me and my perspective is that the AI and the deep fakes and the voice cloning and everything that goes along with it and the pig butchering and like the money being made and how awesome these criminals are,
39:58 Brad they're awesome.
39:59 Robert awesome what they do.
40:01 Robert They're incredible,
40:02 Robert right?
40:03 Robert There's never been a better time because that story is so compelling,
40:07 Robert right?
40:08 Robert Like right now, you know, this is like the stuff of 007, Minority Report,
40:14 Robert like Tom Cruise Mission Impossible stuff.
40:16 Robert It's
40:17 Brad Yeah.
40:17 Robert awesome.
40:18 Robert This is Hollywood stuff.
40:19 Robert And I think this is like the perfect opportunity to engage an audience in security appreciation because this is fun.
40:26 Robert This is interesting.
40:27 Robert This is way more than cybersecurity.
40:29 Robert And to be honest,
40:30 Robert like cybersecurity awareness,
40:33 Robert cybersecurity training,
40:34 Robert none of that is even in any of my branding materials.
40:39 Robert I don't even talk about cybersecurity anymore because it's so dead. It's been ruined. Like by all the people that do what I do,
40:48 Robert they've made it boring.
40:50 Robert They've made it fear-based. Like they've made it ugly.
40:53 Robert Frankly,
40:54 Robert they've made it ugly.
40:55 Robert right but now with ai and deep fakes and voice cloning it's sexy it's hollywood like this is this stuff is awesome and when you start talking about it in in that way everyone's on the edge of their seat like this is like an unbelievable
41:08 Brad Yeah.
41:09 Robert story that has actually come true and it's happening right now and showing those examples they want to know like this is a good time
41:17 Robert If
41:18 Brad Yep.
41:18 Robert you actually are drinking the Kool-Aid that I'm explaining.
41:22 Robert Otherwise,
41:23 Brad Yeah.
41:23 Robert if y'all just like compliance-based security fatigue,
41:26 Robert you're effed.
41:27 Brad Yeah, it's so funny.
41:28 Brad My I had I had a family incident similar to what you're talking about with the AI where my mom's Facebook account got hacked and they had successfully gotten just 20 seconds of video of her.
41:42 Brad they use that then to just reel in as many people as they could that were in her network you know where it would look they built the thing that would look like she was facetiming me or my sister my brother now fortunately we all we all didn't fall for it we were like wait a second this is this is suspicious but some of her octogenarian friends got you know sucked into it because it was good it was really good
42:08 Robert In a word,
42:09 Robert that's awesome.
42:11 Brad Yeah.
42:11 Robert It is. It's awful,
42:13 Robert but it's awesome.
42:15 Robert You know, that's a compelling story.
42:17 Robert And it's true.
42:18 Robert And that is we are at the very,
42:22 Robert very beginning of that.
42:24 Brad Yep.
42:24 Robert And it's just going to get worse and worse and worse and worse in the existing training is frankly going to make it worse.
42:32 Robert People are just going to put the covers over their head.
42:34 Robert They're going to bury their heads in the sand and then they're going to go into full blown denial.
42:40 Robert Like it's just going to get worse.
42:42 Robert Fear, uncertainty,
42:44 Robert doubt.
42:45 Robert It's too overwhelming.
42:46 Robert And all they want to do, all they want to do anyways is they want to go home and they want to watch Dancing with the Stars.
42:51 Robert with the stars that's
42:51 Brad Yeah,
42:52 Robert all they want to do they don't want to deal with any of this crap but if you make it interesting if you make it fun if you make it about them look at we are selfish creatures or self-interested creatures and actually the word selfish kind of gets a bad rap selfish being selfish is absolutely fundamental and necessary we have to be selfish
43:16 Brad Yeah,
43:16 Robert There's a reason why when you're on the airplane and the flight attendant is providing
43:21 Brad instruction
43:21 Robert instruction and
43:21 Brad right put
43:22 Robert she talks about the oxygen mass coming down. What does he or she say to do with the oxygen mask?
43:28 Brad it on yourself first before you help others
43:30 Robert And that is because you cannot possibly help others until you take care of yourself.
43:35 Robert And so all security being personal start with the human where they're at in their lives.
43:42 Robert Focus on them and their wants and their needs and their concerns,
43:45 Robert what's important to them first.
43:48 Brad Yeah.
43:49 Robert and then provide them compliance-based training.
43:53 Robert That's when they'll understand it.
