Fareedah Shaheed - What Can League of Legends Teach Us About Cybersecurity?

we have a problem and the best way for me to explain this problem is to bring the League of Legends game into the myths now by raise of hands who here has heard of League of Legends okay also we got awesome crowd I can drop a few guys who here has played it ok maybe not so much maybe you played a similar game maybe Starcraft 2 or maybe none of this applies to you but you've worked with a group of human beings before okay good and we all can get them off and you can understand this story this story took place after an exhausting day at work one thing that I like to do tell me whine down this play League of

Legends game and now essentially what League of Legends is is a strategy game and the whole point of the match is to take down the Nexus which is the enemy base there are only two ways to win the game one you take down the enemy base two you forfeit the match or you surrender when a team dies or when a player dies you can respond you can come back it depends on how late in the game it is and that depends on how long your timer is to come back the game doesn't end when you die I knew this and so I open up the game in I have a strategy I have things planned out when I usually

have things planned out but this time posting the perfect tunnel vision when the world around me slips away and the game is all I can see or think about ok so this is me talking to myself focus on helping your teammates protect the ADC which is the high-damage player of the match which is a port of player like I was was tasked with protecting oh and keep an eye on enemy players and then out of the corner of my eye in the in-game map on the side I see a teammate of mine chasing after another player in enemy territory with no visibility into the me area basically into their jungle one characteristic of a jungle in real

life is that it's dense you can't see past a certain point and this is the same for leap you can't see past a certain point it so he was basically going there blind and the reason why was because he was strong he saw month larry's uh-uh I got it I'll be fine because moments before in the match he ain't got a lot of kills and with every kill it was a risky it's a risky play but like all of us when we make a risky play what happens to us when we make a risky play we win we hear like okay I got this I'm good so we make another risky play and we're fine if we develop an ego and

this is what happened ten he develops an ego so you went after the plate and he does classic rookie mistake we all make them but I don't have to talk to this this match was important to me I wanted to win so I decided to say what all my teammates were saying but a much nicer way I mean granted I felt my teammates frustration but instead of calling them a mother-loving piece of shirt I decided to follow my own personal rules and her a real nice message yeah well that was a play but we really need you in the match you're one of my strongest players so let's not do that it was to know what

though he just kept making one risky play after the other and instead of each risky play being a risky play it became a list of rookie mistakes one after the other I was beyond frustrated at this point I want to win this match he didn't have to take every single piece of advice that I told him all he had to do was follow one piece of the bust you know cuz the whole objective of this match it's a be an actual contributing plate

enemy double kill in a niche triple kill enemy Quadra kill enemy Penta kill that's around I realize it we all had I see that I was tasked with protecting had uh and naturally my team's annoyance which was first on the rookie mistakes player shifted to me and right Felicia because I wasn't protecting the team because of rookie mistakes player in I were similarly the same while he was in his own tunnel vision so was i moments before our team's I I was so frustrated with him and his rookie mistakes I was so distracted by my annoyances with him that I forgot my role in the team in my team was on the other side of the map

getting killed by enemy players one after the other and by the time I got there it was too late I couldn't help them and thus the rookie mistakes player and I were guilty of the same crime because I also lost sight of the goal the goal wasn't to play perfectly and everyone play on this artificial even a superior level the goal what to attack the enemy Nexus as a team the best teams are the ones the lot more energy towards their own individual performance rather than micromanaging someone else's they offer a helpful perspective when something goes wrong and then go on about the task at hand in cybersecurity the end user is in there while the end

user is in there tunnel vision so are we we so often focus on our annoyances and frustrations with them that we forget that we are also a part of the problem we also can make mistakes

the rookie mistakes player wasn't a bad player they were actually a very capable very strong player they just made a mistake

so what happened we told him what we needed from him as a team we emphasized that he was vital to the match and we gave him a game plan using our strengths and we win the game yes not all games go like this but some of them do similarly in cybersecurity the end user isn't a bad player they're a very strong very capable player they just have moments maybe more moments than we do but they're still strong and by

when we're talking to end-users when an incident happens in may trigger an alert and we're upset for the X amount of time before you talk to them have a game plan okay you're frustrated take a walk around the campus take a deep breath tell them what you need from them as a team or a part of the team every single person the team is tasked with protecting their allies and protecting their own Nexus there in a third base emphasize their vital role tell them what you need from them say hey you know what this is my job I'm a security professional this is why my job exists and what we need from everyone in the

team are in the world we're gonna go that big is that everyone plays their on the role we're human and we make mistakes Innes okay but make sure they know that they're a part of the team you're not leaving them out you're not making them feel like they're inferior fess up to being human to be open no one wants to talk to someone who's infectious if you did something wrong and someone came to you it's like yeah I never made that we're not going to feel really good about listening to them so be open when you're talking to them I believe our attitude towards end users is doing a disservice to our ultimate goal because

