Everything I Need to Know About Cybersecurity, I Learned From Teaching Scuba Diving

hi there um so anyway it's kind of interesting they called me up about five minutes ago and said are you speaking today and I was like yeah I speak at 10 o'clock they're like no uh you speak now there was an adjustment to the schedule I go I know I looked at the thing I'm looking online and they're like and this I don't get I blame them for this but anyway what happened was my computer literally still says 10 o'clock because I don't when I get to a new time zone I don't bother having I don't want my computer to readjust the time zone and so for some reason they have this Dynamic time on the system depending on

your time zone and I don't know I just think that's stupid since I didn't pay any attention to that so anyway um actually that's kind of relevant to my presentation too so here's the thing when they you know when I started saying Hey I want to speak in the Cayman Islands because this event sounds really cool I'm like what type of talk can I give for this and then I'm thinking let's talk about scuba diving so if I go scuba diving it'll all be tax deductible and everything like a business expense so it is and I had to do my research of course while I was here so that's a given so anyway with that in mind

because um actually let me go through the presentation because it starts covering a lot so the first time I ever heard you the phrase you can't stop stupid was when I was taking my instructor class and this guy uh what's John's last John Kaiser this is the course director that I took it from the guy like has certified probably the most divers for Patty in like history or something at some point in time and he's local to me and they're the local dive shop so I just randomly wandered in there and I started taking classes I liked it so I kept taking another class because there's no reason to dive in Maryland honestly the diving pretty much anywhere

except the Caribbean anywhere near here really sucks so anyway the only reason I would take diving or I would be able to go diving was to keep taking classes So eventually I finally like worked my way up like through the ranks and then it was like do I actually want to be a professional instructor I'm like I don't really care but it's a good excuse to go diving more so anyway I went ahead and I did that it also makes diving tax deductible because if I ever have to go on a refresher dive it's to refresh my skills as part of my professional responsibility studies but anyway we were sitting in the class and John's the

type who mumbles and he's the he was mumbling it's like no matter what you do you can't stop stupid some student you tell them what to do no matter what happens they're gonna do it you just can't stop stupid and I'm like sitting there thinking this whole course is about stopping stupid it's about dive standards it's about pretty much what you do to plan for people being stupid and there was a sorry I remember once like so just a heads up the title of my well second most recent book is you can stop stupid by the way and you know I also hear in cyber security a world-renowned ex-hacker uh and I kind of almost throw

up in my mouth as I say that I'm not going to mention the name was quoted as saying you can't patch stupid I'll just give you a hint as a cyber security professional patching stupid is your job because you can't stop it from existing but it's your job to stop the results from people being stupid and frankly behind every stupid user is a stupider security professional in general so you gotta start thinking that as well because if you know the user is going to do something stupid and you don't say hey the user is going to do something stupid let me do something about that in advance that's on you but anyway the first time I heard this was back in my

diving course and I'm sitting there thinking again we are taking hundreds of hours of training to stop stupid so let me tell you about my stupid and anyway I've had probably four near-death experiences maybe more I've lost count that's how bad I am at this and you know one of them involves scuba diving and I have a sea lion on here because it's a nice picture but also because it was ironically during a sea lion dive and the sea lion literally had nothing to do with this but anyway it's a nice picture so anyway what was happening was I was on a dive where you like you you go out and this was in Curacao you dive out and

then you sit someplace and then the trainer brings over a sea lion and then the sea lion goes among people and everything like that so then we were finishing up the dive and what happened was this was in Curacao and the waves really really suck and so what happened was at this Resort where I was they had this and I it's hard for me to describe but you know they had like a wall of rocks around the dolphin enclosure because this was like an aquatic Park type of thing where they had sea lions they had Dolphins but then they had kind of also built around it a little Cove so when you went down you wanted to go

diving you got in the water in the cove and then you don't and then you underwater went around and so what happened was we dove in the cove and went around underwater and then um as we were coming back from this because I just remember as we get to kind of where the wall is we see a light because when you're underwater all of a sudden you see like lights to the side and that's kind of where I thought the Cove was because you know there's not like perfect visibility down there and what happened was all of a sudden I saw a light and I followed the light it wasn't like Poltergeist Carrie in stay

away from the light but anyway there I was I followed the light unlike Carrie Anne and I went ahead followed the light and then all of a sudden I realized I'm at a wall and then I start like and then all of a sudden a wave picks me up and puts me on top of this Rocky ledge because what happened was was for the dolphin enclosure they had little holes in the enclosed like in the like rocks to allow water from overflowing going back and forth and so on so anyway there I was on this ledge and then I decided okay this kind of sucks and I shouldn't be here so I try to just go back into

the water well what happened was there were just like series of small waves which kind of kept me there and then big waves would come and slam me into the rocks and that really sucked I'll tell you that much so there I was waiting for like you know trying like a couple times while the little waves were coming and trying to get back but it was still enough to keep me there and then the big waves would come and I would have to grab onto these Coral rocks and my fingers were bleeding because Coral Rock really sucks it's not like a nice rock it's like Coral so then what happens there I was on this and then the Dive