43:55 Robert But until that time,
43:56 Robert you're just talking to somebody who's not listening to you because your CISO is paranoid as far as they're concerned.
44:03 Brad Right.
44:03 Brad Exactly.
44:04 Brad We're just flipping the bozo bit on the CISO because that person is just paranoid or falling into that trap.
44:09 Robert Yeah.
44:09 Brad I am curious,
44:11 Brad do you see a correlation with
44:15 Brad security appreciation or kind of let's call it security literacy maybe to get to your appreciation do you see a correlation with that and
44:24 Brad media literacy or even just sort of like education and fundamental,
44:31 Brad you know, kind of critical thinking?
44:32 Brad Like, is there a, do we kind of have a bigger challenge here as a culture if we're struggling on those aspects as well or not related at all?
44:44 Robert So you're a smart guy,
44:46 Robert and the words that you're looking for are digital literacy.
44:49 Brad Yeah.
44:50 Robert That's it.
44:51 Robert It's digital literacy.
44:53 Robert And we are sorely, sorely lacking in digital literacy in this country.
44:57 Robert It's awful.
44:59 Robert We are only beginning to teach it in schools.
45:03 Robert My kids have learned digital literacy in the private schools in which they attend.
45:09 Robert It's only now that municipalities and statewide are beginning to ban cell phones in school.
45:16 Robert And that tells you point blank that the entire states are digitally illiterate, allowing phones in schools completely.
45:25 Brad Yeah, yeah
45:26 Robert That is like caveman stuff.
45:29 Robert Right.
45:30 Robert And because we significantly lack digital literacy in this country,
45:35 Robert security literacy is like it's taken up, you know, it's the it's the caboose.
45:42 Robert It's
45:43 Brad Yeah.
45:43 Robert back of the bus,
45:44 Robert you know, it doesn't even show up on our radar.
45:47 Robert It's not even a thing.
45:48 Robert And so I teach digital literacy revolving around cybersecurity, but in that same presentation.
45:59 Robert If I have like a six-hour day,
46:00 Robert which I often do,
46:01 Robert which isn't going to happen generally in a corporate setting, but in like a full day training,
46:05 Robert I'm talking digital literacy for a good portion of the day, you know, about how I've raised my children in regards to their own devices and how I react and respond to misinformation and how I do my own research to determine what's real and what's fake and how I,
46:22 Robert you know, manage my own digital life.
46:24 Robert and how I see others getting in lots of trouble in regards to their own digital lives.
46:30 Robert And I speak to firefighters and teachers and law enforcement officers on social media and online reputation management.
46:37 Robert And what's okay and not okay to say and post and like and share because you are in the public eye.
46:42 Robert And what you put out there has gravity. It matters, you know, and when a real estate agent,
46:48 Robert if I do a quick search on realtor.
46:51 Robert fired post three words realtor fired post you see thousands of articles on a realtor who was fired because of what she posted you do the same exact thing for a firefighter for a police officer for a teacher you know like that what does that tell you it tells you that digital literacy in this country is non-existent in that regard you know when somebody likes or thumbs up their buddies you know
47:17 Robert you know anti-semitic post
47:19 Brad Yeah,
47:20 Robert because it's his buddy and he you know wants to support his buddy and he gets in trouble for that he doesn't understand why well i mean it doesn't take a rocket science to figure that one out but
47:31 Brad yeah.
47:31 Robert but that's all part of it and you're 100 correct that is the fundamental issue that we face here but like
47:39 Robert I can't totally do that in a 90 minute presentation.
47:43 Robert And the interesting thing is like, sometimes they won't even give me 90 minutes because they got to get back to work.
47:48 Robert And it's like, you really
47:48 Brad Yeah.
47:49 Robert think you're going to solve this problem in 60 minutes?
47:51 Robert I mean, at least give me 90, you know, 75 to 90,
47:54 Robert like at least give me that, you know, but like it's a real, real problem, but not one that we need to, that we should just throw our hands up in the air and be overwhelmed by.
48:04 Robert It's one that we should actually.
48:06 Robert address and
48:07 Brad Yeah.
48:08 Robert it's addressable it's solvable you know and it is truly solvable I do this over the course of a presentation whether it's a 90 minute or a six hour and you would be amazed when at the end of the day people come up to me and they're like I did not want to be here
48:22 Robert I truly only came here because my boss told me to be here.
48:26 Robert I really didn't think I needed any of this,
48:28 Robert but I'm so glad I came and I really wish that my spouse was here because he or she would have loved it.
48:34 Robert And do you do programs for high schools because they need this too?