ultimately what do we want a more secure world a more secure future but we can't do that if we alienate some of our teammates we can't do that if we make someone feel inferior we can't do that if we're distracted by our own annoyances and frustrations with the routines days play like I was and as cheesy as it sounds we're all a part of a team fighting for a world where our security our privacy is taken seriously and we can't afford to keep toxic mentalities about what an end user is or isn't we will be frustrated and users we will want to curse them out and we will want to shout and yell I'm having an ID 10t error over

here idiot and flip the desk I'm pretty sure all of you want to success every day but we definitely want to put the desk with someone triggers of alert again but you can't but I'm saying we can't because there are part of the team maybe you don't have the capacity to guide someone maybe you're not that person that can walk around the campus take a deep breath and then talk to the end user and say hey I'm on your side maybe that's not you that doesn't have to be you maybe that's me that's what I'd like to do you can pass it on to someone who likes to do it but if you have to do it

consider your game plan consider the end goal what do you ultimately want and let's not let our annoyances and frustrations take over us like it didn't be in the game when we lose sight of the ball so much that we can't see what's in front of us the strong and vital player who makes mistakes who may not know security I believe it's time that we treat each other like we are all human and part of a bigger team let's talk about being human I'm gonna ask you a question and you don't have to raise your hands for this question but if you want to feel free have you ever been made to feel like you

were inadequate not smart or not good enough I'm gonna be vulnerable yes that's me and if you haven't that let me be you for a day because I'm pretty sure that would be nice actually it's not because then you wouldn't know your strengths

everybody has someone in their life that has made them feel this way it could have been a parent thankfully wasn't blind but it could be your parents it could be your friends your bosses your co-workers how does it make you feel to talk to this person do you feel yeah they came to me for another day to tell me to do another task I like them I'm gonna do it cuz they make me feel really inadequate you know you don't because we hate being around them because they make us feel like we're stupid and you know what they may have never said anything to you about being stupid or inadequate you may have never heard anything

through the grapevine about them thinking you're stupid but the way that they act towards you makes you know and feel that you just know they feel like you don't belong that someone else should be in your place because our thoughts affect how we treat people it affects how we have conversations it affects our jokes it affects I contact our micro smiles and micro frowns they all affect us and what I'm saying to you is that the way we think about it users effects end users because if we feel and we constantly say that they're inadequate they become an advocate because that's how they feel whether they know it or not I'm not saying everyone but I'm saying one thing that I

had to realize while doing security awareness trainings and well caught while talking to coaching clients or creating security awareness training modules is that one thing we have to really understand is that not everyone knows security and we're going to a few examples of my stories with that not everyone knows that so when you're talking to them or when you're thinking about them or you're talking about fun see to understand your their situation Geor have your brands we need to have our events we need to get it out for in front of them on our training ourselves how to speak and how to talk about them so that when we go to them we give them

the best information to understand their situation does their whole job involve clicking on links there's this lady who her entire job is to click those links and open attachments and if I go to her and tell her do you know this person you shouldn't click on that because you don't know if the IVA doesn't even look right to you it's not gonna work for her because if she doesn't click and she does respond to client emails and she doesn't provide amazing customer service as well she loses her job her mortgages get paid for kids don't need so when you say don't click on that link goes because mortgage says click on that link are they

confused with the exact steps to take in certain situations maybe they know about security talk to me more like you I've heard on the news I know Facebook is doing whatever they're doing with the privacy and yeah I understand that but what do I do if I click on a link what's the next step maybe they understand it but in a certain situation it doesn't they don't understand exactly the steps to take who to call may you be either a person wants a ton on their plate I talk to a lot of families and small business owners who are like yeah Security's great they're mostly concerned but God like I have to worry about rent

I gotta worry about keeping my job security is like that's great but is it gonna give me money if it's not I don't want it it's not going to keep my child safe in the physical sense I just hope they don't get cyber bully maybe they have no idea what security is and why it matters I was having this conversation with this small business owner which is having casual conversation was nothing like it was for my business and I just mentioned what I do I said hey you know I do cyber sphere coaching and then she's like what if I was skating that was the first time someone asked me in that situation what is cybersecurity and