Master sees me and he's like come on it you know come on back in and he's there floating like 20 feet away I'm like just shaking my head because when you're diving the things you're trained to do is to keep your regulator in your mouth and your mask on no matter what if you're in potential harm so I just kept this and I just kept shaking my head no and the guy thought I was panicking real Panic means you tear off your mask and don't have your regulator in your mouth if you're a good instructor by the way but anyway what happened was there I was and then the Dive Master decided he's going to get on the rocks with me to

help me off and then he realized why I was still on the Rocks so there I was in that case and then what happened was remember there was a little hole into this dolphin enclosure it used to have like rebar but it all kind of rusted away and before this I also took some training because I also dive to help maintain oyster reefs in the Chesapeake Bay to try to keep that Cesspool clean and what happened was you know then it was like okay how do you get yourself kind of small and I took off my equipment and kept on it pushed the equipment through and then went through the hole and then I was in

the dolphin enclosure and now I'm gonna curse here because Dolphins can be real that's a given everybody thinks dolphins are sweet smart things they can be territorial bastards so there I was thinking I mean they're going to get killed by the rocks or potentially you know have like be a play toy for dolphins because one of my friends I'll talk about them later is a you know Navy SEAL and I'm like what was it you know I talked did you ever work with like dolphins or sea lions he's like oh yeah he's like dolphins really suck because dolphins are trained in the military to do Force protection and go around ships and if they see enemy divers to just you

know just keep poking at them and keep poking at them he's like it could get away from sea lions if you hug the bottom but Dolphins at echolocation he's like those little will keep going for your heart it I'm like what do you do he's like curl up in a ball and hope they pull you out quickly so there I was after everything else happened expecting to curl up in a ball and getting pulled out but luckily somebody saw and pulled us up on Top of the Rock so anyway that's my near-death experience what did I do I did something really stupid by ending up on the Rocks but again it was a lot of things right

by not panicking by making sure I kept my mask on by making sure because if I ever put took the mask off even in my hand it literally would have been float you know pushed away really quickly but again kept everything on and then started using the training it's like okay how do I get through that little hole and started using my equipment to get out of there and then having sense enough to say let me stay near these rocks so these I'm not swimming in the middle of the dolphin pool and stuff where the Dolphins can like use me as a play toy again but anyway that's kind of my stupidity and I've done stupid things

more more than that yeah so now here's the thing a lot goes wrong in scuba diving but it can be pretty safe now one thing is I mentioned I had you know I ended up with um I ended up on the rocks that was obviously a really dumb thing and things that end up going wrong I was once bit by a green sea turtle because I was also a volunteer diver at the National Aquarium in Baltimore and what happened was we had this green sea turtle in this tank and we were not allowed to release it because one of the flippers was kind of it got um caught up in fishing line and they had to remove the flipper so they

couldn't release it back out in the wild and what would happen was we'd keep it for all the tourists and everything and we would have to hand feed this sea turtle like we're supposed to feed a cabbage and broccoli brussels sprouts and things like that we're not supposed to feed a shrimp because in the same tanks they were stingrays much like it happened Stingray City out there and so you know we would feed this the Rays um shrimp because Rays loves shrimp and the Taurus loved to see these you know stingrays give all the divers hickeys and stuff like that crawling up and down us so there we were the attraction bigger than the Rays and what happened

though was some of the other divers would still feed the turtle the shrimp and there I was and I I would never feed the turtle the shrimp but one time again I was feeding the Rays other divers were trying to take care of the turtle and then I like bent over on my back because you know water start filling the mask just bent over to or turned over and I'm holding like the shrimp like you know this while I'm doing that and Clarion and all of a sudden I just feel something clamped down on my hand and that was a nice little sea turtle because all those other bastard divers would feed the turtles shrimp so this

the turtle did not know hey if a diver is not actually trying to feed you shrimp don't use their hands as a feeder so anyway then there was another time I ran out of air and literally I was like and I'm gonna get to this later but all scuba professionals are not the same quality and one time I was on this early dive one of my first Dives out after instruction and I had and I couldn't get down and then the Dive Master oh you you know you got to stop panicking and go I'm not panicking I'm like literally trying to show I'm pulling myself down the rope and I'm still being held up because you know there was air in the

BCD no matter what I did and the diver was a and then he's like uh you know finally I managed to get down there by putting lots of rocks in my pockets and then what happens is I'm going around and like after a little bit longer all of a sudden I'm like sucking in and I was like I think I'm out of air and I'm like sitting there it's like I can't be out of air and then I look at my you know look at the little air regular and it's like I'm out of air and then I'm like sitting there thinking do I have to do one of those stupid odds and go up

slowly like they train you and I'm like yeah I have to do that so anyway I did that got to the surface then the Dive Master comes and I go I'm out of here he's like you can't be out of air I'm like show him he's like oh you're just breathing too much I'm like it's not the fact my equipment has more air than I do you know anyway that's you know bad equipment even when it's supposed to be good leaking Mass you know you do have mass that leak no matter what you use a dive Hood sometimes it really screws things up but these things happen over time and then here's a good one the