48:38 Brad Yeah, totally.
48:39 Robert That's what security appreciation should be.
48:42 Brad Yeah, you're right. Your point is like if you can get people to start to appreciate it for themselves.
48:47 Brad if they if you can if you can help like overcome the the sort of like heuristic biases and the sort of like built-in biological interdependency to get that person to click into a selfishness state around their own safety and their own you know kind of safety in the world in general then you've got them into appreciation mode and once you get them in appreciation mode they become
49:14 Brad a team member and an acolyte to help proselytize to the rest of them, like, yes, we all need this.
49:23 Robert When this podcast is done,
49:26 Robert I'm going to go back to the video or the audio and I'm going to take what you just said and include that exactly in my sales presentation because you hit the nail on the head. That is exactly what the CEO, what the CISO, what the CTO needs.
49:40 Robert needs to tell their boss so
49:42 Brad Yeah,
49:42 Brad totally.
49:44 Brad So how do we how do we summarize this,
49:47 Brad Robert, other than other than get people to to become selfish so that they can start to appreciate it?
49:53 Brad What else do we need to know as CTOs and CSOs and and CSO executives?
49:59 Robert look at i think that the majority of the people that are listening to this watching this are already a form of the strategic
50:07 Robert strategic human firewall.
50:09 Robert Let's get that straight.
50:11 Robert Even though there might be a few people who might not be congruent, I think that based on my chastising, they may pick up a credit freeze or maybe consider a home security system.
50:21 Robert Apologies, nothing personal.
50:22 Robert That said, I think we all understand risk,
50:28 Robert but we may not be effective communicators.
50:31 Robert You know, we may not be the best communicators and that might be a skill that some of us might want to adopt if we're going to like take this to the those in the organization that matter or that, you know, in order to move the needle.
50:44 Robert Right.
50:44 Robert Just maybe communicate a little more effective in regards to, you know, what it's going to take to actually solve this problem. And then from there, like to actually do it, like I presented not too long ago.
50:58 Robert go in you know certain part of northern california to a company i'm not going to name but they're responsible pretty much for what mobile phone technology is today you
51:10 Brad Mm-hmm.
51:10 Robert know and they've essentially created the backbone of what we know as mobile communications and i spoke in this beautiful beautiful auditorium that i know like orchestras play there and such like
51:23 Robert like inside this company's headquarters it was amazing but not everybody has that but everybody has an all hands event right and i did an all hands event in front of maybe like 200 employees that's all it was was 200 employees in the room but there was about 4 000 people connected for
51:44 Brad Mm-hmm.
51:44 Robert that event you know they were all watching
51:48 Robert And many of them actually asking questions because my presentation is a dialogue. It is the same way that you and I are talking right now. It is the same way that I communicate with my girls and my honey.
51:59 Robert When my girls come home upset,
52:01 Robert you know, disillusioned, you know, overwhelmed,
52:04 Robert what do we do? We sit down.
52:07 Brad Yeah.
52:07 Robert and we have a dialogue well I ask them questions they tell me what's going on I respond with more questions they tell me what's going on and then you know when the time's right I ask them I'm like okay so can I can I like give you a little bit of information like stuff that I've learned and let's talk about it like let's discuss like what's worked for me you know we have this dialogue and they walk away like not so upset
52:32 Robert with like some tools they can use going forward so they can actually like solve the problem on their own you know like that's how we raise our families that's how we should be talking to our our co-workers and i'm not asking a single cto to start holding your you know employees hands and kumbaya or any of that stuff i'm just saying a little more empathy might help you know
52:54 Brad connect with i mean well in some sense that's like you know to your point like
52:58 Brad like humans are an interdependent species if we connect with each other then that's the gateway into influence right and so if the goal if the goal is to influence them to become you know to appreciate security then connect first
53:14 Robert And so at this all hands on event,
53:16 Robert like I'm speaking to 200 people,
53:18 Robert but they're asking the questions of the 4000 people.
53:23 Robert people they're engaged in the dialogue of those 4,000 people that are watching because when I when they start raising their hands which often go up pretty quickly and now like 10 people are raising their hand right and I point okay sir what was your question and he asked that question and then I point to the woman you know five seats down you had a question oh he just asked it we
53:46 Brad Yeah
53:46 Robert all have the same cares and concerns we're all the same
53:50 Robert same in that regard you
53:51 Brad Yep.