I'm used to people who know it but they don't know all of the details in it so I had to sit there and explain what type of security is in its essence what I do why it matters why it matters to hurt me either well aware of what to do and this distracted there are you there me and this is one of my favorite Twitter stories and I got her permission so don't freak out and I'm sharing it because I think this is one of the best things I've ever seen on Twitter hands down this is tara some of you may know her she's a white hat hacker she's a pen tester she knows security

really well and she says I just fell for a phishing email on someone else's account they asked me to look at you never saw me type so fast to change a password harder trick hammering in my chest I got extremely lucky next time maybe not so much very disappointing to an otherwise victorious week what does she do here she's vulnerable as someone in for her position she's vulnerable as someone who positioned that off who says oh gosh these people click on links all the time I never do that I'm perfect I never had something go wrong when I was playing around the malware nothing happened said no one ever she admitted it this is huge because

when you or I admit this on Twitter I don't think so she goes on to say that it was a she gives context to it so she was saying as a personal account on someone's PC before anyone freaked out on Twitter she said it wasn't worth work-related and she gave them security steps to integrate into their life so that next time something happens or doesn't happen because they have certain things in place they know what to do and then she goes into everything that she did to remediate the problem she changed her passwords and Crouse all the counts in case they had multiple passwords because no one feels like dealing with passwords I believe that we should all be like

Tara now when I asked her to put this up she said we shouldn't but we should that's a little point of my keynote but we should because we aren't immune and we make mistakes I make mistakes sometimes that phishing email looks really good like really the package came gosh at the wave

that was a point of the first story and this is going to be the point for the second story that we are human that's not that's we are human okay yeah see I make mistakes I'm going to ask you a question and this time you can definitely raise your hands I encourage you do you think that the thoughts that you have inside of your head could influence how someone moves through space do you think the thoughts that you have inside of your head influence how someone moves through space and you can internally and analyze it or answer it but I do

we're going to go back to that question but for right now I'm going to take another deep dive into a league game and take you along your journey with me I remember the first time I did terribly on a champion which is a player controlled character that was good at granted it was late at night and I've been playing more than a few games or shut up but either way he's playing badly doesn't feel good remember my personal rule in the beginning if you don't is fine where I don't talk badly about my teammates I don't curse them out in my head I do but not on the paper it probably came from one of these moments I cannot believe I

have another no brain character or player in my dimension this moment came after a bad mistake bad move on my part I was new to the game my bed shut the whole Cup you know damn well you must late that and I have to sit here and deal with your shirt players internalize their comments too much because I knew that patronizing someone and tearing them down doesn't exactly inspire them to play better I wasn't inspired so have you to do because even if I felt like I wasn't internalizing it I was

because I felt like no matter how many mistakes someone makes they can be an actual contributing player to the match because every time I saw someone do one dumb mistake I knew we could do better they could be better and somebody develops high expectations of my teammate because I knew that that wasn't the best way they could ever make in their life they could do better and so I decided to test out this high expectations mindset in my next game we were having a great game in this game I mean it was once the ending of a Cinderella story we all had our match meaning we all that rules everything was moving seamlessly through the game

nothing could go wrong right we had the most strongest player in our batch he just kept getting kill after kill after kill and he developed my ego but I thought I'm chasing after another enemy player this one is fine it's good whatever I didn't care he got him cold that's wherever he turns around and another player comes behind our probably for revenge killing he gets them too but his health was a little declining he was damaged a lot but I thought he'll be fine but then I see him heading towards two other enemy players so instead of a fight being one-on-one it was two-on-one and so since I'm the supportive player and I love supporting my teammates I

start heading down there thinking hey you might help and before I get there he gets them double kill okay that's four people out we're good in his house was really low this time and I'm like he's going to back obviously he's going to recall he's gonna retreat because he doesn't have enough help he doesn't have enough strength to go to a next player in killer so I back off and or a set of a part of my I see something again he goes after another player and it was getting really close I did not think he was gonna win this only no this is not happening this is stupid and he gets up BAM Penta kill five

players down and like a really nice supportive player I decide to support I said hey wow that was amazing you're so bad and what that means in league is that you've gotten a lot of kills you are strong oh it's a pump up his ego you know I needed to win this game I need to eat but he didn't do that he heard your beating and what feeding means a league is that you have been dying a lot you've been giving another player kills your week and so for ten minutes I rented this whole things that I bet did you even look at my kills over No he was telling teammates the enemy team this time being in chat to the enemy

team giving the enemy team fuel to the fire one thing I've never understood is giving an enemy team an advantage over your own team because you're upset with your own team why would we do that because we're frustrated and we want Iran every time you talk to an enemy player about your annoying team you bring the morale of the team down and of yourself and you increase the chances of losing the game my teammates knew this and so we decided to band together and forget them because we didn't need that fifth player who decide to not be a contributor because he misheard me I lied I didn't leave him alive I leave him behind because I have