reason I have a picture of Amore eel here I was once on a dive trip at a Fort Lauderdale and this one guy was diving and he was trying to you know catch lobsters and so what happened was we all went our ways it wasn't a guy to dive then we were just doing a drift dive along the coast and then I get up top and there's this guy all with his hand benched up bandage up dripping blood down his arm it was like and I'm like what I was like oh I'm okay I like I don't care if you're okay I'm just curious what happened and then he's like well I was like feeling under a reef and

then I you know to catch lobsters and then apparently there was an eel under there and so what happened was the guy who was an experienced diver you're supposed to know to have a poll and to like use poles to go under so you don't get bit by eels and other bad things like lionfish and stuff and for those of you that don't know eels are like alien because this is Amore yield that does not look very scary with the teeth the problem is it has a second set of Jaws where the outer jaw when it bites something just grabs it and the second shot like alien juts out with lots of big fangs grabs it and then pulls it

back in so the guy basically shredded his hand because the eel tried to pull his hand in and so what happened was that was this guy and then I went back to Fort Lauderdale and I went to the dive shop and I was like yeah I went out diving with you guys it's like oh yeah the guy told us how he fought an eel I'm like that's not what happened so anyway it's kind of like the guy that caught the fish this big That Got Away so anyway and here's the thing that comes back despite all these things going wrong no training is ever waste of time there's bad classes that I've taken there's classes I thought were pretty

much a waste that I had to take but at the end of the day what these classes did was they breed you know they breed skill and familiarity the more you're underwater the more comfortable you are the more training you have like I would never think that that training I did for the Magothy River Association where like we had to put um paper towels in our mask to Blind us essentially because they wanted us to train for zero visibility which essentially what diving in some places is so they trained us with that they trained us how to get through obstacles and there I was having to get through obstacles to get out of a rock into a

dolphin tank and all this stuff kind of comes together because the more you dive the more comfortable you are the less you'll panic and so on and know what to do when things go wrong and then there's also the question and you never know when you're going to need your skills so there was a during my rescue diver class like our checkout Dives and this is actually pretty funny except Somebody almost got themselves killed during the rescue diver class all of us were like in this deep end of a quarry in the middle of nowhere and out of the nowhere this guy just pops up and freaking out again tears off his mask throws the

regulator out exactly like what a panic diver would be like and we're all looking at each other there's eight of us in this class and we're like is this like a pop quiz or something like did they put somebody down there to test us and then it turns out this guy so then he was like there and then you have and the worst place to ever come up is in the middle of a like first aid rescue diver class in a panic because then you have like eight people okay breathe slowly do this calm down and I'm like I just went away because that guy had more than enough to worry about all these people telling him to calm down was

going to freak him out more than whatever he was freaked out at that point and what happened was there he was and it turns out that this diver he was actually doing some what they call Tech diving training which is like you know multiple air tanks of different you know different types of air and stuff like that and apparently he was taking a class freaked out and just popped up and then all of a sudden we're all sitting there thinking wait a second if he's the student and then we're like where's your buddy he's like oh it's just me and the instructor then we're thinking do we have to form rescue parties to go down

and find the instructor now and then all of a sudden like three minutes later his instructor oh I guess he just freaked out and we're like instructor of the Year material there so anyway you know I had a son with BR like he ended up having whooping cough and all of a sudden it's like he was choking I did the Heimlich maneuver I learned in one of my rest in like emergency first responder class it had nothing to do with like stopping whooping cough but apparently it helped get forcing air in and out so that's like those skills I mentioned getting corn on the Rocks then there's other times there was one time I was diving over in the Bahamas and all

of a sudden you look around and there's like these eight foot Caribbean reef sharks just swimming alongside the divers now if you're not used to knowing what to do it's really easy for somebody to freak out thinking we're being surrounded by a school of sharks being hunted by them but if you know what you're doing you're familiar with diving you know the behavior of sharks it's like hey wow this is really cool and you can take pictures of it like I'm lucky at the time I was diving with my ex-wife and she was back there and I just like waved to her to get her to wave and I took a picture and she's like oh okay

then I showed her the picture when we got back on the boat and and she's like oh I go here's a picture of you waving with a shark five feet behind you and she like and she would have freaked out if she knew that was going on at the time but anyway then there's Braille diving like I mentioned I call it Braille diving with zero visibility where you're just feeling the ground trying to do stuff and so on getting stuck with dolphins knowing what to do what not to do but stopping at the end of the day all of this I'm telling you what's going wrong because stopping stupid is a process and an ecosystem

everything that I just spoke about and everybody's thinking I mean hopefully you're starting to see the similarities between what I'm talking about with scuba diving and what actually happens in cyber security as well because stopping stupid much like scuba diving it's a process it's the same thing and it's not just a process it's an ego system I saw this article this morning when I thought I had more time to than to come down here I was reading this article by a woman at nist and she was talking about oh how companies ruined security awareness training and how security awareness training should be more approachable and things like this and I'm sitting here thinking it's like and you shouldn't

have like you know like it should be a carrot not a stick and I'm sitting there thinking you know what why is filling out a time card and if you don't fill out your time card you don't get paid and that's okay by everybody but telling somebody if they ruin the company's Network they shouldn't be have some repercussions for doing things they shouldn't be doing you know the problem is we're like looking at security awareness as just tell people what to do and in the right way and they'll do it and if we're if they're not doing what we tell them oh we must be doing it in the wrong way no people will do stupid