53:51 Robert know so those 4 000 people watching are the 200 people that are in the room it's the same thing and so now i've just affected 4 200 people's appreciation of security that's an easy sell that's an easy thing to do you
54:04 Brad Yeah.
54:05 Robert know you just gotta make it more human and make it less you know you got to affect the wet wear what's the wet wear
54:14 Brad Yeah.
54:14 Robert versus the software the Yeah. wet where's the human brain yeah right there like you just got to affect that and and and and and truly my perspective is in order security appreciation is from security security awareness is from the neck up security appreciation is from the heart up and in order to change
54:38 Robert minds you need to affect and change hearts first that's
54:41 Brad Yeah, that makes
54:43 Robert easy
54:43 Brad sense.
54:43 Robert if
54:43 Brad It makes
54:43 Robert it's
54:44 Brad sense.
54:44 Robert easy if you are I guess you know not a sociopath or a psychopath
54:50 Brad Right.
54:52 Brad Yeah,
54:52 Brad this is super, super interesting stuff,
54:54 Brad Robert,
54:55 Brad and I appreciate you kind of like your perspective is really compelling.
55:00 Brad And so I think that.
55:03 Brad Yeah, it's definitely given me something to think about as a fractional CTO who's working with multiple teams and helping them go through their SOC compliance.
55:10 Brad And I literally just had a meeting a couple days ago with one of the CEOs who was like,
55:15 Brad wait,
55:16 Brad what happens if? And I was like, yeah, well, we did have everybody sign that agreement,
55:20 Brad right?
55:20 Brad But I love how you're presenting it that if they aren't really connecting it at a human level with their heart, then it's just in there.
55:29 Brad It's just in their mind and that's not enough. This is fantastic,
55:33 Brad Robert.
55:33 Brad I'm going to say like you've given me a fresh perspective.
55:36 Brad Hopefully the listeners of the podcast have gotten a fresh perspective.
55:40 Brad They're going to.
55:41 Brad Turn away from compliance theater and the drudgery of the annual renewal of the watch the video that's a one-way thing and they'll look into the idea of working with you or at least approaching the philosophy that you've brought to the table of connecting with us as human beings in order to get from security awareness to security appreciation.
56:05 Robert It's not turning away,
56:07 Robert it's in addition to.
56:08 Brad In addition to.
56:09 Robert Yeah. Yeah. You still got to do that.
56:11 Robert It's still necessary,
56:13 Robert but you put the horse before the cart and all of a sudden you start to see, because I know when I, I have friends that are, you know, CIOs, CTOs, CISOs, and their thing is like,
56:26 Robert I need numbers. I need metrics. I need results.
56:30 Robert I need this.
56:31 Robert I get it, but you're going to get better results once.
56:35 Robert Once you add an addendum to your existing training,
56:38 Robert then you'll start to see different results.
56:41 Robert But as is,
56:42 Robert you know, you're just going to get the same results that aren't necessarily,
56:47 Robert I'm seeing too many people getting fired,
56:49 Robert too many people getting shamed. I don't know that that's going to be effective with AI and deep fakes going forward.
56:56 Brad Yeah.
56:57 Brad Totally.
56:57 Brad Well,
56:58 Brad thanks a lot for joining the pod, Robert.
57:00 Brad This was an amazing conversation.
57:02 Brad We'll make sure that we include in the show notes links to your services and so people that are interested can reach out to you.
57:09 Robert You can also find me at protectnowllc.com. Is that cool?
57:14 Brad Yeah,
57:15 Brad protectnowllc.com.
57:16 Robert Thank
57:16 Brad That sounds
57:16 Robert you,
57:17 Brad fantastic.
57:17 Robert sir.
57:17 Brad All right. Thanks, everybody,
57:19 Brad for listening and remember to rate,
57:20 Brad review and subscribe.
57:22 Brad Let's subscribe and we'll see you guys next week.
57:25 Robert This episode of How Many CTOs Does It Take podcast was edited by Safran Epigal.
57:30 Robert Our theme song was AI Generated by Brad.
57:33 Robert Please follow us on all the social media platforms at,
57:36 Robert at HowManyCTOsPod.
57:38 Robert You can find us on YouTube,
57:41 Robert LinkedIn,
57:41 Robert Instagram,
57:42 Robert Facebook,
57:42 Robert Threads, X,
57:43 Robert TikTok,
57:44 Robert and Patreon.
57:45 Robert Or at our website at HowManyCTOsPod.com. And remember to rate, review, and subscribe on the podcast platform of your choice.
57:55 Robert Thanks for listening.