a really hard time leaving my teammates behind the supporter player so I decided to put in something that I usually do when I know the match is getting a little sour but I need a rectify it I go into operation team I say hey my mistake sorry didn't mean that we really need you in the match you're really strong and I thought I could win without you but we really can't so if we can just finish this game with your strengths weak ego inflated then we could get over to us second look okay whatever let's get this over with but I know he was feeling real good about himself and we won we won because

operation chains on me doesn't leave anybody behind because when you leave someone behind no matter how annoying they are you leave a teammate behind and you increase the chances of the enemy team winning every time we're toxic to our own teammates inside the security we bring the morale of security when we bring the morale of the end users down and we give that enemy team up one point in us zero because guess who capitalizes on someone not caring about security I told you this story to say that sometimes it doesn't begin right sometimes it can go wrong but we can rectify in our security industry every time you're toxic to an end-user or speak about them as if they're dumb

even with their hearing you we bring the morale down because remember my question in the beginning you're not going to finish that we're going to go back to 70 and we increase the chances of being stuck in the same place we're complaining about I want the end users to know that I am on their side just like I'm on the side of my teammates when they do something dumb nokay I'm not perfect I'm not always on their side and sometimes I want to forfeit the match but at the end of the game at the end of the day the bowl is what matters because our expectations of ourselves as security professionals and others outside of the field is off way

off we expect no one to make a mistake while securing for them I want us to raise our expectations of the end-user so now remember my question in the beginning do you think that the thoughts that you have inside of your head could influence how someone moves through space had I thought that player was stupid and capable when I'm not wasting my time guess what I would have lost more matches than I do now because every player has some high even if they're a low potential player they can do something exponential even if there are bronze level layer and we're in a plat or diamond to match they can do something maybe not as good as

someone else but they can help us win they can stand here they can stand here they cannot do this they cannot do that

we have all had someone like I said in the beginning who has made us feel like we were inadequate when we think someone is stupid and users we treat them as such we don't give them the resources and the guidance that they need because they're stupid what can you learn some professions some roles require us to be more cognizant of these micro realities than others when you're a teacher it matters because it affects how people grow up thinking about math and science and literature so many people hate it I know I did it affects how people think that their IQ when they think it defines them for their whole entire life but they think they're stupid and it can

overcome that it affects our doctors because it affects how they treat their patients the treatment that they get how they get it and when they get it affects us as security professionals because it affects our strongest defense humans

think about our responsibility to protect information and help others protect theirs it's our responsibility and we're gonna get annoying because I'm sure the teachers don't like your kids but they gotta do it anyways because they got a passion for it because we all have a passion for that's why we're here spending our Friday in here because we have a passion about it and you don't have to want to work and users like I do but at least give them the time of day to be human to be you to be imperfectly perfect and still intelligent and capable our micro negatives our dumb and stupid translates how they write articles about them and one of our

articles about them everyone who comes into the field has the same way about them feels the same way about end users even if they haven't dealt with them someone comes across the article if I came across an article that doctor wrote about some dumb patients that don't take the advice about unique one Apple a day I'd be annoyed because I'm allergic to apples because they don't understand my situation when we speak to them like this when we write about them like this all we see is a self-fulfilling prophecy garbage in garbage out sure I'm saying I'm not saying that we don't have a problem I'm saying we have a problem but we aren't going about it

the correct way we've tried through years in this way and I believe it's time to shift our perspective on it instead of the end users are someone outside of security being the enemy team I want them to be our team our team that's human our teams that makes the mistake because I'm sure someone and some important profession or role thinks that we're stupid because maybe you haven't had salad today or you've been eating too many french fries or you haven't driven the car frankly I'm gonna change the oil and you should have but it's not stupidity they see it's not stupidity I see it's just a blind spot let the blind spots are driving our car we have to check what is

when you're learning how to drive no one told you about those damn and they were just everywhere was like oh my god it's happening on the wires in car accidents what if we told people about the blind spots but they didn't listen but then we treated them like they're inadequate and dumb and stupid because they didn't do you ever listen to everything then someone tells you to do our job like other professionals job it to make people aware of those blind spots our job is not to dehumanize but to guide because when we do humanize we rob ourselves of our own goals safer streets safer wood whoever said yes to the other question you're correct

because our inner thoughts can influence how someone moves through space I'm going to read some folks from research studies about this teacher expectations produce self-fulfilling prophecies and students performance high teacher expectations results in students high academic performance and low teacher expectation result in students lower academic performance another second the finding that people are just up and down to expectations is important because through their behavior bosses communicate expectations as well as influencing the self expectations of ordnance

this was a point this is what I brought gaming in because it taught me so much and I believe it can taught teach us a lot because you can use a little fun analogy and take it into something that's a little more serious we have a problem I will leave you with a question today what could you do to positively impact how someone feels about cybersecurity

[Applause]