things it's a given I promise you if I send the message out that said this is a phishing message and if you click this message it will ruin your entire network three percent of people will click that message that's a given but what you need is an ecosystem that expects three percent of people to do something wrong and that's essentially what the dive Community has done because if you think about it if diving like if we're relying upon if three percent of divers go out and get themselves killed or seriously injured on a regular basis the diving industry would end really really quickly but yet it's created an ecosystem where that doesn't happen and frankly you

could do yourself a lot more harm scuba diving than using a computer anyway and we still are able to have a safer environment scuba diving than on our computers so there's a process and the process starts from start to finish how you train people to do things right how you train the instructors to train people to do things right and then the diving providers in other words the people who take people out in diving their standards for them there are processes for them and so on and all of this works together with the diving instructors and then throughout the whole industry there's quality control and the reason quality control is important is if you're relying much like you have to

expect students to do something wrong you have to expect um dive professionals to do something wrong as well so think about when you try how many here are certified divers just out of curiosity or ever went diving okay only a few which well surprisingly you're in the Cayman Islands where everybody goes to get diving I mean it's like in Maryland everybody loves supposed to have crabs there and only the Taurus really eat those crabs from Phillips crab house so anyway um but to become a to to actually become a certified diver the first thing you have to do is take like dozens of hours of training these days it's online before you had to sit in a class for

like a couple weeks you know a few hours a night but now you pretty much do all your training online and the training at the end of the day is proud not to get yourself killed at the end of the day I mean they teach you a little bit about science Boyle's Law a little bit about that that's just all fluff at the end but really most of it is to tell you how not to get yourself killed then what happens is after you take the materials then you're given a quiz and the quiz basically goes ahead and says whether or not you have retained enough information on how not to get yourself killed and

they print you up a certificate then you go to the dive shop of your choice say I have passed my class now a smart school will go ahead and say congratulations I want you to sit down and take that test again sorry I didn't even remember not to shut my phone off that's how in a hurry I was but anyway so there we were and but a smart school will go ahead and they will make the student retake the test and why because you expect people to have their friend who's a certified diver take the test for them so they don't have to sit through it so a smart dive school will make sure they watch

the people take the test and then once you do that then you fill out a medical form before they put you in the water and the medical form is supposed to make sure you're not going to have a heart attack you're not going to have a stroke when you get in the water and you're not otherwise impaired and then you take actual swimming or water test and then what they want you to do is they want you to like swim like 200 yards it doesn't matter how you do it I mean frankly you could just like do doggy paddle and whatever and that qualifies then they want you to float in the water I think it's for like three minutes or

10 minutes I can't remember how much do they really care I mean that's what all the scuba equipment's for the only reason we want people to do that is to make sure they're not going to freak out in the Water by default that is the only reason it has no skills requirement it's really just to examine their mental state and comfort in water then once we do that we teach them all the com you know how to set up the equipment how to do things you do it around the pool area or other really very kind area and that's one thing and then once they pass that then you say great we're going to take you to

open water in pretty much a confined area have you go through all the skills again and do everything specifically and what that does is does that make somebody a great diver the answer is no frankly before you have 10 scuba Dives in you kind of really suck at diving it's a given because you have to like control your buoyancy intuitively and things like how you flow through the water that you're not going to go drastically up or drastically down it just takes a while and that's okay but it doesn't mean that you're a great diver it doesn't mean you're not going to get yourself killed really at the end of the day it just means that maybe

that's oh no anyway it just means that you're not going to go ahead and die by default you at least know how to do it safely but anyway then like the cold dive profession they went together and had like a curriculum developed like what are safe skills to learn at different times so you know they have a few of the fun things like for kids like the bubble maker steel team discover scuba diving which is really just okay here's put yourself in a tank in a like reasonable area not get yourself killed then you know the Specialties you can learn then how to work your way through professional ranks now the thing is most people you don't really have to know

anything besides open water diving but another thing is there are if you work with good dive providers which unfortunately a lot of dive providers don't want to do the check like they should if they're going to take you below 60 feet make sure you're at least you know an adventure diver certification if you're going to go below 100 feet they better make sure you have a deep dive certification or something like that because you really have to know things to do right and do you really have to know it anybody could go 100 feet because in general around here being down like in the Cayman Islands being down 30 feet and being down like 130 feet is pretty much the

same for the most part you just get a little less fish as you go deeper but it's really a nice gradual dive and it looks the same but people have to do things and train you and expect and put you in situations that at least you're certified to be put into a dive operator can ignore it but if somebody gets themselves killed and I could tell you like if I'm out on a dive and somebody injures themselves in 70 feet of water and what happens is all of a sudden they go back they sue them and they say well why did you take this person out to 70 feet he's only an Open Water diver and

an Open Water diver without having a deep water training dive is not allowed shouldn't be allowed to go below 60 feet and so on and that could come back to bite them but they don't want to turn people away in many cases and that's a risk that each dive provider has so we'll go back to that later then there's risk management throughout the process when I teach people to dive when I have to do things there are training standards developed like if I take people in the water I'm only allowed as an instructor to take eight people in the water at a time sometimes it's limited to four people in the water unless I bring the Dive Master with me

depending upon the age of the divers and so on and then they keep doing and then what happens is as there are incidents they keep revising the standards they keep saying okay well this happened this hasn't happened we think it's a safe risk to do this we've seen an incident where somebody did this so then go ahead and we'll you know you have to modify that and so on you know the course curriculum has been developed and refined what goes into the training what goes into the Dives I have here let's see does that work so these cards here are over here those are cue cards that when I take people down to certify them

as a diver or to teach them as a diver and open water for advanced certifications these cue cards tell me exactly what I'm supposed to do what skills I'm supposed to generate for that course at that time and these cue cards that they print up take it with me so I I can't forget them theoretically risk Management's embedded in every step you have insurance this those cards I mentioned instructors I have to be certified to take people in as an emergency First Responders certified you know usually you have to be an efr instructor as well we have to have first aid kits we have to have oxygen kits we have to have aeds like you know the

heart palpitation devices that have to be with us at all times in case something goes wrong we have to know where the hospitals are the hyperbaric chambers and this all goes into every time we teach why do we have to know that because they've examined all this data on what has gone wrong and how do we manage all this risk despite the fact things will go wrong anyway but how is the risk reason reasonably well contained so this is all built into the standards now I have this slide because this is an example I'm going to assume just for the case this person here is a student the one on the left side this is

the instructor watching that person trying to do a fin pivot and then you can see like all these other people are sitting around and while the instructor has to look at one person at a time which is potentially dangerous because people will do stupid things and I actually was in this situation and in the corner of my eye somebody like here just like hey let's look under the platform to see what's there despite the fact we tell them stay on the platform until we swim around somebody is always going to want to look under the platform I promise that because people do stupid things anyway what happens is if you do good risk management like I mentioned before

when I'm a teacher if I can especially when I have more than four people or frankly more than two people if I have to you know a smart instructor will bring another person a Dive Master or assistant instructor around to go ahead and watch everybody also when you take them on the actual scuba dive afterwards that person stays behind and follows everybody behind to make sure they don't like get lost and do other things because people you know it's kind of like you know squirrel chasing and things sometimes and stuff but anyway that's what you do then also embedded in everything is insurance at every step what dive organizations do is they make sure everybody's insured they get cheap

insurance rates the instructors insurance insured the school is insured the dive site's insured the bone and the staff are insured and then there's even a policy we take out on students the students don't know that we ensure all all of the students so if something goes wrong with them we don't know if they have health insurance or not that's not one of the questions but we take out like a policy like twenty dollars per student that they don't know we're paying for them in case they get injured so insurance and is risk management and that's embedded everywhere and like I said before a certification doesn't mean a diver is a safe diver it means we have

certified that at least they know how to be a safe diver if they follow what we've taught them and that should be the same for cyber security users we should be able to say look we know users are going to do really stupid things but we're not going to be stupider than they are we're going to acknowledge that they do stupid things and we're going to train them to the best of the ability but we're going to put in infrastructure behind them to make sure that their stupidity does not ruin the company but again all we know is that they are certified that they know how not to kill themselves they know it it's not worth

saying they're never going to kill themselves but then training the instructors and I had that big diagram a few slides back you know there's the first level of professional was a Dive Master and everybody thinks like the Dive Master is something like really special at the end of the day 80 percent of Dive Master training is like show me you can do a fin pivot at a level four or five out of five show me you can take off and remove your equipment at a level four out of five or a level four or five that's a 80 percent of Dive Master training there's a little bit on safety there's a little bit on dive industry

business and so on but most of it is just to make sure that they have perfected it there's also the assumption that they've already taken a rescue diver class that they've already been efr started you know emergency First Response certified which means they know how to give CPR how to do basic first aid and so on how to handle emergencies but basically 90 80 percent is really just basic diving skills the one thing that is horrid and the hardest thing I ever had to do in dive training and it sounds simple at the time where you have to go down in a pool with a buddy and you have to completely exchange equipment with each other while buddy

breathing that sounds really simple I asked my Navy SEAL friend how he did he's like oh yeah I just took a big D you know I just took a big gulp of air and then I would just take my equipment off I let the other guy keep doing it whenever I needed more air the guy would give me his air and so on and I thought that's what I'm gonna do God was that the stupidest thing I ever thought but I mean I am not the same training as this my Navy SEAL friend I thought it would be easy it wasn't so anyway there's a lot of people who blow Dive Master training on just that test and why do

they actually do that it's not about really a hard skill it's really about will you panic that is the most thing because some of the tests are not obvious on what they're trying to get at people students floating in a pool again the primary goal for students floating in the pool they're not going to freak out in the water the primary thing that a scuba a Dive Master exchanging equipment while body breathing is that they can control their Panic they can control their fear that's what that test is for if you ask me but then you have the instructors instructor training again as how to do basic skills how to teach people how to recognize students doing things wrong

and so on a lot is legal responsibility a lot is quality control you know Advanced certifications and so on then amass the scuba diver trainer which is what I'm at it's really just a scuba instructor who's done 25 certifications and can train on five Specialties which I'm shocked all scuba instructors aren't because it's really easy but anyway that's what I'm and then instructor trainers they have like higher levels and course directors so certified the actual instructors they're the primary Gatekeepers if you want to call it that and they also do quality control of all the other people involved but ultimately being a professional like in cyber security should be about here adhering to an enforcing standards and that again

is what a good cyber security professional should be doing as well oh yeah sorry I just ruined my joke what do you call the person that bottoms at the it graduates at the bottom of their medical school class doctor you know what do you call an instructor that's at the bottom of their class instructor so on what do you call a cyber security professional who doesn't even take a class a cyber security professional that's the unfortunate part so anyway dive agency sort of you know certifying a pro that just means that they believe the dive Pro is acceptable to put the entire industry at risk cyber security people are putting their entire company at risk theoretically much in the same

way but really if I'm an instructor people have said it's okay for me to put the whole dive industry at risk and why is that what happens when people die and during scuba diving I mean the stories go all over the place they make movies about it what was this movie Blue Water or something where a dive boat leaves two student you know two divers behind that freaked people out that's a really good way to ruin the whole dive profession you know you see all these Megalodon you know the Meg and Meg too like about big sharks eating people going underwater that's really not good publicity for the dive industry and when somebody kills themselves scuba diving it's really

really a bad thing and I would argue that when there's a major cyber security incident it doesn't reflect on our profession well think about it when you have like a major ransomware attack it's like why didn't their security people do anything when you had the Equifax breach it's like oh they had a music Major in charge of their cyber security program and things like that there were other problems and I'm not saying that the you know but they go ahead and will tear you apart when there's a major incident dive operators they take people on trips they fill air tanks they basically allow people to dive if they're going to be an independent diver like it could go to a

dive shop here rent equipment and then say I'm just going to go off a beach and they'll let you provide equipment maintain equipment and so on but what's risk management for them when you walk into a dive shop a good dive shop should go ahead and check your certifications test they want to see your card or they can look it up online they'll ask medical questions unfortunately I didn't get a medical questionnaire so bet on them they'll ask the date of your last dive and why do they want to do that because if you haven't Dove within the standard is two years years you should get a refresher class frankly for many people it's six months to get

um because you know you just might not be comfortable they don't know your use of equipment how many times have you Dove like if you've Dove 300 times you haven't Dove for like six months you're probably okay if you've only Dove like you know five times and the last time you Dove was two years on a trip they really need to make sure they give you help and stuff like that so anyway they want to check your equipment to make sure everything's safe they have to have insurance on everything responsible dive operations like you if you're on a boat they should be calling off people's names they should be have a Dive Master in the water with you a certified

captain and so on they should know where the medical facilities are they should have oxygen first aid and so on in case she gets oh yeah I've also been stung by a jellyfish that kind of sucks and that pissed me off too because I got I I was actually I was I was scuba diving in Oman It's actually an interesting story and they took us to this Cove and the Cove was filled with gel fish and I didn't think that there was any place like this except for like in Fiji or somewhere like that and then I'm like and the only place I heard that you could go swimming with jellyfishes in this Cove in Fiji where they're all

stuck in everything and don't have tentacles and what happens is we get there the guy's like oh yeah it's safe they won't sting you and I'm like sitting there and I'm watching everybody else go off the boat before I do and I'm like just sitting there pretending to check my air the guy's like are you okay I'm like oh yeah I'm just you know I just want to make sure I didn't hear screaming before I went in myself that's my risk management then I finally go in and then we're coming back in the cove and I get there and what happens is all of a sudden I feel a really painful thing on my hand and I go back to the

dive boat because it's right there and then he's like oh yeah you should be more careful I'm like looking for a stinging jellyfish in a lagoon with a hundred thousand jellyfish he's like yeah I'm like Dive Master of the year right there people anyway so quality control quality control is embedded within the entire industry there's major scuba organizations like Patty like SSI and so on and these people whenever there's an incident they go back and investigate the incident they figured out what happened what were the enabling factors and when you do incident responses you should be doing the exact same thing when a user clicks on a phishing message you should be asking yourself why did

that user click on a phishing message and I'll give you a quick aside I was once investigating if you actually want something funny Google Ira Winkler and Syrian electronic Army and you could throw in cockroach it's a really good you know you can do that now while you're waiting but anyway I would investigate Syrian electronic armians and army hacking incidents and one of them they broke into a multi-billion dollar company and one of the people who fell for a phishing message was the CFO I went to the CFO I go this looks like an obvious phishing message I go this is going to sound bad but you're a smart guy why did you fall for this crap and

the guy was like well I woke up at 6am in the morning opened up my iPhone saw a message saying we were mentioned in the BBC the guy by the Chant by the way was British working in New York they really targeted a guy he's like I opened it up and I clicked on the link and entered my credentials I'm like well don't you know how to check for a malicious links on your iPhone he's like no and then we went through all their top tier cyber security awareness training and none of the videos they had them watch or any of the training said anything about how to check for the validity of links on mobile devices so

we had to put an emergency cyber security program in place on how to check militia for malicious links on mobile devices as an example and those are only things you do when you do a detailed incident investigation down to why did people do something you think is stupid and so on and that's what dive industry does they handle complaints about teachers doing bad things and a God I can give them dozens of complaints there's a disciplinary process where they go ahead and investigate they can pull or suspend certifications of instructors professionals dive or dive operators and so on they do periodic inspections and this is built into everything that's done just to make sure the industry is not going to go out of

business because somebody leaves someone body in a dive site or somebody gets somebody killed because they took a first-time diver and put them in 130 feet of water so anyway if there is a lawsuit with all the risk management in place they contact insurance they go ahead they cite training standards like if somebody gets harmed they go back there's cars that student when I certify people there are cards that Patty prints up that has students initial that yes they have they are initially that yes I made sure they know how to do this skill this skill this skill this skill because if somebody gets killed their family will try to sue who's ever there I'm not

saying rightfully or wrongfully so but they will try to sue them and they will drag everybody in from start to finish the person who first certified that person 20 years ago will be part of the lawsuit and then you have to break out the trading cards and said well this person died because they didn't you know do a slow ascent and they initial that they were told how to do a slow ascent and I witnessed them doing a slow Ascend so therefore they knew what to do they just didn't do it and I'm off the hook by and that that's the type of things that you have to do from a risk management perspective where the dive

industry is really teetering on one incident and just for example when you're talking about that how many people heard of Steve Irwin Crocodile Hunter how was Steve Irwin killed Stingray you have people stepping on stingrays hunt thousands of people A Day stepping on stingrays not getting killed how was Steve Irwin got killed and this we you know they did an after accident and because I was a volunteer diver for the National Aquarium in Baltimore they actually went through this because we dove with stingrays on a daily basis and what they said was they put a camera in front of a stingray on the bottom of the water and then Steve Irwin wanted to come on top so it looked like a cool

picture of Steve Irwin diving of coming right into the camera on top of the stingray so there you had a stingray trapped with a guy six inches above him hovering over him trapping him and a stingray what's the first thing they do they jump and their tail goes up and they try to run away that's what happened that's why Steve Irwin Advanced Medical Handler got himself killed and that's what happens when people do stupid things in so anyway so oh yeah and and besides all this people hate compliance compliance seems like a holes sorry I'm not cursing that much today I'm trying not to but diving is statistically safer than bowling that is a true story

so anyway keep that in mind when you start looking at all the standards all the compliance all the quality controls and so on the whole industry and this is why I'm saying this the whole industry is basically relying upon each other that if somebody does something right or wrong it can seriously impact the whole industry if somebody if a dive operator gives people bad equipment that just fails at 100 feet that's going to ruin it because it will be news stories they will make movies out of this and so on it's a five billion dollar industry that doesn't include the tourism that doesn't include for example all the people traveling here to Grand Cayman and other

places you know it's all because of risk management from start to finish and the organizations that oversee this that really go ahead and maintain the whole industry oh yeah I know it's three minutes 40 seconds by the way not five so anyway if one element fails they're all gonna fail that's cyber security so General lessons science is embedded in everything in diving by the way you know don't panic the small stuff because you will have like leaky air mass you will have leaky Mass you will have like equipment that isn't operating perfectly and stuff and you just go ahead and go with the flow and mellow out on the other hand sometimes the small stuff

rally really can become big stuff where if all of a sudden you see like a slow leak and sometimes a hose will pop all of a sudden so you got to make sure that those things are accounted for it takes a while to get things right like I mentioned new scuba divers new scuba divers no matter what no matter how good they think they are they're going to be a mess for like the first 10 to 25 Dives also the big thing the things that sound really really cool aren't like I could tell you for example that deep diving to me really sucks you know going down like everybody was asking me so how low do

you go I'm like well I've gone 130 feet they're like wow that's cool like oh no it really sucks there's not a lot of light there there's not a lot of coral there basically all the cool stuff is like you know 30 to 60 feet in general that's where I really like to dive there's another guy we were on a dive trip Christopher peacock is on this trip and there was this guy who was wearing a dive knife on his leg which looks really cool he was even wearing it exactly where they tell you on the inside of the leg so you can pull it out only a douche sorry I'm trying not to curse but only a

only a loser really carries a dive knife if they're not going to do stuff like when I would maintain oysters and stuff I have like a knife that I just have by default there you know with a flashlight and stuff but you don't go around you know like I have this all this equipment look around for the people that have like 500 Dives none of them has a dive knife if you have to rescue a sea turtle from fishing line sure but the average diver especially with 25 Dives is not going to go ahead and rescue a whale I promise that you know don't get overwhelmed time take time to think when things go wrong stop and breathe stop

and consider what's going on you know never can be too well trained and also you need the 10-foot view you also need the 10 000 foot View and that's in cyber security especially because when you're diving and I'm gonna show a picture um oh yeah 30 feet I'll come back to the that one later but 30 feet can be really awesome and it can really suck I did my checkout Dives in skinny Atlas Lake in 15 feet of water where the visibility was about five feet and the temperature of the water was 41 degrees that really really really sucks to put it mildly but the reality is when somebody says oh 30 feet it's not the depth that everybody

thinks of you got to look at the overall conditions that say if something's good or bad now going back to the 10-foot view on the 100 foot view we were diving earlier this week I guess it was Tuesday and what happened was it was near the end of the dive I was running low on air so I stay higher because that conserves air a little bit better and what happened was everybody else this was low down looking at the coral and everything and because I was up higher I was able to see something that people wasn't and all of a sudden so anyway if you can look there there's actually like an eagle ray and it looks really really and

that's actually probably like six to eight feet wide but nobody else was able to see that because they were looking down on the coral and so finally we had got the instructors or the dive Masters attention and he was able to go ahead and get every you know a few people to get the attention but that only happens when you're looking carefully at the things that matter to most people but you're also looking around all the time and taking a higher level View so anyway there's another thing I'll quickly say because I'm I'm out of time but he did give me another minute 20 seconds nobody I asked my friends to the Navy SEAL that I mentioned and so I was

I use them on Consulting assignments for physical security and one of the clients like you know they like talking to Navy Seals because they think it makes them sound cool because they're talking to them and they asked to do so which was harder the training you went through or being in the field and Stu's like and I was expecting Stu to say the training like with all the hell they put them through literally and through surprising he's like he goes oh being in the field easily I go what he's like nobody ever pulled me out of the water when I had hypothermia when I was trying to mine chips you know that type of stuff and that's the type of

thing you don't think about so again the training as hard as you can get is really really important because that way you're trained for when things go really really wrong I do want to go ahead I don't really have time to go in but Patty one of the certifying people joke like my the course director I had who was a combustion he's like yeah Patty should stand for put another dollar in and I'm like thinking that put another dollar in is the only thing keeping you in business because he was able to go ahead and like he made a lot of business by going to different colleges around Maryland and teaching the students at those colleges

scuba diving and the only reason he was able to do that was Patty spent a lot of money to have scuba diving as a as a class that goes ahead and is able to get college credit for and that allowed that had colleges them wanting to bring scuba diving in if nothing else that one thing he hated paying them money for was what made his whole business whether he wanted to admit it or not and there's a whole bunch of other stuff I don't have time to go into I'll leave you with this thought this and this was actually I saw this when I was taking flight lessons and you know it said this the sign of an

outstanding diver is one who never gets into a position where they have to use their outstanding skills you know I saw it originally where it said pilot but anyway same thing with diving same thing with cyber security professional don't get in the position where you have to use your outstanding skills again for lack of a better term if you haven't got it now pretty much everything I said replaced scuba diving with cyber security and today I just love this one so I had to add that otherwise for your reading pleasure those are my books buy them they're awesome and thanks I don't think I have time for questions but if they want me to I'll take them

well you oh yeah oh she has a question I'll do that because nobody else is here now you can start getting on uh anyway go ahead

don't take

care of the Educators um they're aware of the typical threats um however the waters and temperatures change um how does one prepare for that no different than unknown cyber security friends in addition to the training um the ever-changing landscape um obviously sorry okay um so in addition to the training and the forever changing landscape with respect to cyber security what are your best practice recommendations on how often you should provide training for your end users no different than you would for uh diving and refresh courses so that's actually a question I have really really strong opinions having written security awareness for dummies and you can't stop stupid I'm a big believer in security awareness so don't

get me wrong the problem is it's they look at it they're trying to make a tactic strategy security awareness is a tactic within a larger strategy to mitigate the whole concept of user risk much like teaching people how to dive is a tactic in making a strategy of a safe dive industry So to that thing what's the right period there should be both passive and um sorry passive and active methods of training people you should have constant reminders throughout you should have nudges embedded you should have good like for example email messages should make use of those um banners let's say external message versus internal message and so on that's a constant reminder for people to be on the lookout you should

have people for example you know like posters newsletters they're not they're not great but they provide some sort of reminder and then you do have to have because of Industry standards you have to have monthly training or whatever your Auditors tell you to have I frankly think the quality is more important than the quali quantity and I think most security awareness training sucks royally to put it mildly and bad training is useless and frankly harmful because people people are offended by taking bad train I should not have to take my sock manager and give him the same training I'm giving to the person in the mail room and that's what we're doing in this profession

so that's an example of things that need to be improved but you need a constant flow of the right information in the right format and it's not just a one-time thing when you get on a dive boat they always reiterate you're going in the water here's what you need to know now here's what you need to do safety stop you know you need to do this you need and even in the water they're telling you to do a safety stop so it's embedded as people are doing things and that's really what we need to be doing embedding awareness and practices as we're doing it not just in be aware because there's evil hackers out there because people are too afraid

of the hackers and they're making mistakes that cost you more than the hackers ever will and he was talking about my Knights and Dragons I told them everybody's afraid about the big horrible dragons when they should be afraid of the rats and cockroaches with the fleas that cause the Bubonic plague the Middle Ages were never ruined by dragons they were ruined by rats and we need to make sure we're taking care of the rats not the dragons anyway hopefully I I went way over I apologize to the next thing thank you